Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @umacloud/cli-linux-musl-arm64 (npm) GHSA-ppgw-mhjm-w25f, MAL-2026-11956 | Malicious | Not scored | 04 Aug, 2026 | npm @umacloud/cli-linux-musl-arm64 |
Malicious release: Malicious code in @umacloud/cli-darwin-x64 (npm) GHSA-qqc5-qqrh-3hx8, MAL-2026-11954 | Malicious | Not scored | 04 Aug, 2026 | npm @umacloud/cli-darwin-x64 |
Malicious release: Malicious code in @umacloud/cli-darwin-arm64 (npm) GHSA-qrjp-2vx3-hwg4, MAL-2026-11953 | Malicious | Not scored | 04 Aug, 2026 | npm @umacloud/cli-darwin-arm64 |
Malicious release: Malicious code in umadev (npm) GHSA-rxr8-mfg7-xm79, MAL-2026-11989 | Malicious | Not scored | 04 Aug, 2026 | npm umadev |
Malicious release: Malicious code in @umacloud/cli-win32-x64 (npm) GHSA-vgf8-c62c-jjxr, MAL-2026-11959 | Malicious | Not scored | 04 Aug, 2026 | npm @umacloud/cli-win32-x64 |
Malicious release: Malicious code in @umacloud/knowledge (npm) GHSA-vpvg-254v-wp7h, MAL-2026-11960 | Malicious | Not scored | 04 Aug, 2026 | npm @umacloud/knowledge |
Malicious release: Malicious code in @adminide-stack/clock-tik-browser (npm) MAL-2026-11551 | Malicious | Not scored | 04 Aug, 2026 | npm @adminide-stack/clock-tik-browser |
Malicious release: Malicious code in @deliveroo/determinator (npm) MAL-2026-11562 | Malicious | Not scored | 04 Aug, 2026 | npm @deliveroo/determinator |
Malicious release: Malicious code in @deliveroo/reevent (npm) MAL-2026-11563 | Malicious | Not scored | 04 Aug, 2026 | npm @deliveroo/reevent |
Malicious release: Malicious code in @qlik/dts-bundler (npm) MAL-2026-11788 | Malicious | Not scored | 04 Aug, 2026 | npm @qlik/dts-bundler |
Malicious release: Malicious code in @qlik/embed-svelte (npm) MAL-2026-11791 | Malicious | Not scored | 04 Aug, 2026 | npm @qlik/embed-svelte |
Flowise: Incomplete Credential Redaction Exposes Secrets via API CVE-2026-73604, GHSA-rwrp-9823-p2xq | High | 0.4% | 04 Aug, 2026 | npm flowise |
Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history CVE-2026-70473, GHSA-fr6g-7cq8-fg82 | High | 0.5% | 04 Aug, 2026 | npm flowise |
Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store CVE-2026-70472, GHSA-chm3-vqcf-52rx | High | 0.5% | 04 Aug, 2026 | npm flowise |
Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation CVE-2026-69264, GHSA-4j8x-x6v7-w9rq | Critical | 1.1% | 04 Aug, 2026 | npm flowise npm flowise-components |
Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys GHSA-88pr-878c-24wf | High | Not scored | 04 Aug, 2026 | npm flowise npm flowise-components |
Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure CVE-2026-70471, GHSA-8r8h-6vcc-xhrv | High | 0.4% | 04 Aug, 2026 | npm flowise |
Malicious release: Malicious code in @jsimplify/errno (npm) GHSA-vgg6-7x38-g434, MAL-2026-12006 | Malicious | Not scored | 04 Aug, 2026 | npm @jsimplify/errno |
Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE CVE-2026-70470, GHSA-52fh-8v99-63c2 | Critical | 1.0% | 04 Aug, 2026 | npm flowise npm flowise-components |
Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) CVE-2026-69263, GHSA-xc48-889x-5qmw | High | 0.7% | 04 Aug, 2026 | npm flowise npm flowise-components |
Malicious release: Malicious code in cors-version (npm) GHSA-2hwp-7m6r-hgjg, MAL-2026-12026 | Malicious | Not scored | 04 Aug, 2026 | npm cors-version |
Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type CVE-2026-69262, GHSA-p5w8-m249-4r4v | High | 0.5% | 04 Aug, 2026 | npm flowise |
Malicious release: Malicious code in tailwind-anime (npm) GHSA-58f3-m5c8-hcrv, MAL-2026-12027 | Malicious | Not scored | 04 Aug, 2026 | npm tailwind-anime |
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions CVE-2026-10032, GHSA-72qq-p3r5-f7wq | Critical | 0.1% | 04 Aug, 2026 | npm @a2ui/web_core |
Malicious release: Malicious code in server-hemera-mongo (npm) GHSA-rrhh-mxmx-x7xf, MAL-2026-11986 | Malicious | Not scored | 04 Aug, 2026 | npm server-hemera-mongo |
Flowise RCE via SQLite Record Manager Node CVE-2026-69259, GHSA-x3hf-7cj6-3r4m | Critical | 0.8% | 04 Aug, 2026 | npm flowise npm flowise-components |
