Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in aio-commerce-lib-app (npm) GHSA-897j-xx2q-x2h9, MAL-2026-11022 | Malicious | Not scored | 23 Jul, 2026 | npm aio-commerce-lib-app |
Malicious release: Malicious code in helix-deploy (npm) GHSA-fhpm-cq57-j289, MAL-2026-11028 | Malicious | Not scored | 23 Jul, 2026 | npm helix-deploy |
Malicious release: Malicious code in da-sc-sdk (npm) GHSA-vxfh-w38r-2g54, MAL-2026-11025 | Malicious | Not scored | 23 Jul, 2026 | npm da-sc-sdk |
Malicious release: Malicious code in ethers-packge (npm) GHSA-67vw-rvv3-mh93, MAL-2026-11026 | Malicious | Not scored | 23 Jul, 2026 | npm ethers-packge |
Malicious release: Malicious code in bs58-88 (npm) GHSA-qj7h-vp7h-8v85, MAL-2026-11023 | Malicious | Not scored | 23 Jul, 2026 | npm bs58-88 |
Malicious release: Malicious code in @bcryptln/bcryptjs (npm) GHSA-qw92-vxcv-397r, MAL-2026-11021 | Malicious | Not scored | 23 Jul, 2026 | npm @bcryptln/bcryptjs |
Malicious release: Malicious code in hardhat-gas-tracker (npm) MAL-2026-11020 | Malicious | Not scored | 22 Jul, 2026 | npm hardhat-gas-tracker |
n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation CVE-2026-72750, GHSA-652q-gvq3-74qv | Medium | 0.5% | 22 Jul, 2026 | npm n8n |
n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances CVE-2026-72775, GHSA-jqwr-vx3p-r266 | Medium | 0.5% | 22 Jul, 2026 | npm n8n |
n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner CVE-2026-72764, GHSA-9cmh-xcqm-5hqr | Medium | 0.8% | 22 Jul, 2026 | npm n8n |
Next.js: Server-Side Request Forgery in Server Actions on custom servers CVE-2026-64649, GHSA-89xv-2m56-2m9x | High | 0.5% | 22 Jul, 2026 | npm next |
Next.js: Cache confusion of response bodies for requests with bodies CVE-2026-64648, GHSA-68g3-v927-f742 | Medium | 0.3% | 22 Jul, 2026 | npm next |
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences CVE-2026-64647, GHSA-4633-3j49-mh5q | Medium | 0.3% | 22 Jul, 2026 | npm next |
Next.js: Unbounded Server Action payload in Edge runtime CVE-2026-64646, GHSA-4c39-4ccg-62r3 | Medium | 0.5% | 22 Jul, 2026 | npm next |
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname CVE-2026-64645, GHSA-p9j2-gv94-2wf4 | High | 0.4% | 22 Jul, 2026 | npm next |
Next.js: Denial of Service in the Image Optimization API using SVGs CVE-2026-64644, GHSA-q8wf-6r8g-63ch | Medium | 0.7% | 22 Jul, 2026 | npm next |
Next.js: Unauthenticated disclosure of internal Server Function endpoints CVE-2026-64643, GHSA-955p-x3mx-jcvp | Medium | 0.5% | 22 Jul, 2026 | npm next |
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale CVE-2026-64642, GHSA-6gpp-xcg3-4w24 | High | 0.6% | 22 Jul, 2026 | npm next |
Next.js: Denial of Service in App Router using Server Actions CVE-2026-64641, GHSA-m99w-x7hq-7vfj | High | 0.9% | 22 Jul, 2026 | npm next |
danger allows local OS command injection through crafted file paths CVE-2026-16629, GHSA-3x93-p86w-5jvh | Medium | 1.1% | 22 Jul, 2026 | npm danger |
n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory CVE-2026-72773, GHSA-pf2q-pxhf-hgmw | Medium | 0.6% | 22 Jul, 2026 | npm n8n |
n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service CVE-2026-72769, GHSA-hx4h-vr3m-45vh | Medium | 0.5% | 22 Jul, 2026 | npm n8n |
n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service CVE-2026-72749, GHSA-xwx6-jjhv-84p8 | High | 0.6% | 22 Jul, 2026 | npm n8n |
n8n: Edit Image Node Format Injection Allows Arbitrary File Write CVE-2026-72762, GHSA-xmc9-4f2h-jf9c | High | 0.5% | 22 Jul, 2026 | npm n8n |
