Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @chatunitycenter/baileys (npm) GHSA-g6j7-j669-23g6, MAL-2026-18392 | Malicious | Not scored | 2 hours ago | npm @chatunitycenter/baileys |
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs CVE-2026-118664, GHSA-qr28-fpjm-wq7f | High | Not scored | 2 hours ago | npm decode-uri-component |
Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset GHSA-vpp8-g58w-m8mp | High | Not scored | 2 hours ago | PyPI Twisted PyPI twisted |
Vite: `server.fs.deny` bypassed with queries CVE-2026-118662, GHSA-8g5g-mxqh-grgj | Medium | Not scored | 3 hours ago | npm vite |
@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy GHSA-w9x9-j56r-h98r | High | Not scored | 3 hours ago | npm @eeacms/volto-chatbot |
Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence GHSA-c33x-vcv4-vg3g | Low | Not scored | 3 hours ago | crates.io cedar-policy npm @cedar-policy/cedar-wasm |
@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY CVE-2026-62264, GHSA-q344-5v34-gm84 | High | Not scored | 3 hours ago | npm @sylphx/pdf-reader-mcp |
PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox CVE-2026-61438, GHSA-26mh-57q7-jfvr | High | Not scored | 3 hours ago | PyPI praisonai |
Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist BIT-parse-2026-61448, CVE-2026-61448, GHSA-r899-h629-j84r | Low | Not scored | 3 hours ago | npm parse-server |
PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets CVE-2026-86198, GHSA-pg53-p7qp-65cv | Low | Not scored | 3 hours ago | Packagist pocketmine/pocketmine-mp |
MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow CVE-2026-55186, GHSA-68wq-phq7-p2vg | Medium | Not scored | 3 hours ago | Packagist silverstripe/mfa |
Malicious release: Malicious code in 789bet-vip-login (npm) GHSA-4rjq-j97h-cqxc, MAL-2026-18387 | Malicious | Not scored | 4 hours ago | npm 789bet-vip-login |
Malicious release: Malicious code in 789bet-entrance (npm) GHSA-6xqc-cfvp-q89v, MAL-2026-18383 | Malicious | Not scored | 4 hours ago | npm 789bet-entrance |
Malicious release: Malicious code in 789bet-vip-online-login (npm) GHSA-f5mv-v4rc-qq2q, MAL-2026-18388 | Malicious | Not scored | 4 hours ago | npm 789bet-vip-online-login |
Malicious release: Malicious code in 789bet-slot (npm) GHSA-q68g-454g-9qww, MAL-2026-18385 | Malicious | Not scored | 4 hours ago | npm 789bet-slot |
Malicious release: Malicious code in 789bet-vip (npm) GHSA-rvxc-82gp-xpr6, MAL-2026-18386 | Malicious | Not scored | 4 hours ago | npm 789bet-vip |
Malicious release: Malicious code in 789bet-login-th (npm) GHSA-wg3r-wqgc-7fgf, MAL-2026-18384 | Malicious | Not scored | 4 hours ago | npm 789bet-login-th |
Malicious release: Malicious code in m98bet (npm) GHSA-6ggw-hqvq-8wcm, MAL-2026-18389 | Malicious | Not scored | 4 hours ago | npm m98bet |
Malicious release: Malicious code in 789bet (npm) GHSA-cccw-qphx-7whg, MAL-2026-18382 | Malicious | Not scored | 4 hours ago | npm 789bet |
Malicious release: Malicious code in m98vip (npm) GHSA-gp92-xqcg-876c, MAL-2026-18391 | Malicious | Not scored | 4 hours ago | npm m98vip |
Malicious release: Malicious code in m98th (npm) GHSA-x82c-crm3-jcwv, MAL-2026-18390 | Malicious | Not scored | 4 hours ago | npm m98th |
Malicious release: Malicious code in @jasperquinn/postcss-motion-helpers (npm) GHSA-88vx-c9pj-9527, MAL-2026-18379 | Malicious | Not scored | 4 hours ago | npm @jasperquinn/postcss-motion-helpers |
Malicious release: Malicious code in black-spindle-2 (npm) MAL-2026-18376 | Malicious | Not scored | 4 hours ago | npm black-spindle-2 |
Malicious release: Malicious code in poc-revshell (PyPI) MAL-2026-18378 | Malicious | Not scored | 4 hours ago | PyPI poc-revshell |
Malicious release: Malicious code in spectral-core (npm) MAL-2026-18377 | Malicious | Not scored | 4 hours ago | npm spectral-core |
