Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenClaw: memory-wiki ingest could read local files with operator.write scope CVE-2026-53825, GHSA-p2fh-f5fc-44hr | High | 0.4% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Slack allowFrom could bind to mutable display names CVE-2026-53823, GHSA-c29c-2q9c-pc86 | High | 0.2% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Shell wrapper argv could change between approval and execution CVE-2026-53822, GHSA-2j8v-hwgc-x698 | High | 1.1% | 12 Jun, 2026 | npm Openclaw |
OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing CVE-2026-53821, GHSA-qjpc-qf9m-xwmr | High | 0.3% | 12 Jun, 2026 | npm openclaw |
@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag CVE-2026-53608, GHSA-wf43-fpp3-cf65 | High | 0.3% | 12 Jun, 2026 | npm @apostrophecms/seo |
form-data: CRLF injection in form-data via unescaped multipart field names and filenames CVE-2026-12143, GHSA-hmw2-7cc7-3qxx | High | 0.7% | 12 Jun, 2026 | npm form-data |
Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher CVE-2026-53721, GHSA-mm7m-92g8-7m47 | High | 0.4% | 12 Jun, 2026 | npm nuxt |
OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows CVE-2026-53819, GHSA-8wg3-5mcm-fjq8 | High | 0.3% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Control UI locality spoofing could mint a durable admin device token CVE-2026-53817, GHSA-chr9-m4q2-76hw | High | 0.3% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance CVE-2026-53816, GHSA-3c6j-hq33-3jv4 | High | 0.3% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Message read actions could skip channel allowlist checks CVE-2026-53815, GHSA-q7q8-3mgw-q67r | High | 0.2% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority CVE-2026-53814, GHSA-6fvr-66p3-3qj4 | High | 0.3% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Fake package roots could influence memory-core artifact loading CVE-2026-53813, GHSA-v8cx-933x-r976 | High | 0.1% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Matrix allowFrom could bind to mutable display names CVE-2026-53811, GHSA-7hxm-f538-3xp6 | High | 0.3% | 11 Jun, 2026 | npm openclaw |
OpenClaw's marketplace runtime extension metadata could point at unscanned payloads CVE-2026-53810, GHSA-v6r2-jh58-xx6w | High | 0.4% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Telegram interactive callbacks could skip commands.allowFrom CVE-2026-53807, GHSA-w5ww-7chg-mxcq | High | 0.3% | 11 Jun, 2026 | npm openclaw |
OpenClaw: Combined POSIX shell options could confuse exec revalidation CVE-2026-53806, GHSA-vxx3-6hc9-7cc3 | High | 0.4% | 11 Jun, 2026 | npm openclaw |
tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template CVE-2026-49982, GHSA-7c78-jf6q-g5cm | High | 0.5% | 11 Jun, 2026 | npm tmp |
@grpc/grpc-js: A malformed request can cause a server crash CVE-2026-48068, GHSA-5375-pq7m-f5r2 | High | 0.9% | 11 Jun, 2026 | npm @grpc/grpc-js |
@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash CVE-2026-48069, GHSA-99f4-grh7-6pcq | High | 0.9% | 11 Jun, 2026 | npm @grpc/grpc-js |
OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri CVE-2026-48054, GHSA-4x76-22x2-rx8v | High | 0.6% | 11 Jun, 2026 | npm @openzeppelin/wizard |
Element Call reports full URLs of visited pages to analytics server CVE-2026-48007, GHSA-6vhh-4xw6-h2h2 | High | 0.3% | 11 Jun, 2026 | npm @element-hq/element-call-embedded |
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges CVE-2026-50131, GHSA-xw9q-2mv6-9fr8 | High | 0.4% | 10 Jun, 2026 | npm @fedify/fedify npm @fedify/vocab-runtime |
aws-cdk-lib: OS Command Injection in NodejsFunction Bundling CVE-2026-11417, GHSA-999r-qq7v-r334 | High | 1.0% | 10 Jun, 2026 | npm aws-cdk-lib |
image-size: ICNS parser allows denial of service through an infinite loop CVE-2025-71330, GHSA-w3rx-r6r6-pgpr | High | 0.4% | 10 Jun, 2026 | npm image-size |
