Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in yoodan-github-single-ver-pkg (npm) GHSA-2946-w5c6-hcw2, MAL-2026-17851 | Malicious | Not scored | 16 days ago | npm yoodan-github-single-ver-pkg |
obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields CVE-2026-77362, GHSA-43r2-c7g8-prc8 | Medium | 0.2% | 16 days ago | npm obsidian-tc |
obsidian-tc : Symlink read-ACL scope bypass via lexical path checks CVE-2026-77361, GHSA-c5xx-h28h-f682 | Medium | 0.1% | 16 days ago | npm obsidian-tc |
fastify is vulnerable to header validation bypass via case-sensitive propertyNames CVE-2026-107832, GHSA-389g-gv7q-r4x8 | Low | 0.3% | 16 days ago | npm fastify |
Malicious release: Malicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm) MAL-2026-17867 | Malicious | Not scored | 16 days ago | npm @accenturecodefoundry/mfe-pot-shared-ui-scds-core |
Malicious release: Malicious code in @chatest/baileys (npm) GHSA-c2gc-jwcq-w8r3, MAL-2026-17850 | Malicious | Not scored | 16 days ago | npm @chatest/baileys |
Malicious release: Malicious code in brass-common (npm) GHSA-g6mf-8rwx-xgwh, MAL-2026-17849 | Malicious | Not scored | 17 days ago | npm brass-common |
Malicious release: Malicious code in @mntv-analysis/ui (npm) MAL-2026-17869 | Malicious | Not scored | 17 days ago | npm @mntv-analysis/ui |
Malicious release: Malicious code in @mntv-analysis/ui-components (npm) MAL-2026-17870 | Malicious | Not scored | 17 days ago | npm @mntv-analysis/ui-components |
Malicious release: Malicious code in @mntv-analysis/workspaces-components (npm) MAL-2026-17871 | Malicious | Not scored | 17 days ago | npm @mntv-analysis/workspaces-components |
Malicious release: Malicious code in @newspage/lib-ng-async-routes-ui (npm) MAL-2026-17872 | Malicious | Not scored | 17 days ago | npm @newspage/lib-ng-async-routes-ui |
Malicious release: Malicious code in @newspage/libx-amount (npm) MAL-2026-17873 | Malicious | Not scored | 17 days ago | npm @newspage/libx-amount |
Malicious release: Malicious code in @user-interface-common/common-styles (npm) MAL-2026-17874 | Malicious | Not scored | 17 days ago | npm @user-interface-common/common-styles |
Malicious release: Malicious code in monkey-tags-ip (npm) MAL-2026-17875 | Malicious | Not scored | 17 days ago | npm monkey-tags-ip |
Backstage: Improper access control in backend action invocation CVE-2026-106495, GHSA-3xr5-8w6c-p5gw | Medium | 0.2% | 17 days ago | npm @backstage/backend-defaults |
obsidian-tc tokens can access arbitrary configured vaults CVE-2026-77366, GHSA-84c9-qqpq-2pq5 | Critical | 0.3% | 17 days ago | npm obsidian-tc |
obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default CVE-2026-77364, GHSA-cvp8-vvgf-69q4 | Medium | 0.2% | 17 days ago | npm obsidian-tc |
obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback CVE-2026-77363, GHSA-pqh8-4pj7-32xx | Critical | 0.2% | 17 days ago | npm obsidian-tc |
better-auth: Device login approval does not show the requesting client or permissions CVE-2026-109346, GHSA-q84f-53jg-9ppm | High | 0.3% | 17 days ago | npm better-auth |
Malicious release: Malicious code in @zanta/baileys (npm) GHSA-2rh8-cvqq-44jf, MAL-2026-17443 | Malicious | Not scored | 17 days ago | npm @zanta/baileys |
Malicious release: Malicious code in @yudzxml/baileys (npm) GHSA-qh6w-wgpq-j344, MAL-2026-17846 | Malicious | Not scored | 17 days ago | npm @yudzxml/baileys |
Malicious release: Malicious code in @xrelly-stack/bails (npm) GHSA-8qfw-qm7w-8239, MAL-2026-17843 | Malicious | Not scored | 17 days ago | npm @xrelly-stack/bails |
Malicious release: Malicious code in node-telegram-sockets (npm) GHSA-c773-2559-g4g3, MAL-2026-17845 | Malicious | Not scored | 17 days ago | npm node-telegram-sockets |
Malicious release: Malicious code in @wanzxlonelyy/bailslonely (npm) GHSA-r69x-4p42-hrf9, MAL-2026-17841 | Malicious | Not scored | 17 days ago | npm @wanzxlonelyy/bailslonely |
Malicious release: Malicious code in @wanzlonely/bails4u (npm) GHSA-4327-j8v7-q48w, MAL-2026-17381 | Malicious | Not scored | 17 days ago | npm @wanzlonely/bails4u |
Malicious release: Malicious code in @wanzlonelyy/bailslonely (npm) GHSA-rj8v-mcc6-hf5c, MAL-2026-17840 | Malicious | Not scored | 17 days ago | npm @wanzlonelyy/bailslonely |
