Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Apollo Serve vulnerable to Denial of Service with `startStandaloneServer` CVE-2026-23897, GHSA-mp6q-xf9x-fwf7 | High | 0.7% | 04 Feb, 2026 | npm @apollo/server npm apollo-server |
n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH Node CVE-2026-25055, GHSA-m82q-59gv-mcr9 | High | 1.9% | 04 Feb, 2026 | npm n8n |
n8n Has Stored Cross-site Scripting via Markdown Rendering in Workflow UI CVE-2026-25054, GHSA-qpq4-pw7f-pp8w | High | 0.2% | 04 Feb, 2026 | npm n8n |
n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS CVE-2026-25051, GHSA-825q-w924-xhgx | High | 0.3% | 04 Feb, 2026 | npm n8n |
n8n's Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner CVE-2025-61917, GHSA-49mx-fj45-q3p6 | High | 0.4% | 04 Feb, 2026 | npm n8n |
ingress-nginx's `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx CVE-2026-1580, GHSA-9h3p-52vh-959w, GO-2026-4423 | High | Not scored | 04 Feb, 2026 | Go k8s.io/ingress-nginx |
ingress-nginx's `rules.http.paths.path` Ingress field can be used to inject configuration into nginx CVE-2026-24512, GHSA-jx8c-56mg-h6vp, GO-2026-4426 | High | Not scored | 04 Feb, 2026 | Go k8s.io/ingress-nginx |
melange affected by potential host command execution via license-check YAML mode patch pipeline CVE-2026-25143, GHSA-rf4g-89h5-crcr, GO-2026-4412 | High | Not scored | 04 Feb, 2026 | Go chainguard.dev/melange |
apko has a path traversal in apko dirFS which allows filesystem writes outside base CVE-2026-25121, GHSA-5g94-c2wx-8pxw, GO-2026-4405 | High | Not scored | 03 Feb, 2026 | Go chainguard.dev/apko |
melange pipeline working-directory could allow command injection CVE-2026-24844, GHSA-vqqr-rmpc-hhg2, GO-2026-4408 | High | Not scored | 03 Feb, 2026 | Go chainguard.dev/melange |
melange QEMU runner could write files outside workspace directory CVE-2026-24843, GHSA-qxx2-7h4c-83f4, GO-2026-4407 | High | Not scored | 03 Feb, 2026 | Go chainguard.dev/melange |
Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data) CVE-2026-25155, GHSA-vm6g-8r4h-22x8 | High | 0.1% | 03 Feb, 2026 | npm @builder.io/qwik-city |
Claude Code has a Command Injection in find Command Bypasses User Approval Prompt CVE-2026-24887, GHSA-qgqw-h4xq-7w8w | High | 0.6% | 03 Feb, 2026 | npm @anthropic-ai/claude-code |
Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes CVE-2026-24053, GHSA-q728-gf8j-w49r | High | 0.5% | 03 Feb, 2026 | npm @anthropic-ai/claude-code |
Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains CVE-2026-24052, GHSA-vhw5-3g5m-8ggf | High | 0.4% | 03 Feb, 2026 | npm @anthropic-ai/claude-code |
OpenSTAManager has an SQL Injection in the Stampe Module CVE-2025-69215, GHSA-qx9p-w3vj-q24q | High | 0.4% | 03 Feb, 2026 | Packagist devcode-it/openstamanager |
OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint) CVE-2025-69213, GHSA-w995-ff8h-rppg | High | 0.5% | 03 Feb, 2026 | Packagist devcode-it/openstamanager |
FacturaScripts has SQL Injection in Autocomplete Actions CVE-2026-25514, GHSA-pqqg-5f4f-8952 | High | 0.5% | 03 Feb, 2026 | Packagist facturascripts/facturascripts |
Boltz contains an insecure deserialization vulnerability in its molecule loading functionality CVE-2025-70560, GHSA-fjm6-8xp2-4fwc, PYSEC-2026-1224 | High | 0.2% | 03 Feb, 2026 | PyPI boltz |
FacturaScripts has SQL Injection in API ORDER BY Clause CVE-2026-25513, GHSA-cjfx-qhwm-hf99 | High | 0.5% | 03 Feb, 2026 | Packagist facturascripts/facturascripts |
Compressing Vulnerable to Arbitrary File Write via Symlink Extraction CVE-2026-24884, GHSA-cc8f-xg8v-72m3 | High | 0.3% | 03 Feb, 2026 | npm compressing |
Decidim's private data exports can lead to data leaks CVE-2025-65017, GHSA-3cx6-j9j4-54mp | High | Not scored | 03 Feb, 2026 | RubyGems decidim RubyGems decidim-core |
Django has an SQL Injection issue BIT-django-2026-1287, CVE-2026-1287, GHSA-gvg8-93h5-g6qq, PYSEC-2026-46 | High | 0.8% | 03 Feb, 2026 | PyPI Django PyPI django |
Django has Inefficient Algorithmic Complexity BIT-django-2026-1285, CVE-2026-1285, GHSA-4rrr-2h4v-f3j9, PYSEC-2026-45 | High | 1.1% | 03 Feb, 2026 | PyPI Django PyPI django |
Django has an SQL Injection issue BIT-django-2026-1207, CVE-2026-1207, GHSA-mwm9-4648-f68q, PYSEC-2026-44 | High | 12.8% | 03 Feb, 2026 | PyPI Django PyPI django |
