Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Seroval: Script injection through RegExp sources in serialized output CVE-2026-116582, GHSA-9wx9-5pv9-3349 | Medium | 0.2% | 3 days ago | npm seroval |
Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS) CVE-2026-116581, GHSA-97r2-qh9m-474h | High | 0.5% | 3 days ago | npm seroval |
Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check CVE-2026-116580, GHSA-7rv5-mrxv-xcr9 | High | 0.3% | 3 days ago | npm seroval |
systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks CVE-2026-116576, GHSA-3f7j-7jwc-fxfj | High | 0.1% | 3 days ago | npm systeminformation |
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope) CVE-2026-116575, GHSA-5324-3w58-qpp2 | Medium | 0.1% | 3 days ago | PyPI mem0ai npm mem0ai |
Malicious release: Malicious code in ctf-agent (npm) GHSA-2j3v-rjgw-5wgg, MAL-2026-18335 | Malicious | Not scored | 3 days ago | npm ctf-agent |
Malicious release: Malicious code in csvflow-schema (npm) MAL-2026-18357 | Malicious | Not scored | 3 days ago | npm csvflow-schema |
Backstage catalog rules can be bypassed for URL locations using encoded path segments CVE-2026-115923, GHSA-w658-mh9p-ww8f | Medium | 0.3% | 3 days ago | npm @backstage/plugin-catalog-backend |
Malicious release: Malicious code in @iobandamwer/native-helper (npm) GHSA-g457-v22r-g8j3, MAL-2026-18330 | Malicious | Not scored | 3 days ago | npm @iobandamwer/native-helper |
Malicious release: Malicious code in path-stream-utils-testmetest (npm) GHSA-7pvr-f92m-6fwg, MAL-2026-18333 | Malicious | Not scored | 3 days ago | npm path-stream-utils-testmetest |
Malicious release: Malicious code in @iobandamwer/cache-helper (npm) GHSA-j83w-xhgf-7m58, MAL-2026-18329 | Malicious | Not scored | 3 days ago | npm @iobandamwer/cache-helper |
Malicious release: Malicious code in postcss-semantic-themes (npm) GHSA-fh55-fq5h-h352, MAL-2026-18334 | Malicious | Not scored | 3 days ago | npm postcss-semantic-themes |
Malicious release: Malicious code in birch-css-utils (npm) GHSA-p597-2ggw-c82r, MAL-2026-18331 | Malicious | Not scored | 3 days ago | npm birch-css-utils |
Malicious release: Malicious code in harlow-css-mixer (npm) GHSA-j658-c56g-qxh4, MAL-2026-18332 | Malicious | Not scored | 3 days ago | npm harlow-css-mixer |
Malicious release: Malicious code in @worca/app (npm) GHSA-rmc5-cxrx-5fh9, MAL-2026-18325 | Malicious | Not scored | 3 days ago | npm @worca/app |
Malicious release: Malicious code in publish-poc-base (npm) MAL-2026-18323 | Malicious | Not scored | 3 days ago | npm publish-poc-base |
Malicious release: Malicious code in publish-poc-test3 (npm) MAL-2026-18324 | Malicious | Not scored | 3 days ago | npm publish-poc-test3 |
Malicious release: Malicious code in @apexacc/cli (npm) MAL-2026-17924 | Malicious | Not scored | 3 days ago | npm @apexacc/cli |
Malicious release: Malicious code in numbors (npm) GHSA-682c-pwqm-7gxv, MAL-2026-18322 | Malicious | Not scored | 3 days ago | npm numbors |
Malicious release: Malicious code in dsh-native (npm) GHSA-x94m-hxm5-m298, MAL-2026-18315 | Malicious | Not scored | 3 days ago | npm dsh-native |
Malicious release: Malicious code in bow-test (npm) GHSA-w53j-w72q-2f32, MAL-2026-18311 | Malicious | Not scored | 3 days ago | npm bow-test |
Malicious release: Malicious code in css-hnhxwd-polyfill (npm) GHSA-r2cx-wgxm-g93q, MAL-2026-18314 | Malicious | Not scored | 3 days ago | npm css-hnhxwd-polyfill |
Malicious release: Malicious code in util-foriepft (npm) GHSA-rc7p-6p9r-rfj9, MAL-2026-17878 | Malicious | Not scored | 3 days ago | npm util-foriepft |
Malicious release: Malicious code in css-flexgap-shim (npm) GHSA-xv83-g4vx-88wf, MAL-2026-18312 | Malicious | Not scored | 3 days ago | npm css-flexgap-shim |
Malicious release: Malicious code in @regex33-hackerone/tb-compat (npm) GHSA-vwp8-h222-46p8, MAL-2026-18310 | Malicious | Not scored | 3 days ago | npm @regex33-hackerone/tb-compat |
Malicious release: Malicious code in css-grid-snap-util (npm) GHSA-ww37-mhpw-cm3q, MAL-2026-18313 | Malicious | Not scored | 3 days ago | npm css-grid-snap-util |
