Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @ornikar/webpack-config (npm) GHSA-2pgp-wr8q-rh6x, MAL-2026-11780 | Malicious | Not scored | 04 Aug, 2026 | npm @ornikar/webpack-config |
Malicious release: Malicious code in @ornikar/babel-preset-kitt-universal (npm) GHSA-mfxj-5cvr-c5xv, MAL-2026-11741 | Malicious | Not scored | 04 Aug, 2026 | npm @ornikar/babel-preset-kitt-universal |
Malicious release: Malicious code in @ornikar/eslint-config-formatjs (npm) GHSA-mv58-mh2g-g3p8, MAL-2026-11748 | Malicious | Not scored | 04 Aug, 2026 | npm @ornikar/eslint-config-formatjs |
Malicious release: Malicious code in @ornikar/postcss-config (npm) GHSA-8h3p-72jc-w79j, MAL-2026-11765 | Malicious | Not scored | 04 Aug, 2026 | npm @ornikar/postcss-config |
Malicious release: Malicious code in pob-test-typescript-package-in-monorepo (npm) GHSA-w4vx-v8m8-c885, MAL-2026-11981 | Malicious | Not scored | 04 Aug, 2026 | npm pob-test-typescript-package-in-monorepo |
Malicious release: Malicious code in @ornikar/eslint-config-babel (npm) GHSA-2gh5-m3gp-wvx5, MAL-2026-11746 | Malicious | Not scored | 04 Aug, 2026 | npm @ornikar/eslint-config-babel |
Malicious release: Malicious code in @ornikar/eslint-config-react (npm) GHSA-h957-h79m-9cv6, MAL-2026-11750 | Malicious | Not scored | 04 Aug, 2026 | npm @ornikar/eslint-config-react |
Malicious release: Malicious code in @ornikar/browserslist-config (npm) GHSA-vw7j-698w-fqgm, MAL-2026-11743 | Malicious | Not scored | 04 Aug, 2026 | npm @ornikar/browserslist-config |
Malicious release: Malicious code in @ornikar/storybook-config (npm) GHSA-9c66-8phf-mg3m, MAL-2026-11777 | Malicious | Not scored | 04 Aug, 2026 | npm @ornikar/storybook-config |
Malicious release: Malicious code in @ornikar/intl-config (npm) GHSA-g4r2-833j-2226, MAL-2026-11757 | Malicious | Not scored | 04 Aug, 2026 | npm @ornikar/intl-config |
Malicious release: Malicious code in @ornikar/commitlint-config (npm) GHSA-79fp-44mf-fvwq, MAL-2026-11744 | Malicious | Not scored | 04 Aug, 2026 | npm @ornikar/commitlint-config |
Malicious release: Malicious code in @ornikar/eslint-config (npm) GHSA-7qcp-pxw2-878v, MAL-2026-11745 | Malicious | Not scored | 04 Aug, 2026 | npm @ornikar/eslint-config |
Malicious release: Malicious code in @ornikar/eslint-config-typescript-nestjs (npm) GHSA-jr2v-ffp3-8hpw, MAL-2026-11752 | Malicious | Not scored | 04 Aug, 2026 | npm @ornikar/eslint-config-typescript-nestjs |
Malicious release: Malicious code in @ornikar/eslint-config-typescript (npm) GHSA-vq4r-gmr2-8q6r, MAL-2026-11751 | Malicious | Not scored | 04 Aug, 2026 | npm @ornikar/eslint-config-typescript |
Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization CVE-2026-69252, GHSA-wp74-f5hh-5f3r | High | 0.5% | 04 Aug, 2026 | npm flowise |
Flowise RCE via TypeORM DataSource CVE-2026-69251, GHSA-g32j-mmxr-gfq5 | Critical | 2.7% | 04 Aug, 2026 | npm flowise npm flowise-components |
Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration CVE-2026-69250, GHSA-r745-8hwv-h473 | High | 0.6% | 04 Aug, 2026 | npm flowise |
Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint CVE-2026-73488, GHSA-2364-jh4q-m9vm | Medium | 0.4% | 04 Aug, 2026 | npm flowise |
Malicious release: Malicious code in @servicetitan/culture (npm) GHSA-583v-3qjp-549g, MAL-2026-11848 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/culture |
Malicious release: Malicious code in @or-sdk/account-settings (npm) GHSA-w8v8-2w56-hqw9, MAL-2026-11665 | Malicious | Not scored | 04 Aug, 2026 | npm @or-sdk/account-settings |
Malicious release: Malicious code in @or-sdk/views (npm) GHSA-grj3-qrwq-q7rf, MAL-2026-11737 | Malicious | Not scored | 04 Aug, 2026 | npm @or-sdk/views |
Malicious release: Malicious code in @onereach/step-components (npm) GHSA-x3rq-c2qw-cvjx, MAL-2026-11652 | Malicious | Not scored | 04 Aug, 2026 | npm @onereach/step-components |
Malicious release: Malicious code in @onereach/si-validated-timestring-input (npm) GHSA-7pvm-9q4f-5qv7, MAL-2026-11649 | Malicious | Not scored | 04 Aug, 2026 | npm @onereach/si-validated-timestring-input |
Malicious release: Malicious code in @servicetitan/table (npm) GHSA-26gm-fxj3-c2gp, MAL-2026-11929 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/table |
Malicious release: Malicious code in @or-sdk/deployer (npm) GHSA-9cwc-pwgf-r82h, MAL-2026-11687 | Malicious | Not scored | 04 Aug, 2026 | npm @or-sdk/deployer |
