Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in vor8zakon (npm) GHSA-9f89-97fj-pqmp, MAL-2026-10694 | Malicious | Not scored | 16 Jul, 2026 | npm vor8zakon |
Malicious release: Malicious code in nordpass (npm) MAL-2026-10743 | Malicious | Not scored | 16 Jul, 2026 | npm nordpass |
Malicious release: Malicious code in nyt-cms (npm) GHSA-r98c-r926-c796, MAL-2026-10692 | Malicious | Not scored | 16 Jul, 2026 | npm nyt-cms |
Malicious release: Malicious code in @edgecommons/streamlog-node (npm) GHSA-4rqf-6883-f59f, MAL-2026-10763 | Malicious | Not scored | 16 Jul, 2026 | npm @edgecommons/streamlog-node |
Malicious release: Malicious code in @edgecommons/edgecommons (npm) GHSA-8p39-h6xv-p2g9, MAL-2026-10762 | Malicious | Not scored | 16 Jul, 2026 | npm @edgecommons/edgecommons |
Malicious release: Malicious code in @across-toolkit/typescript-config (npm) MAL-2026-10704 | Malicious | Not scored | 16 Jul, 2026 | npm @across-toolkit/typescript-config |
Malicious release: Malicious code in syft-acp-atoms (npm) MAL-2026-10764 | Malicious | Not scored | 16 Jul, 2026 | npm syft-acp-atoms |
Malicious release: Malicious code in syft-acp-core (npm) MAL-2026-10765 | Malicious | Not scored | 16 Jul, 2026 | npm syft-acp-core |
Malicious release: Malicious code in syft-acp-uikit (npm) MAL-2026-10766 | Malicious | Not scored | 16 Jul, 2026 | npm syft-acp-uikit |
Malicious release: Malicious code in syft-acp-util (npm) MAL-2026-10767 | Malicious | Not scored | 16 Jul, 2026 | npm syft-acp-util |
Malicious release: Malicious code in internallib_v907 (npm) GHSA-4jf7-q8jf-84cg, MAL-2026-10691 | Malicious | Not scored | 15 Jul, 2026 | npm internallib_v907 |
@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default CVE-2026-54504, GHSA-6f5r-5672-72j7 | High | 0.6% | 15 Jul, 2026 | npm @andrea9293/mcp-documentation-server |
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux CVE-2026-50289, GHSA-5xpp-75jx-m839 | High | 2.2% | 15 Jul, 2026 | npm systeminformation |
dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS CVE-2026-50272, GHSA-wxqq-gcq8-c443 | High | 0.8% | 15 Jul, 2026 | npm dd-trace |
Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication CVE-2026-55445, GHSA-v667-gc2r-2xm7 | Critical | 0.5% | 15 Jul, 2026 | npm @whyour/qinglong |
websocket-driver: Resource limit bypass via message compression CVE-2026-54490, GHSA-mp7j-qc5w-4988 | Medium | 0.4% | 15 Jul, 2026 | npm websocket-driver |
websocket-driver: Message corruption via abuse of protocol length headers CVE-2026-54466, GHSA-xv26-6w52-cph6 | Critical | 0.4% | 15 Jul, 2026 | npm websocket-driver |
obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete GHSA-62gx-5q78-wrvx | High | Not scored | 15 Jul, 2026 | npm obsidian-local-rest-api |
9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade CVE-2026-56679, GHSA-vmjq-hvgq-2wv4 | High | 0.4% | 15 Jul, 2026 | npm 9router |
9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding CVE-2026-56678, GHSA-6mwv-4mrm-5p3m | Medium | 0.2% | 15 Jul, 2026 | npm 9router |
NocoBase backup restore schema name allows command injection CVE-2026-55410, GHSA-p853-83gj-wjj3 | Medium | 0.7% | 15 Jul, 2026 | npm @nocobase/plugin-backups |
NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass CVE-2026-52888, GHSA-v8vm-cqh8-q87q | Medium | 0.5% | 15 Jul, 2026 | npm @nocobase/plugin-collection-sql |
NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE CVE-2026-52887, GHSA-p849-8hwh-84j9 | Critical | 0.9% | 15 Jul, 2026 | npm @nocobase/plugin-notification-in-app-message |
jsii-diff: Command Injection via npm: package argument CVE-2026-15895, GHSA-wcx4-wpfv-mc5c | High | 1.1% | 15 Jul, 2026 | npm jsii-diff |
