Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence GHSA-c33x-vcv4-vg3g | Low | Not scored | 1 day ago | crates.io cedar-policy npm @cedar-policy/cedar-wasm |
i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string CVE-2026-118258, GHSA-3cmx-xjww-583x | Low | 0.3% | 2 days ago | npm i18next-http-backend |
Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list CVE-2026-118256, GHSA-8rc2-428q-7ww3 | Low | 0.5% | 2 days ago | npm @intlify/core npm @intlify/core-base npm @intlify/vue-i18n-core npm petite-vue-i18n +1 more |
CKEditor: Cross-site scripting (XSS) in the engine package CVE-2026-116687, GHSA-v6mg-96c6-gmpq | Low | 0.3% | 3 days ago | npm @ckeditor/ckeditor5-engine npm ckeditor5 |
systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net CVE-2026-116673, GHSA-4vjg-vx72-qq4g | Low | 0.1% | 3 days ago | npm systeminformation |
dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS CVE-2026-46350, GHSA-px68-xx5g-48q5 | Low | Not scored | 3 days ago | npm dcmjs |
Tornado: Open redirect in RedirectHandler via protocol-relative URLs CVE-2026-116578, GHSA-pw9p-v7r6-gx4p | Low | 0.5% | 4 days ago | PyPI tornado |
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database CVE-2026-112913, GHSA-9vhv-jxww-xfm5 | Low | Not scored | 6 days ago | PyPI filelock |
filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break CVE-2026-112907, GHSA-567q-5qvw-pf92 | Low | Not scored | 6 days ago | PyPI filelock |
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body CVE-2026-115754, CVE-2026-115897, GHSA-m5mm-p8h7-m29v | Low | 0.3% | 6 days ago | npm serialize-javascript |