Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in vantora (npm) GHSA-4fm5-fwqx-8r39, MAL-2026-11016 | Malicious | Not scored | 22 Jul, 2026 | npm vantora |
Malicious release: Malicious code in veskr (npm) GHSA-77c3-35xp-6chp, MAL-2026-11019 | Malicious | Not scored | 22 Jul, 2026 | npm veskr |
Malicious release: Malicious code in calmora (npm) GHSA-7wwx-476f-c8gm, MAL-2026-11009 | Malicious | Not scored | 22 Jul, 2026 | npm calmora |
Malicious release: Malicious code in caldryn (npm) GHSA-h9c8-8wq8-r6q2, MAL-2026-11008 | Malicious | Not scored | 22 Jul, 2026 | npm caldryn |
Malicious release: Malicious code in calvora (npm) GHSA-jwm3-4ffq-hr73, MAL-2026-11010 | Malicious | Not scored | 22 Jul, 2026 | npm calvora |
Malicious release: Malicious code in veldora (npm) GHSA-wxrm-vmq9-jp23, MAL-2026-11018 | Malicious | Not scored | 22 Jul, 2026 | npm veldora |
Malicious release: Malicious code in vectormark (npm) GHSA-g48p-2cr5-5hm2, MAL-2026-11017 | Malicious | Not scored | 22 Jul, 2026 | npm vectormark |
Malicious release: Malicious code in react-tabulix-query (npm) GHSA-4rrq-g9w7-39c3, MAL-2026-11015 | Malicious | Not scored | 22 Jul, 2026 | npm react-tabulix-query |
Malicious release: Malicious code in react-tabulix-extended (npm) MAL-2026-11040 | Malicious | Not scored | 22 Jul, 2026 | npm react-tabulix-extended |
n8n: Google Service Account Private Key Exposed in JWT Header CVE-2026-65599, GHSA-9r8p-h6cc-6qhm | Medium | 0.2% | 22 Jul, 2026 | npm n8n |
n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution CVE-2026-65598, CVE-2026-71539, GHSA-g3r5-9h93-4j2c | High | 0.3% | 22 Jul, 2026 | npm n8n |
n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview CVE-2026-65597, GHSA-p3rg-hrf9-w9gj | High | 0.3% | 22 Jul, 2026 | npm n8n |
n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction CVE-2026-65596, GHSA-gq66-9cw5-j5jm | Medium | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs CVE-2026-65595, GHSA-777w-rpr6-c52h | High | 0.7% | 22 Jul, 2026 | npm n8n |
n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check CVE-2026-65594, GHSA-q5xf-xhwf-cwqf | Medium | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access CVE-2026-65593, GHSA-9w78-79q7-r4fp | Medium | 0.2% | 22 Jul, 2026 | npm n8n |
n8n: Stored DOM XSS via Resource Locator `cachedResultUrl` CVE-2026-65592, GHSA-9wcp-9r3j-383q | High | 0.2% | 22 Jul, 2026 | npm n8n |
n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution CVE-2026-65591, GHSA-pm35-fqvh-cq5g | High | 0.7% | 22 Jul, 2026 | npm n8n |
n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows CVE-2026-65590, GHSA-fpg6-x68q-5793 | Medium | 0.6% | 22 Jul, 2026 | npm n8n |
n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data CVE-2026-65589, GHSA-89gh-3pgc-v5h2 | Medium | 0.5% | 22 Jul, 2026 | npm n8n |
n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner CVE-2026-65016, GHSA-35q8-9mj6-wjmf | High | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool CVE-2026-65015, GHSA-x5vx-c2c8-m3w9 | High | 0.6% | 22 Jul, 2026 | npm n8n |
n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook CVE-2026-65014, GHSA-33q9-f52j-gc75 | Medium | 0.6% | 22 Jul, 2026 | npm n8n |
fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives CVE-2026-45820, GHSA-px8p-9vwx-vf98 | Medium | 0.3% | 22 Jul, 2026 | npm fflate |
Malicious release: Malicious code in streak-calendar (npm) GHSA-2p69-mmpj-h84r, MAL-2026-10981 | Malicious | Not scored | 21 Jul, 2026 | npm streak-calendar |
Malicious release: Malicious code in streak-daycount (npm) GHSA-2v57-6hmf-hpfj, MAL-2026-10982 | Malicious | Not scored | 21 Jul, 2026 | npm streak-daycount |
