Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Parse Server has a bypass of class-level permissions in LiveQuery BIT-parse-2026-30947, CVE-2026-30947, GHSA-7ch5-98q2-7289 | High | 0.4% | 10 Mar, 2026 | npm parse-server |
Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API BIT-parse-2026-30946, CVE-2026-30946, GHSA-cmj3-wx7h-ffvg | High | 0.6% | 10 Mar, 2026 | npm parse-server |
Elysia has a string URL format ReDoS CVE-2026-30837, GHSA-f45g-68q3-5w8x | High | 0.5% | 10 Mar, 2026 | npm elysia |
pdfmake is vulnerable to server-side request forgery (SSRF) CVE-2026-26801, GHSA-wp52-r2fp-4vmr | High | 0.5% | 10 Mar, 2026 | npm pdfmake |
MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers CVE-2026-27826, GHSA-7r34-79r5-rcc9, PYSEC-2026-2621 | High | 13.0% | 10 Mar, 2026 | PyPI mcp-atlassian |
Envoy has RBAC Header Validation Bypass via Multi-Value Header Concatenation BIT-envoy-2026-26308, CVE-2026-26308, GHSA-ghc4-35x6-crw5 | High | Not scored | 10 Mar, 2026 | Go github.com/envoyproxy/envoy |
Craft Commerce has multiple Stored XSS in Commerce Inventory Page, Leading to Session Hijacking CVE-2026-29175, GHSA-cfpv-rmpf-f624 | High | 0.2% | 10 Mar, 2026 | Packagist craftcms/commerce |
Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting CVE-2026-29174, GHSA-pmgj-gmm4-jh6j | High | 0.5% | 10 Mar, 2026 | Packagist craftcms/commerce |
Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting CVE-2026-29172, GHSA-j3x5-mghf-xvfw | High | 0.4% | 10 Mar, 2026 | Packagist craftcms/commerce |
StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service CVE-2026-30945, GHSA-8rgj-vrfr-6hqr | High | 0.5% | 10 Mar, 2026 | npm studiocms |
Parse Server has a NoSQL injection via token type in password reset and email verification endpoints BIT-parse-2026-30941, CVE-2026-30941, GHSA-vgjh-hmwf-c588 | High | 0.5% | 10 Mar, 2026 | npm parse-server |
Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network CVE-2026-26118, GHSA-hhfx-wfvq-7g9c, PYSEC-2026-2669 | High | 1.0% | 10 Mar, 2026 | NuGet Azure.Mcp PyPI msmcp-azure npm @azure/mcp |
LimeSurvey is vulnerable to SQL injection CVE-2025-56421, GHSA-rccq-2fxq-7x3h | High | 0.5% | 10 Mar, 2026 | Packagist limesurvey/limesurvey |
StudioCMS has Privilege Escalation via Insecure API Token Generation CVE-2026-30944, GHSA-667w-mmh7-mrr4 | High | 0.6% | 10 Mar, 2026 | npm studiocms |
node-tar Symlink Path Traversal via Drive-Relative Linkpath CVE-2026-31802, GHSA-9ppj-qmqm-q256 | High | 0.3% | 10 Mar, 2026 | npm tar |
liquidjs has a path traversal fallback vulnerability CVE-2026-30952, GHSA-wmfp-5q7x-987x | High | 0.6% | 10 Mar, 2026 | npm liquidjs |
Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution BIT-parse-2026-30939, CVE-2026-30939, GHSA-5j86-7r7m-p8h6 | High | 0.5% | 10 Mar, 2026 | npm parse-server |
Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery BIT-parse-2026-30925, CVE-2026-30925, GHSA-mf3j-86qx-cq5j | High | 0.5% | 10 Mar, 2026 | npm parse-server |
NLTK has Arbitrary File Read via Absolute Path Input in nltk.util.filestring() CVE-2026-0846, GHSA-h8wq-7xc4-p3qx, PYSEC-2026-97 | High | 0.6% | 09 Mar, 2026 | PyPI nltk |
AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs CVE-2026-100857, GHSA-93fx-5qgc-wr38 | High | 0.4% | 09 Mar, 2026 | Packagist azuracast/azuracast |
OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects CVE-2026-32913, GHSA-6mgf-v5j7-45cr | High | 0.3% | 09 Mar, 2026 | npm openclaw |
OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage GHSA-rchv-x836-w7xp | High | Not scored | 09 Mar, 2026 | npm openclaw |
Glances has SQL Injection via Process Names in TimescaleDB Export CVE-2026-30930, GHSA-x46r-mf5g-xpr6, PYSEC-2026-2165 | High | 0.4% | 09 Mar, 2026 | PyPI Glances PyPI glances |
Glances Exposes Unauthenticated Configuration Secrets CVE-2026-30928, GHSA-gh4x-f7cq-wwx6, PYSEC-2026-2164 | High | 1.7% | 09 Mar, 2026 | PyPI glances |
FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse) CVE-2026-30934, GHSA-r633-fcgp-m532, GO-2026-4660 | High | Not scored | 09 Mar, 2026 | Go github.com/gtsteffaniak/filebrowser |
FileBrowser Quantum: Password-Protected Share Bypass via /public/api/share/info CVE-2026-30933, GHSA-525j-95gf-766f, GO-2026-4659 | High | Not scored | 09 Mar, 2026 | Go github.com/gtsteffaniak/filebrowser/backend |