n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON CVE-2026-72763, GHSA-cj9h-qx8g-pq2g | High | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType` CVE-2026-72774, GHSA-6qc9-mqvw-jg7x | High | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: Expression sandbox escape via arrow-function bodies enabling command execution CVE-2026-72765, GHSA-gv7g-jm28-cr3m | High | 0.9% | 22 Jul, 2026 | npm n8n |
n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion CVE-2026-72766, GHSA-2x35-3fw4-9jr4 | High | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: Authenticated code execution in the n8n Git node CVE-2026-72767, GHSA-rcv6-pvrj-4xcg | High | 0.9% | 22 Jul, 2026 | npm n8n |
n8n: SSRF Protection Bypass via MCP Client Node CVE-2026-72768, GHSA-vhf8-cg2h-cg3p | Medium | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction CVE-2026-72770, GHSA-gf29-4f56-r2jf | High | 0.7% | 22 Jul, 2026 | npm n8n |
n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes CVE-2026-72771, GHSA-64xh-79j6-r5v8 | High | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login CVE-2026-72772, GHSA-8342-988q-86cr | High | 0.4% | 22 Jul, 2026 | npm n8n |
Malicious release: Malicious code in application-util (npm) MAL-2026-11000 | Malicious | Not scored | 22 Jul, 2026 | npm application-util |
Malicious release: Malicious code in web3-terminal (npm) MAL-2026-11007 | Malicious | Not scored | 22 Jul, 2026 | npm web3-terminal |
Malicious release: Malicious code in habinger (npm) MAL-2026-11002 | Malicious | Not scored | 22 Jul, 2026 | npm habinger |
Malicious release: Malicious code in encryptstringadmincore (npm) GHSA-hgfq-c4x3-jx2r, MAL-2026-11013 | Malicious | Not scored | 22 Jul, 2026 | npm encryptstringadmincore |
Malicious release: Malicious code in encrypt-string-ttak (npm) GHSA-mpgp-492w-x7xj, MAL-2026-11011 | Malicious | Not scored | 22 Jul, 2026 | npm encrypt-string-ttak |
Malicious release: Malicious code in encryptstringadmin (npm) GHSA-x92w-56m5-jchf, MAL-2026-11012 | Malicious | Not scored | 22 Jul, 2026 | npm encryptstringadmin |
Malicious release: Malicious code in n8n-nodes-net-utils (npm) MAL-2026-11003 | Malicious | Not scored | 22 Jul, 2026 | npm n8n-nodes-net-utils |
Malicious release: Malicious code in n8n-nodes-pwn (npm) MAL-2026-11004 | Malicious | Not scored | 22 Jul, 2026 | npm n8n-nodes-pwn |
Malicious release: Malicious code in n8n-nodes-quick-utils (npm) MAL-2026-11005 | Malicious | Not scored | 22 Jul, 2026 | npm n8n-nodes-quick-utils |
Malicious release: Malicious code in n8n-nodes-utils-helper (npm) MAL-2026-11006 | Malicious | Not scored | 22 Jul, 2026 | npm n8n-nodes-utils-helper |
Malicious release: Malicious code in n8n-nodes-http-probe (npm) MAL-2026-10997 | Malicious | Not scored | 22 Jul, 2026 | npm n8n-nodes-http-probe |
Malicious release: Malicious code in n8n-nodes-port-scanner (npm) MAL-2026-10998 | Malicious | Not scored | 22 Jul, 2026 | npm n8n-nodes-port-scanner |
Malicious release: Malicious code in habingeer (npm) MAL-2026-10995 | Malicious | Not scored | 22 Jul, 2026 | npm habingeer |
Malicious release: Malicious code in app-data-ist (npm) GHSA-wcx6-x67q-wff5, MAL-2026-10994 | Malicious | Not scored | 22 Jul, 2026 | npm app-data-ist |
Malicious release: Malicious code in init-js-examples (npm) MAL-2026-10996 | Malicious | Not scored | 22 Jul, 2026 | npm init-js-examples |
Malicious release: Malicious code in n8n-nodes-task-runner (npm) MAL-2026-10999 | Malicious | Not scored | 22 Jul, 2026 | npm n8n-nodes-task-runner |
Malicious release: Malicious code in kijai (npm) GHSA-5mgj-24pj-pj6f, MAL-2026-11014 | Malicious | Not scored | 22 Jul, 2026 | npm kijai |