Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Budibase: Privilege escalation via public role assignment API missing app-level authorization CVE-2026-73305, GHSA-j9fc-w3mr-x6mv | High | 0.5% | 24 Jul, 2026 | npm @budibase/server |
Malicious release: Malicious code in app-data-layer (npm) GHSA-346c-3w9c-8pmh, MAL-2026-11052 | Malicious | Not scored | 24 Jul, 2026 | npm app-data-layer |
Malicious release: Malicious code in app-node-layer (npm) GHSA-4xc7-2jx9-rp5j, MAL-2026-11054 | Malicious | Not scored | 24 Jul, 2026 | npm app-node-layer |
Malicious release: Malicious code in app-data-lts (npm) GHSA-c6xr-m3x3-23fm, MAL-2026-11053 | Malicious | Not scored | 24 Jul, 2026 | npm app-data-lts |
js-yaml: Exponential parsing time in flow collections leads to denial of service CVE-2026-73643, GHSA-pm4m-ph32-ghv5 | High | 0.5% | 24 Jul, 2026 | npm js-yaml |
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response GHSA-qwww-vcr4-c8h2 | High | Not scored | 24 Jul, 2026 | npm react-router |
AWS CDK CodeBuild S3 Log Encryption Boolean Inversion GHSA-464c-974j-9xm6, GO-2026-6093 | Low | Not scored | 24 Jul, 2026 | Go github.com/aws/aws-cdk-go/awscdk Go github.com/aws/aws-cdk-go/awscdk/v2 Maven software.amazon.awscdk:aws-cdk-lib Maven software.amazon.awscdk:codebuild +7 more |
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection CVE-2026-73566, GHSA-r292-9mhp-454m | High | 0.5% | 24 Jul, 2026 | npm tar |
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure CVE-2026-73646, GHSA-r28c-9q8g-f849 | High | 0.5% | 24 Jul, 2026 | npm postcss |
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer CVE-2026-73299, GHSA-w28w-gp39-m4p6 | Critical | 1.8% | 24 Jul, 2026 | npm @prompty/core |
Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter) BIT-mongoose-2026-73562, CVE-2026-73562, GHSA-664h-wqgq-64gw | Medium | 0.5% | 24 Jul, 2026 | npm mongoose |
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix) CVE-2026-73649, GHSA-7gfh-x38p-prh3 | Critical | 0.7% | 24 Jul, 2026 | npm velocityjs |
@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass CVE-2026-73563, GHSA-38hq-7x33-php4 | Medium | 0.2% | 24 Jul, 2026 | npm @backstage/plugin-auth-backend |
Trix: Stored XSS via HTMLParser attribute injection on paste CVE-2026-73428, GHSA-53g2-mvcc-q9x3 | Medium | 0.4% | 24 Jul, 2026 | RubyGems action_text-trix npm trix |
Valibot: record() issue paths can make flatten() throw for inherited Object property names CVE-2026-59952, GHSA-5qjj-4xww-7phc | Medium | 0.4% | 24 Jul, 2026 | npm valibot |
seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization CVE-2026-59940, GHSA-mv8w-475r-vwqw | Critical | 0.8% | 24 Jul, 2026 | npm seroval |
SvelteKit: Prototype pollution in file input deletion path in remote-function forms CVE-2026-82257, GHSA-866w-xmhq-wj7x | Medium | 0.4% | 24 Jul, 2026 | npm @sveltejs/kit |
SvelteKit: Big remote form function payloads can cause Node process to crash CVE-2026-82256, GHSA-wqjv-9729-c5q2 | Medium | 0.4% | 24 Jul, 2026 | npm @sveltejs/kit |
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in CVE-2026-67327, GHSA-qq9h-g4jm-xgf3 | High | 0.4% | 24 Jul, 2026 | npm better-auth |
@better-auth/stripe: cross-organization billing tampering in organization subscription actions CVE-2026-67329, GHSA-h3rm-78g3-j7cp | High | 0.3% | 24 Jul, 2026 | npm @better-auth/stripe |
@better-auth/scim: account takeover and stale access via SCIM provider-id collision CVE-2026-67330, GHSA-rjg6-39jm-rgg4 | Critical | 0.6% | 24 Jul, 2026 | npm @better-auth/scim |
React Router: Unauthenticated Denial of Service via Inefficient Route Matching CVE-2026-55685, GHSA-chx6-hx7r-mcp5 | High | 0.7% | 24 Jul, 2026 | npm react-router |
Malicious release: Malicious code in subapp-pkg-util (npm) GHSA-f946-r32q-xrp6, MAL-2026-11045 | Malicious | Not scored | 24 Jul, 2026 | npm subapp-pkg-util |
Malicious release: Malicious code in @daylightqc/date-fmt-lite (npm) MAL-2026-11041 | Malicious | Not scored | 24 Jul, 2026 | npm @daylightqc/date-fmt-lite |
