Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
ciguard: discover_pipeline_files follows symlinks out of scan root CVE-2026-44220, GHSA-8cxw-cc62-q28v, PYSEC-2026-2408 | Low | 0.2% | 05 May, 2026 | PyPI ciguard |
ciguard: Container image runs as root (no USER directive) CVE-2026-44218, GHSA-jrm4-4pcf-4763, PYSEC-2026-2409 | Low | 0.1% | 05 May, 2026 | PyPI ciguard |
parse-server: MFA SMS one-time password accepted twice under concurrent login BIT-parse-2026-43930, CVE-2026-43930, GHSA-jpq4-7fmq-q5fj | Low | 0.2% | 05 May, 2026 | npm parse-server |
Microdot has HTTP response splitting in Response.set_cookie() CVE-2026-42874, GHSA-7wc8-wvc4-m498, PYSEC-2026-2646 | Low | 0.2% | 05 May, 2026 | PyPI microdot |
Langchain-Chatchat Uses Insufficiently Random Values CVE-2026-7847, GHSA-jv4p-mhmp-69vw, PYSEC-2026-2557 | Low | 0.2% | 05 May, 2026 | PyPI langchain-chatchat |
Langchain-Chatchat has a Race Condition in its OpenAI-Compatible File Upload API CVE-2026-7846, GHSA-x229-w2j4-h748, PYSEC-2026-2559 | Low | 0.2% | 05 May, 2026 | PyPI langchain-chatchat |
Langchain-Chatchat Uses a Broken or Risky Cryptographic Algorithm CVE-2026-7845, GHSA-wmvv-fhm6-w34x, PYSEC-2026-2558 | Low | 0.1% | 05 May, 2026 | PyPI langchain-chatchat |
Django Uses Cache Containing Sensitive Information BIT-django-2026-6907, CVE-2026-6907, GHSA-5hrc-gvxj-w55p, PYSEC-2026-55 | Low | 0.4% | 05 May, 2026 | PyPI Django PyPI django |
Django Uses Persistent Cookies Containing Sensitive Information BIT-django-2026-35192, CVE-2026-35192, GHSA-7h2m-m8vj-598h, PYSEC-2026-50 | Low | 0.5% | 05 May, 2026 | PyPI Django PyPI django |
@puchunjie/doc-tools-mcp has a Path Traversal Issue CVE-2026-7738, GHSA-gcmm-c94j-j47x | Low | 0.3% | 04 May, 2026 | npm @puchunjie/doc-tools-mcp |
Prefect Git Argument Injection in GitRepository Pull Steps CVE-2026-7725, GHSA-6rcx-55r6-jx65, PYSEC-2026-2955 | Low | 0.2% | 04 May, 2026 | PyPI prefect |
Prefect SSRF Bypass via DNS Rebinding in validate_restricted_url CVE-2026-7724, GHSA-p3pq-hxmr-vqqr, PYSEC-2026-2959 | Low | 0.3% | 04 May, 2026 | PyPI prefect |
Dolibarr has Insufficient Verification of Data Authenticity CVE-2026-7689, GHSA-jggh-5rmh-r6h5 | Low | 0.1% | 03 May, 2026 | Packagist dolibarr/dolibarr |
Dolibarr has an Injection issue CVE-2026-7688, GHSA-rvwr-q5hj-wq7g | Low | 0.2% | 03 May, 2026 | Packagist dolibarr/dolibarr |
yii2-mcp-server has a Command Injection Issue CVE-2026-7600, GHSA-gc8w-x73w-p4rh | Low | 1.2% | 02 May, 2026 | npm yii2-mcp-server |
mem0ai mem0 has an Improper Input Validation Issue CVE-2026-7597, GHSA-xqxw-r767-67m7, PYSEC-2026-2636 | Low | 0.3% | 01 May, 2026 | PyPI mem0ai |
ps_checkout allows unauthorized method invocation through unvalidated parameter GHSA-mqq7-wxx5-mp8h | Low | Not scored | 30 Apr, 2026 | Packagist prestashop/ps_checkout |
django-mdeditor is Missing Authentication for Critical Function CVE-2025-13030, GHSA-qp2c-xqv6-phh6, PYSEC-2026-2450 | Low | 0.3% | 30 Apr, 2026 | PyPI django-mdeditor |
Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send CVE-2026-41663, GHSA-rw74-vc9h-534j | Low | 0.1% | 29 Apr, 2026 | Packagist admidio/admidio |
Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment CVE-2026-41659, GHSA-68pr-7prh-mpv4 | Low | 0.3% | 29 Apr, 2026 | Packagist admidio/admidio |
Grav has Insecure Deserialization in File Cache CVE-2026-7317, GHSA-gwfr-jfjf-92vv | Low | 0.2% | 28 Apr, 2026 | Packagist getgrav/grav |
auto-favicon has a Server-Side Request Forgery issue CVE-2026-7150, GHSA-vmh7-9c7h-2pgg, PYSEC-2026-2386 | Low | 0.2% | 27 Apr, 2026 | PyPI auto-favicon |
Wooey has an Incorrect Privilege Assignment issue CVE-2026-7142, GHSA-w65c-cmxj-qrhm, PYSEC-2026-3427 | Low | 0.2% | 27 Apr, 2026 | PyPI wooey |
vLLM makes Use of Uninitialized Resource CVE-2026-7141, GHSA-x368-4g9h-fvv4, PYSEC-2026-2306 | Low | 0.3% | 27 Apr, 2026 | PyPI vllm |
OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks CVE-2026-45000, GHSA-j4c5-89f5-f3pm | Low | 0.2% | 25 Apr, 2026 | npm openclaw |
