Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
undici WebSocket client vulnerable to denial of service via fragment count bypass CVE-2026-12151, GHSA-vxpw-j846-p89q | High | 0.8% | 17 Jun, 2026 | npm undici |
Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts CVE-2026-54328, GHSA-jfgx-wxx8-mp94 | High | 0.2% | 17 Jun, 2026 | npm @earendil-works/pi-coding-agent npm @mariozechner/pi-coding-agent |
n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host CVE-2026-54304, GHSA-rm2v-h48j-895m | High | 0.4% | 16 Jun, 2026 | npm n8n |
n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions CVE-2026-54309, GHSA-qrx8-25qr-5r7v | High | 0.5% | 16 Jun, 2026 | npm n8n |
n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints CVE-2026-54305, GHSA-2j5h-858j-5mpf | High | 0.4% | 16 Jun, 2026 | npm n8n |
n8n: Credential Exfiltration via Permission Bypass CVE-2026-54307, GHSA-pmqw-72cg-wx85 | High | 0.4% | 16 Jun, 2026 | npm n8n |
n8n: Stored XSS in Chat Trigger Node CVE-2026-54302, GHSA-42h7-m79w-wvg5 | High | 0.2% | 16 Jun, 2026 | npm n8n |
n8n: Microsoft SQL Node Prototype Pollution CVE-2026-54312, GHSA-x6p3-m6h9-fx7r | High | 0.4% | 16 Jun, 2026 | npm n8n |
OpenClaw: Shell inline-command parsing could miss an allowlist check CVE-2026-53866, GHSA-f397-5vjw-v2c2 | High | 0.3% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Workspace-derived service PATH could influence trash command selection CVE-2026-53865, GHSA-rx78-29qr-5hq8 | High | 0.1% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Host environment sanitizer missed two Node.js control variables CVE-2026-53864, GHSA-ccwh-wwpp-6wg5 | High | 0.2% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots CVE-2026-53858, GHSA-wc84-j36w-pw4x | High | 0.1% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Zalo allowFrom could bind to mutable display names CVE-2026-53857, GHSA-8c59-hr4w-qg69 | High | 0.2% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Shell positional parameters could weaken strict inline-eval checks CVE-2026-53855, GHSA-5cj2-3jr2-5h77 | High | 0.3% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns CVE-2026-53853, GHSA-v2ww-5rh7-2h5v | High | 0.3% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Discord allowFrom could bind to mutable display names CVE-2026-53849, GHSA-cw4q-gqg5-g38h | High | 0.3% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install CVE-2026-53846, GHSA-24vr-rprv-67rf | High | 0.1% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Pairing-scoped device session could restore revoked node token authority CVE-2026-53843, GHSA-q99w-vh6v-q3v7 | High | 0.3% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution CVE-2026-53842, GHSA-fq9j-vw4w-fr6v | High | 0.1% | 16 Jun, 2026 | npm openclaw |
OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin CVE-2026-53840, GHSA-rjxq-qqhf-8hwh | High | 0.2% | 16 Jun, 2026 | npm openclaw |
n8n: Same-Origin XSS in Respond to Webhook Node CVE-2026-54301, GHSA-v733-mwr6-fgcm | High | 0.2% | 16 Jun, 2026 | npm n8n |
n8n: Python sandbox escape CVE-2026-49444, GHSA-9pq8-m8gp-4p53 | High | 0.4% | 16 Jun, 2026 | npm n8n |
Astro: Host header SSRF in prerendered error page fetch CVE-2026-54299, GHSA-2pvr-wf23-7pc7 | High | 0.3% | 16 Jun, 2026 | npm astro |
hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard CVE-2026-54290, GHSA-88fw-hqm2-52qc | High | 0.3% | 16 Jun, 2026 | npm hono |
Astro: Reflected XSS via unescaped slot name CVE-2026-50146, GHSA-8hv8-536x-4wqp | High | 0.3% | 16 Jun, 2026 | npm astro |
Nest: Middleware Bypass on Fastify via Trailing Slash CVE-2026-54281, GHSA-6v32-fjc9-9qf6 | High | 0.5% | 15 Jun, 2026 | npm @nestjs/platform-fastify |
protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names CVE-2026-54271, GHSA-pr59-h9ph-3fr8 | High | 0.3% | 15 Jun, 2026 | npm protobufjs-cli |
Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception CVE-2026-82662, GHSA-r7g4-qg5f-qqm2 | High | 0.2% | 15 Jun, 2026 | npm nodemailer |
protobufjs: Denial of service through unbounded Any expansion during JSON conversion CVE-2026-48712, GHSA-wcpc-wj8m-hjx6 | High | 0.5% | 15 Jun, 2026 | npm protobufjs |
@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker CVE-2026-54264, GHSA-qxh6-94w6-9r5p | High | 0.4% | 15 Jun, 2026 | npm @angular/service-worker |
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate) CVE-2026-54268, GHSA-48r7-hpm6-gfxm | High | 0.6% | 15 Jun, 2026 | npm @angular/common |
@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning CVE-2026-54266, GHSA-39pv-4j6c-2g6v | High | 0.1% | 15 Jun, 2026 | npm @angular/common |
@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR CVE-2026-50556, GHSA-gxx4-3xcv-f8qx | High | 0.4% | 15 Jun, 2026 | npm @angular/platform-server |
@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-50555, GHSA-hqr9-c56f-3x7f | High | 0.3% | 15 Jun, 2026 | npm @angular/platform-server |
vite: `server.fs.deny` bypass on Windows alternate paths CVE-2026-53571, GHSA-fx2h-pf6j-xcff | High | 0.6% | 15 Jun, 2026 | npm vite npm vite-plus |
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo) CVE-2026-50171, GHSA-p3vc-36g9-x9gr | High | 0.3% | 15 Jun, 2026 | npm @angular/common |
@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache CVE-2026-50170, GHSA-q6f4-qqrg-jv6x | High | 0.4% | 15 Jun, 2026 | npm @angular/common |
@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass CVE-2026-50168, GHSA-xrxm-cp7j-8xf6 | High | 0.2% | 15 Jun, 2026 | npm @angular/platform-server |
ws: Memory exhaustion DoS from tiny fragments and data chunks CVE-2026-48779, GHSA-96hv-2xvq-fx4p | High | 1.4% | 15 Jun, 2026 | npm ws |
Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads CVE-2026-5038, GHSA-3p4h-7m6x-2hcm | High | 0.4% | 15 Jun, 2026 | npm multer |
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning CVE-2026-54267, GHSA-rgjc-h3x7-9mwg | High | 0.4% | 15 Jun, 2026 | npm @angular/core |
Multer vulnerable to Denial of Service via deeply nested field names CVE-2026-5079, GHSA-72gw-mp4g-v24j | High | 0.3% | 15 Jun, 2026 | npm multer |
OpenClaw: Trusted retry endpoint checks could match hostname prefixes CVE-2026-53839, GHSA-77q5-rr5v-x43q | High | 0.3% | 12 Jun, 2026 | npm openclaw |
OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks CVE-2026-53836, GHSA-j472-gf56-x589 | High | 0.5% | 12 Jun, 2026 | npm openclaw |
OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks CVE-2026-53834, GHSA-77pv-3w4q-vrj5 | High | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: QQBot streaming command could mutate config without explicit allowFrom CVE-2026-53833, GHSA-jvm4-4j77-39p6 | High | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers CVE-2026-53832, GHSA-rggc-m335-3wvj | High | 0.1% | 12 Jun, 2026 | npm openclaw |
OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion CVE-2026-53831, GHSA-mhq8-78pj-5j79 | High | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Exec approval display truncation could hide the command being approved CVE-2026-53829, GHSA-xww8-gqvh-92x9 | High | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Native command authorization could skip owner-command enforcement CVE-2026-53828, GHSA-p73f-w79w-jqr5 | High | 0.3% | 12 Jun, 2026 | npm openclaw |