Malicious release: Malicious code in @wanzlonely/bailsme (npm) GHSA-4h3p-p24h-82rf, MAL-2026-17839 | Malicious | Not scored | 17 days ago | npm @wanzlonely/bailsme |
Malicious release: Malicious code in @wanzlonely/bailsforme (npm) GHSA-p3g3-r8vh-rwhx, MAL-2026-17838 | Malicious | Not scored | 17 days ago | npm @wanzlonely/bailsforme |
Malicious release: Malicious code in bailslonely (npm) GHSA-vc96-c7r4-h83m, MAL-2026-17844 | Malicious | Not scored | 17 days ago | npm bailslonely |
Malicious release: Malicious code in @wenzyx1/bails (npm) GHSA-q7r7-xm3q-rmwv, MAL-2026-17382 | Malicious | Not scored | 17 days ago | npm @wenzyx1/bails |
Malicious release: Malicious code in @sanzoffc/libsignal-node (npm) GHSA-38h3-6834-45vg, MAL-2026-17837 | Malicious | Not scored | 17 days ago | npm @sanzoffc/libsignal-node |
Malicious release: Malicious code in @sakataoffc/baileys (npm) GHSA-jrm5-8gc9-77hx, MAL-2026-17379 | Malicious | Not scored | 17 days ago | npm @sakataoffc/baileys |
Malicious release: Malicious code in @sairidev/baileys-new (npm) GHSA-wf67-crp9-g283, MAL-2026-17378 | Malicious | Not scored | 17 days ago | npm @sairidev/baileys-new |
Malicious release: Malicious code in @saazkira/libsignal-node (npm) GHSA-5f92-7xqw-69hg, MAL-2026-17836 | Malicious | Not scored | 17 days ago | npm @saazkira/libsignal-node |
Malicious release: Malicious code in @saazkira/eslint-config (npm) GHSA-6h28-rjw4-r5vh, MAL-2026-17835 | Malicious | Not scored | 17 days ago | npm @saazkira/eslint-config |
Malicious release: Malicious code in @saazkira/baileys (npm) GHSA-wqr2-p8mq-9c3f, MAL-2026-17377 | Malicious | Not scored | 17 days ago | npm @saazkira/baileys |
Malicious release: Malicious code in @revizahoshii/hoshino-voip (npm) GHSA-ffcp-p98x-xf5q, MAL-2026-17833 | Malicious | Not scored | 17 days ago | npm @revizahoshii/hoshino-voip |
Malicious release: Malicious code in @revizahoshii/hoshino-fake-server (npm) GHSA-hf93-m6x5-f6w9, MAL-2026-17824 | Malicious | Not scored | 17 days ago | npm @revizahoshii/hoshino-fake-server |
Malicious release: Malicious code in @revizahoshii/hoshino-wam (npm) GHSA-mw58-c46j-c7h4, MAL-2026-17834 | Malicious | Not scored | 17 days ago | npm @revizahoshii/hoshino-wam |
Malicious release: Malicious code in @revizahoshii/hoshino-native (npm) GHSA-p9mj-5xqc-v9rw, MAL-2026-17827 | Malicious | Not scored | 17 days ago | npm @revizahoshii/hoshino-native |
Malicious release: Malicious code in @revizahoshii/hoshino-mcp-server (npm) GHSA-xjwm-grrq-qm27, MAL-2026-17825 | Malicious | Not scored | 17 days ago | npm @revizahoshii/hoshino-mcp-server |
Malicious release: Malicious code in @revizahoshii/hoshino-media-utils (npm) GHSA-5c9f-v5pg-rwjp, MAL-2026-17826 | Malicious | Not scored | 17 days ago | npm @revizahoshii/hoshino-media-utils |
Malicious release: Malicious code in @revizahoshii/hoshino (npm) GHSA-5w74-m47h-rxp2, MAL-2026-17376 | Malicious | Not scored | 17 days ago | npm @revizahoshii/hoshino |
Malicious release: Malicious code in @revizahoshii/hoshino-store-redis (npm) GHSA-9vwc-wr35-xw3c, MAL-2026-17831 | Malicious | Not scored | 17 days ago | npm @revizahoshii/hoshino-store-redis |
Malicious release: Malicious code in @revizahoshii/hoshino-store-sqlite (npm) GHSA-cjch-4gc3-vrg5, MAL-2026-17832 | Malicious | Not scored | 17 days ago | npm @revizahoshii/hoshino-store-sqlite |
Malicious release: Malicious code in @revizahoshii/hoshino-store-mysql (npm) GHSA-h3qh-5mw2-6hp7, MAL-2026-17829 | Malicious | Not scored | 17 days ago | npm @revizahoshii/hoshino-store-mysql |
Malicious release: Malicious code in @revizahoshii/baileys (npm) GHSA-h8f3-w3fx-c43w, MAL-2026-17375 | Malicious | Not scored | 17 days ago | npm @revizahoshii/baileys |
Malicious release: Malicious code in @revizahoshii/hoshino-store-postgres (npm) GHSA-j429-q69w-883m, MAL-2026-17830 | Malicious | Not scored | 17 days ago | npm @revizahoshii/hoshino-store-postgres |
Malicious release: Malicious code in @revizahoshii/hoshino-store-mongo (npm) GHSA-rw66-grf5-whpp, MAL-2026-17828 | Malicious | Not scored | 17 days ago | npm @revizahoshii/hoshino-store-mongo |
Malicious release: Malicious code in baileys-xbats (npm) GHSA-w855-vw8p-6gc8, MAL-2026-17388 | Malicious | Not scored | 17 days ago | npm baileys-xbats |