Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set CVE-2026-59880, GHSA-xvcm-6775-5m9r | High | 0.7% | 08 Jul, 2026 | npm immutable |
protobufjs: Denial of Service via infinite loop in .proto option parsing CVE-2026-59877, GHSA-j3f2-48v5-ccww | High | 0.4% | 08 Jul, 2026 | npm protobufjs |
node-tar: Negative tar entry size causes infinite loop in archive replace CVE-2026-59874, GHSA-8x88-c5mf-7j5w | High | 0.4% | 08 Jul, 2026 | npm tar |
node-tar: Process crash via PAX numeric path type confusion CVE-2026-59871, GHSA-w8wr-v893-vjvp | High | 0.6% | 08 Jul, 2026 | npm tar |
js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA CVE-2026-59870, GHSA-724g-mxrg-4qvm | High | 0.7% | 08 Jul, 2026 | npm js-yaml |
js-yaml: YAML merge-key chains can force quadratic CPU consumption CVE-2026-59869, GHSA-52cp-r559-cp3m | High | 0.6% | 08 Jul, 2026 | npm js-yaml |
js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml CVE-2026-59868, GHSA-g796-fgmg-93mv | High | 0.6% | 08 Jul, 2026 | npm js-yaml |
Socket.IO: Engine.IO Polling Transport Connection Exhaustion CVE-2026-59725, GHSA-r635-g3xr-vw7x | High | 0.6% | 08 Jul, 2026 | npm engine.io |
Socket.IO: Engine.IO WebTransport SID DoS CVE-2026-59724, GHSA-gr94-w7qr-f4j3 | High | 0.6% | 08 Jul, 2026 | npm engine.io |
@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers CVE-2026-67331, GHSA-j8v8-g9cx-5qf4 | High | 0.4% | 07 Jul, 2026 | npm @better-auth/scim |
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive CVE-2026-53518, GHSA-7w99-5wm4-3g79 | High | 0.4% | 07 Jul, 2026 | npm @better-auth/oauth-provider npm better-auth |
Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption CVE-2026-53517, GHSA-392p-2q2v-4372 | High | 0.4% | 07 Jul, 2026 | npm @better-auth/oauth-provider npm better-auth |
Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp CVE-2026-67333, GHSA-86j7-9j95-vpqj | High | 0.3% | 07 Jul, 2026 | npm better-auth |
Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email CVE-2026-53516, GHSA-g38m-r43w-p2q7 | High | 0.3% | 07 Jul, 2026 | npm better-auth |
Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin CVE-2026-53514, GHSA-fmh4-wcc4-5jm3 | High | 0.2% | 07 Jul, 2026 | npm better-auth |
9router: Login brute-force protection bypass via spoofed X-Forwarded-For header CVE-2026-55501, GHSA-7cfm-pqrj-xgq7 | High | 0.4% | 06 Jul, 2026 | npm 9router |
9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING CVE-2026-49353, GHSA-6g2f-w7g3-77vf | High | 0.3% | 02 Jul, 2026 | npm 9router |
@asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write GHSA-322x-v876-g883 | High | Not scored | 02 Jul, 2026 | npm @asymmetric-effort/nogginlessdom |
jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion CVE-2026-52746, GHSA-86vw-mfpg-wwv9 | High | 0.7% | 02 Jul, 2026 | npm jsonata |
Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR) GHSA-f9ff-5x35-7gfw | High | Not scored | 02 Jul, 2026 | npm @grackle-ai/auth npm @grackle-ai/mcp npm @grackle-ai/plugin-core |
electerm has Command Injection in File System Operations (rmrf, mv, cp) CVE-2026-49255, GHSA-v5ff-xmfp-p245 | High | 0.8% | 02 Jul, 2026 | npm electerm |
electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling CVE-2026-49253, GHSA-38j7-23hf-9mhc | High | 0.4% | 02 Jul, 2026 | npm electerm |
@conform-to/dom parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields CVE-2026-49250, GHSA-525m-7f82-2mf7 | High | 0.5% | 02 Jul, 2026 | npm @conform-to/dom |
Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true) GHSA-vv65-f55v-xm6g | High | Not scored | 02 Jul, 2026 | npm @grackle-ai/powerline npm @grackle-ai/runtime-sdk |
@asymmetric-effort/specifyjs: URL parse failure silently allows request CVE-2026-50288, GHSA-8882-frvv-92w4 | High | 0.5% | 02 Jul, 2026 | npm @asymmetric-effort/specifyjs |
Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token CVE-2026-50143, GHSA-6gr2-qh89-hxwm | High | 0.5% | 01 Jul, 2026 | npm @apify/actors-mcp-server |
Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier CVE-2026-58263, GHSA-rxcw-mc6f-6hr3 | High | 0.2% | 01 Jul, 2026 | npm jodit |
sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced CVE-2026-48815, GHSA-52v5-jr5w-gjxr | High | 0.2% | 01 Jul, 2026 | npm sigstore |
aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling CVE-2026-13760, GHSA-vcrf-j523-4mrf | High | 1.2% | 01 Jul, 2026 | npm aws-cdk-lib |
repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection CVE-2026-49987, GHSA-9mm9-rqhj-j5mx | High | 0.7% | 01 Jul, 2026 | npm repomix |
wetty vulnerable to DOM XSS via file-download filename CVE-2026-49864, GHSA-p26j-h7wj-r568 | High | 0.4% | 01 Jul, 2026 | npm wetty |
auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback CVE-2026-49857, GHSA-pvrj-8cg3-j5f8 | High | 0.5% | 01 Jul, 2026 | npm auth-fetch-mcp |
electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime` CVE-2026-54673, GHSA-p2f4-r6v6-j797 | High | 0.4% | 30 Jun, 2026 | npm builder-util-runtime |
electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib` CVE-2026-54672, GHSA-7g7r-gx96-252g | High | 0.2% | 30 Jun, 2026 | npm app-builder-lib |
@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754 CVE-2026-48795, GHSA-qcm7-3vpr-hj5h | High | 0.5% | 30 Jun, 2026 | npm @adonisjs/bodyparser |
@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation CVE-2026-49473, GHSA-g4w6-vmgf-xqvx | High | 0.5% | 30 Jun, 2026 | npm @cedar-policy/authorization-for-expressjs |
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups CVE-2026-13149, GHSA-3jxr-9vmj-r5cp | High | 0.4% | 30 Jun, 2026 | npm brace-expansion |
Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution CVE-2026-55607, GHSA-7835-87q9-rgvv | High | 0.7% | 29 Jun, 2026 | npm @anthropic-ai/claude-code |
fast-uri vulnerable to host confusion via failed IDN canonicalization CVE-2026-13676, GHSA-4c8g-83qw-93j6 | High | 0.7% | 29 Jun, 2026 | npm fast-uri |
pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config CVE-2026-59195, GHSA-qrv3-253h-g69c | High | 0.4% | 27 Jun, 2026 | npm pnpm |
pnpm: `patch-remove` could delete project-selected files outside the patches directory CVE-2026-59194, GHSA-72r4-9c5j-mj57 | High | 0.4% | 27 Jun, 2026 | npm pnpm |
pnpm: Hoisted install imports lockfile alias outside node_modules CVE-2026-59196, GHSA-fr4h-3cph-29xv | High | 0.4% | 27 Jun, 2026 | npm pnpm |
better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server GHSA-3p34-w4f6-5xh2 | High | Not scored | 26 Jun, 2026 | npm better-helperjs |
Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key GHSA-fhp4-pr5j-46m5 | High | Not scored | 26 Jun, 2026 | npm muhammara |
LinkifyIt#match scan loop has quadratic algorithmic complexity CVE-2026-48801, GHSA-22p9-wv53-3rq4 | High | 0.4% | 26 Jun, 2026 | npm linkify-it |
extract-zip unvalidated symlink path traversal CVE-2026-56876, GHSA-jmr9-qjv8-65gv | High | 0.5% | 26 Jun, 2026 | npm extract-zip |
pnpm: `stage download` writes outside its destination directory via manifest name/version traversal CVE-2026-55700, GHSA-v23m-ccfg-pq9h | High | 0.4% | 25 Jun, 2026 | npm pnpm |
pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes CVE-2026-55698, GHSA-w466-c33r-3gjp | High | 0.3% | 25 Jun, 2026 | npm pnpm |
pnpm: Repository-controlled configDependencies can select a pacquet native install engine CVE-2026-55697, GHSA-gj8w-mvpf-x27x | High | 0.2% | 25 Jun, 2026 | npm pnpm |
pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle CVE-2026-55487, GHSA-5wx6-mg75-v57r | High | 0.2% | 25 Jun, 2026 | npm pnpm |