Django has Inefficient Algorithmic Complexity BIT-django-2025-14550, CVE-2025-14550, GHSA-33mw-q7rj-mjwj, PYSEC-2026-43 | High | 1.1% | 03 Feb, 2026 | PyPI Django PyPI django |
Moodle Affected by Improper Restriction of Excessive Authentication Attempts BIT-moodle-2025-67853, CVE-2025-67853, GHSA-5cx4-w4fh-fr57 | High | 0.5% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle formula injection vulnerability BIT-moodle-2025-67851, CVE-2025-67851, GHSA-qfh6-h7j6-fvjv | High | 0.3% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle vulnerable to Cross-site Scripting BIT-moodle-2025-67850, CVE-2025-67850, GHSA-6mmv-f6c6-v6q8 | High | 0.3% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle Cross-site Scripting (XSS) vulnerability BIT-moodle-2025-67849, CVE-2025-67849, GHSA-mhf6-pp52-8wqj | High | 0.3% | 03 Feb, 2026 | Packagist moodle/moodle |
Moodle authentication bypass vulnerability BIT-moodle-2025-67848, CVE-2025-67848, GHSA-j5jv-w5cw-j9ff | High | 0.4% | 03 Feb, 2026 | Packagist moodle/moodle |
Notepad++ Download of Code Without Integrity Check Vulnerability CVE-2025-15556 | HighExploited | 1.7% | 03 Feb, 2026 | |
OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand CVE-2026-25157, GHSA-q284-4pvr-m585 | High | 1.1% | 02 Feb, 2026 | npm clawdbot |
OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable CVE-2026-24763, GHSA-mc68-q9jw-2h3v | High | 5.2% | 02 Feb, 2026 | npm clawdbot |
SageMaker Python SDK has Insecure TLS Configuration CVE-2026-1778, GHSA-62rc-f4v9-h543, PYSEC-2026-1886 | High | 0.3% | 02 Feb, 2026 | PyPI sagemaker |
SageMaker Python SDK has Exposed HMAC CVE-2026-1777, GHSA-rjrp-m2jw-pv9c, PYSEC-2026-1888 | High | 0.5% | 02 Feb, 2026 | PyPI sagemaker |
Fastify's Content-Type header tab character allows body validation bypass CVE-2026-25223, GHSA-jx2c-rxcm-jvmq | High | 0.9% | 02 Feb, 2026 | npm fastify |
terraform-provider-proxmox has insecure sudo recommendation in the documentation CVE-2026-25499, GHSA-gwch-7m8v-7544, GO-2026-4395 | High | Not scored | 02 Feb, 2026 | Go github.com/bpg/terraform-provider-proxmox |
OpenList has Insecure TLS Default Configuration CVE-2026-25060, GHSA-wf93-3ghh-h389, GO-2026-4397 | High | Not scored | 02 Feb, 2026 | Go github.com/OpenListTeam/OpenList Go github.com/OpenListTeam/OpenList/v3 Go github.com/OpenListTeam/OpenList/v4 |
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking CVE-2026-24051, GHSA-9h8m-3fm2-qjrq, GO-2026-4394 | High | Not scored | 02 Feb, 2026 | Go go.opentelemetry.io/otel/sdk |
OpenList vulnerable to Path Traversal in file copy and remove handlers CVE-2026-25059, GHSA-qmj2-8r24-xxcq, GO-2026-4396 | High | Not scored | 02 Feb, 2026 | Go github.com/OpenListTeam/OpenList Go github.com/OpenListTeam/OpenList/v3 Go github.com/OpenListTeam/OpenList/v4 |
jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution CVE-2026-24737, GHSA-pqxr-3g65-p328 | High | 0.6% | 02 Feb, 2026 | npm jspdf |
jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder CVE-2026-24133, GHSA-95fx-jjr5-f39c | High | 0.6% | 02 Feb, 2026 | npm jspdf |
Khoj has an IDOR in Notion OAuth Flow that Enables Index Poisoning CVE-2025-69207, GHSA-6whj-7qmg-86qj, PYSEC-2026-1491 | High | 0.4% | 02 Feb, 2026 | PyPI khoj |
Hugging Face Text Generation Inference vulnerable to Uncontrolled Resource Consumption CVE-2026-0599, GHSA-j7x9-7j54-2v3h, PYSEC-2026-1965 | High | 29.5% | 02 Feb, 2026 | PyPI text-generation |
mlflow Creates of Temporary File in Directory with Insecure Permissions BIT-mlflow-2025-10279, CVE-2025-10279, GHSA-4x5p-f36r-mxxr, PYSEC-2026-1639 | High | 0.2% | 02 Feb, 2026 | PyPI mlflow |
Lollms has an Improper Access Control vulnerability CVE-2026-1117, GHSA-82fw-ch24-j34w, PYSEC-2026-1586 | High | 0.6% | 02 Feb, 2026 | PyPI lollms |
fog-kubevirt allows remote attacker to perform MITM attack due to disabled certificate validation CVE-2026-1530, GHSA-m3hq-3qj8-c5fm | High | Not scored | 02 Feb, 2026 | RubyGems fog-kubevirt |
foreman_kubevirt disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set CVE-2026-1531, GHSA-2qxw-7fmx-gqfm | High | Not scored | 02 Feb, 2026 | RubyGems foreman_kubevirt |
RaspAP raspap-webgui contains an OS Command Injection vulnerability CVE-2026-24788, GHSA-4wwf-f7w3-94f5 | High | 1.4% | 02 Feb, 2026 | Packagist billz/raspap-webgui |