Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Microsoft Windows Improper Privilege Management Vulnerability CVE-2026-21533 | HighExploited | 4.2% | 10 Feb, 2026 | |
Microsoft Windows Type Confusion Vulnerability CVE-2026-21519 | HighExploited | 2.5% | 10 Feb, 2026 | |
Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability CVE-2026-21514 | HighExploited | 1.6% | 10 Feb, 2026 | |
Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability CVE-2026-21513 | HighExploited | 15.9% | 10 Feb, 2026 | |
Microsoft Windows Shell Protection Mechanism Failure Vulnerability CVE-2026-21510 | HighExploited | 61.2% | 10 Feb, 2026 | |
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability CVE-2026-1603 | HighExploited | 88.3% | 10 Feb, 2026 | |
Emmett-Core: Unhandled CookieError Exception Causing Denial of Service CVE-2026-25577, GHSA-x6cr-mq53-cc76, PYSEC-2026-2469 | High | 0.3% | 10 Feb, 2026 | PyPI emmett-core |
File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL CVE-2026-25890, GHSA-4mh3-h929-w968, GO-2026-4474 | High | Not scored | 10 Feb, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Cube Core is vulnerable to privilege escalation via a specially crafted request CVE-2026-25958, GHSA-v226-32c7-x2v7 | High | 0.4% | 09 Feb, 2026 | npm @cubejs-backend/server-core |
FUXA Affected by a Path Traversal Sanitization Bypass CVE-2026-25951, GHSA-68m5-5w2h-h837 | High | 1.4% | 09 Feb, 2026 | npm fuxa-server |
Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint CVE-2026-25892, GHSA-q4f2-39gr-45jh | High | 1.7% | 09 Feb, 2026 | Packagist vrana/adminer |
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior CVE-2026-25498, GHSA-7jx7-3846-m7w7 | High | 1.1% | 09 Feb, 2026 | Packagist craftcms/cms |
Craft CMS: GraphQL Asset Mutation Privilege Escalation CVE-2026-25497, GHSA-fxp3-g6gw-4r4v | High | 0.5% | 09 Feb, 2026 | Packagist craftcms/cms |
Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]` CVE-2026-25495, GHSA-2453-mppf-46cj | High | 0.6% | 09 Feb, 2026 | Packagist craftcms/cms |
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig CVE-2026-25639, GHSA-43fc-jf86-j433 | High | 2.8% | 09 Feb, 2026 | npm axios |
Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins CVE-2026-25478, GHSA-2p2x-hpg8-cqp2, PYSEC-2026-2195 | High | 0.4% | 09 Feb, 2026 | PyPI litestar |
jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions CVE-2026-1615, GHSA-87r5-mp6g-5w5j | High | 1.2% | 09 Feb, 2026 | npm jsonpath |
Sliver has DNS C2 OTP Bypass that Allows Unauthenticated Session Flooding and Denial of Service CVE-2026-25791, GHSA-wxrw-gvg8-fqjp, GO-2026-4466 | High | Not scored | 06 Feb, 2026 | Go github.com/bishopfox/sliver |
Antrea has invalid enforcement order for network policy rules caused by integer overflow CVE-2026-25804, GHSA-86x4-wp9f-wrr9, GO-2026-4461 | High | Not scored | 06 Feb, 2026 | Go antrea.io/antrea |
Blocklist Bypass possible via ECDSA Signature Malleability CVE-2026-25793, GHSA-69x3-g4r3-p962, GO-2026-4458 | High | Not scored | 06 Feb, 2026 | Go github.com/slackhq/nebula |
AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection CVE-2026-25762, GHSA-xx9g-fh25-4q64 | High | 0.5% | 06 Feb, 2026 | npm @adonisjs/bodyparser |
Gogs vulnerable to Stored XSS via Mermaid diagrams GHSA-26gq-grmh-6xm6, GO-2026-4454 | High | Not scored | 06 Feb, 2026 | Go gogs.io/gogs |
Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values GHSA-w67g-2h6v-vjgq | High | Not scored | 06 Feb, 2026 | RubyGems phlex |
AdonisJS multipart body parsing has Prototype Pollution issue CVE-2026-25754, GHSA-f5x2-vj4h-vg4c | High | 0.4% | 06 Feb, 2026 | npm @adonisjs/bodyparser |
MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token CVE-2026-25650, GHSA-vf6j-c56p-cq58, PYSEC-2026-2629 | High | 0.5% | 06 Feb, 2026 | PyPI mcp-salesforce-connector |
Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL CVE-2026-25640, GHSA-wjp5-868j-wqv7, PYSEC-2026-2979, PYSEC-2026-2983 | High | 0.4% | 06 Feb, 2026 | PyPI pydantic-ai PyPI pydantic-ai-slim |
Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling CVE-2026-25580, GHSA-2jrp-274c-jhv3, PYSEC-2026-2976, PYSEC-2026-2980 | High | 0.6% | 06 Feb, 2026 | PyPI pydantic-ai PyPI pydantic-ai-slim |
Mattermost Confluence plugin doesn't properly escape user-controlled display names in HTML template rendering CVE-2025-13523, GHSA-ffx7-34p2-vm3w, GO-2026-4456 | High | Not scored | 06 Feb, 2026 | Go github.com/mattermost/mattermost-plugin-confluence |
OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module CVE-2026-24418, GHSA-4xwv-49c8-fvhq | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service CVE-2026-24417, GHSA-4hc4-8599-xh2h | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module CVE-2026-24416, GHSA-p864-fqgv-92q4 | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update CVE-2026-24135, GHSA-jp7c-wj6q-3qf2, GO-2026-4452 | High | Not scored | 06 Feb, 2026 | Go gogs.io/gogs |
Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json CVE-2026-25725, GHSA-ff64-7w26-62rf | High | 0.5% | 06 Feb, 2026 | npm @anthropic-ai/claude-code |
Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions CVE-2026-25723, GHSA-mhg7-666j-cqg4 | High | 0.4% | 06 Feb, 2026 | npm @anthropic-ai/claude-code |
Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection CVE-2026-25722, GHSA-66q4-vfjg-2qhh | High | 0.5% | 06 Feb, 2026 | npm @anthropic-ai/claude-code |
OpenSTAManager has a SQL Injection in the Prima Nota module CVE-2026-24419, GHSA-4j2x-jh4m-fqv6 | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a SQL Injection in Scadenzario Print Template CVE-2025-69216, GHSA-q6g3-fv43-m2w6 | High | 0.4% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint) CVE-2025-69214, GHSA-qjv8-63xq-gq8m | High | 0.5% | 06 Feb, 2026 | Packagist devcode-it/openstamanager |
Gogs Vulnerable to 2FA Bypass via Recovery Code CVE-2025-64175, GHSA-p6x6-9mx6-26wj, GO-2026-4449 | High | Not scored | 06 Feb, 2026 | Go gogs.io/gogs |
OpenCloud Affected by Public Link Exploit GHSA-vf5j-r2hw-2hrw, GO-2026-4447 | High | Not scored | 05 Feb, 2026 | Go github.com/opencloud-eu/opencloud |
Unauthenticated Spree Commerce users can access all guest addresses CVE-2026-25758, GHSA-87fh-rc96-6fr6 | High | Not scored | 05 Feb, 2026 | RubyGems spree_api |
Unauthenticated Spree Commerce users can view completed guest orders by Order ID CVE-2026-25757, GHSA-p6pv-q7rc-g4h9 | High | Not scored | 05 Feb, 2026 | RubyGems spree_storefront |
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write CVE-2026-25732, GHSA-9ffm-fxg3-xrhh, PYSEC-2026-95 | High | 3.4% | 05 Feb, 2026 | PyPI nicegui |
OpenCloud Reva has a Public Link Exploit CVE-2026-23989, GHSA-9j2f-3rj3-wgpg, GO-2026-4444 | High | Not scored | 05 Feb, 2026 | Go github.com/opencloud-eu/reva Go github.com/opencloud-eu/reva/v2 |
pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability CVE-2026-1707, GHSA-3p7x-94q9-jq9x, PYSEC-2026-2864 | High | 0.4% | 05 Feb, 2026 | PyPI pgadmin4 |
OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.apply CVE-2026-25593, GHSA-g55j-c2v4-pjcg | High | 0.7% | 04 Feb, 2026 | npm openclaw |
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse CVE-2026-25536, GHSA-345p-7cg4-v4c7 | High | 0.3% | 04 Feb, 2026 | npm @modelcontextprotocol/sdk |
godot-mcp has Command Injection via unsanitized projectPath CVE-2026-25546, GHSA-8jx2-rhfh-q928 | High | 1.0% | 04 Feb, 2026 | npm @coding-solo/godot-mcp |
Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage CVE-2026-25538, GHSA-8wpc-j9q9-j5m2, GO-2026-4416 | High | Not scored | 04 Feb, 2026 | Go github.com/devtron-labs/devtron |
Alist vulnerable to Path Traversal in multiple file operation handlers CVE-2026-25161, GHSA-x4q4-7phh-42j9, GO-2026-4415 | High | Not scored | 04 Feb, 2026 | Go github.com/alist-org/alist Go github.com/alist-org/alist/v3 |