Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
New API has an SQL LIKE Wildcard Injection DoS via Token Search CVE-2026-25591, GHSA-w6x6-9fp7-fqm4, GO-2026-4531 | High | Not scored | 23 Feb, 2026 | Go github.com/QuantumNous/new-api |
yapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent CVE-2025-70058, GHSA-663h-2vr3-ghrj | High | 0.2% | 23 Feb, 2026 | npm yapi-vendor |
Moodle has a Remote Code Execution risk via file restore BIT-moodle-2026-26045, CVE-2026-26045, GHSA-ggxq-2mg9-8966 | High | 0.6% | 21 Feb, 2026 | Packagist moodle/moodle |
MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability CVE-2026-2033, GHSA-q2r8-vmq7-fpx2, PYSEC-2026-2658 | High | 1.8% | 20 Feb, 2026 | PyPI mlflow |
Traefik affected by TLS ClientAuth Bypass on HTTP/3 GHSA-gv8r-9rw9-9697, GO-2026-4530 | High | Not scored | 20 Feb, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Google Cloud Vertex AI has a a vulnerability involving predictable bucket naming CVE-2026-2473, GHSA-wh2j-26j7-9728, PYSEC-2026-2500 | High | 0.5% | 20 Feb, 2026 | PyPI google-cloud-aiplatform |
Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS) CVE-2026-2472, GHSA-qv8j-hgpc-vrq8, PYSEC-2026-2499 | High | 0.6% | 20 Feb, 2026 | PyPI google-cloud-aiplatform |
Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize() CVE-2026-27206, GHSA-v7m3-fpcr-h7m2 | High | 0.8% | 19 Feb, 2026 | Packagist zumba/json-serializer |
OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace CVE-2026-32060, GHSA-r5fq-947m-xm57 | High | 0.8% | 19 Feb, 2026 | npm openclaw |
Feathers exposes internal headers via unencrypted session cookie CVE-2026-27193, GHSA-9m9c-vpv5-9g85 | High | 0.4% | 19 Feb, 2026 | npm @feathersjs/authentication-oauth |
Feathers has an origin validation bypass via prefix matching CVE-2026-27192, GHSA-mp4x-c34x-wv3x | High | 0.3% | 19 Feb, 2026 | npm @feathersjs/authentication-oauth |
Feathers has an open redirect in OAuth callback enables account takeover CVE-2026-27191, GHSA-ppf9-4ffw-hh4p | High | 0.3% | 19 Feb, 2026 | npm @feathersjs/authentication-oauth |
Formwork Improperly Managed Privileges in User creation CVE-2026-27198, GHSA-34p4-7w83-35g2 | High | 0.5% | 19 Feb, 2026 | Packagist getformwork/formwork |
Statamic affected by privilege escalation via stored cross-site scripting CVE-2026-27196, GHSA-8r7r-f4gm-wcpq | High | 0.3% | 19 Feb, 2026 | Packagist statamic/cms |
CPU exhaustion in SvelteKit remote form deserialization (experimental only) CVE-2026-82261, GHSA-88qp-p4qg-rqm6 | High | 0.5% | 19 Feb, 2026 | npm @sveltejs/kit |
Memory exhaustion in SvelteKit remote form deserialization (experimental only) CVE-2026-82260, GHSA-vrhm-gvg7-fpcf | High | 0.5% | 19 Feb, 2026 | npm @sveltejs/kit |
D-Tale affected by Remote Code Execution through the /save-column-filter endpoint CVE-2026-27194, GHSA-c87c-78rc-vmv2, PYSEC-2026-2461 | High | 0.8% | 19 Feb, 2026 | PyPI dtale |
eBay API MCP Server Affected by Environment Variable Injection CVE-2026-27203, GHSA-97rm-xj73-33jh | High | 0.4% | 19 Feb, 2026 | npm ebay-mcp |
Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages CVE-2026-26193, GHSA-vjm7-m4xh-7wrc, PYSEC-2026-2760 | High | 0.2% | 19 Feb, 2026 | PyPI open-webui |
Open WebUI vulnerable to Stored XSS via iFrame in citations model CVE-2026-26192, GHSA-xc8p-9rr6-97r2, PYSEC-2026-2769 | High | 0.2% | 19 Feb, 2026 | PyPI open-webui |
OpenClaw replaced a deprecated sandbox hash algorithm CVE-2026-28479, GHSA-fh3f-q9qw-93j9 | High | 0.2% | 19 Feb, 2026 | npm openclaw |
jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property) CVE-2026-25940, GHSA-p5xg-68wr-hm3m | High | 0.5% | 19 Feb, 2026 | npm jspdf |
jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method CVE-2026-25755, GHSA-9vjf-qc39-jprp | High | 1.0% | 19 Feb, 2026 | npm jspdf |
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions CVE-2026-25535, GHSA-67pg-wm7f-q7fj | High | 0.8% | 19 Feb, 2026 | npm jspdf |
Fabric.js Affected by Stored XSS via SVG Export CVE-2026-27013, GHSA-hfvx-25r5-qc3w | High | 0.3% | 18 Feb, 2026 | npm fabric |
