Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @tuluax/errb (npm) MAL-2026-11993 | Malicious | Not scored | 04 Aug, 2026 | npm @tuluax/errb |
Malicious release: Malicious code in emulative (npm) MAL-2026-11996 | Malicious | Not scored | 04 Aug, 2026 | npm emulative |
Malicious release: Malicious code in webdev-conf (npm) MAL-2026-12005 | Malicious | Not scored | 04 Aug, 2026 | npm webdev-conf |
Malicious release: Malicious code in vitest-preview-pro (npm) GHSA-wx22-xm6j-mgqx, MAL-2026-12004 | Malicious | Not scored | 04 Aug, 2026 | npm vitest-preview-pro |
Malicious release: Malicious code in simple-date-formatter-util-7 (npm) MAL-2026-11998 | Malicious | Not scored | 04 Aug, 2026 | npm simple-date-formatter-util-7 |
Malicious release: Malicious code in @zzzgenesis00/web3-provider-engine (npm) MAL-2026-11994 | Malicious | Not scored | 04 Aug, 2026 | npm @zzzgenesis00/web3-provider-engine |
Malicious release: Malicious code in @zzzgenesis00/etherjs (npm) MAL-2026-11530 | Malicious | Not scored | 04 Aug, 2026 | npm @zzzgenesis00/etherjs |
Malicious release: Malicious code in @zzzgenesis00/crypto-config (npm) MAL-2026-11529 | Malicious | Not scored | 04 Aug, 2026 | npm @zzzgenesis00/crypto-config |
Malicious release: Malicious code in @zzzgenesis00/solana-web3 (npm) MAL-2026-11533 | Malicious | Not scored | 04 Aug, 2026 | npm @zzzgenesis00/solana-web3 |
Malicious release: Malicious code in hubert-application-get-document-preview-am (npm) GHSA-7c6g-rhc6-239f, MAL-2026-11540 | Malicious | Not scored | 04 Aug, 2026 | npm hubert-application-get-document-preview-am |
Malicious release: Malicious code in @zzzgenesis00/solana-wallet-adapter (npm) MAL-2026-11532 | Malicious | Not scored | 04 Aug, 2026 | npm @zzzgenesis00/solana-wallet-adapter |
Malicious release: Malicious code in bigops-backend (npm) MAL-2026-11535 | Malicious | Not scored | 04 Aug, 2026 | npm bigops-backend |
Malicious release: Malicious code in eacq-payform-core (npm) GHSA-gpp6-qxfg-2m7x, MAL-2026-11538 | Malicious | Not scored | 04 Aug, 2026 | npm eacq-payform-core |
Malicious release: Malicious code in twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer (npm) GHSA-337w-cgvw-mpg3, MAL-2026-11550 | Malicious | Not scored | 04 Aug, 2026 | npm twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer |
Malicious release: Malicious code in entropyeasybots (npm) MAL-2026-11539 | Malicious | Not scored | 04 Aug, 2026 | npm entropyeasybots |
Malicious release: Malicious code in @zzzgenesis00/hdkey-wallet (npm) MAL-2026-11531 | Malicious | Not scored | 04 Aug, 2026 | npm @zzzgenesis00/hdkey-wallet |
Malicious release: Malicious code in @zzzgenesis00/xrp-lib (npm) MAL-2026-11534 | Malicious | Not scored | 04 Aug, 2026 | npm @zzzgenesis00/xrp-lib |
Malicious release: Malicious code in simple-date-formatter-util-6 (npm) MAL-2026-11546 | Malicious | Not scored | 04 Aug, 2026 | npm simple-date-formatter-util-6 |
Malicious release: Malicious code in simple-date-formatter-util-10 (npm) MAL-2026-11544 | Malicious | Not scored | 04 Aug, 2026 | npm simple-date-formatter-util-10 |
Malicious release: Malicious code in simple-date-formatter-util-9 (npm) MAL-2026-11547 | Malicious | Not scored | 04 Aug, 2026 | npm simple-date-formatter-util-9 |
Malicious release: Malicious code in discord-vibegrations-api-helpers (npm) MAL-2026-11536 | Malicious | Not scored | 04 Aug, 2026 | npm discord-vibegrations-api-helpers |
Malicious release: Malicious code in tinkoff-terminal-kit-carousel (npm) GHSA-g537-jjq6-mv8m, MAL-2026-11549 | Malicious | Not scored | 04 Aug, 2026 | npm tinkoff-terminal-kit-carousel |
Malicious release: Malicious code in streak-math-abz (npm) MAL-2026-11548 | Malicious | Not scored | 04 Aug, 2026 | npm streak-math-abz |
Malicious release: Malicious code in nagixjs (npm) MAL-2026-11541 | Malicious | Not scored | 04 Aug, 2026 | npm nagixjs |