@better-auth/sso: SSO provider may allow registration for any org member without a checking their role CVE-2026-53515, GHSA-gv74-j8m3-fg5f | High | 0.4% | 15 Jul, 2026 | npm @better-auth/sso |
Malicious release: Malicious code in selparsecss-selector (npm) MAL-2026-10687 | Malicious | Not scored | 15 Jul, 2026 | npm selparsecss-selector |
Malicious release: Malicious code in @ddh-libraries/analytics (npm) MAL-2026-10686 | Malicious | Not scored | 15 Jul, 2026 | npm @ddh-libraries/analytics |
Malicious release: Malicious code in react-hook-scripts (npm) MAL-2026-10684 | Malicious | Not scored | 15 Jul, 2026 | npm react-hook-scripts |
Malicious release: Malicious code in code-formatter-setup (npm) GHSA-fr6r-7qpj-x22g, MAL-2026-10682 | Malicious | Not scored | 15 Jul, 2026 | npm code-formatter-setup |
Malicious release: Malicious code in formatters.ts (npm) MAL-2026-10683 | Malicious | Not scored | 15 Jul, 2026 | npm formatters.ts |
Directus: Authorization-dependent response served from unsegmented cache key CVE-2026-61836, GHSA-c6w9-5g5j-jh2p | High | 0.5% | 15 Jul, 2026 | npm directus |
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import CVE-2026-61835, GHSA-j5h6-vqc3-phqh | High | 0.4% | 15 Jul, 2026 | npm directus |
n8n: External Secrets Permission Bypass via Expression Parser Mismatch CVE-2026-59259, GHSA-jp7m-xcgx-57qm | Medium | 0.4% | 15 Jul, 2026 | npm n8n |
n8n: External Secrets Accessible via Workflow Expressions Outside Credentials CVE-2026-59254, GHSA-2434-3x6q-8r99 | Medium | 0.4% | 15 Jul, 2026 | npm n8n |
Malicious release: Malicious code in rakibox (npm) MAL-2026-10679 | Malicious | Not scored | 15 Jul, 2026 | npm rakibox |
Malicious release: Malicious code in ls-env-config (npm) MAL-2026-10678 | Malicious | Not scored | 15 Jul, 2026 | npm ls-env-config |
Malicious release: Malicious code in deployowl (npm) MAL-2026-10677 | Malicious | Not scored | 15 Jul, 2026 | npm deployowl |
Malicious release: Malicious code in syncgrove (npm) MAL-2026-10680 | Malicious | Not scored | 15 Jul, 2026 | npm syncgrove |
Malicious release: Malicious code in commonjs-assert (npm) GHSA-hcmm-fvc7-pjv3, MAL-2026-10676 | Malicious | Not scored | 15 Jul, 2026 | npm commonjs-assert |
Malicious release: Malicious code in ac-raf-emitter (npm) MAL-2026-10675 | Malicious | Not scored | 15 Jul, 2026 | npm ac-raf-emitter |
Malicious release: Malicious code in gulp-jscrambler (npm) GHSA-2cjx-v4hm-f5gf, MAL-2026-10673 | Malicious | Not scored | 15 Jul, 2026 | npm gulp-jscrambler |
Malicious release: Malicious code in jscrambler-metro-plugin (npm) GHSA-v442-7fpg-636g, MAL-2026-10674 | Malicious | Not scored | 15 Jul, 2026 | npm jscrambler-metro-plugin |
Malicious release: Malicious code in chain-as-log (npm) MAL-2026-10668 | Malicious | Not scored | 15 Jul, 2026 | npm chain-as-log |
Malicious release: Malicious code in spytrack (npm) MAL-2026-10671 | Malicious | Not scored | 15 Jul, 2026 | npm spytrack |
Malicious release: Malicious code in dbconnectify (npm) GHSA-p5xv-vqcx-vm42, MAL-2026-10669 | Malicious | Not scored | 15 Jul, 2026 | npm dbconnectify |
Malicious release: Malicious code in eslintcmd (npm) GHSA-73c6-pgjj-9v82, MAL-2026-10670 | Malicious | Not scored | 15 Jul, 2026 | npm eslintcmd |
Malicious release: Malicious code in @fhkry/baileys-v2 (npm) GHSA-g5qp-fx35-w54m, MAL-2026-10664 | Malicious | Not scored | 15 Jul, 2026 | npm @fhkry/baileys-v2 |
Malicious release: Malicious code in @fhkry/x-baileys (npm) GHSA-mxxc-f6p6-98j7, MAL-2026-10665 | Malicious | Not scored | 15 Jul, 2026 | npm @fhkry/x-baileys |
Malicious release: Malicious code in crypto-hasher (npm) GHSA-886f-w6pq-7w7j, MAL-2026-10666 | Malicious | Not scored | 15 Jul, 2026 | npm crypto-hasher |
Malicious release: Malicious code in true (npm) GHSA-f59f-vj5q-c725, MAL-2026-10667 | Malicious | Not scored | 15 Jul, 2026 | npm true |