Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Denial of service in github.com/jackc/pgproto3/v2 CVE-2026-32286, GHSA-jqcq-xjh3-6g23, GO-2026-4518 | High | Not scored | 16 Mar, 2026 | Go github.com/jackc/pgproto3/v2 |
SiYuan importSY/importZipMd: path traversal via multipart filename enables arbitrary file write CVE-2026-32749, GHSA-qvvf-q994-x79v, GO-2026-4707 | High | Not scored | 16 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries BIT-parse-2026-32728, CVE-2026-32728, GHSA-42ph-pf9q-cr72 | High | 0.3% | 16 Mar, 2026 | npm parse-server |
Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability CVE-2026-32268, GHSA-q6fm-p73f-x862 | High | 0.4% | 16 Mar, 2026 | Packagist craftcms/azure-blob |
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() CVE-2026-32267, GHSA-cc7p-2j3x-x7xf | High | 9.6% | 16 Mar, 2026 | Packagist craftcms/cms |
GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute CVE-2026-30405, GHSA-4p9m-8gc4-rw2h, GO-2026-4736 | High | Not scored | 16 Mar, 2026 | Go github.com/osrg/gobgp Go github.com/osrg/gobgp/v3 Go github.com/osrg/gobgp/v4 |
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController CVE-2026-32264, GHSA-4484-8v2f-5748 | High | 0.5% | 16 Mar, 2026 | Packagist craftcms/cms |
Craft CMS vulnerable to behavior injection RCE via EntryTypesController CVE-2026-32263, GHSA-qx2q-q59v-wf3j | High | 0.5% | 16 Mar, 2026 | Packagist craftcms/cms |
RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin CVE-2026-32261, GHSA-8wg7-wm29-2rvg | High | 0.4% | 16 Mar, 2026 | Packagist craftcms/webhooks |
Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers CVE-2026-32634, GHSA-vx5f-957p-qpvm, PYSEC-2026-2172 | High | 0.3% | 16 Mar, 2026 | PyPI Glances PyPI glances |
Glances's Default CORS Configuration Allows Cross-Origin Credential Theft CVE-2026-32610, GHSA-9jfm-9rc6-2hfq, PYSEC-2026-2169 | High | 0.3% | 16 Mar, 2026 | PyPI Glances PyPI glances |
Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials CVE-2026-32609, GHSA-cvwp-r2g2-j824, PYSEC-2026-2168 | High | 0.5% | 16 Mar, 2026 | PyPI Glances PyPI glances |
Glances has a Command Injection via Process Names in Action Command Templates CVE-2026-32608, GHSA-vcv2-q258-wrg7, PYSEC-2026-2167 | High | 0.2% | 16 Mar, 2026 | PyPI Glances PyPI glances |
IncusOS has a LUKS encryption bypass due to insufficient TPM policy CVE-2026-32606, GHSA-wj2j-qwcf-cfcc, GO-2026-4704 | High | Not scored | 16 Mar, 2026 | Go github.com/lxc/incus-os/incus-osd |
Glances exposes the REST API without authentication CVE-2026-32596, GHSA-wvxv-4j8q-4wjq, PYSEC-2026-2166 | High | 1.6% | 16 Mar, 2026 | PyPI Glances PyPI glances |
pyOpenSSL DTLS cookie callback buffer overflow CVE-2026-27459, GHSA-5pwr-322w-8jr4, PYSEC-2026-2269 | High | 0.7% | 16 Mar, 2026 | PyPI pyopenssl |
Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter CVE-2026-29112, GHSA-v3r3-4qgc-vw66 | High | 0.4% | 16 Mar, 2026 | npm @dicebear/converter |
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding CVE-2026-28498, GHSA-m344-f55w-2m6j, PYSEC-2026-2117 | High | 0.2% | 16 Mar, 2026 | PyPI authlib |
Mattermost Microsoft Teams Plugin fails to properly mask sensitive configuration values CVE-2026-2476, GHSA-4ppj-6chv-5pgc, GO-2026-4784 | High | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-plugin-msteams |
Mattermost fails to properly handle very long passwords CVE-2026-24458, GHSA-m5rv-56xx-hfc6, GO-2026-4731 | High | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle CVE-2026-28490, GHSA-7432-952r-cw78, PYSEC-2026-2116 | High | 0.1% | 16 Mar, 2026 | PyPI authlib |
FastMCP OAuth Proxy token reuse across MCP servers CVE-2025-69196, GHSA-5h2m-4q8j-pqpj, PYSEC-2026-2474 | High | 0.4% | 16 Mar, 2026 | PyPI fastmcp |
MLflow has a command injection in mlflow/sagemaker/__init__.py BIT-mlflow-2025-14287, CVE-2025-14287, GHSA-xch3-2f9x-wh9f, PYSEC-2026-2661 | High | 1.5% | 16 Mar, 2026 | PyPI mlflow |
