Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @greenlake/mfe-login-url (npm) GHSA-6vg7-x7p2-c749, MAL-2026-18318 | Malicious | Not scored | 6 days ago | npm @greenlake/mfe-login-url |
Malicious release: Malicious code in @greenlake/context-pane (npm) GHSA-5pp4-pvpc-g2xv, MAL-2026-18317 | Malicious | Not scored | 6 days ago | npm @greenlake/context-pane |
Malicious release: Malicious code in @greenlake/common-context (npm) GHSA-mm6p-8j6f-9fch, MAL-2026-18282 | Malicious | Not scored | 6 days ago | npm @greenlake/common-context |
Malicious release: Malicious code in @greenlake/auth (npm) GHSA-h6v3-2957-9j3g, MAL-2026-18316 | Malicious | Not scored | 6 days ago | npm @greenlake/auth |
odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values GHSA-2rqm-h6hv-g79v | Medium | Not scored | 6 days ago | npm odf-kit |
Electron: Mitigation for compromised eMudhra intermediate certificates CVE-2026-115570, GHSA-jr5w-w6x2-84p9 | High | 0.4% | 6 days ago | npm electron |
Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root CVE-2026-115569, GHSA-jfwm-3p3c-6hx5 | Low | 0.2% | 6 days ago | crates.io fallow-cli crates.io fallow-core npm @fallow-cli/fallow-node npm fallow |
@justice8096/sagemath-mcp-server: executes arbitrary code via the escapeShellString and sanitizeCode functions CVE-2026-106763, GHSA-2vq3-mpmf-9xgr | High | Not scored | 6 days ago | npm @justice8096/sagemath-mcp-server |
@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function CVE-2026-106764, GHSA-jwc4-922r-f2rw | High | Not scored | 6 days ago | npm @rog0x/mcp-git-tools |
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes CVE-2026-115478, GHSA-r3g7-r4hr-m258 | High | 0.3% | 6 days ago | npm obsidian-tc |
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP CVE-2026-115477, GHSA-737x-cwfr-5vvc | High | 0.4% | 6 days ago | npm obsidian-tc |
Malicious release: Malicious code in skillward (npm) GHSA-9wgc-5pgr-25p3, MAL-2026-18220 | Malicious | Not scored | 6 days ago | npm skillward |
i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf) CVE-2026-115730, GHSA-9jhj-wvmw-cfx5 | Low | 0.2% | 6 days ago | npm i18next-http-backend |
Malicious release: Malicious code in @grabcad/user-license (npm) GHSA-6w2v-744r-g5j5, MAL-2026-18217 | Malicious | Not scored | 6 days ago | npm @grabcad/user-license |
Malicious release: Malicious code in @grabcad/grabcad-shop-shared (npm) GHSA-cc6r-jh8f-6c76, MAL-2026-18215 | Malicious | Not scored | 6 days ago | npm @grabcad/grabcad-shop-shared |
Malicious release: Malicious code in @grabcad/company-server-shared (npm) GHSA-fpfw-7wv8-x4mh, MAL-2026-18214 | Malicious | Not scored | 6 days ago | npm @grabcad/company-server-shared |
Malicious release: Malicious code in @grabcad/preferences-client (npm) GHSA-mfh5-wvcp-2v6v, MAL-2026-18216 | Malicious | Not scored | 6 days ago | npm @grabcad/preferences-client |
Malicious release: Malicious code in @blueskydataplatform/shared-ui (npm) GHSA-6x9m-j5h8-w3vg, MAL-2026-18212 | Malicious | Not scored | 6 days ago | npm @blueskydataplatform/shared-ui |
Malicious release: Malicious code in @cecm-web-sdk/core (npm) GHSA-88qx-q5v7-q7x5, MAL-2026-18213 | Malicious | Not scored | 6 days ago | npm @cecm-web-sdk/core |
Malicious release: Malicious code in @ecg-internal/js-react-i18n (npm) GHSA-5x9g-7rj9-4xc8, MAL-2026-18209 | Malicious | Not scored | 6 days ago | npm @ecg-internal/js-react-i18n |
Malicious release: Malicious code in @ecg-internal/aurora-js-formatters (npm) GHSA-9976-3w38-mrmj, MAL-2026-18207 | Malicious | Not scored | 6 days ago | npm @ecg-internal/aurora-js-formatters |
Malicious release: Malicious code in @ecg-internal/media-util-js-lib (npm) GHSA-hcw5-m6mm-qg3q, MAL-2026-18210 | Malicious | Not scored | 6 days ago | npm @ecg-internal/media-util-js-lib |
Malicious release: Malicious code in @ecg-internal/favourites-ui (npm) GHSA-g8hh-8pxg-jr3x, MAL-2026-18208 | Malicious | Not scored | 6 days ago | npm @ecg-internal/favourites-ui |
Malicious release: Malicious code in @ecg-internal/adobe-dmp-js (npm) GHSA-vcj4-3hxm-4rf3, MAL-2026-18206 | Malicious | Not scored | 6 days ago | npm @ecg-internal/adobe-dmp-js |
Malicious release: Malicious code in @ecg-internal/reviews-dialog-ui (npm) GHSA-r47j-grcr-p9h9, MAL-2026-18211 | Malicious | Not scored | 6 days ago | npm @ecg-internal/reviews-dialog-ui |
Malicious release: Malicious code in @tekmidian/pai (npm) GHSA-xvgg-qjjh-gq34, MAL-2026-18205 | Malicious | Not scored | 6 days ago | npm @tekmidian/pai |