Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Vite: `server.fs.deny` bypassed with queries CVE-2026-118662, GHSA-8g5g-mxqh-grgj | Medium | Not scored | 4 hours ago | npm vite |
Waline login accepts a non-string email as a match-all MongoDB query CVE-2026-55369, GHSA-jf75-q64q-g65r | Medium | Not scored | 1 day ago | npm @waline/vercel |
Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies CVE-2026-118661, GHSA-5fpq-26gf-qwcr | Medium | Not scored | 1 day ago | npm happy-dom |
GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller CVE-2026-118666, GHSA-mp66-8ww2-pcwm | Medium | Not scored | 1 day ago | npm @graphql-tools/executor-legacy-ws |
@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths CVE-2026-118663, GHSA-rmxm-3fg6-px4f | Medium | Not scored | 1 day ago | npm @hono/node-server |
Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. CVE-2026-118247, GHSA-c75x-9x9h-28rm | Medium | Not scored | 1 day ago | npm @highcharts/dashboards npm @highcharts/grid-pro |
Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` CVE-2026-118243, GHSA-jqgh-w3cc-7jqw | Medium | Not scored | 1 day ago | npm @highcharts/dashboards |
systeminformation has prototype pollution in `networkStats()` via the interface name CVE-2026-116674, GHSA-7648-jmwf-vw7j | Medium | 0.3% | 2 days ago | npm systeminformation |
Seroval: Code injection through a typed array's own constructor property CVE-2026-116583, GHSA-f86p-h4j2-7qgj | Medium | 0.3% | 3 days ago | npm seroval |
Seroval: Script injection through RegExp sources in serialized output CVE-2026-116582, GHSA-9wx9-5pv9-3349 | Medium | 0.2% | 3 days ago | npm seroval |
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope) CVE-2026-116575, GHSA-5324-3w58-qpp2 | Medium | 0.1% | 3 days ago | PyPI mem0ai npm mem0ai |
Backstage catalog rules can be bypassed for URL locations using encoded path segments CVE-2026-115923, GHSA-w658-mh9p-ww8f | Medium | 0.3% | 3 days ago | npm @backstage/plugin-catalog-backend |
Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient GHSA-8c8m-p3m8-cjg8 | Medium | Not scored | 5 days ago | npm nodemailer |
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient GHSA-m943-m63m-w62w | Medium | Not scored | 5 days ago | npm nodemailer |
Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name GHSA-85x2-q946-cp5h | Medium | Not scored | 5 days ago | npm nodemailer |
odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values GHSA-2rqm-h6hv-g79v | Medium | Not scored | 6 days ago | npm odf-kit |