image-size: JXL and HEIF parsers allow denial of service through infinite loops CVE-2025-71329, GHSA-5p2g-fcmc-qvqq | High | 0.4% | 10 Jun, 2026 | npm image-size |
@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts CVE-2026-48036, GHSA-32g3-35g9-wc9g | High | 0.5% | 10 Jun, 2026 | npm @hulumi/drift |
@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened CVE-2026-48035, GHSA-2mxr-p26x-mj73 | High | 0.5% | 10 Jun, 2026 | npm @hulumi/baseline |
@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket CVE-2026-48034, GHSA-9vc9-4jv3-rf86 | High | 0.4% | 10 Jun, 2026 | npm @hulumi/policies |
@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name CVE-2026-48033, GHSA-rhgj-6g2c-frmm | High | 0.5% | 10 Jun, 2026 | npm @hulumi/policies |
@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers CVE-2026-48032, GHSA-g759-4pxw-6692 | High | 0.5% | 10 Jun, 2026 | npm @hulumi/policies |
degit has a Command Injection issue CVE-2026-11572, GHSA-77c7-pq4r-6mcq | High | 1.0% | 09 Jun, 2026 | npm degit |
FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading CVE-2026-47719, GHSA-w86f-rf9w-h3x6 | High | 0.6% | 08 Jun, 2026 | npm fuxa-server |
AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping CVE-2026-11393, GHSA-m4x6-gwgp-4pm7 | High | 0.3% | 08 Jun, 2026 | npm @aws/agentcore |
DbGate: Remote Code Execution via functionName injection in loadReader endpoint CVE-2026-48017, GHSA-hv83-ggc4-v385 | High | 0.5% | 05 Jun, 2026 | npm dbgate-api |
Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP CVE-2026-47684, GHSA-q4x5-8cj6-52wg | High | 0.2% | 05 Jun, 2026 | npm @sync-in/server |
NocoDB: Stored Cross-Site Scripting via Form View Redirect URL CVE-2026-47387, GHSA-hj85-ph9q-78jg | High | 0.4% | 05 Jun, 2026 | npm nocodb |
NocoDB: Stored Cross-Site Scripting via Row Comments CVE-2026-47383, GHSA-jf3g-4gwg-4h66 | High | 0.4% | 05 Jun, 2026 | npm nocodb |
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending CVE-2026-45337, GHSA-cq3f-vc6p-68fh | High | 0.2% | 04 Jun, 2026 | npm better-auth |
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVE-2026-44496, GHSA-hfxv-24rg-xrqf | High | 5.4% | 04 Jun, 2026 | npm axios |
Allocation of Resources Without Limits or Throttling in Axios CVE-2026-44488, GHSA-777c-7fjr-54vf | High | 0.7% | 04 Jun, 2026 | npm axios |
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter CVE-2026-44487, GHSA-p92q-9vqr-4j8v | High | 0.7% | 04 Jun, 2026 | npm axios |
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection CVE-2026-44486, GHSA-j5f8-grm9-p9fc | High | 0.6% | 04 Jun, 2026 | npm axios |
browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server CVE-2026-49144, GHSA-8rpw-6cqh-2v9h | High | 0.4% | 02 Jun, 2026 | npm browserstack-runner |
browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler CVE-2026-49143, GHSA-6vr3-7wcx-v5g5 | High | 0.8% | 02 Jun, 2026 | npm browserstack-runner |
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint CVE-2026-42342, GHSA-8x6r-g9mw-2r78 | High | 0.3% | 02 Jun, 2026 | npm @remix-run/server-runtime npm react-router |
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE CVE-2026-42211, GHSA-49rj-9fvp-4h2h | High | 0.4% | 02 Jun, 2026 | npm react-router |
React Router vulnerable to Denial of Service via reflected user input in single-fetch CVE-2026-34077, GHSA-rxv8-25v2-qmq8 | High | 0.3% | 02 Jun, 2026 | npm react-router npm turbo-stream |
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets CVE-2026-33245, GHSA-8646-j5j9-6r62 | High | 0.2% | 02 Jun, 2026 | npm react-router |
launch-editor vulnerable to command injection via the crafted request on Windows CVE-2024-52011, GHSA-c27g-q93r-2cwf | High | 0.5% | 01 Jun, 2026 | npm launch-editor npm vite |