Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in xmd-baileys (npm) GHSA-m3qf-j9rf-pqrh, MAL-2026-17892 | Malicious | Not scored | 14 days ago | npm xmd-baileys |
Malicious release: Malicious code in @developmentyora/baileyss (npm) GHSA-v8xh-mr86-2fpq, MAL-2026-17439 | Malicious | Not scored | 14 days ago | npm @developmentyora/baileyss |
Malicious release: Malicious code in @developmentyora/yorakids (npm) GHSA-xgr5-84p3-qqmf, MAL-2026-17890 | Malicious | Not scored | 14 days ago | npm @developmentyora/yorakids |
Malicious release: Malicious code in asistenyorstore (npm) GHSA-qgh5-36wr-3vvw, MAL-2026-17891 | Malicious | Not scored | 14 days ago | npm asistenyorstore |
Malicious release: Malicious code in @celestial-community/baileys (npm) GHSA-5ghv-64gv-gv29, MAL-2026-17438 | Malicious | Not scored | 14 days ago | npm @celestial-community/baileys |
Malicious release: Malicious code in @apexacc/audit (npm) MAL-2026-17923 | Malicious | Not scored | 14 days ago | npm @apexacc/audit |
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor CVE-2026-87029, GHSA-55wc-3pg8-jfw6 | High | 0.3% | 14 days ago | npm undici |
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation CVE-2026-87018, GHSA-qrxm-fqhp-jwvm | High | 0.2% | 14 days ago | npm undici |
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering CVE-2026-109932, GHSA-9fm3-97px-rjf6 | High | 0.3% | 14 days ago | npm undici |
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser CVE-2026-109924, GHSA-4qv8-2p9j-2685 | High | 0.3% | 14 days ago | npm undici |
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings CVE-2026-109869, GHSA-xjj6-f33q-929c | High | 0.3% | 14 days ago | npm undici |
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens CVE-2026-109841, GHSA-f72v-6w45-q472 | High | 0.3% | 14 days ago | npm undici |
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects CVE-2026-109829, GHSA-4w7w-5xrc-9h26 | Critical | 0.1% | 14 days ago | npm undici |
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent CVE-2026-109383, GHSA-2m5v-pch6-74hx | Critical | 0.2% | 14 days ago | npm undici |
AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity CVE-2026-104150, GHSA-524c-h47v-m3h8 | High | 0.4% | 14 days ago | npm @adonisjs/http-server |
Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes CVE-2026-102527, GHSA-2x6f-rp82-ppmj | Medium | 0.2% | 14 days ago | npm nuxt-og-image |
OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths CVE-2026-100409, GHSA-2vc4-c4r6-p6v6 | High | 0.3% | 14 days ago | npm @opennextjs/cloudflare |
Malicious release: Malicious code in buyerdashboard (npm) MAL-2026-17893 | Malicious | Not scored | 14 days ago | npm buyerdashboard |
Malicious release: Malicious code in xapi-lib (npm) MAL-2026-17896 | Malicious | Not scored | 14 days ago | npm xapi-lib |
Malicious release: Malicious code in web-pixels-manager (npm) MAL-2026-17895 | Malicious | Not scored | 14 days ago | npm web-pixels-manager |
Malicious release: Malicious code in idlive-face-capture-web-development (npm) MAL-2026-17894 | Malicious | Not scored | 14 days ago | npm idlive-face-capture-web-development |
undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake CVE-2026-109855, GHSA-qq8j-7v2v-3rwp | High | 0.3% | 15 days ago | npm undici |
Malicious release: Malicious code in tailwindcss-uniform (npm) GHSA-r7f7-6833-rxh9, MAL-2026-17882 | Malicious | Not scored | 15 days ago | npm tailwindcss-uniform |
ApostropheCMS: Page REST API authorization bypass CVE-2026-110904, CVE-2026-113670, GHSA-2j32-q6rx-h844 | Medium | 0.3% | 15 days ago | npm apostrophe |
Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service CVE-2026-110872, GHSA-4g23-2xm8-66gc | High | 0.4% | 15 days ago | npm nodemailer |
Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing CVE-2026-110871, GHSA-39m8-27wv-hr27 | High | 0.4% | 15 days ago | npm nodemailer |
Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped CVE-2026-110870, GHSA-g73g-hqqh-jr95 | Medium | 0.3% | 15 days ago | npm nodemailer |
Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service CVE-2026-110869, GHSA-4ffr-jq9g-5ffx | High | 0.4% | 15 days ago | npm nodemailer |
better-auth: OAuth Proxy lets an attacker sign in as another user CVE-2026-110864, GHSA-r4xp-prcw-77qf | Critical | 0.3% | 15 days ago | npm better-auth |
@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL CVE-2026-110861, GHSA-44jh-23m7-hpcf | Medium | 0.2% | 15 days ago | npm @better-auth/drizzle-adapter npm @better-auth/kysely-adapter npm better-auth |
qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS) CVE-2026-110816, GHSA-6pq8-jhm2-2vcw | Medium | 0.4% | 15 days ago | npm qs |
Appium: Symlink based Zip Slip in @appium/support ZIP extraction CVE-2026-103975, GHSA-qfxx-c367-67f8 | Medium | 0.6% | 15 days ago | npm @appium/support |
Malicious release: Malicious code in @xxxfnbs21/hello-demo (npm) GHSA-hf57-6wg3-343x, MAL-2026-17876 | Malicious | Not scored | 15 days ago | npm @xxxfnbs21/hello-demo |
nodejs-whisper allows OS command injection through crafted audio file paths CVE-2026-110644, GHSA-2f48-3555-fpx6 | Critical | 2.7% | 15 days ago | npm nodejs-whisper |
git-diff: OS command injection vulnerability via crafted strings to the gitDiff API CVE-2026-110634, GHSA-6wfj-92cw-88vg | Critical | 2.3% | 15 days ago | npm git-diff |
Malicious release: Malicious code in @flexmr/utils (npm) GHSA-hpc9-fxqh-hhf8, MAL-2026-17888 | Malicious | Not scored | 16 days ago | npm @flexmr/utils |
Malicious release: Malicious code in @kre64/hello-npm-test (npm) GHSA-c43r-xf4h-m548, MAL-2026-17868 | Malicious | Not scored | 16 days ago | npm @kre64/hello-npm-test |
Malicious release: Malicious code in @flexmr/ui (npm) MAL-2026-17879 | Malicious | Not scored | 16 days ago | npm @flexmr/ui |
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning CVE-2026-86063, GHSA-pq7j-f95f-qfcv | High | 0.2% | 16 days ago | npm @anthropic-ai/claude-code |
Qwik: Crashing any Qwik Server via Resource thenable CVE-2026-84994, GHSA-x586-xvc8-g7q6 | High | 0.5% | 16 days ago | npm @builder.io/qwik npm @qwik.dev/core |
Malicious release: Malicious code in opencode2-darwin-arm64 (npm) GHSA-36mq-frp2-jc97, MAL-2026-17853 | Malicious | Not scored | 16 days ago | npm opencode2-darwin-arm64 |
Malicious release: Malicious code in opencode2-linux-x64 (npm) GHSA-3jr5-3qvm-r54h, MAL-2026-17857 | Malicious | Not scored | 16 days ago | npm opencode2-linux-x64 |
Malicious release: Malicious code in opencode2-windows-x64 (npm) GHSA-6x5j-r784-fx6j, MAL-2026-17860 | Malicious | Not scored | 16 days ago | npm opencode2-windows-x64 |
Malicious release: Malicious code in opencode2 (npm) GHSA-8w65-j2wh-mqv7, MAL-2026-17852 | Malicious | Not scored | 16 days ago | npm opencode2 |
Malicious release: Malicious code in opencode2-linux-arm64-musl (npm) GHSA-cm8m-24p9-hh65, MAL-2026-17856 | Malicious | Not scored | 16 days ago | npm opencode2-linux-arm64-musl |
Malicious release: Malicious code in opencode2-darwin-x64 (npm) GHSA-pmv2-r2q9-rmg9, MAL-2026-17854 | Malicious | Not scored | 16 days ago | npm opencode2-darwin-x64 |
Malicious release: Malicious code in opencode2-linux-x64-musl (npm) GHSA-qx7m-vw4p-xv3j, MAL-2026-17858 | Malicious | Not scored | 16 days ago | npm opencode2-linux-x64-musl |
Malicious release: Malicious code in opencode2-windows-arm64 (npm) GHSA-xr5m-85hf-27r5, MAL-2026-17859 | Malicious | Not scored | 16 days ago | npm opencode2-windows-arm64 |
Malicious release: Malicious code in opencode2-linux-arm64 (npm) GHSA-xwcq-r6hw-mc5p, MAL-2026-17855 | Malicious | Not scored | 16 days ago | npm opencode2-linux-arm64 |
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses CVE-2026-102989, GHSA-qx66-fv34-fjm8 | Critical | 0.5% | 16 days ago | npm @tanstack/react-start npm @tanstack/solid-start npm @tanstack/start-server-core npm @tanstack/vue-start |