github.com/ctfer-io/monitoring Vulnerable to Improper Access Control CVE-2026-32720, GHSA-7x23-j8gv-v54x, GO-2026-4701 | High | Not scored | 13 Mar, 2026 | Go github.com/ctfer-io/monitoring |
SimpleEval: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox CVE-2026-32640, GHSA-44vg-5wv2-h2hg, PYSEC-2026-132 | High | 0.5% | 13 Mar, 2026 | PyPI simpleeval |
Angular vulnerable to XSS in i18n attribute bindings CVE-2026-32635, GHSA-g93w-mfhg-p222 | High | 0.5% | 13 Mar, 2026 | npm @angular/compiler npm @angular/core |
OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured CVE-2026-32974, GHSA-g353-mgv3-8pcj | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Gateway `agent` calls could override the workspace boundary CVE-2026-33573, GHSA-2rqg-gjgv-84jm | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories CVE-2026-32920, GHSA-99qw-6mr3-36qr | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces CVE-2026-32914, GHSA-r7vr-gr74-94p8 | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths CVE-2026-32973, GHSA-f8r2-vg7x-gh8m | High | 0.4% | 13 Mar, 2026 | npm openclaw |
OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes CVE-2026-32972, GHSA-vmhq-cqm9-6p7q | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens CVE-2026-33575, GHSA-7h7g-x2px-94hj | High | 0.3% | 13 Mar, 2026 | npm openclaw |
simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption CVE-2026-32600, GHSA-r353-4845-pr5p | High | 0.2% | 13 Mar, 2026 | Packagist simplesamlphp/xml-security |
xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption CVE-2026-32313, GHSA-4v26-v6cg-g6f9 | High | 0.2% | 13 Mar, 2026 | Packagist robrichards/xmlseclibs |
Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware CVE-2026-105782, GHSA-cwxj-rr6w-m6w7, PYSEC-2026-4299 | High | 0.4% | 13 Mar, 2026 | PyPI Scrapy PyPI scrapy |
@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script CVE-2026-4092, GHSA-hqjg-pww4-pcgq | High | 0.5% | 13 Mar, 2026 | npm @google/clasp |
Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability CVE-2026-3910 | HighExploited | 2.7% | 13 Mar, 2026 | |
Google Skia Out-of-Bounds Write Vulnerability CVE-2026-3909 | HighExploited | 2.3% | 13 Mar, 2026 | |
PyJWT accepts unknown `crit` header extensions CVE-2026-32597, GHSA-752w-5fwx-jx9f, PYSEC-2026-120 | High | 0.3% | 13 Mar, 2026 | PyPI PyJWT PyPI pyjwt |
OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") CVE-2026-32308, GHSA-wvh5-6vjm-23qh | High | 0.2% | 13 Mar, 2026 | npm oneuptime |
CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification CVE-2026-31899, GHSA-f38f-5xpm-9r7c, PYSEC-2026-2122 | High | 0.5% | 13 Mar, 2026 | PyPI CairoSVG PyPI cairosvg |
OpenClaw: Sandbox staged writes could escape the verified parent directory before commit CVE-2026-32988, GHSA-mj4p-rc52-m843 | High | 0.1% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Channel commands could bypass account-scoped `configWrites` restrictions CVE-2026-32976, GHSA-8jhh-jcqg-mj5p | High | 0.2% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv CVE-2026-32971, GHSA-rw39-5899-8mxp | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity CVE-2026-32979, GHSA-xf99-j42q-5w5p | High | 0.1% | 13 Mar, 2026 | npm openclaw |
Dagu: SSE Authentication Bypass in Basic Auth Mode CVE-2026-31882, GHSA-9wmw-9wph-2vwp | High | 0.8% | 13 Mar, 2026 | npm dagu |
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation CVE-2026-2229, GHSA-v9p9-hfj2-hcw8 | High | 0.9% | 12 Mar, 2026 | npm undici |
Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client CVE-2026-1528, GHSA-f269-vfmq-vjvj | High | 0.5% | 12 Mar, 2026 | npm undici |
Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression CVE-2026-1526, GHSA-vrm6-8vpv-qv8q | High | 1.2% | 12 Mar, 2026 | npm undici |