OpenClaw: Docker container escape via unvalidated bind mount config injection CVE-2026-27002, GHSA-w235-x559-36mg | High | 0.5% | 18 Feb, 2026 | npm openclaw |
OpenClaw: Unsanitized CWD path injection into LLM prompts CVE-2026-27001, GHSA-2qj5-gwg2-xwc4 | High | 0.2% | 18 Feb, 2026 | npm openclaw |
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern CVE-2026-26996, GHSA-3ppc-4f35-3m26 | High | 0.6% | 18 Feb, 2026 | npm minimatch |
Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation CVE-2026-26318, GHSA-5vv4-hvf7-2h46 | High | 1.3% | 18 Feb, 2026 | npm systeminformation |
Go Ethereum affected by DoS via malicious p2p message CVE-2026-26314, GHSA-2gjw-fg97-vg3r, GO-2026-4507 | High | Not scored | 18 Feb, 2026 | Go github.com/ethereum/go-ethereum |
LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php CVE-2026-26990, GHSA-79q9-wc6p-cf92 | High | 4.5% | 18 Feb, 2026 | Packagist librenms/librenms |
Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path CVE-2026-26280, GHSA-9c88-49p5-5ggf | High | 1.4% | 18 Feb, 2026 | npm systeminformation |
Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde CVE-2026-26974, GHSA-w7h5-55jg-cq2f | High | 0.6% | 18 Feb, 2026 | npm @tygo-van-den-hurk/slyde |
OpenStack Nova calls qemu-img without format restrictions for resize CVE-2026-24708, GHSA-m4f3-qp2w-gwh6, PYSEC-2026-2685 | High | 0.4% | 18 Feb, 2026 | PyPI Nova PyPI nova |
Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER CVE-2026-53875, GHSA-97f8-7cmv-76j2, PYSEC-2026-2873 | High | 0.6% | 18 Feb, 2026 | PyPI picklescan |
OpenClaw has an authentication bypass in sandbox browser bridge server CVE-2026-28468, GHSA-h9g4-589h-68xv | High | 0.2% | 18 Feb, 2026 | npm openclaw |
OpenClaw has two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension CVE-2026-28451, GHSA-x22m-j5qq-j49m | High | 0.3% | 18 Feb, 2026 | npm openclaw |
OpenClaw has a LFI in BlueBubbles media path handling CVE-2026-29611, GHSA-rwj8-p9vq-25gv | High | 0.3% | 18 Feb, 2026 | npm openclaw |
OpenClaw: Prevent shell injection in macOS keychain credential write CVE-2026-27487, GHSA-4564-pvr2-qq4h | High | 1.4% | 18 Feb, 2026 | npm openclaw |
OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writes CVE-2026-28462, GHSA-gq9c-wg68-gwj2 | High | 0.5% | 18 Feb, 2026 | npm openclaw |
opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path CVE-2026-26205, GHSA-9f29-v6mm-pw6w, GO-2026-4506 | High | Not scored | 18 Feb, 2026 | Go github.com/open-policy-agent/opa-envoy-plugin |
NVIDIA NeMo Framework Deserializes Untrusted Data CVE-2025-33253, GHSA-hvjw-vp7g-39h5, PYSEC-2026-2673 | High | 0.2% | 18 Feb, 2026 | PyPI nemo-toolkit |
NVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution CVE-2025-33245, GHSA-9379-mwvr-7wxx, PYSEC-2026-2672 | High | 0.6% | 18 Feb, 2026 | PyPI nemo-toolkit |
OpenClaw affected by potential code execution via unsafe hook module path handling in Gateway CVE-2026-28456, GHSA-v6c6-vqqg-w888 | High | 0.5% | 18 Feb, 2026 | npm openclaw |
OpenClaw's unsanitized session ID enables path traversal in transcript file operations CVE-2026-28482, GHSA-5xfq-5mr7-426q | High | 0.2% | 18 Feb, 2026 | npm openclaw |
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction CVE-2026-26960, GHSA-83g3-92jg-28cx | High | 0.3% | 18 Feb, 2026 | npm tar |
OpenClaw inter-session prompts could be treated as direct user instructions GHSA-w5c7-9qqw-6645 | High | Not scored | 18 Feb, 2026 | npm openclaw |
OpenClaw: Command hijacking via unsafe PATH handling (bootstrapping + node-host PATH overrides) CVE-2026-29610, GHSA-jqpq-mgvm-f9r6 | High | 0.5% | 18 Feb, 2026 | npm openclaw |
OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting CVE-2026-28469, GHSA-rq6g-px6m-c248 | High | 0.3% | 18 Feb, 2026 | npm clawdbot npm openclaw |
OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints CVE-2026-26317, GHSA-3fqr-4cg8-h96q | High | 0.2% | 18 Feb, 2026 | npm clawdbot npm openclaw |