Malicious release: Malicious code in @servicetitan/standalone-root (npm) GHSA-c7r5-mv7x-qrhc, MAL-2026-11920 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/standalone-root |
Malicious release: Malicious code in @servicetitan/anvil2-mcp (npm) GHSA-936x-86fr-fp2f, MAL-2026-11829 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/anvil2-mcp |
Malicious release: Malicious code in @servicetitan/docs-uikit (npm) GHSA-9r7x-f6vx-29fr, MAL-2026-11854 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/docs-uikit |
Malicious release: Malicious code in @or-sdk/card-templates (npm) GHSA-758p-fc7f-p8vg, MAL-2026-11679 | Malicious | Not scored | 04 Aug, 2026 | npm @or-sdk/card-templates |
Malicious release: Malicious code in @servicetitan/anvil-css-utilities (npm) GHSA-4vc6-772g-qrp6, MAL-2026-11815 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/anvil-css-utilities |
Malicious release: Malicious code in @onereach/si-text-message (npm) GHSA-567h-cq5c-267h, MAL-2026-11647 | Malicious | Not scored | 04 Aug, 2026 | npm @onereach/si-text-message |
Malicious release: Malicious code in @servicetitan/assist-ui (npm) GHSA-c7vw-mh2h-h6m7, MAL-2026-11830 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/assist-ui |
Malicious release: Malicious code in @onereach/orest-cli (npm) GHSA-jhfg-vcxw-v5mc, MAL-2026-11614 | Malicious | Not scored | 04 Aug, 2026 | npm @onereach/orest-cli |
Malicious release: Malicious code in @thiennq/docs-viewer (npm) GHSA-734j-4vxf-w896, MAL-2026-11952 | Malicious | Not scored | 04 Aug, 2026 | npm @thiennq/docs-viewer |
Malicious release: Malicious code in @servicetitan/install (npm) GHSA-jgj8-q99c-px8x, MAL-2026-11879 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/install |
Malicious release: Malicious code in @servicetitan/eslint-plugin (npm) GHSA-hw9w-2j23-j8hq, MAL-2026-11861 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/eslint-plugin |
Malicious release: Malicious code in @servicetitan/hammer-icon (npm) GHSA-wvxj-x32x-6p99, MAL-2026-11873 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/hammer-icon |
Malicious release: Malicious code in @servicetitan/anvil-icons (npm) GHSA-xvjq-jv5h-p55m, MAL-2026-11818 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/anvil-icons |
Malicious release: Malicious code in @hubsync/web-sdk-react (npm) GHSA-4534-cw9p-7438, MAL-2026-11564 | Malicious | Not scored | 04 Aug, 2026 | npm @hubsync/web-sdk-react |
Malicious release: Malicious code in @servicetitan/anvil-themes (npm) GHSA-3pch-xh49-x28w, MAL-2026-11820 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/anvil-themes |
Malicious release: Malicious code in @qlik/sprout-react (npm) GHSA-pc9r-8h2v-v6mw, MAL-2026-11808 | Malicious | Not scored | 04 Aug, 2026 | npm @qlik/sprout-react |
Malicious release: Malicious code in @servicetitan/marketing-widgets (npm) GHSA-8rh9-8r2x-mqv4, MAL-2026-11897 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/marketing-widgets |
Malicious release: Malicious code in @servicetitan/web-components (npm) GHSA-ppx3-8h2p-vrx8, MAL-2026-11949 | Malicious | Not scored | 04 Aug, 2026 | npm @servicetitan/web-components |
Malicious release: Malicious code in @picsart/gen-ai (npm) GHSA-4p68-ppf4-vjwc, MAL-2026-11782 | Malicious | Not scored | 04 Aug, 2026 | npm @picsart/gen-ai |
Malicious release: Malicious code in @ornikar/graphql-config (npm) GHSA-pwmg-hhvx-94mr, MAL-2026-11756 | Malicious | Not scored | 04 Aug, 2026 | npm @ornikar/graphql-config |
Malicious release: Malicious code in @ornikar/eslint-plugin-neverthrow (npm) GHSA-j378-3j38-8rg5, MAL-2026-11754 | Malicious | Not scored | 04 Aug, 2026 | npm @ornikar/eslint-plugin-neverthrow |
Malicious release: Malicious code in @or-sdk/chat (npm) GHSA-mxcc-ccp6-gxp4, MAL-2026-11682 | Malicious | Not scored | 04 Aug, 2026 | npm @or-sdk/chat |
Malicious release: Malicious code in @onereach/get-version-data (npm) GHSA-7vcg-ff6h-mhph, MAL-2026-11600 | Malicious | Not scored | 04 Aug, 2026 | npm @onereach/get-version-data |
Malicious release: Malicious code in @or-sdk/library-categories (npm) GHSA-hgxp-rjq6-qhqx, MAL-2026-11707 | Malicious | Not scored | 04 Aug, 2026 | npm @or-sdk/library-categories |
Malicious release: Malicious code in @onereach/cb-schema-translator (npm) GHSA-wx6r-7qj6-rjxv, MAL-2026-11591 | Malicious | Not scored | 04 Aug, 2026 | npm @onereach/cb-schema-translator |