Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Highcharts Dashboards parses sidebar component labels as HTML CVE-2026-118252, GHSA-rcqf-f6h2-ccg9 | High | Not scored | 1 day ago | npm @highcharts/dashboards |
Highcharts: `javascript:` URL in credits.href runs script on click CVE-2026-118251, GHSA-5793-x2q3-c3q7 | High | Not scored | 1 day ago | npm highcharts |
Malicious release: Malicious code in itsa-utils (npm) GHSA-x788-rmcm-4x49, MAL-2026-18363 | Malicious | Not scored | 1 day ago | npm itsa-utils |
Malicious release: Malicious code in itsa-react-checkbox (npm) GHSA-46r9-rx5f-hqqf, MAL-2026-18360 | Malicious | Not scored | 1 day ago | npm itsa-react-checkbox |
Highcharts: dotted series.keys paths write to Object.prototype CVE-2026-118250, GHSA-rmqc-xvr3-v46c | High | Not scored | 1 day ago | npm highcharts |
Highcharts: series column construction writes to Object.prototype CVE-2026-118249, GHSA-gfvx-2c2g-38wq | High | Not scored | 1 day ago | npm highcharts |
Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. CVE-2026-118247, GHSA-c75x-9x9h-28rm | Medium | Not scored | 1 day ago | npm @highcharts/dashboards npm @highcharts/grid-pro |
Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes CVE-2026-118246, GHSA-35rr-xwfh-x789 | High | Not scored | 1 day ago | npm highcharts |
Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace CVE-2026-118245, GHSA-grj7-r4jv-pw9j | High | Not scored | 1 day ago | npm @highcharts/dashboards |
Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing CVE-2026-118244, GHSA-65hg-cf3f-5m39 | High | Not scored | 1 day ago | npm highcharts |
Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` CVE-2026-118243, GHSA-jqgh-w3cc-7jqw | Medium | Not scored | 1 day ago | npm @highcharts/dashboards |
Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>` CVE-2026-118242, GHSA-6g3c-p4fg-xv47 | High | Not scored | 1 day ago | npm @highcharts/grid-lite npm @highcharts/grid-pro |
Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute` CVE-2026-116797, GHSA-5ghw-9mgr-jvx2 | High | Not scored | 1 day ago | npm @highcharts/dashboards npm @highcharts/grid-pro |
Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts CVE-2026-116796, GHSA-mw4f-gj5x-6xr4 | High | Not scored | 1 day ago | npm highcharts |
RE2JS: Quadratic-time denial of service in re2js lookbehind matching CVE-2026-116795, GHSA-gg6h-894w-4m9c | High | Not scored | 1 day ago | npm re2js |
Malicious release: Malicious code in transaction-info-generate-sdk (npm) GHSA-23j5-jj88-v9f3, MAL-2026-18362 | Malicious | Not scored | 1 day ago | npm transaction-info-generate-sdk |
Malicious release: Malicious code in mock-transactions-sdk (npm) GHSA-357r-x5jp-3p8f, MAL-2026-18361 | Malicious | Not scored | 1 day ago | npm mock-transactions-sdk |
Malicious release: Malicious code in black-spindle (npm) MAL-2026-18359 | Malicious | Not scored | 1 day ago | npm black-spindle |
Malicious release: Malicious code in @zmtcdn/components (npm) MAL-2026-18372 | Malicious | Not scored | 1 day ago | npm @zmtcdn/components |
Malicious release: Malicious code in @zmtcdn/ui (npm) MAL-2026-18373 | Malicious | Not scored | 1 day ago | npm @zmtcdn/ui |
Malicious release: Malicious code in identity-two-factor (npm) MAL-2026-18367 | Malicious | Not scored | 1 day ago | npm identity-two-factor |
Malicious release: Malicious code in spectral-net-probe (npm) MAL-2026-18368 | Malicious | Not scored | 1 day ago | npm spectral-net-probe |
Malicious release: Malicious code in glyphmatrix-fixture (npm) GHSA-vc33-3x34-x6jm, MAL-2026-18355 | Malicious | Not scored | 1 day ago | npm glyphmatrix-fixture |
Malicious release: Malicious code in ccsec-crypto-toolkit (npm) GHSA-2732-c6cp-rx5v, MAL-2026-18347 | Malicious | Not scored | 1 day ago | npm ccsec-crypto-toolkit |
Malicious release: Malicious code in ccsseecc-form-validator (npm) GHSA-h5wr-j55v-8m79, MAL-2026-18350 | Malicious | Not scored | 1 day ago | npm ccsseecc-form-validator |
Malicious release: Malicious code in csec-form-validatorr (npm) GHSA-ph3g-jrf5-8792, MAL-2026-18353 | Malicious | Not scored | 1 day ago | npm csec-form-validatorr |