Malicious release: Malicious code in eth-slint (npm) GHSA-xp97-c4c4-7928, MAL-2026-11034 | Malicious | Not scored | 23 Jul, 2026 | npm eth-slint |
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) CVE-2026-53669, GHSA-wrjc-x8rr-h8h6 | Medium | 0.3% | 23 Jul, 2026 | npm react-router |
React Router: Open redirect leading to XSS CVE-2026-53668, GHSA-jjmj-jmhj-qwj2 | Medium | 0.3% | 23 Jul, 2026 | npm react-router npm react-router-dom |
React Router: RSCErrorHandler Missing Protocol Validation (XSS) CVE-2026-53667, GHSA-h8fp-f39c-q6mh | Medium | 0.4% | 23 Jul, 2026 | npm react-router |
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration CVE-2026-53666, GHSA-337j-9hxr-rhxg | Medium | 0.4% | 23 Jul, 2026 | npm react-router |
find-my-way: DDoS with HTTP2 CVE-2026-47219, GHSA-c96f-x56v-gq3h | High | 0.5% | 23 Jul, 2026 | npm find-my-way |
Malicious release: Malicious code in chai-as-stringify (npm) GHSA-vh7h-h87g-qv6x, MAL-2026-11032 | Malicious | Not scored | 23 Jul, 2026 | npm chai-as-stringify |
Malicious release: Malicious code in yuinpm (npm) GHSA-vpgm-qmgp-w4h4, MAL-2026-11039 | Malicious | Not scored | 23 Jul, 2026 | npm yuinpm |
Malicious release: Malicious code in eth-codergen (npm) GHSA-87w3-vjw9-8h4w, MAL-2026-11033 | Malicious | Not scored | 23 Jul, 2026 | npm eth-codergen |
Malicious release: Malicious code in streak-lib-math (npm) GHSA-c7rv-9j9g-pqh2, MAL-2026-11036 | Malicious | Not scored | 23 Jul, 2026 | npm streak-lib-math |
Malicious release: Malicious code in svelte-streak-metrics (npm) GHSA-fc4x-xfq3-5f35, MAL-2026-11038 | Malicious | Not scored | 23 Jul, 2026 | npm svelte-streak-metrics |
Malicious release: Malicious code in svelte-goal-streak (npm) GHSA-jw9g-wvg5-7rjg, MAL-2026-11037 | Malicious | Not scored | 23 Jul, 2026 | npm svelte-goal-streak |
Malicious release: Malicious code in streak-bucket-lib (npm) GHSA-rg2p-8587-wx3w, MAL-2026-11035 | Malicious | Not scored | 23 Jul, 2026 | npm streak-bucket-lib |
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments CVE-2026-45623, GHSA-6g55-p6wh-862q | Critical | 0.6% | 23 Jul, 2026 | npm postcss |
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error) CVE-2026-73421, GHSA-8fpg-xm3f-6cx3 | Critical | 0.6% | 23 Jul, 2026 | npm next-auth |
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers CVE-2026-73418, GHSA-xmf8-cvqr-rfgj | High | 0.9% | 23 Jul, 2026 | npm @auth/core npm next-auth |
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass CVE-2026-73420, GHSA-7rqj-j65f-68wh | Critical | 0.7% | 23 Jul, 2026 | npm @auth/core npm next-auth |
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them CVE-2026-73419, GHSA-x445-f3h2-j279 | Medium | 0.2% | 23 Jul, 2026 | npm @auth/core npm next-auth |
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash CVE-2026-14257, GHSA-mh99-v99m-4gvg | High | 0.6% | 23 Jul, 2026 | npm brace-expansion |
@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths CVE-2026-7120, GHSA-8pvw-jcv7-9cmj | Medium | 0.4% | 23 Jul, 2026 | npm @fastify/static |
@fastify/static vulnerable to route guard bypass via path traversal CVE-2026-15074, GHSA-83w8-p2f5-377r | High | 0.7% | 23 Jul, 2026 | npm @fastify/static |
Malicious release: Malicious code in vitest-axios (npm) GHSA-6v5g-7h35-h33q, MAL-2026-11030 | Malicious | Not scored | 23 Jul, 2026 | npm vitest-axios |
Malicious release: Malicious code in fs-extra-core (npm) GHSA-f246-8cf4-26v7, MAL-2026-11027 | Malicious | Not scored | 23 Jul, 2026 | npm fs-extra-core |
Malicious release: Malicious code in create-kumo-project (npm) GHSA-7jg3-v58m-2f3p, MAL-2026-11024 | Malicious | Not scored | 23 Jul, 2026 | npm create-kumo-project |
Malicious release: Malicious code in lychee-norm-cache (npm) GHSA-pj38-6jj4-4x3p, MAL-2026-11029 | Malicious | Not scored | 23 Jul, 2026 | npm lychee-norm-cache |
Malicious release: Malicious code in aio-commerce-lib-app (npm) GHSA-897j-xx2q-x2h9, MAL-2026-11022 | Malicious | Not scored | 23 Jul, 2026 | npm aio-commerce-lib-app |