Malicious release: Malicious code in @dmangal/curse-dependent-ecto (npm) MAL-2026-18375 | Malicious | Not scored | 4 hours ago | npm @dmangal/curse-dependent-ecto |
Malicious release: Malicious code in cjlowuxbnexkhgpzq (npm) GHSA-pr23-gvcv-c422, MAL-2026-18381 | Malicious | Not scored | 5 hours ago | npm cjlowuxbnexkhgpzq |
Malicious release: Malicious code in bcxhdh1kjlopsde (npm) GHSA-v78q-7787-v9rq, MAL-2026-18380 | Malicious | Not scored | 5 hours ago | npm bcxhdh1kjlopsde |
Malicious release: Malicious code in mw-communication-client (npm) MAL-2026-18370 | Malicious | Not scored | 6 hours ago | npm mw-communication-client |
Malicious release: Malicious code in mw-test-utils (npm) MAL-2026-18371 | Malicious | Not scored | 6 hours ago | npm mw-test-utils |
Malicious release: Malicious code in mui-wrapper-x-date-pickers (npm) MAL-2026-18369 | Malicious | Not scored | 6 hours ago | npm mui-wrapper-x-date-pickers |
Malicious release: Malicious code in monte-md-baileys (npm) MAL-2026-17399 | Malicious | Not scored | 6 hours ago | npm monte-md-baileys |
Malicious release: Malicious code in noxleyss (npm) MAL-2026-17402 | Malicious | Not scored | 6 hours ago | npm noxleyss |
Malicious release: Malicious code in @rennnpm/baileys (npm) MAL-2026-17374 | Malicious | Not scored | 6 hours ago | npm @rennnpm/baileys |
Malicious release: Malicious code in seapy-ops (PyPI) MAL-2026-17880 | Malicious | Not scored | 6 hours ago | PyPI seapy-ops |
Malicious release: Malicious code in @testsecuiitytestme/cache-helper (npm) MAL-2026-18358 | Malicious | Not scored | 6 hours ago | npm @testsecuiitytestme/cache-helper |
Malicious release: Malicious code in dsh-volcengine-provider (npm) GHSA-8hr2-m7vq-fhpg, MAL-2026-18374 | Malicious | Not scored | 10 hours ago | npm dsh-volcengine-provider |
Malicious release: Malicious code in dsh-redteam-mode (npm) GHSA-r4m9-8735-g966, MAL-2026-18366 | Malicious | Not scored | 14 hours ago | npm dsh-redteam-mode |
Malicious release: Malicious code in b20miner (npm) GHSA-fw7x-6chc-4244, MAL-2026-18365 | Malicious | Not scored | 20 hours ago | npm b20miner |
Waline login accepts a non-string email as a match-all MongoDB query CVE-2026-55369, GHSA-jf75-q64q-g65r | Medium | Not scored | 22 hours ago | npm @waline/vercel |
LangGraph JavaScript custom authentication may permit cross-user Store access CVE-2026-118668, GHSA-4hm6-w6qq-w73v | High | Not scored | 22 hours ago | PyPI langgraph-api |
filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold CVE-2026-112908, GHSA-6627-m3xw-93mp | Medium | Not scored | 22 hours ago | PyPI filelock |
filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL CVE-2026-112910, GHSA-8mx5-7m5m-r77g | Medium | Not scored | 22 hours ago | PyPI filelock |
filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses CVE-2026-112938, GHSA-m462-7rxw-wvpg | Medium | Not scored | 22 hours ago | PyPI filelock |
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML CVE-2026-118660, GHSA-c8p4-j97h-3vg8 | High | Not scored | 22 hours ago | npm happy-dom |
Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies CVE-2026-118661, GHSA-5fpq-26gf-qwcr | Medium | Not scored | 22 hours ago | npm happy-dom |
LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests CVE-2026-118667, GHSA-3fx2-cqw9-xr3c | Medium | Not scored | 22 hours ago | PyPI langgraph PyPI langgraph-sdk |
GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications CVE-2026-118665, GHSA-434m-5hcj-pxf3 | High | Not scored | 22 hours ago | npm @graphql-tools/executor-legacy-ws |
GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller CVE-2026-118666, GHSA-mp66-8ww2-pcwm | Medium | Not scored | 22 hours ago | npm @graphql-tools/executor-legacy-ws |
@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths CVE-2026-118663, GHSA-rmxm-3fg6-px4f | Medium | Not scored | 22 hours ago | npm @hono/node-server |