Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths CVE-2026-47676, GHSA-2gcr-mfcq-wcc3 | Medium | 0.3% | 28 May, 2026 | npm hono |
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection CVE-2026-47675, GHSA-3hrh-pfw6-9m5x | Medium | 0.2% | 28 May, 2026 | npm hono |
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 CVE-2026-47674, GHSA-xrhx-7g5j-rcj5 | Medium | 0.2% | 28 May, 2026 | npm hono |
Hono: JWT middleware accepts any Authorization scheme, not only Bearer CVE-2026-47673, GHSA-f577-qrjj-4474 | Medium | 0.2% | 28 May, 2026 | npm hono |
json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio CVE-2026-9673, GHSA-g27c-q7cp-mhx6 | Medium | 0.2% | 28 May, 2026 | npm json-2-csv |
Budibase: Unvalidated VectorDB Host Parameter Enables SSRF CVE-2026-48148, GHSA-cv96-5348-p5p8 | Medium | 0.2% | 27 May, 2026 | npm @budibase/server |
Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker CVE-2026-48147, GHSA-wxq7-x3qp-vcr8 | Medium | 0.1% | 27 May, 2026 | npm @budibase/backend-core |
Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step CVE-2026-48128, GHSA-6964-pp88-6wp9 | Medium | 0.3% | 27 May, 2026 | npm budibase |
@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects CVE-2026-44979, GHSA-vhjm-w67q-g75c | Medium | 0.4% | 27 May, 2026 | npm @hapi/wreck |
LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()` CVE-2026-44646, GHSA-9x9p-qf8f-mvjg | Medium | 0.3% | 27 May, 2026 | npm liquidjs |
LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body CVE-2026-44645, GHSA-8xx9-69p8-7jp3 | Medium | 0.4% | 27 May, 2026 | npm liquidjs |
LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS CVE-2026-44644, GHSA-2qv6-9wx5-cwv4 | Medium | 0.3% | 27 May, 2026 | npm liquidjs |
@koa/router has an Access Control Bypass CVE-2026-9495, GHSA-47p6-69vm-vw6v | Medium | 0.4% | 26 May, 2026 | npm @koa/router |
Apache ECharts has a cross-site scripting (XSS) vulnerability CVE-2026-45249, GHSA-fgmj-fm8m-jvvx | Medium | 0.7% | 25 May, 2026 | npm echarts |
Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers CVE-2026-39964, GHSA-hqmv-v56g-4m47 | Medium | 0.2% | 22 May, 2026 | npm @typebot.io/js |
NocoDB: Shared-base link access can invite arbitrary users as persistent base members CVE-2026-46552, GHSA-chqv-vrj7-qffp | Medium | 0.3% | 21 May, 2026 | npm nocodb |
NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion CVE-2026-46551, GHSA-99vc-2jx2-688p | Medium | 0.4% | 21 May, 2026 | npm nocodb |
NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags CVE-2026-46550, GHSA-f74w-272x-mqcv | Medium | 0.2% | 21 May, 2026 | npm nocodb |
NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams) CVE-2026-46548, GHSA-2c5x-4jgf-88mj | Medium | 0.3% | 21 May, 2026 | npm nocodb |
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL CVE-2026-46547, GHSA-9qgr-6vpg-9gh9 | Medium | 0.3% | 21 May, 2026 | npm nocodb |
@sveltejs/kit: `query.batch` cross-talk CVE-2026-82258, GHSA-hgv7-v322-mmgr | Medium | 0.2% | 21 May, 2026 | npm @sveltejs/kit |
CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS CVE-2026-26028, GHSA-g2g4-47gv-p72v | Medium | 0.2% | 20 May, 2026 | npm cryptpad |
@cyntler/react-doc-viewer's TXTRenderer fails to sanitize file content and explicitly casts raw data as a ReactNode CVE-2026-30691, GHSA-fvhg-p4hf-79x3 | Medium | 0.3% | 20 May, 2026 | npm @cyntler/react-doc-viewer |
Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows CVE-2026-56268, GHSA-c2c9-mfw7-p8hw | Medium | 0.4% | 20 May, 2026 | npm flowise |
Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change Verification CVE-2026-56276, GHSA-59fh-9f3p-7m39 | Medium | 0.4% | 20 May, 2026 | npm flowise |
Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage CVE-2026-56277, GHSA-m837-xvxr-vqwg | Medium | 0.2% | 20 May, 2026 | npm flowise |
HAX CMS: Denial of Service using Malicious Import Request CVE-2026-46357, GHSA-9r33-xhw8-4qqp | Medium | 0.2% | 19 May, 2026 | npm @haxtheweb/haxcms-nodejs |
Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching CVE-2026-46341, GHSA-jwp7-wg77-3w9v | Medium | 0.2% | 19 May, 2026 | npm @apify/actors-mcp-server |
Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour CVE-2026-46424, GHSA-6vp2-6r7m-2jvx | Medium | 0.2% | 19 May, 2026 | npm @budibase/backend-core |
n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass CVE-2026-56348, GHSA-3875-8gcx-7v46 | Medium | 0.5% | 19 May, 2026 | npm n8n |
n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions CVE-2026-56352, GHSA-2vx9-7wpg-88jq | Medium | 0.3% | 19 May, 2026 | npm n8n |
Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) CVE-2026-45670, GHSA-6m52-m754-pw2g | Medium | 0.2% | 19 May, 2026 | npm @nuxt/rspack-builder npm @nuxt/webpack-builder |
Nuxt: Reflected XSS in `navigateTo()` external redirect CVE-2026-45669, GHSA-fx6j-w5w5-h468 | Medium | 0.2% | 19 May, 2026 | npm nuxt |
ExifReader is vulnerable to denial of service via unbounded decompression of image metadata CVE-2026-8814, GHSA-rr89-w3h9-m66j | Medium | 0.5% | 19 May, 2026 | npm exifreader |
Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links CVE-2026-45245, GHSA-2r69-qgv3-hr65 | Medium | 0.3% | 18 May, 2026 | npm @steipete/summarize |
Summarize contains a missing authorization vulnerability CVE-2026-45243, GHSA-5624-2pmv-jx46 | Medium | 0.2% | 18 May, 2026 | npm @steipete/summarize |
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API CVE-2026-45719, GHSA-363w-hvwh-w7m6 | Medium | 0.3% | 18 May, 2026 | npm @budibase/server |
Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows CVE-2026-45718, GHSA-3263-v5v9-xq8q | Medium | 0.1% | 18 May, 2026 | npm budibase |
Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass CVE-2026-45577, GHSA-5cvp-p7p4-mcx9 | Medium | 0.2% | 18 May, 2026 | npm neotoma |
n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters CVE-2026-45582, GHSA-f3rg-xqjj-cj9w | Medium | 0.3% | 18 May, 2026 | npm n8n-mcp |
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set CVE-2026-8723, GHSA-q8mj-m7cp-5q26 | Medium | 0.4% | 17 May, 2026 | npm qs |
Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE CVE-2026-67335, GHSA-wxw3-q3m9-c3jr | Medium | 0.3% | 15 May, 2026 | npm better-auth |
Turbo: Login callback CSRF/session fixation CVE-2026-45773, GHSA-hcf7-66rw-9f5r | Medium | 0.1% | 15 May, 2026 | npm turbo |
@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol CVE-2026-45366, GHSA-r8j5-8747-88cm | Medium | 0.1% | 14 May, 2026 | npm @utcp/http |
Svelte: SSR XSS via Insecure Promise Serialization in hydratable GHSA-f3cj-j4f6-wq85 | Medium | Not scored | 14 May, 2026 | npm svelte |
electerm's encrypt method not safe enough CVE-2026-45787, GHSA-g29v-q6h7-76wh | Medium | 0.1% | 14 May, 2026 | npm electerm |
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State CVE-2026-42573, GHSA-rcqx-6q8c-2c42 | Medium | 0.3% | 14 May, 2026 | npm svelte |
Svelte: ReDoS in `<svelte:element>` Tag Validation CVE-2026-42567, GHSA-9rmh-mm8f-r9h6 | Medium | 0.5% | 14 May, 2026 | npm svelte |
Open WebUI Has Stored Cross-Site Scripting in SVG Renderer CVE-2026-45346, GHSA-r29h-37fj-x2w6 | Medium | 0.2% | 14 May, 2026 | npm open-webui |
Svelte SSR vulnerable to cross-site scripting via spread attributes CVE-2026-42599, GHSA-pr6f-5x2q-rwfp | Medium | 0.2% | 14 May, 2026 | npm svelte |