Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Microsoft Windows Improper Privilege Management Vulnerability CVE-2026-21533 | HighExploited | 4.2% | 10 Feb, 2026 | |
Microsoft Windows Type Confusion Vulnerability CVE-2026-21519 | HighExploited | 2.5% | 10 Feb, 2026 | |
Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability CVE-2026-21514 | HighExploited | 1.6% | 10 Feb, 2026 | |
Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability CVE-2026-21513 | HighExploited | 15.9% | 10 Feb, 2026 | |
Microsoft Windows Shell Protection Mechanism Failure Vulnerability CVE-2026-21510 | HighExploited | 61.2% | 10 Feb, 2026 | |
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability CVE-2026-1603 | HighExploited | 88.3% | 10 Feb, 2026 | |
Emmett-Core: Unhandled CookieError Exception Causing Denial of Service CVE-2026-25577, GHSA-x6cr-mq53-cc76, PYSEC-2026-2469 | High | 0.3% | 10 Feb, 2026 | PyPI emmett-core |
Cube Core is vulnerable to privilege escalation via a specially crafted request CVE-2026-25958, GHSA-v226-32c7-x2v7 | High | 0.4% | 09 Feb, 2026 | npm @cubejs-backend/server-core |
FUXA Affected by a Path Traversal Sanitization Bypass CVE-2026-25951, GHSA-68m5-5w2h-h837 | High | 1.4% | 09 Feb, 2026 | npm fuxa-server |
Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint CVE-2026-25892, GHSA-q4f2-39gr-45jh | High | 1.7% | 09 Feb, 2026 | Packagist vrana/adminer |
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior CVE-2026-25498, GHSA-7jx7-3846-m7w7 | High | 1.1% | 09 Feb, 2026 | Packagist craftcms/cms |
Craft CMS: GraphQL Asset Mutation Privilege Escalation CVE-2026-25497, GHSA-fxp3-g6gw-4r4v | High | 0.5% | 09 Feb, 2026 | Packagist craftcms/cms |
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]` CVE-2026-25495, GHSA-2453-mppf-46cj | High | 0.6% | 09 Feb, 2026 | Packagist craftcms/cms |
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig CVE-2026-25639, GHSA-43fc-jf86-j433 | High | 2.8% | 09 Feb, 2026 | npm axios |
Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins CVE-2026-25478, GHSA-2p2x-hpg8-cqp2, PYSEC-2026-2195 | High | 0.4% | 09 Feb, 2026 | PyPI litestar |
jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions CVE-2026-1615, GHSA-87r5-mp6g-5w5j | High | 1.2% | 09 Feb, 2026 | npm jsonpath |
AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection CVE-2026-25762, GHSA-xx9g-fh25-4q64 | High | 0.5% | 06 Feb, 2026 | npm @adonisjs/bodyparser |
AdonisJS multipart body parsing has Prototype Pollution issue CVE-2026-25754, GHSA-f5x2-vj4h-vg4c | High | 0.4% | 06 Feb, 2026 | npm @adonisjs/bodyparser |
MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token CVE-2026-25650, GHSA-vf6j-c56p-cq58, PYSEC-2026-2629 | High | 0.5% | 06 Feb, 2026 | PyPI mcp-salesforce-connector |
Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL CVE-2026-25640, GHSA-wjp5-868j-wqv7, PYSEC-2026-2979, PYSEC-2026-2983 | High | 0.4% | 06 Feb, 2026 | PyPI pydantic-ai PyPI pydantic-ai-slim |
Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling CVE-2026-25580, GHSA-2jrp-274c-jhv3, PYSEC-2026-2976, PYSEC-2026-2980 | High | 0.7% | 06 Feb, 2026 | PyPI pydantic-ai PyPI pydantic-ai-slim |
OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module CVE-2026-24418, GHSA-4xwv-49c8-fvhq | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service CVE-2026-24417, GHSA-4hc4-8599-xh2h | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module CVE-2026-24416, GHSA-p864-fqgv-92q4 | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json CVE-2026-25725, GHSA-ff64-7w26-62rf | High | 0.5% | 06 Feb, 2026 | npm @anthropic-ai/claude-code |
Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions CVE-2026-25723, GHSA-mhg7-666j-cqg4 | High | 0.4% | 06 Feb, 2026 | npm @anthropic-ai/claude-code |
Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection CVE-2026-25722, GHSA-66q4-vfjg-2qhh | High | 0.5% | 06 Feb, 2026 | npm @anthropic-ai/claude-code |
OpenSTAManager has a SQL Injection in the Prima Nota module CVE-2026-24419, GHSA-4j2x-jh4m-fqv6 | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a SQL Injection in Scadenzario Print Template CVE-2025-69216, GHSA-q6g3-fv43-m2w6 | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint) CVE-2025-69214, GHSA-qjv8-63xq-gq8m | High | 0.5% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write CVE-2026-25732, GHSA-9ffm-fxg3-xrhh, PYSEC-2026-95 | High | 3.4% | 05 Feb, 2026 | PyPI nicegui |
pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability CVE-2026-1707, GHSA-3p7x-94q9-jq9x, PYSEC-2026-2864 | High | 0.4% | 05 Feb, 2026 | PyPI pgadmin4 |
OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.apply CVE-2026-25593, GHSA-g55j-c2v4-pjcg | High | 0.7% | 04 Feb, 2026 | npm openclaw |
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse CVE-2026-25536, GHSA-345p-7cg4-v4c7 | High | 0.3% | 04 Feb, 2026 | npm @modelcontextprotocol/sdk |
godot-mcp has Command Injection via unsanitized projectPath CVE-2026-25546, GHSA-8jx2-rhfh-q928 | High | 1.0% | 04 Feb, 2026 | npm @coding-solo/godot-mcp |
Apollo Serve vulnerable to Denial of Service with `startStandaloneServer` CVE-2026-23897, GHSA-mp6q-xf9x-fwf7 | High | 0.7% | 04 Feb, 2026 | npm @apollo/server npm apollo-server |
n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH Node CVE-2026-25055, GHSA-m82q-59gv-mcr9 | High | 1.9% | 04 Feb, 2026 | npm n8n |
n8n Has Stored Cross-site Scripting via Markdown Rendering in Workflow UI CVE-2026-25054, GHSA-qpq4-pw7f-pp8w | High | 0.2% | 04 Feb, 2026 | npm n8n |
n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS CVE-2026-25051, GHSA-825q-w924-xhgx | High | 0.3% | 04 Feb, 2026 | npm n8n |
n8n's Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner CVE-2025-61917, GHSA-49mx-fj45-q3p6 | High | 0.4% | 04 Feb, 2026 | npm n8n |
Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data) CVE-2026-25155, GHSA-vm6g-8r4h-22x8 | High | 0.1% | 03 Feb, 2026 | npm @builder.io/qwik-city |
Claude Code has a Command Injection in find Command Bypasses User Approval Prompt CVE-2026-24887, GHSA-qgqw-h4xq-7w8w | High | 0.6% | 03 Feb, 2026 | npm @anthropic-ai/claude-code |
Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes CVE-2026-24053, GHSA-q728-gf8j-w49r | High | 0.5% | 03 Feb, 2026 | npm @anthropic-ai/claude-code |
Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains CVE-2026-24052, GHSA-vhw5-3g5m-8ggf | High | 0.4% | 03 Feb, 2026 | npm @anthropic-ai/claude-code |
OpenSTAManager has an SQL Injection in the Stampe Module CVE-2025-69215, GHSA-qx9p-w3vj-q24q | High | 0.4% | 03 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint) CVE-2025-69213, GHSA-w995-ff8h-rppg | High | 0.5% | 03 Feb, 2026 | Packagist devcode-it/openstamanager |
FacturaScripts has SQL Injection in Autocomplete Actions CVE-2026-25514, GHSA-pqqg-5f4f-8952 | High | 0.5% | 03 Feb, 2026 | Packagist facturascripts/facturascripts |
Boltz contains an insecure deserialization vulnerability in its molecule loading functionality CVE-2025-70560, GHSA-fjm6-8xp2-4fwc, PYSEC-2026-1224 | High | 0.2% | 03 Feb, 2026 | PyPI boltz |
FacturaScripts has SQL Injection in API ORDER BY Clause CVE-2026-25513, GHSA-cjfx-qhwm-hf99 | High | 0.5% | 03 Feb, 2026 | Packagist facturascripts/facturascripts |
Compressing Vulnerable to Arbitrary File Write via Symlink Extraction CVE-2026-24884, GHSA-cc8f-xg8v-72m3 | High | 0.3% | 03 Feb, 2026 | npm compressing |