Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in orderbook-volt-plugin (npm) GHSA-w9pq-6r9f-pj96, MAL-2026-18393 | Malicious | Not scored | 1 hour ago | npm orderbook-volt-plugin |
Malicious release: Malicious code in react-native-drago-callkit (npm) GHSA-jp74-4rg3-7ppj, MAL-2026-18394 | Malicious | Not scored | 2 hours ago | npm react-native-drago-callkit |
Malicious release: Malicious code in @chatunitycenter/baileys (npm) GHSA-g6j7-j669-23g6, MAL-2026-18392 | Malicious | Not scored | 3 hours ago | npm @chatunitycenter/baileys |
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs CVE-2026-118664, GHSA-qr28-fpjm-wq7f | High | Not scored | 3 hours ago | npm decode-uri-component |
Vite: `server.fs.deny` bypassed with queries CVE-2026-118662, GHSA-8g5g-mxqh-grgj | Medium | Not scored | 3 hours ago | npm vite |
@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy GHSA-w9x9-j56r-h98r | High | Not scored | 4 hours ago | npm @eeacms/volto-chatbot |
Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence GHSA-c33x-vcv4-vg3g | Low | Not scored | 4 hours ago | crates.io cedar-policy npm @cedar-policy/cedar-wasm |
@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY CVE-2026-62264, GHSA-q344-5v34-gm84 | High | Not scored | 4 hours ago | npm @sylphx/pdf-reader-mcp |
Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist BIT-parse-2026-61448, CVE-2026-61448, GHSA-r899-h629-j84r | Low | Not scored | 4 hours ago | npm parse-server |
Malicious release: Malicious code in 789bet-vip-login (npm) GHSA-4rjq-j97h-cqxc, MAL-2026-18387 | Malicious | Not scored | 5 hours ago | npm 789bet-vip-login |
Malicious release: Malicious code in 789bet-entrance (npm) GHSA-6xqc-cfvp-q89v, MAL-2026-18383 | Malicious | Not scored | 5 hours ago | npm 789bet-entrance |
Malicious release: Malicious code in 789bet-vip-online-login (npm) GHSA-f5mv-v4rc-qq2q, MAL-2026-18388 | Malicious | Not scored | 5 hours ago | npm 789bet-vip-online-login |
Malicious release: Malicious code in 789bet-slot (npm) GHSA-q68g-454g-9qww, MAL-2026-18385 | Malicious | Not scored | 5 hours ago | npm 789bet-slot |
Malicious release: Malicious code in 789bet-vip (npm) GHSA-rvxc-82gp-xpr6, MAL-2026-18386 | Malicious | Not scored | 5 hours ago | npm 789bet-vip |
Malicious release: Malicious code in 789bet-login-th (npm) GHSA-wg3r-wqgc-7fgf, MAL-2026-18384 | Malicious | Not scored | 5 hours ago | npm 789bet-login-th |
Malicious release: Malicious code in m98bet (npm) GHSA-6ggw-hqvq-8wcm, MAL-2026-18389 | Malicious | Not scored | 5 hours ago | npm m98bet |
Malicious release: Malicious code in 789bet (npm) GHSA-cccw-qphx-7whg, MAL-2026-18382 | Malicious | Not scored | 5 hours ago | npm 789bet |
Malicious release: Malicious code in m98vip (npm) GHSA-gp92-xqcg-876c, MAL-2026-18391 | Malicious | Not scored | 5 hours ago | npm m98vip |
Malicious release: Malicious code in m98th (npm) GHSA-x82c-crm3-jcwv, MAL-2026-18390 | Malicious | Not scored | 5 hours ago | npm m98th |
Malicious release: Malicious code in @jasperquinn/postcss-motion-helpers (npm) GHSA-88vx-c9pj-9527, MAL-2026-18379 | Malicious | Not scored | 5 hours ago | npm @jasperquinn/postcss-motion-helpers |
Malicious release: Malicious code in black-spindle-2 (npm) MAL-2026-18376 | Malicious | Not scored | 5 hours ago | npm black-spindle-2 |
Malicious release: Malicious code in spectral-core (npm) MAL-2026-18377 | Malicious | Not scored | 5 hours ago | npm spectral-core |
Malicious release: Malicious code in @dmangal/curse-dependent-ecto (npm) MAL-2026-18375 | Malicious | Not scored | 5 hours ago | npm @dmangal/curse-dependent-ecto |
Malicious release: Malicious code in cjlowuxbnexkhgpzq (npm) GHSA-pr23-gvcv-c422, MAL-2026-18381 | Malicious | Not scored | 6 hours ago | npm cjlowuxbnexkhgpzq |
Malicious release: Malicious code in bcxhdh1kjlopsde (npm) GHSA-v78q-7787-v9rq, MAL-2026-18380 | Malicious | Not scored | 6 hours ago | npm bcxhdh1kjlopsde |
