Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in fazzanime (npm) GHSA-r3jh-34p6-m7xp, MAL-2026-11085 | Malicious | Not scored | 27 Jul, 2026 | npm fazzanime |
Malicious release: Malicious code in fazzgram (npm) GHSA-vjhp-hr8c-42m8, MAL-2026-11086 | Malicious | Not scored | 27 Jul, 2026 | npm fazzgram |
Malicious release: Malicious code in @fazzcode/baileys (npm) GHSA-wqqq-qm88-5433, MAL-2026-11073 | Malicious | Not scored | 27 Jul, 2026 | npm @fazzcode/baileys |
Malicious release: Malicious code in @sqlite-tag/sql-creator (npm) GHSA-6vr8-7f3x-9c9r, MAL-2026-11077 | Malicious | Not scored | 27 Jul, 2026 | npm @sqlite-tag/sql-creator |
Malicious release: Malicious code in @sqlite-tag/schema-generator (npm) GHSA-hpc8-vc57-jjcp, MAL-2026-11076 | Malicious | Not scored | 27 Jul, 2026 | npm @sqlite-tag/schema-generator |
Malicious release: Malicious code in @sqlite-frame/createsql (npm) GHSA-723v-4wq3-j58v, MAL-2026-11075 | Malicious | Not scored | 27 Jul, 2026 | npm @sqlite-frame/createsql |
Malicious release: Malicious code in express-self-destruct1 (npm) GHSA-4h93-54g6-hm75, MAL-2026-11084 | Malicious | Not scored | 27 Jul, 2026 | npm express-self-destruct1 |
Malicious release: Malicious code in @my_name_is_khn/express-security-tool-v2 (npm) GHSA-v2gc-c6j4-6gq8, MAL-2026-11074 | Malicious | Not scored | 27 Jul, 2026 | npm @my_name_is_khn/express-security-tool-v2 |
Malicious release: Malicious code in @ks-radar/radar (npm) MAL-2026-11066 | Malicious | Not scored | 25 Jul, 2026 | npm @ks-radar/radar |
Malicious release: Malicious code in swiper_angular (npm) GHSA-r6m9-x8fm-wq5c, MAL-2026-11065 | Malicious | Not scored | 25 Jul, 2026 | npm swiper_angular |
Malicious release: Malicious code in whs4_deu (npm) MAL-2026-11070 | Malicious | Not scored | 25 Jul, 2026 | npm whs4_deu |
Malicious release: Malicious code in wsh4_edu (npm) MAL-2026-11072 | Malicious | Not scored | 25 Jul, 2026 | npm wsh4_edu |
Malicious release: Malicious code in whs4_eud (npm) MAL-2026-11071 | Malicious | Not scored | 25 Jul, 2026 | npm whs4_eud |
Malicious release: Malicious code in page-navigation (npm) MAL-2026-11064 | Malicious | Not scored | 25 Jul, 2026 | npm page-navigation |
Malicious release: Malicious code in identityscimapiserv (npm) GHSA-gv4f-vm3w-7v7w, MAL-2026-11061 | Malicious | Not scored | 25 Jul, 2026 | npm identityscimapiserv |
Malicious release: Malicious code in xo-member-components (npm) GHSA-r5v8-7g3c-jp8w, MAL-2026-11063 | Malicious | Not scored | 25 Jul, 2026 | npm xo-member-components |
Malicious release: Malicious code in f0-form-manipulator (npm) GHSA-r235-8hvg-777j, MAL-2026-11060 | Malicious | Not scored | 25 Jul, 2026 | npm f0-form-manipulator |
Malicious release: Malicious code in preferenceslifecycle-paypal (npm) GHSA-jpjh-7qpg-hqxv, MAL-2026-11062 | Malicious | Not scored | 25 Jul, 2026 | npm preferenceslifecycle-paypal |
Malicious release: Malicious code in merchantprefsservice-paypal (npm) GHSA-w6fc-gq73-j24m, MAL-2026-11057 | Malicious | Not scored | 25 Jul, 2026 | npm merchantprefsservice-paypal |
Malicious release: Malicious code in gpaas-paypal (npm) GHSA-c77x-6gm9-q7mf, MAL-2026-11056 | Malicious | Not scored | 25 Jul, 2026 | npm gpaas-paypal |
Malicious release: Malicious code in pp-react-ui5 (npm) GHSA-6h4j-g3j5-97rc, MAL-2026-11059 | Malicious | Not scored | 25 Jul, 2026 | npm pp-react-ui5 |
Malicious release: Malicious code in payoutsvettingserv-paypal (npm) GHSA-q284-v87w-8w6f, MAL-2026-11058 | Malicious | Not scored | 25 Jul, 2026 | npm payoutsvettingserv-paypal |
Malicious release: Malicious code in fundraiserservicepp (npm) MAL-2026-11055 | Malicious | Not scored | 25 Jul, 2026 | npm fundraiserservicepp |
FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller GHSA-8q49-2h5h-434x | Medium | Not scored | 24 Jul, 2026 | npm @frontmcp/adapters |
Quasar: Prototype pollution in the extend() utility CVE-2026-73647, GHSA-3r53-75j5-3g7j | Medium | 0.4% | 24 Jul, 2026 | npm quasar |
Shescape: Quadratic-time denial of service in the flag-protection CVE-2026-73413, GHSA-gm3r-q2wp-hw87 | High | 0.6% | 24 Jul, 2026 | npm shescape |
Shescape: Home-directory disclosure in assignment context on Unix with Dash CVE-2026-73411, GHSA-q53c-4prm-w95q | Medium | 0.6% | 24 Jul, 2026 | npm shescape |
Shescape: Shell injection via unescaped parentheses on Windows with CMD CVE-2026-73414, GHSA-w4hw-qcx7-56pr | Critical | 0.9% | 24 Jul, 2026 | npm shescape |
Shescape: Path disclosure on Unix with Zsh CVE-2026-73412, GHSA-6v4m-fw66-8r4x | Medium | 0.6% | 24 Jul, 2026 | npm shescape |
sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock CVE-2026-73567, GHSA-vh45-f885-3848 | Critical | 0.4% | 24 Jul, 2026 | npm sm-crypto |
Malicious release: Malicious code in clerk-next-fix-auth-protection (npm) MAL-2026-11069 | Malicious | Not scored | 24 Jul, 2026 | npm clerk-next-fix-auth-protection |
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion CVE-2026-73561, GHSA-g5vv-q72c-7j78 | High | 0.6% | 24 Jul, 2026 | npm @anephenix/hub |
Budibase: SSRF via bare fetch() in uploadUrl during AI table generation CVE-2026-73307, GHSA-hfhx-w8p8-4hc7 | Medium | 0.4% | 24 Jul, 2026 | npm @budibase/server |
Budibase: SSRF via DNS rebinding in the REST datasource integration CVE-2026-73410, GHSA-v42f-v8xc-j435 | High | 0.3% | 24 Jul, 2026 | npm @budibase/server |
Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete CVE-2026-73617, GHSA-pmpg-2mxq-6xwr | High | 0.3% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Account Enumeration via Login Lockout Response Differential CVE-2026-73306, GHSA-cr7p-cr3q-h5cm | Medium | 0.4% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF) CVE-2026-72849, GHSA-pvcr-8mvp-w8qr | High | 0.2% | 24 Jul, 2026 | npm @budibase/server |
Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector CVE-2026-73408, GHSA-2xgg-r2wc-c5r2 | High | 0.5% | 24 Jul, 2026 | npm @budibase/server |
Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution CVE-2026-73618, GHSA-qw6m-8fw2-2v64 | High | 0.4% | 24 Jul, 2026 | npm @budibase/server |
Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders CVE-2026-73308, GHSA-gh4h-34gr-87r7 | Medium | 0.4% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint CVE-2026-73406, GHSA-hr66-5mqr-8mpx | High | 0.5% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak CVE-2026-73407, GHSA-mqhr-6j6h-74p5 | Critical | 0.5% | 24 Jul, 2026 | npm @budibase/server |
Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified CVE-2026-73302, GHSA-hp6v-6jw7-gv2f | Critical | 0.4% | 24 Jul, 2026 | npm @budibase/server |
Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution CVE-2026-72855, GHSA-xg5g-26x8-cvf4 | High | 0.4% | 24 Jul, 2026 | npm @budibase/server |
Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs CVE-2026-72859, GHSA-xcx6-4f2g-hhgx | High | 0.2% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile CVE-2026-73409, GHSA-ppr4-5f46-j9c6 | High | 0.3% | 24 Jul, 2026 | npm @budibase/server |
Budibase: SQL Injection via `multipleStatements: true` CVE-2026-73300, GHSA-q6x4-v3qx-85qw | Critical | 0.6% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session) CVE-2026-73303, GHSA-c8vc-7pv3-g98p | High | 0.3% | 24 Jul, 2026 | npm @budibase/server |
Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users CVE-2026-73304, GHSA-fcrw-f7gg-6g9f | Medium | 0.5% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings CVE-2026-73301, GHSA-4qcj-m5wp-jmf4 | Medium | 0.3% | 24 Jul, 2026 | npm @budibase/server |