Malicious release: Malicious code in discord-vibegrations-api-natives (npm) MAL-2026-11537 | Malicious | Not scored | 04 Aug, 2026 | npm discord-vibegrations-api-natives |
Malicious release: Malicious code in simple-date-formatter-new-5 (npm) MAL-2026-11543 | Malicious | Not scored | 04 Aug, 2026 | npm simple-date-formatter-new-5 |
Malicious release: Malicious code in osinthell (npm) MAL-2026-11542 | Malicious | Not scored | 04 Aug, 2026 | npm osinthell |
Malicious release: Malicious code in simple-date-formatter-util-15 (npm) MAL-2026-11545 | Malicious | Not scored | 04 Aug, 2026 | npm simple-date-formatter-util-15 |
Malicious release: Malicious code in @ks-openclaw/kim (npm) MAL-2026-11528 | Malicious | Not scored | 04 Aug, 2026 | npm @ks-openclaw/kim |
Ghost: Session Fixation in Ghost Admin BIT-ghost-2026-70594, CVE-2026-70594, GHSA-7mpp-r37j-x5wh | Medium | 0.2% | 04 Aug, 2026 | npm ghost |
Ghost: Theme Upload Path Traversal BIT-ghost-2026-70593, CVE-2026-70593, GHSA-cjc9-q5gf-327p | Medium | 0.4% | 04 Aug, 2026 | npm ghost |
Ghost: Database Backup Path Traversal BIT-ghost-2026-70592, CVE-2026-70592, GHSA-cj62-hvv2-2q5h | Medium | 0.4% | 04 Aug, 2026 | npm ghost |
Ghost: Server-Side Request Forgery in Image Fetching BIT-ghost-2026-70591, CVE-2026-70591, GHSA-gcvv-72q8-9v76 | Medium | 0.4% | 04 Aug, 2026 | npm ghost |
Ghost: Blind Password Hash Disclosure in Ghost Admin API BIT-ghost-2026-70590, CVE-2026-70590, GHSA-jm22-3w23-5q7w | Medium | 0.3% | 04 Aug, 2026 | npm ghost |
Malicious release: Malicious code in streak-metricsaz (npm) MAL-2026-11527 | Malicious | Not scored | 04 Aug, 2026 | npm streak-metricsaz |
Malicious release: Malicious code in beaver-ui-form (npm) MAL-2026-11522 | Malicious | Not scored | 04 Aug, 2026 | npm beaver-ui-form |
Malicious release: Malicious code in nagix-nodejs (npm) MAL-2026-11526 | Malicious | Not scored | 04 Aug, 2026 | npm nagix-nodejs |
Ghost: Archived Offers can be Redeemed BIT-ghost-2026-70589, CVE-2026-70589, GHSA-4wx2-7gvj-qfq3 | Medium | 0.3% | 04 Aug, 2026 | npm ghost |
Malicious release: Malicious code in nagix-node (npm) MAL-2026-11525 | Malicious | Not scored | 04 Aug, 2026 | npm nagix-node |
Ghost: Cross-Site Scripting in Universal Import BIT-ghost-2026-70588, CVE-2026-70588, GHSA-2gx6-7gx2-wwcf | Medium | 0.4% | 04 Aug, 2026 | npm ghost |
Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service CVE-2026-70478, GHSA-qgvm-j2hm-6m38 | Critical | 0.6% | 04 Aug, 2026 | npm flowise |
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability CVE-2026-70477, GHSA-5xvg-pmgg-3mxr | Critical | 0.8% | 04 Aug, 2026 | npm flowise npm flowise-components |
Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation CVE-2026-70476, GHSA-gmmw-qg98-6j6p | High | 0.5% | 04 Aug, 2026 | npm flowise |
Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials CVE-2026-73603, GHSA-8gj2-2cvc-6xx7 | Medium | 0.3% | 04 Aug, 2026 | npm flowise |
Flowise: Missing Authorization on Execution Update Endpoint CVE-2026-70475, GHSA-fm2f-4339-4p2f | High | 0.5% | 04 Aug, 2026 | npm flowise |
Flowise: Cross-Workspace OAuth2 Credential Metadata Leak CVE-2026-70474, GHSA-wch5-xp77-fxg4 | High | 0.5% | 04 Aug, 2026 | npm flowise |
Malicious release: Malicious code in @umacloud/cli-linux-arm64 (npm) GHSA-cgqh-w28v-v9wg, MAL-2026-11955 | Malicious | Not scored | 04 Aug, 2026 | npm @umacloud/cli-linux-arm64 |
Malicious release: Malicious code in @umacloud/cli-linux-musl-x64 (npm) GHSA-jp94-5mph-fpf8, MAL-2026-11957 | Malicious | Not scored | 04 Aug, 2026 | npm @umacloud/cli-linux-musl-x64 |
Malicious release: Malicious code in @umacloud/cli-linux-x64 (npm) GHSA-p886-3cf4-j5cx, MAL-2026-11958 | Malicious | Not scored | 04 Aug, 2026 | npm @umacloud/cli-linux-x64 |
Malicious release: Malicious code in @umacloud/cli-linux-musl-arm64 (npm) GHSA-ppgw-mhjm-w25f, MAL-2026-11956 | Malicious | Not scored | 04 Aug, 2026 | npm @umacloud/cli-linux-musl-arm64 |