Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function GHSA-9m65-766c-r333 | Medium | Not scored | 14 May, 2026 | npm @tanstack/start-server-core |
@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input CVE-2026-42853, GHSA-hcwq-x9fw-8cfq | Medium | 0.5% | 14 May, 2026 | npm @apostrophecms/cli |
Strapi Upload Plugin MIME Validation Bypass via Content API CVE-2026-22707, GHSA-pcw7-5633-82vv | Medium | 0.2% | 14 May, 2026 | npm @strapi/upload |
Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying CVE-2025-64526, GHSA-7mqx-wwh4-f9fw | Medium | 0.5% | 13 May, 2026 | npm @strapi/plugin-users-permissions |
OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover CVE-2026-44720, GHSA-223g-f5mq-gw33 | Medium | 0.2% | 13 May, 2026 | npm openlearnx |
SillyTavern has a SSRF vulnerability in the CORS proxy middleware CVE-2026-44652, GHSA-ccfq-2454-f5xw | Medium | 0.4% | 12 May, 2026 | npm sillytavern |
SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware CVE-2026-44651, GHSA-xc4x-2452-5gc9 | Medium | 0.3% | 12 May, 2026 | npm sillytavern |
OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS CVE-2026-42073, GHSA-c73c-x77g-854r | Medium | 0.3% | 12 May, 2026 | npm @gitlawb/openclaude |
protobuf.js: Denial of service from crafted field names in generated code CVE-2026-44294, GHSA-2pr8-phx7-x9h3 | Medium | 0.4% | 12 May, 2026 | npm protobufjs |
protobuf.js: Prototype injection in generated message constructors CVE-2026-44292, GHSA-fx83-v9x8-x52w | Medium | 0.3% | 12 May, 2026 | npm protobufjs |
protobufjs has overlong UTF-8 decoding CVE-2026-44288, GHSA-q6x5-8v7m-xcrf | Medium | 0.3% | 12 May, 2026 | npm @protobufjs/utf8 npm protobufjs |
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins CVE-2026-6402, GHSA-79cf-xcqc-c78w | Medium | 0.3% | 12 May, 2026 | npm webpack-dev-server |
Mermaid: Improper sanitization of configuration leads to CSS injection CVE-2026-41159, GHSA-87f9-hvmw-gh4p | Medium | 0.5% | 11 May, 2026 | npm mermaid |
Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS CVE-2026-41150, GHSA-6m6c-36f7-fhxh | Medium | 0.4% | 11 May, 2026 | npm mermaid |
Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection CVE-2026-41149, GHSA-ghcm-xqfw-q4vr | Medium | 0.4% | 11 May, 2026 | npm mermaid |
Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection CVE-2026-41148, GHSA-xcj9-5m2h-648r | Medium | 0.3% | 11 May, 2026 | npm mermaid |
@steipete/summarize allows local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json CVE-2026-45222, GHSA-qp7v-gjgg-4mj6 | Medium | 0.1% | 11 May, 2026 | npm @steipete/summarize |
Next.js's Middleware / Proxy redirects can be cache-poisoned CVE-2026-44572, GHSA-3g8h-86w9-wvmq | Medium | 0.3% | 11 May, 2026 | npm next |
Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces CVE-2026-44581, GHSA-ffhc-5mcf-pf4q | Medium | 0.2% | 11 May, 2026 | npm next |
Next.js has cross-site scripting in beforeInteractive scripts with untrusted input CVE-2026-44580, GHSA-gx5p-jg67-6x7h | Medium | 0.2% | 11 May, 2026 | npm next |
Next.js has a Denial of Service in the Image Optimization API CVE-2026-44577, GHSA-h64f-5h5j-jqjh | Medium | 0.7% | 11 May, 2026 | npm next |
Next.js vulnerable to cache poisoning in React Server Component responses CVE-2026-44576, GHSA-wfc6-r584-vfw7 | Medium | 0.3% | 11 May, 2026 | npm next |
Hono has CSS Declaration Injection via Style Object Values in JSX SSR CVE-2026-44458, GHSA-qp7p-654g-cw7p | Medium | 0.2% | 09 May, 2026 | npm hono |
Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage CVE-2026-44457, GHSA-p77w-8qqv-26rm | Medium | 0.2% | 09 May, 2026 | npm hono |
eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fields CVE-2026-44214, GHSA-m9g3-3g99-mhpx | Medium | 0.3% | 08 May, 2026 | npm eventsource-encoder |