Malicious release: Malicious code in mw-communication-client (npm) MAL-2026-18370 | Malicious | Not scored | 6 hours ago | npm mw-communication-client |
Malicious release: Malicious code in mw-test-utils (npm) MAL-2026-18371 | Malicious | Not scored | 6 hours ago | npm mw-test-utils |
Malicious release: Malicious code in mui-wrapper-x-date-pickers (npm) MAL-2026-18369 | Malicious | Not scored | 6 hours ago | npm mui-wrapper-x-date-pickers |
Malicious release: Malicious code in monte-md-baileys (npm) MAL-2026-17399 | Malicious | Not scored | 7 hours ago | npm monte-md-baileys |
Malicious release: Malicious code in noxleyss (npm) MAL-2026-17402 | Malicious | Not scored | 7 hours ago | npm noxleyss |
Malicious release: Malicious code in @rennnpm/baileys (npm) MAL-2026-17374 | Malicious | Not scored | 7 hours ago | npm @rennnpm/baileys |
Malicious release: Malicious code in @testsecuiitytestme/cache-helper (npm) MAL-2026-18358 | Malicious | Not scored | 7 hours ago | npm @testsecuiitytestme/cache-helper |
Malicious release: Malicious code in dsh-volcengine-provider (npm) GHSA-8hr2-m7vq-fhpg, MAL-2026-18374 | Malicious | Not scored | 11 hours ago | npm dsh-volcengine-provider |
Malicious release: Malicious code in dsh-redteam-mode (npm) GHSA-r4m9-8735-g966, MAL-2026-18366 | Malicious | Not scored | 15 hours ago | npm dsh-redteam-mode |
Malicious release: Malicious code in b20miner (npm) GHSA-fw7x-6chc-4244, MAL-2026-18365 | Malicious | Not scored | 21 hours ago | npm b20miner |
Waline login accepts a non-string email as a match-all MongoDB query CVE-2026-55369, GHSA-jf75-q64q-g65r | Medium | Not scored | 23 hours ago | npm @waline/vercel |
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML CVE-2026-118660, GHSA-c8p4-j97h-3vg8 | High | Not scored | 23 hours ago | npm happy-dom |
Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies CVE-2026-118661, GHSA-5fpq-26gf-qwcr | Medium | Not scored | 23 hours ago | npm happy-dom |
GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications CVE-2026-118665, GHSA-434m-5hcj-pxf3 | High | Not scored | 23 hours ago | npm @graphql-tools/executor-legacy-ws |
GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller CVE-2026-118666, GHSA-mp66-8ww2-pcwm | Medium | Not scored | 23 hours ago | npm @graphql-tools/executor-legacy-ws |
@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths CVE-2026-118663, GHSA-rmxm-3fg6-px4f | Medium | Not scored | 23 hours ago | npm @hono/node-server |
Malicious release: Malicious code in @zaip-ai/cli (npm) GHSA-ffq4-h5jm-8pqr, MAL-2026-18364 | Malicious | Not scored | 1 day ago | npm @zaip-ai/cli |
mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 GHSA-4mfg-r38w-w8fg | High | Not scored | 1 day ago | npm mcp-sanitizer |
mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths GHSA-7w82-6f9j-v9jp | High | Not scored | 1 day ago | npm mcp-sanitizer |
i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string CVE-2026-118258, GHSA-3cmx-xjww-583x | Low | Not scored | 1 day ago | npm i18next-http-backend |
Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages CVE-2026-118257, GHSA-83rm-6c8r-g728 | High | Not scored | 1 day ago | npm @intlify/core npm @intlify/core-base npm @intlify/shared npm @intlify/vue-i18n-core +2 more |
Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list CVE-2026-118256, GHSA-8rc2-428q-7ww3 | Low | Not scored | 1 day ago | npm @intlify/core npm @intlify/core-base npm @intlify/vue-i18n-core npm petite-vue-i18n +1 more |
Highcharts Grid: `javascript:` URL in credits.href runs script on click CVE-2026-118255, GHSA-6hgp-fmhr-mrg4 | High | Not scored | 1 day ago | npm @highcharts/dashboards npm @highcharts/grid-pro |
Highcharts Grid parses pagination language options as HTML CVE-2026-118254, GHSA-r5wg-q8fc-p6w2 | High | Not scored | 1 day ago | npm @highcharts/grid-lite npm @highcharts/grid-pro |
Highcharts Dashboards parses fullscreen labels as HTML CVE-2026-118253, GHSA-58g7-7f52-h92c | High | Not scored | 1 day ago | npm @highcharts/dashboards |