Malicious release: Malicious code in @walknpm/todo-cli (npm) GHSA-p6gj-69gx-r376, MAL-2026-18320 | Malicious | Not scored | 3 days ago | npm @walknpm/todo-cli |
Malicious release: Malicious code in dsh-plugin-blender-3d (npm) GHSA-hw9g-f63g-4c8x, MAL-2026-18321 | Malicious | Not scored | 3 days ago | npm dsh-plugin-blender-3d |
Malicious release: Malicious code in @s4yhiitestpoc/scan-echo-b (npm) GHSA-2wfm-2q62-f937, MAL-2026-18308 | Malicious | Not scored | 3 days ago | npm @s4yhiitestpoc/scan-echo-b |
Malicious release: Malicious code in @s4yhiitestpoc/scan-https-dualuse-e (npm) GHSA-5957-rhph-hx5p, MAL-2026-18309 | Malicious | Not scored | 3 days ago | npm @s4yhiitestpoc/scan-https-dualuse-e |
Malicious release: Malicious code in @s4yhiitestpoc/r2-echo (npm) GHSA-gcfx-vpjf-86m9, MAL-2026-18304 | Malicious | Not scored | 3 days ago | npm @s4yhiitestpoc/r2-echo |
Malicious release: Malicious code in @s4yhiitestpoc/r2-dns (npm) GHSA-jr92-v3rg-vg3w, MAL-2026-18303 | Malicious | Not scored | 3 days ago | npm @s4yhiitestpoc/r2-dns |
Malicious release: Malicious code in @s4yhiitestpoc/scan-control-a (npm) GHSA-m9p6-4pgh-6gqx, MAL-2026-18306 | Malicious | Not scored | 3 days ago | npm @s4yhiitestpoc/scan-control-a |
Malicious release: Malicious code in @s4yhiitestpoc/r2-control (npm) GHSA-mgmq-xcr7-2945, MAL-2026-18302 | Malicious | Not scored | 3 days ago | npm @s4yhiitestpoc/r2-control |
Malicious release: Malicious code in @s4yhiitestpoc/r2-https-dualuse (npm) GHSA-mv2r-j9qg-322h, MAL-2026-18305 | Malicious | Not scored | 3 days ago | npm @s4yhiitestpoc/r2-https-dualuse |
Malicious release: Malicious code in @s4yhiitestpoc/scan-dns-c (npm) GHSA-vhw8-ph25-jc87, MAL-2026-18307 | Malicious | Not scored | 3 days ago | npm @s4yhiitestpoc/scan-dns-c |
Malicious release: Malicious code in @capsense/ccx-welcome-page (npm) GHSA-phgq-4c2g-6xpx, MAL-2026-18294 | Malicious | Not scored | 4 days ago | npm @capsense/ccx-welcome-page |
Malicious release: Malicious code in @capsense/core-ui (npm) GHSA-c2qc-c78r-386v, MAL-2026-18295 | Malicious | Not scored | 4 days ago | npm @capsense/core-ui |
Malicious release: Malicious code in event-bus-lite-testmetest (npm) MAL-2026-18292 | Malicious | Not scored | 4 days ago | npm event-bus-lite-testmetest |
Malicious release: Malicious code in w-mousekey (npm) GHSA-gmhr-j769-j6qf, MAL-2026-18293 | Malicious | Not scored | 4 days ago | npm w-mousekey |
Malicious release: Malicious code in jshelperdependenceny (npm) GHSA-2gxp-q3vq-594r, MAL-2026-18288 | Malicious | Not scored | 4 days ago | npm jshelperdependenceny |
Malicious release: Malicious code in @fmr-ap153177/apex-kit-icons (npm) MAL-2026-18279 | Malicious | Not scored | 4 days ago | npm @fmr-ap153177/apex-kit-icons |
Malicious release: Malicious code in @generic-means/ing-feat-scanner-libs (npm) MAL-2026-18281 | Malicious | Not scored | 4 days ago | npm @generic-means/ing-feat-scanner-libs |
Malicious release: Malicious code in @factoryz/apollo (npm) MAL-2026-18278 | Malicious | Not scored | 4 days ago | npm @factoryz/apollo |
Malicious release: Malicious code in @jm-telefonica/multibrand-components (npm) MAL-2026-18284 | Malicious | Not scored | 4 days ago | npm @jm-telefonica/multibrand-components |
Malicious release: Malicious code in @postex/common (npm) MAL-2026-18285 | Malicious | Not scored | 4 days ago | npm @postex/common |
Malicious release: Malicious code in sc-hydrate-carousel-price (npm) GHSA-9gcx-88qx-rxch, MAL-2026-18291 | Malicious | Not scored | 4 days ago | npm sc-hydrate-carousel-price |
Malicious release: Malicious code in @futurae-public/adaptive-js (npm) MAL-2026-18280 | Malicious | Not scored | 4 days ago | npm @futurae-public/adaptive-js |
Malicious release: Malicious code in paychex-pdftron (npm) GHSA-9mgv-25w8-jwhf, MAL-2026-18289 | Malicious | Not scored | 4 days ago | npm paychex-pdftron |
Malicious release: Malicious code in @ppa-web-components/ppa-headerfooter (npm) GHSA-p3hf-95qq-mv56, MAL-2026-18274 | Malicious | Not scored | 4 days ago | npm @ppa-web-components/ppa-headerfooter |