Malicious release: Malicious code in @adminide-stack/yantra-mobile (npm) GHSA-2698-4w7r-9qqv, MAL-2026-11552 | Malicious | Not scored | 04 Aug, 2026 | npm @adminide-stack/yantra-mobile |
Malicious release: Malicious code in workbench-browser-server (npm) GHSA-63m5-c696-rwrc, MAL-2026-11992 | Malicious | Not scored | 04 Aug, 2026 | npm workbench-browser-server |
Malicious release: Malicious code in @workbench-stack/core (npm) GHSA-qc5f-j5q7-57hf, MAL-2026-11961 | Malicious | Not scored | 04 Aug, 2026 | npm @workbench-stack/core |
Malicious release: Malicious code in @qlik/nebula-table-utils (npm) GHSA-qgqm-m8rp-5q25, MAL-2026-11798 | Malicious | Not scored | 04 Aug, 2026 | npm @qlik/nebula-table-utils |
Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API CVE-2026-69258, GHSA-6vh2-wg4h-4vwj | High | 0.7% | 04 Aug, 2026 | npm flowise |
Malicious release: Malicious code in @nebula.js/sn-line-chart (npm) GHSA-jvxf-3873-cvcw, MAL-2026-11575 | Malicious | Not scored | 04 Aug, 2026 | npm @nebula.js/sn-line-chart |
Malicious release: Malicious code in @nebula.js/sn-layout-container (npm) GHSA-cqf2-r88m-hcq2, MAL-2026-11574 | Malicious | Not scored | 04 Aug, 2026 | npm @nebula.js/sn-layout-container |
Malicious release: Malicious code in @qlik/sprout-icons (npm) GHSA-4hhj-rpx3-pw9f, MAL-2026-11807 | Malicious | Not scored | 04 Aug, 2026 | npm @qlik/sprout-icons |
Malicious release: Malicious code in http-metrics-middleware (npm) GHSA-w86p-g27r-2m6q, MAL-2026-11975 | Malicious | Not scored | 04 Aug, 2026 | npm http-metrics-middleware |
Malicious release: Malicious code in @qlik/sprout-design-docs (npm) GHSA-m3hw-7p37-3vmh, MAL-2026-11805 | Malicious | Not scored | 04 Aug, 2026 | npm @qlik/sprout-design-docs |
Malicious release: Malicious code in @qlik/prettier-config (npm) GHSA-2259-j57x-rf45, MAL-2026-11801 | Malicious | Not scored | 04 Aug, 2026 | npm @qlik/prettier-config |
Malicious release: Malicious code in @qlik/browserslist-config (npm) GHSA-x47v-2r4m-2q34, MAL-2026-11784 | Malicious | Not scored | 04 Aug, 2026 | npm @qlik/browserslist-config |
Malicious release: Malicious code in @qlik/api (npm) GHSA-qcx7-ppp7-p6r4, MAL-2026-11783 | Malicious | Not scored | 04 Aug, 2026 | npm @qlik/api |
Malicious release: Malicious code in qlik-modifiers (npm) GHSA-8q52-v99f-4q28, MAL-2026-11983 | Malicious | Not scored | 04 Aug, 2026 | npm qlik-modifiers |
Malicious release: Malicious code in @qlik/eslint-config-react (npm) GHSA-p827-gwm8-29x5, MAL-2026-11795 | Malicious | Not scored | 04 Aug, 2026 | npm @qlik/eslint-config-react |
Malicious release: Malicious code in qlik-object-conversion (npm) GHSA-4hq4-8pfx-pmvw, MAL-2026-11984 | Malicious | Not scored | 04 Aug, 2026 | npm qlik-object-conversion |
Malicious release: Malicious code in @qlik/eslint-config-base (npm) GHSA-mc8j-vx8m-ww53, MAL-2026-11794 | Malicious | Not scored | 04 Aug, 2026 | npm @qlik/eslint-config-base |
Malicious release: Malicious code in @nebula.js/sn-listbox (npm) GHSA-rfr7-p954-4m4q, MAL-2026-11576 | Malicious | Not scored | 04 Aug, 2026 | npm @nebula.js/sn-listbox |
Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses CVE-2026-69257, GHSA-c6xh-wv4j-ppv5 | High | 0.4% | 04 Aug, 2026 | npm flowise |
Malicious release: Malicious code in @qlik/carbon-core (npm) GHSA-5p47-xqh5-mx62, MAL-2026-11785 | Malicious | Not scored | 04 Aug, 2026 | npm @qlik/carbon-core |
Malicious release: Malicious code in @qlik/embed-runtime (npm) GHSA-6f9f-wgfq-wg6c, MAL-2026-11790 | Malicious | Not scored | 04 Aug, 2026 | npm @qlik/embed-runtime |
Malicious release: Malicious code in qlik-chart-modules (npm) GHSA-6pc2-3g2j-m6wg, MAL-2026-11982 | Malicious | Not scored | 04 Aug, 2026 | npm qlik-chart-modules |
Malicious release: Malicious code in @qlik/carboncopy (npm) GHSA-g8xp-phjg-2v98, MAL-2026-11786 | Malicious | Not scored | 04 Aug, 2026 | npm @qlik/carboncopy |
Malicious release: Malicious code in @nebula.js/stardust (npm) GHSA-7g8p-fjjf-5ggq, MAL-2026-11584 | Malicious | Not scored | 04 Aug, 2026 | npm @nebula.js/stardust |