SiYuan: Authorization Bypass Allows Low-Privilege Publish User to Modify Notebook Content via /api/block/appendHeadingChildren CVE-2026-30926, GHSA-f9cq-v43p-v523, GO-2026-4658 | High | Not scored | 09 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding CVE-2026-30920, GHSA-656w-6f6c-m9r6 | High | 0.2% | 09 Mar, 2026 | npm @oneuptime/common |
Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys CVE-2026-29196, GHSA-4hgg-c4rr-6h7f, GO-2026-4651 | High | Not scored | 09 Mar, 2026 | Go github.com/gravitl/netmaker |
Netmaker has Insufficient Authorization in Host Token Verification CVE-2026-29194, GHSA-hmqr-wjmj-376c, GO-2026-4655 | High | Not scored | 09 Mar, 2026 | Go github.com/gravitl/netmaker |
Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange CVE-2026-28513, GHSA-qh6q-598w-w6m2, GO-2026-4656 | High | Not scored | 09 Mar, 2026 | Go github.com/pocket-id/pocket-id/backend |
Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion CVE-2026-28512, GHSA-9h33-g3ww-mqff, GO-2026-4653 | High | Not scored | 09 Mar, 2026 | Go github.com/pocket-id/pocket-id/backend |
@budibase/server: Command Injection in PostgreSQL Dump Command CVE-2026-25041, GHSA-726g-59wr-cj4c | High | 0.5% | 09 Mar, 2026 | npm @budibase/server |
Apache Airflow Providers Http has Unsafe Pickle Deserializatio leading to RCE via HttpOperator CVE-2025-69219, GHSA-9r5j-7r2x-rv4g, PYSEC-2026-2367 | High | 0.7% | 09 Mar, 2026 | PyPI apache-airflow-providers-http |
Meta Box Plugin for WordPress: Authenticated (Contributor+) Arbitrary File Deletion via ajax_delete_file CVE-2025-14675, GHSA-m4q3-832v-44j6 | High | 2.7% | 07 Mar, 2026 | Packagist wpmetabox/meta-box |
x402 SDK Security Advisory GHSA-qr2g-p6q7-w82m, GO-2026-4647 | High | Not scored | 07 Mar, 2026 | Go github.com/coinbase/x402/go PyPI x402 npm @x402/svm |
mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft CVE-2026-33010, GHSA-g9rg-8vq5-mpwm, PYSEC-2026-2625 | High | 0.4% | 07 Mar, 2026 | PyPI mcp-memory-service |
WeKnora has Broken Access Control - Cross-Tenant Data Exposure CVE-2026-30859, GHSA-2f4c-vrjq-rcgv, GO-2026-4637 | High | Not scored | 06 Mar, 2026 | Go github.com/Tencent/WeKnora |
WeKnora has DNS Rebinding Vulnerability in web_fetch Tool that Allows SSRF to Internal Resources CVE-2026-30858, GHSA-h6gw-8f77-mmmp, GO-2026-4643 | High | Not scored | 06 Mar, 2026 | Go github.com/Tencent/WeKnora |
Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation CVE-2026-30851, GHSA-7r4p-vjf4-gxv4, GO-2026-4639 | High | Not scored | 06 Mar, 2026 | Go github.com/caddyserver/caddy/v2 Go github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy |
Flowise Missing Authentication on NVIDIA NIM Endpoints CVE-2026-30824, GHSA-5f53-522j-j454 | High | 37.3% | 06 Mar, 2026 | npm flowise |
Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration CVE-2026-30823, GHSA-cwc3-p92j-g7qm | High | 0.5% | 06 Mar, 2026 | npm flowise |
Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint CVE-2026-30822, GHSA-mq4r-h2gh-qv7x | High | 15.0% | 06 Mar, 2026 | npm flowise |
Zarf's symlink targets in archives are not validated against destination directory CVE-2026-29064, GHSA-hcm4-6hpj-vghm, GO-2026-4636 | High | Not scored | 06 Mar, 2026 | Go github.com/zarf-dev/zarf Go github.com/zarf-dev/zarf/src/pkg/archive |
CoreDNS Loop Detection Denial of Service Vulnerability CVE-2026-26018, GHSA-h75p-j8xm-m278, GO-2026-4635 | High | Not scored | 06 Mar, 2026 | Go github.com/coredns/coredns |
TSPortal: Any user can forge self-deletion requests for any account CVE-2026-29788, GHSA-gfhq-7499-f3f2 | High | 0.3% | 06 Mar, 2026 | Packagist miraheze/ts-portal |
Flowise has Arbitrary File Upload via MIME Spoofing CVE-2026-30821, GHSA-j8g8-j7fc-43v6 | High | 16.7% | 06 Mar, 2026 | npm flowise |
Flowise has Authorization Bypass via Spoofed x-request-from Header CVE-2026-30820, GHSA-wvhq-wp8g-c7vq | High | 0.5% | 06 Mar, 2026 | npm flowise |
parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user BIT-parse-2026-30229, CVE-2026-30229, GHSA-79wj-8rqv-jvp5 | High | 0.4% | 06 Mar, 2026 | npm parse-server |
PinchTab has SSRF with Full Response Exfiltration via Download Handler CVE-2026-30834, GHSA-rw8p-c6hf-q3pg, GO-2026-4631 | High | Not scored | 06 Mar, 2026 | Go github.com/pinchtab/pinchtab Go github.com/pinchtab/pinchtab/cmd/pinchtab |