Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network CVE-2026-30827, GHSA-46wh-pxpv-q5gq | High | 0.5% | 06 Mar, 2026 | npm express-rate-limit |
CoreDNS ACL Bypass CVE-2026-26017, GHSA-c9v3-4pv7-87pr, GO-2026-4630 | High | Not scored | 06 Mar, 2026 | Go github.com/coredns/coredns |
Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment CVE-2025-15602, GHSA-5448-v74m-7mv7 | High | 0.5% | 06 Mar, 2026 | Packagist snipe/snipe-it |
GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution CVE-2026-29783, GHSA-g8r9-g2v8-jv6f | High | 0.5% | 06 Mar, 2026 | npm @github/copilot |
SageMaker Python SDK replaced eval() with safe parser in JumpStart search functionality GHSA-5r2p-pjr8-7fh7 | High | Not scored | 05 Mar, 2026 | PyPI sagemaker |
Plane is Vulnerable to Unauthenticated Workspace Member Information Disclosure CVE-2026-30244, GHSA-87x4-j8vh-p5qf | High | 0.4% | 05 Mar, 2026 | PyPI plane |
Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer CVE-2026-30242, GHSA-fpx8-73gf-7x73 | High | 0.4% | 05 Mar, 2026 | PyPI plane |
@perfood/couch-auth has an Observable Timing Discrepancy CVE-2025-70949, GHSA-mjqr-5c55-g77h | High | 0.4% | 05 Mar, 2026 | npm @perfood/couch-auth |
OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes CVE-2026-30223, GHSA-g962-2j28-3cg9, GO-2026-4622 | High | Not scored | 05 Mar, 2026 | Go github.com/OliveTin/OliveTin |
Gogs: DOM-based XSS via milestone selection CVE-2026-26276, GHSA-vgjm-2cpf-4g7c, GO-2026-4627 | High | Not scored | 05 Mar, 2026 | Go gogs.io/gogs |
LangGraph checkpoint loading has unsafe msgpack deserialization CVE-2026-28277, GHSA-g48c-2wqr-h844, PYSEC-2026-83 | High | 5.5% | 05 Mar, 2026 | PyPI langgraph |
Gogs: Release tag option injection in release deletion CVE-2026-26194, GHSA-v9vm-r24h-6rqm, GO-2026-4617 | High | Not scored | 05 Mar, 2026 | Go gogs.io/gogs |
Gogs: Stored XSS via data URI in issue comments CVE-2026-26022, GHSA-xrcr-gmf5-2r8j, GO-2026-4620 | High | Not scored | 05 Mar, 2026 | Go gogs.io/gogs |
RAGAS has an Arbitrary File Read vulnerability CVE-2025-45691, GHSA-v2xr-wvrv-p969, PYSEC-2026-3047 | High | 0.6% | 05 Mar, 2026 | PyPI ragas |
Gokapi has Stored XSS in SVG Hotlinks CVE-2026-28683, GHSA-3c22-5j5m-4jq7, GO-2026-4612 | High | Not scored | 05 Mar, 2026 | Go github.com/forceu/gokapi |
xgrammar vulnerable to DoS via multi-layer nesting CVE-2026-25048, GHSA-7rgv-gqhr-fxg3, PYSEC-2026-2322 | High | 1.3% | 05 Mar, 2026 | PyPI xgrammar |
Python-Markdown has an Uncaught Exception CVE-2025-69534, GHSA-5wmx-573v-2qwq, PYSEC-2026-89 | High | 0.7% | 05 Mar, 2026 | PyPI Markdown PyPI markdown |
tar has Hardlink Path Traversal via Drive-Relative Linkpath CVE-2026-29786, GHSA-qffp-2rhf-9h96 | High | 0.5% | 05 Mar, 2026 | npm tar |
Ghost has incomplete CSRF protections around OTC use BIT-ghost-2026-29784, CVE-2026-29784, GHSA-9m84-wc28-w895 | High | 0.2% | 05 Mar, 2026 | npm ghost |
Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction BIT-parse-2026-29182, CVE-2026-29182, GHSA-vc89-5g3r-cmhh | High | 0.4% | 05 Mar, 2026 | npm parse-server |
pyLoad has an Arbitrary File Write via Path Traversal in edit_package() CVE-2026-29778, GHSA-6px9-j4qr-xfjw, PYSEC-2026-121 | High | 0.6% | 05 Mar, 2026 | PyPI pyload-ng |
Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows BIT-docker-cli-2025-15558, CVE-2025-15558, GHSA-p436-gjf2-799p, GO-2026-4610 | High | Not scored | 05 Mar, 2026 | Go github.com/docker/cli Go github.com/docker/compose Go github.com/docker/compose/v2 Go github.com/docker/compose/v5 |
SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) CVE-2026-29074, GHSA-xpqw-6gx7-v673 | High | 0.7% | 04 Mar, 2026 | npm svgo |
ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover CVE-2026-29192, GHSA-6rx5-m2rc-hmf7, GO-2026-4605 | High | Not scored | 04 Mar, 2026 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and Authentication CVE-2026-29193, GHSA-25rw-g6ff-fmg8, GO-2026-4604 | High | Not scored | 04 Mar, 2026 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
