Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence GHSA-c33x-vcv4-vg3g | Low | Not scored | 4 hours ago | crates.io cedar-policy npm @cedar-policy/cedar-wasm |
Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist BIT-parse-2026-61448, CVE-2026-61448, GHSA-r899-h629-j84r | Low | Not scored | 4 hours ago | npm parse-server |
i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string CVE-2026-118258, GHSA-3cmx-xjww-583x | Low | Not scored | 1 day ago | npm i18next-http-backend |
Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list CVE-2026-118256, GHSA-8rc2-428q-7ww3 | Low | Not scored | 1 day ago | npm @intlify/core npm @intlify/core-base npm @intlify/vue-i18n-core npm petite-vue-i18n +1 more |
CKEditor: Cross-site scripting (XSS) in the engine package CVE-2026-116687, GHSA-v6mg-96c6-gmpq | Low | 0.3% | 2 days ago | npm @ckeditor/ckeditor5-engine npm ckeditor5 |
systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net CVE-2026-116673, GHSA-4vjg-vx72-qq4g | Low | 0.1% | 2 days ago | npm systeminformation |
dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS CVE-2026-46350, GHSA-px68-xx5g-48q5 | Low | Not scored | 2 days ago | npm dcmjs |
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body CVE-2026-115754, CVE-2026-115897, GHSA-m5mm-p8h7-m29v | Low | 0.3% | 5 days ago | npm serialize-javascript |
Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root GHSA-h4fr-cmh5-qr62 | Low | Not scored | 5 days ago | crates.io fallow-cli crates.io fallow-config crates.io fallow-core npm @fallow-cli/fallow-node +1 more |
Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root CVE-2026-115569, GHSA-jfwm-3p3c-6hx5 | Low | 0.2% | 6 days ago | crates.io fallow-cli crates.io fallow-core npm @fallow-cli/fallow-node npm fallow |
i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf) CVE-2026-115730, GHSA-9jhj-wvmw-cfx5 | Low | 0.2% | 6 days ago | npm i18next-http-backend |