Malicious release: Malicious code in ccsec-form-validator (npm) GHSA-r889-j2qv-2jv6, MAL-2026-18348 | Malicious | Not scored | 1 day ago | npm ccsec-form-validator |
Malicious release: Malicious code in csec-crypto-toolkit (npm) GHSA-v383-2358-576w, MAL-2026-18351 | Malicious | Not scored | 1 day ago | npm csec-crypto-toolkit |
Malicious release: Malicious code in ccsseecc-crypto-toolkit (npm) GHSA-v9xw-mxj4-fm5q, MAL-2026-18349 | Malicious | Not scored | 1 day ago | npm ccsseecc-crypto-toolkit |
Malicious release: Malicious code in csec-form-validator (npm) GHSA-wh86-6qm8-xgw2, MAL-2026-18352 | Malicious | Not scored | 1 day ago | npm csec-form-validator |
Malicious release: Malicious code in agentenact (npm) GHSA-7p7m-8jmq-qp93, MAL-2026-18346 | Malicious | Not scored | 1 day ago | npm agentenact |
dd-trace: ReDOS in URL query string obfuscation CVE-2026-116693, GHSA-x94g-w73q-hpcw | High | 0.4% | 2 days ago | npm dd-trace |
CKEditor: Cross-site scripting (XSS) in the engine package CVE-2026-116688, GHSA-rh54-vffm-5fvp | High | 0.5% | 2 days ago | npm @ckeditor/ckeditor5-engine npm ckeditor5 |
CKEditor: Cross-site scripting (XSS) in the engine package CVE-2026-116687, GHSA-v6mg-96c6-gmpq | Low | 0.3% | 2 days ago | npm @ckeditor/ckeditor5-engine npm ckeditor5 |
Malicious release: Malicious code in dsh-vm-tester (npm) GHSA-84fw-gj66-p5v3, MAL-2026-18345 | Malicious | Not scored | 2 days ago | npm dsh-vm-tester |
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length GHSA-f897-62hf-6gxq | High | Not scored | 2 days ago | npm @modelcontextprotocol/hono npm @modelcontextprotocol/node npm @modelcontextprotocol/sdk npm @modelcontextprotocol/server |
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization CVE-2026-116675, GHSA-mf2p-h6hf-fcwm | High | 0.3% | 2 days ago | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
systeminformation has prototype pollution in `networkStats()` via the interface name CVE-2026-116674, GHSA-7648-jmwf-vw7j | Medium | 0.3% | 2 days ago | npm systeminformation |
systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net CVE-2026-116673, GHSA-4vjg-vx72-qq4g | Low | 0.1% | 2 days ago | npm systeminformation |
Malicious release: Malicious code in @webapp-shared/login-vmok (npm) MAL-2026-18356 | Malicious | Not scored | 2 days ago | npm @webapp-shared/login-vmok |
Malicious release: Malicious code in adyen-web-v6 (npm) GHSA-r77r-rw3m-rjh5, MAL-2026-18344 | Malicious | Not scored | 2 days ago | npm adyen-web-v6 |
Malicious release: Malicious code in buttoncontent (npm) GHSA-6crh-vwr2-4qfp, MAL-2026-18339 | Malicious | Not scored | 2 days ago | npm buttoncontent |
Malicious release: Malicious code in macro-kernel-record-reader (npm) GHSA-32g3-f74c-pcxq, MAL-2026-18341 | Malicious | Not scored | 2 days ago | npm macro-kernel-record-reader |
Malicious release: Malicious code in fetch-hash-cache-atomic (npm) GHSA-w9mp-cvjp-jfqp, MAL-2026-18340 | Malicious | Not scored | 2 days ago | npm fetch-hash-cache-atomic |
Malicious release: Malicious code in string-target-mapper-hash (npm) GHSA-wfcx-722r-fg5h, MAL-2026-18342 | Malicious | Not scored | 2 days ago | npm string-target-mapper-hash |
dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS CVE-2026-46350, GHSA-px68-xx5g-48q5 | Low | Not scored | 2 days ago | npm dcmjs |
Malicious release: Malicious code in @azure-growth/signup-ux-components (npm) MAL-2026-18338 | Malicious | Not scored | 2 days ago | npm @azure-growth/signup-ux-components |
Malicious release: Malicious code in @camera.ui/camera-ui-nvr-windows-amd64 (npm) GHSA-2w7v-jwxh-w7wc, MAL-2026-18337 | Malicious | Not scored | 2 days ago | npm @camera.ui/camera-ui-nvr-windows-amd64 |
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length CVE-2026-116584, GHSA-wp97-x4hv-qvhp | High | 0.4% | 3 days ago | npm seroval |
Seroval: Code injection through a typed array's own constructor property CVE-2026-116583, GHSA-f86p-h4j2-7qgj | Medium | 0.3% | 3 days ago | npm seroval |