@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry GHSA-qhh4-458h-xwh2 | Medium | Not scored | 08 May, 2026 | npm @cyclonedx/cdxgen |
fast-xml-builder Comment Value regex can be bypassed CVE-2026-44664, GHSA-45c6-75p6-83cc | Medium | 0.2% | 08 May, 2026 | npm fast-xml-builder |
vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL` CVE-2026-92963, GHSA-2cm2-m3w5-gp2f | Medium | 0.3% | 08 May, 2026 | npm vm2 |
Electerm's full process.env exposed to renderer via window.pre.env CVE-2026-43942, GHSA-37j4-88rp-2f6h | Medium | 0.1% | 08 May, 2026 | npm electerm |
short-video-maker has a path traversal vulnerability CVE-2026-8115, GHSA-935g-9rq5-q95c | Medium | 0.6% | 07 May, 2026 | npm short-video-maker |
vm2's Transformer Fast-Path Bypass Exposes Internal State Variable CVE-2026-44003, GHSA-wp5r-2gw5-m7q7 | Medium | 0.2% | 07 May, 2026 | npm vm2 |
vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak CVE-2026-44002, GHSA-v27g-jcqj-v8rw | Medium | 0.2% | 07 May, 2026 | npm vm2 |
Vercel: Non-interactive mode includes CLI arguments in suggested command output CVE-2026-44479, GHSA-pgf8-2hgj-grqg | Medium | 0.2% | 07 May, 2026 | npm vercel |
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests CVE-2026-44456, GHSA-9vqf-7f2p-gf9v | Medium | 0.2% | 06 May, 2026 | npm hono |
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection CVE-2026-44455, GHSA-69xw-7hcm-h432 | Medium | 0.1% | 06 May, 2026 | npm hono |
Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix CVE-2026-44437, GHSA-69xr-m8h6-h664 | Medium | 0.2% | 06 May, 2026 | npm @angular/ssr |
@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening GHSA-cqmh-pcgr-q42f | Medium | Not scored | 06 May, 2026 | npm @axonflow/openclaw |
axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification GHSA-mph8-9v29-pm42 | Medium | Not scored | 06 May, 2026 | npm @axonflow/sdk |
Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks CVE-2026-44374, GHSA-p7g9-rp3g-mgfg | Medium | 0.2% | 06 May, 2026 | npm @backstage/plugin-catalog-backend-module-unprocessed npm @backstage/plugin-catalog-unprocessed-entities npm @backstage/plugin-catalog-unprocessed-entities-common |
Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules CVE-2026-44372, GHSA-9phm-9p8f-hw5m | Medium | 0.3% | 06 May, 2026 | npm nitro npm nitropack |
Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` CVE-2026-44373, GHSA-5w89-w975-hf9q | Medium | 0.5% | 06 May, 2026 | npm nitro npm nitropack |
next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys GHSA-4c35-wcg5-mm9h | Medium | Not scored | 06 May, 2026 | npm next-intl |
Flowise: Bcrypt Password Hash Exposure CVE-2026-8026, GHSA-8f47-4rh3-x44m | Medium | 0.3% | 06 May, 2026 | npm flowise |
sse-channel: SSE Injection via unsanitized event fields CVE-2026-44217, GHSA-84hm-wfh8-c5pg | Medium | 0.5% | 05 May, 2026 | npm sse-channel |
ip-address has XSS in Address6 HTML-emitting methods CVE-2026-42338, GHSA-v2v4-37r5-5v8g | Medium | 0.5% | 05 May, 2026 | npm ip-address |
@evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS GHSA-7xp7-m392-h92c | Medium | Not scored | 05 May, 2026 | npm @evomap/evolver |
OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload CVE-2026-45005, GHSA-q8ff-7ffm-m3r9 | Medium | 0.3% | 05 May, 2026 | npm openclaw |
@workos/authkit-session has an Open Redirect via state-derived redirect target CVE-2026-42565, GHSA-vvvv-983w-r7pv | Medium | 0.2% | 05 May, 2026 | npm @workos/authkit-session |
LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution CVE-2026-42045, GHSA-xq4x-622m-q8fq | Medium | 0.3% | 05 May, 2026 | npm @lobehub/lobehub |
OpenClaw contains a symlink traversal vulnerability CVE-2026-43570, GHSA-35mw-5vvr-vrxc, GHSA-cr8r-7g2h-6wr6 | Medium | 0.3% | 05 May, 2026 | npm openclaw |