Netmaker Vulnerable to Denial of Service via Server Shutdown Endpoint CVE-2026-29771, GHSA-rhr9-hgcm-x289, GO-2026-4608 | High | Not scored | 04 Mar, 2026 | Go github.com/gravitl/netmaker |
Fickling missing RCE-capable modules in UNSAFE_IMPORTS GHSA-5hwf-rc88-82xm | High | Not scored | 04 Mar, 2026 | PyPI fickling |
Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked GHSA-wccx-j62j-r448 | High | Not scored | 04 Mar, 2026 | PyPI fickling |
changedetection.io has Zip Slip vulnerability in the backup restore functionality CVE-2026-29065, GHSA-25g8-2mcf-fcx9, PYSEC-2026-2129 | High | 0.6% | 04 Mar, 2026 | PyPI changedetection-io PyPI changedetection.io |
Immutable is vulnerable to Prototype Pollution CVE-2026-29063, GHSA-wf6x-7x77-mvgw | High | 1.0% | 04 Mar, 2026 | npm immutable |
traefik CVE-2024-45410 fix bypass: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`) CVE-2026-29054, GHSA-92mv-8f8w-wq52, GO-2026-4597 | High | Not scored | 04 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Nuclio Shell Runtime Command Injection Leading to Privilege Escalation CVE-2026-29042, GHSA-95fj-3w7g-4r27, GO-2026-4598 | High | Not scored | 04 Mar, 2026 | Go github.com/nuclio/nuclio |
changedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text() CVE-2026-29039, GHSA-6fmw-82m7-jq6p, PYSEC-2026-2128 | High | 0.5% | 04 Mar, 2026 | PyPI changedetection-io PyPI changedetection.io |
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification CVE-2026-28802, GHSA-7wc2-qxgw-g8gg, PYSEC-2026-2118 | High | 0.5% | 04 Mar, 2026 | PyPI authlib |
IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links CVE-2026-28681, GHSA-22m3-c7vp-49fj, PYSEC-2026-2186 | High | 0.5% | 04 Mar, 2026 | PyPI irrd |
locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection CVE-2026-29091, GHSA-fp25-p6mj-qqg6 | High | 0.9% | 04 Mar, 2026 | npm locutus |
@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware CVE-2026-29087, GHSA-wc8c-qw6v-h7f6 | High | 0.4% | 04 Mar, 2026 | npm @hono/node-server |
OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations GHSA-3jx4-q2m7-r496 | High | Not scored | 04 Mar, 2026 | npm openclaw |
OpenClaw Canvas Authentication Bypass Vulnerability CVE-2026-3690, GHSA-vvjh-f6p9-5vcf | High | 0.7% | 04 Mar, 2026 | npm openclaw |
NLTK has a Path Traversal issue CVE-2026-0847, GHSA-68j8-pq59-fqgm, PYSEC-2026-98 | High | 1.0% | 04 Mar, 2026 | PyPI nltk |
OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows CVE-2026-32005, GHSA-x2ff-j5c2-ggpr | High | 0.3% | 04 Mar, 2026 | npm openclaw |
Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (Slowloris DOS) CVE-2026-26999, GHSA-xw98-5q62-jx94, GO-2026-4594 | High | Not scored | 04 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Multer Vulnerable to Denial of Service via Uncontrolled Recursion CVE-2026-3520, GHSA-5528-5vmv-3xc2 | High | 0.8% | 04 Mar, 2026 | npm multer |
Craft CMS has unauthenticated activation email trigger with potential user enumeration CVE-2026-29069, GHSA-234q-vvw3-mrfq | High | 0.3% | 04 Mar, 2026 | Packagist craftcms/cms |
Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection CVE-2026-3452, GHSA-gj26-w59c-29mf | High | 0.7% | 04 Mar, 2026 | Packagist concrete5/concrete5 |
OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From GHSA-2ch6-x3g4-7759 | High | Not scored | 03 Mar, 2026 | npm openclaw |
OpenClaw's exec allowlist wrapper analysis did not unwrap env/shell dispatch chains CVE-2026-27566, GHSA-jj82-76v6-933r | High | 0.4% | 03 Mar, 2026 | npm openclaw |
OpenClaw's sandbox bind validation could bypass allowed-root and blocked-path checks via symlink-parent missing-leaf paths CVE-2026-27523, GHSA-m8v2-6wwh-r4gc | High | 0.3% | 03 Mar, 2026 | npm openclaw |
OpenClaw: Zip extraction symlink traversal could write outside destination GHSA-jxrq-8fm4-9p58 | High | Not scored | 03 Mar, 2026 | npm openclaw |
OpenClaw's Synology Chat dmPolicy=allowlist failed open on empty allowedUserIds, allowing unauthorized agent dispatch CVE-2026-31998, GHSA-gw85-xp4q-5gp9 | High | 0.3% | 03 Mar, 2026 | npm openclaw |