AstrBot has Incomplete Filtering of Special Elements CVE-2026-6984, GHSA-h3rr-9wqj-v3c6, PYSEC-2026-2381 | Low | 0.3% | 25 Apr, 2026 | PyPI AstrBot PyPI astrbot |
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams CVE-2026-42040, GHSA-xhjh-pmcv-23jw | Low | 0.2% | 24 Apr, 2026 | npm axios |
Kimai has Missing Object-Level Authorization in the Team API CVE-2026-41498, GHSA-jv9x-w4gm-hwcm | Low | 0.2% | 24 Apr, 2026 | Packagist kimai/kimai |
OpenClaw: Slack thread context could include messages from non-allowlisted senders CVE-2026-41358, GHSA-qm77-8qjp-4vcm | Low | 0.1% | 23 Apr, 2026 | npm openclaw |
Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) CVE-2026-41321, GHSA-88gm-j2wx-58h6 | Low | 0.2% | 23 Apr, 2026 | npm @astrojs/cloudflare |
OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization CVE-2026-41908, GHSA-v8qf-fr4g-28p2 | Low | 0.2% | 23 Apr, 2026 | npm openclaw |
verl's math_equal() Vulnerable to Arbitrary Code Execution via Unsafe eval() CVE-2026-6878, GHSA-h57c-v2v3-5v3v, PYSEC-2026-3402 | Low | 0.3% | 23 Apr, 2026 | PyPI verl |
copilot-api has Reliance on Reverse DNS Resolution for a Security-Critical Action CVE-2026-6874, GHSA-3vr4-cvmg-7fx4 | Low | 0.3% | 23 Apr, 2026 | npm copilot-api |
Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4 CVE-2026-41140, GHSA-73h3-mf4w-8647, PYSEC-2026-2890 | Low | 0.3% | 22 Apr, 2026 | PyPI poetry |
Bagisto affected by Cross-site Scripting CVE-2026-6745, GHSA-65fp-7g2v-658r | Low | 0.2% | 21 Apr, 2026 | Packagist bagisto/bagisto |
Bagisto affected by Server-Side Request Forgery CVE-2026-6744, GHSA-x3f9-vcp2-hgcw | Low | 0.2% | 21 Apr, 2026 | Packagist bagisto/bagisto |
October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations CVE-2026-29179, GHSA-jvwg-phxx-j3rp | Low | 0.1% | 21 Apr, 2026 | Packagist october/system |
October CMS: Reflected XSS via DataTable Form Widget CVE-2026-27937, GHSA-jj38-h5w5-mvpf | Low | 0.1% | 21 Apr, 2026 | Packagist october/system |
Cockpit has NoSQL Injection Through Content Aggregation Pipelines CVE-2026-6626, GHSA-5pv2-86qj-5jf9 | Low | 0.2% | 20 Apr, 2026 | Packagist cockpit-hq/cockpit |
Langflow vulnerable to injection CVE-2026-6599, GHSA-v66p-f7x3-4794, PYSEC-2026-2569 | Low | 0.2% | 20 Apr, 2026 | PyPI langflow |
Langflow: Cleartext Storage of Authentication Settings in Project Creation Endpoint CVE-2026-6598, GHSA-9jpj-cph8-w449, PYSEC-2026-2568 | Low | 0.2% | 20 Apr, 2026 | PyPI langflow |
Langflow has an Information Leak through Incomplete API Key Redaction CVE-2026-6597, GHSA-5jjf-wcvf-923w, PYSEC-2026-2565 | Low | 0.3% | 20 Apr, 2026 | PyPI langflow |
RAGAS has SSRF via Multi-Modal Faithfulness Collections Module CVE-2026-6587, GHSA-95ww-475f-pr4f, PYSEC-2026-3046 | Low | 0.3% | 20 Apr, 2026 | PyPI ragas |
Apache Airflow Exposes Secrets in Variables Saved as JSON Dictionaries BIT-airflow-2026-32690, CVE-2026-32690, GHSA-w9r4-94fj-xp69, PYSEC-2026-19, PYSEC-2026-2362 | Low | 0.4% | 18 Apr, 2026 | PyPI apache-airflow PyPI apache-airflow-core |
Neo4j Labs MCP Servers: SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures CVE-2026-35402, GHSA-x3cv-r3g3-fpg9, PYSEC-2026-2626 | Low | 0.3% | 17 Apr, 2026 | PyPI mcp-neo4j-cypher |
langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding CVE-2026-41488, GHSA-r7w7-9xr2-qq2r, PYSEC-2026-76 | Low | 0.2% | 16 Apr, 2026 | PyPI langchain-openai |
OpenClaw: TOCTOU read in exec script preflight CVE-2026-43529, GHSA-gj9q-8w99-mp8j | Low | 0.1% | 16 Apr, 2026 | npm openclaw |
ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint CVE-2026-33877, GHSA-mj7r-x3h3-7rmr | Low | 0.4% | 15 Apr, 2026 | npm apostrophe |
Weblate: Improper access control for pending tasks in API CVE-2026-33212, GHSA-vj45-x3pj-f4w4, PYSEC-2026-2311 | Low | 0.2% | 15 Apr, 2026 | PyPI weblate |
pyLoad's Session Not Invalidated After Permission Changes GHSA-fj52-5g4h-gmq8 | Low | Not scored | 14 Apr, 2026 | PyPI pyload-ng |