Malicious release: Malicious code in svelte-streaks (npm) GHSA-8vq2-5c69-fm3w, MAL-2026-10983 | Malicious | Not scored | 21 Jul, 2026 | npm svelte-streaks |
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 CVE-2026-114113, GHSA-f88m-g3jw-g9cj | High | 0.1% | 21 Jul, 2026 | npm sharp |
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits CVE-2026-73569, GHSA-8r6m-32jq-jx6q | High | 0.5% | 21 Jul, 2026 | npm fast-xml-parser |
Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake CVE-2026-73565, GHSA-9mqv-5hh9-4cgg | Medium | 0.5% | 21 Jul, 2026 | npm @hono/node-server |
TypeORM: migration:generate template-literal code injection CVE-2026-73651, GHSA-2rp8-mm9q-fp49 | Medium | 0.4% | 21 Jul, 2026 | npm typeorm |
Malicious release: Malicious code in @apexfdn/apex (npm) GHSA-w63r-vpcf-2wwf, MAL-2026-10979 | Malicious | Not scored | 21 Jul, 2026 | npm @apexfdn/apex |
SVGO removeScripts plugin leaves some executable scripts intact CVE-2026-73650, GHSA-2p49-hgcm-8545 | High | 0.4% | 21 Jul, 2026 | npm svgo |
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. CVE-2026-66010, GHSA-c2j3-45gr-mqc4 | Medium | 0.2% | 21 Jul, 2026 | npm dompurify |
@vitest/browser: Browser Mode provider commands bypass the file-access permission gate CVE-2026-73653, GHSA-p63j-vcc4-9vmv | Critical | 0.8% | 21 Jul, 2026 | npm @vitest/browser |
Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) GHSA-frvp-7c67-39w9 | Medium | Not scored | 21 Jul, 2026 | npm @hono/node-server |
react-server-dom: Denial of Service in Server Functions CVE-2026-44907, GHSA-wx67-qw84-cm4g | High | 0.6% | 21 Jul, 2026 | npm react-server-dom-parcel npm react-server-dom-turbopack npm react-server-dom-webpack |
Malicious release: Malicious code in veskra (npm) GHSA-pr2p-6xpw-q8vw, MAL-2026-10984 | Malicious | Not scored | 21 Jul, 2026 | npm veskra |
Malicious release: Malicious code in nolby (npm) GHSA-x724-q7wp-wx6q, MAL-2026-10980 | Malicious | Not scored | 21 Jul, 2026 | npm nolby |
Malicious release: Malicious code in react-tabulix-ui (npm) GHSA-5jr9-f9w4-93v3, MAL-2026-10988 | Malicious | Not scored | 21 Jul, 2026 | npm react-tabulix-ui |
Malicious release: Malicious code in react-tabulix-virtual (npm) MAL-2026-10989 | Malicious | Not scored | 21 Jul, 2026 | npm react-tabulix-virtual |
Malicious release: Malicious code in react-tabulix-core (npm) GHSA-5w4q-8fc9-88f4, MAL-2026-10987 | Malicious | Not scored | 21 Jul, 2026 | npm react-tabulix-core |
Malicious release: Malicious code in commonweb-rewards (npm) GHSA-p7jm-wh46-6hxx, MAL-2026-10968 | Malicious | Not scored | 21 Jul, 2026 | npm commonweb-rewards |
Malicious release: Malicious code in consumerweb-calurls (npm) GHSA-2fpw-cmmr-5j84, MAL-2026-10970 | Malicious | Not scored | 21 Jul, 2026 | npm consumerweb-calurls |
Malicious release: Malicious code in commonweb-card (npm) GHSA-cr8q-p657-jfpv, MAL-2026-10966 | Malicious | Not scored | 21 Jul, 2026 | npm commonweb-card |
Malicious release: Malicious code in commonweb-moneymovement (npm) GHSA-j4gf-r356-ff9m, MAL-2026-10967 | Malicious | Not scored | 21 Jul, 2026 | npm commonweb-moneymovement |
Malicious release: Malicious code in signzy-field-level-encrypter (npm) MAL-2026-10972 | Malicious | Not scored | 21 Jul, 2026 | npm signzy-field-level-encrypter |
Malicious release: Malicious code in commonweb-wallet (npm) GHSA-583v-m69g-vj4g, MAL-2026-10969 | Malicious | Not scored | 21 Jul, 2026 | npm commonweb-wallet |
Malicious release: Malicious code in cxpw-offers (npm) GHSA-9mr2-w7h5-r8c8, MAL-2026-10971 | Malicious | Not scored | 21 Jul, 2026 | npm cxpw-offers |
Malicious release: Malicious code in requestor-util (npm) GHSA-mchg-8mp7-q4m6, MAL-2026-10965 | Malicious | Not scored | 21 Jul, 2026 | npm requestor-util |