Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
AdonisJS: Unencoded route parameters can produce open redirects CVE-2026-107718, GHSA-2m6q-8v3h-jqww | Medium | 0.3% | 21 days ago | npm @adonisjs/http-server |
Malicious release: Malicious code in revine (npm) GHSA-gr77-3hqf-674h, MAL-2026-17709 | Malicious | Not scored | 21 days ago | npm revine |
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set CVE-2026-107720, GHSA-8wpc-h4q6-8fxv | High | 0.3% | 21 days ago | npm fast-jwt |
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion CVE-2026-107722, GHSA-ww5h-9m49-7xx4 | Critical | 0.4% | 21 days ago | npm fast-jwt |
fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache) CVE-2026-107721, GHSA-687g-22h4-j4w4 | Medium | 0.3% | 21 days ago | npm fast-jwt |
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array CVE-2026-107723, GHSA-5hjw-83fp-phq9 | High | 0.5% | 21 days ago | npm fast-jwt |
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery CVE-2026-107724, GHSA-g3jj-5cmm-3hxx | High | 0.3% | 21 days ago | npm fast-jwt |
Malicious release: Malicious code in testrrrd (npm) MAL-2026-17706 | Malicious | Not scored | 21 days ago | npm testrrrd |
Malicious release: Malicious code in @wxwxtest/testrrrdd (npm) MAL-2026-17704 | Malicious | Not scored | 21 days ago | npm @wxwxtest/testrrrdd |
Malicious release: Malicious code in wie888r (npm) MAL-2026-17707 | Malicious | Not scored | 21 days ago | npm wie888r |
Malicious release: Malicious code in xblaxw (npm) MAL-2026-17708 | Malicious | Not scored | 21 days ago | npm xblaxw |
Malicious release: Malicious code in css-overscroll-contain (npm) GHSA-xjrr-fv8j-9hw7, MAL-2026-17705 | Malicious | Not scored | 21 days ago | npm css-overscroll-contain |
music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master CVE-2026-107391, GHSA-f94x-6692-553q | High | 0.3% | 21 days ago | npm music-metadata |
music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort CVE-2026-107389, GHSA-5gfj-9q3v-qfp3 | Medium | 0.2% | 21 days ago | npm music-metadata |
music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7) CVE-2026-107392, GHSA-8j4c-6x6g-rq3j | High | 0.4% | 21 days ago | npm music-metadata |
music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS CVE-2026-107388, GHSA-jjpr-9cvf-cq55 | Medium | 0.2% | 21 days ago | npm music-metadata |
music-metadata: Uncontrolled memory allocation in APEv2 parser CVE-2026-107387, GHSA-53v6-4h7p-p4gj | Medium | 0.2% | 21 days ago | npm music-metadata |
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES BIT-mariadb-2026-107385, BIT-mariadb-min-2026-107385, BIT-mysql-client-2026-107385, CVE-2026-107385, GHSA-r3rv-jm3r-62q2 | High | 0.4% | 21 days ago | npm mariadb |
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries) BIT-mariadb-2026-107384, BIT-mariadb-min-2026-107384, BIT-mysql-client-2026-107384, CVE-2026-107384, GHSA-v6pj-gxxw-phfw | High | 0.4% | 21 days ago | npm mariadb |
MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters BIT-mariadb-2026-107383, BIT-mariadb-min-2026-107383, BIT-mysql-client-2026-107383, CVE-2026-107383, GHSA-48qf-xh34-q73r | High | 0.4% | 21 days ago | npm mariadb |
MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS BIT-mariadb-2026-107382, BIT-mariadb-min-2026-107382, BIT-mysql-client-2026-107382, CVE-2026-107382, GHSA-cx2f-j9fh-8g68 | Medium | 0.2% | 21 days ago | npm mariadb |
Malicious release: Malicious code in @kxafunc/xbails (npm) MAL-2026-17701 | Malicious | Not scored | 21 days ago | npm @kxafunc/xbails |
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort CVE-2026-107375, GHSA-r223-96jv-q533 | High | 0.3% | 21 days ago | npm generator-jhipster |
JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob CVE-2026-107303, GHSA-9ffp-22j7-56r2 | High | 0.3% | 21 days ago | npm generator-jhipster npm react-jhipster |
msgpack5: Truncated map32 headers throw an unexpected error CVE-2026-107302, GHSA-8f34-f56x-9xph | High | 0.5% | 21 days ago | npm msgpack5 |
msgpack5: Partial options disable prototype protection CVE-2026-107301, GHSA-8hq7-ggx2-cc6m | Medium | 0.4% | 21 days ago | npm msgpack5 |
msgpack5: Many buffered values can exhaust the streaming decoder stack CVE-2026-107300, GHSA-5x5g-h9x8-2fh9 | High | 0.4% | 21 days ago | npm msgpack5 |
msgpack5: Reserved byte can cause unbounded stream buffering CVE-2026-107299, GHSA-26wq-p25c-j6fv | Medium | 0.4% | 21 days ago | npm msgpack5 |
msgpack5: Deeply nested input can exhaust the decoder stack CVE-2026-107298, GHSA-24ch-f2g6-9hhh | Medium | 0.4% | 21 days ago | npm msgpack5 |
msgpack5: Quadratic parsing in the streaming decoder CVE-2026-107297, GHSA-gcx5-hxj7-gpqq | Medium | 0.4% | 21 days ago | npm msgpack5 |
msgpack5: Decoding negative int64 values mutates the input buffer CVE-2026-107296, GHSA-qw35-55vc-rhgj | Low | 0.3% | 21 days ago | npm msgpack5 |
Malicious release: Malicious code in @bitwardne/jslib (npm) MAL-2026-17694 | Malicious | Not scored | 21 days ago | npm @bitwardne/jslib |
Malicious release: Malicious code in @bitwardne/cli (npm) MAL-2026-17693 | Malicious | Not scored | 21 days ago | npm @bitwardne/cli |
Malicious release: Malicious code in clickfix_npm_delivery (npm) GHSA-37h8-m54m-784j, MAL-2026-17692 | Malicious | Not scored | 21 days ago | npm clickfix_npm_delivery |
Malicious release: Malicious code in @galicia-toolkit/core (npm) GHSA-ff43-rphq-9mgw, MAL-2026-17688 | Malicious | Not scored | 21 days ago | npm @galicia-toolkit/core |
Malicious release: Malicious code in tailwindcss-effects-kit (npm) GHSA-9c94-xcv7-wcf4, MAL-2026-17686 | Malicious | Not scored | 21 days ago | npm tailwindcss-effects-kit |
Malicious release: Malicious code in tailwindcss-ui-extensions (npm) GHSA-9ww2-25r2-rppg, MAL-2026-17687 | Malicious | Not scored | 21 days ago | npm tailwindcss-ui-extensions |
Malicious release: Malicious code in @galicia-toolkit/error-master (npm) GHSA-42vv-c8c8-q765, MAL-2026-17689 | Malicious | Not scored | 21 days ago | npm @galicia-toolkit/error-master |
Malicious release: Malicious code in @galicia-toolkit/tag-manager (npm) GHSA-q3gj-mpgg-cqpv, MAL-2026-17691 | Malicious | Not scored | 21 days ago | npm @galicia-toolkit/tag-manager |
Malicious release: Malicious code in @galicia-toolkit/spa-build-config (npm) GHSA-7hx2-c7qp-ggjp, MAL-2026-17690 | Malicious | Not scored | 21 days ago | npm @galicia-toolkit/spa-build-config |
Malicious release: Malicious code in connector-agent (npm) GHSA-422j-hgjh-g8fg, MAL-2026-17682 | Malicious | Not scored | 21 days ago | npm connector-agent |
Malicious release: Malicious code in system-driver (npm) GHSA-43w2-g2fc-r4h3, MAL-2026-17685 | Malicious | Not scored | 21 days ago | npm system-driver |
Malicious release: Malicious code in node-fetch-lite (npm) GHSA-cfmp-vp7q-257m, MAL-2026-17683 | Malicious | Not scored | 21 days ago | npm node-fetch-lite |
Malicious release: Malicious code in node-gyp-runtime (npm) GHSA-v64f-f8pp-4qx2, MAL-2026-17684 | Malicious | Not scored | 21 days ago | npm node-gyp-runtime |
Malicious release: Malicious code in node-env-resolve (npm) GHSA-fw57-xw67-r253, MAL-2026-17681 | Malicious | Not scored | 21 days ago | npm node-env-resolve |
Malicious release: Malicious code in @bellaxchuu/familyxtrx (npm) GHSA-jgwg-m26g-j9c2, MAL-2026-17344 | Malicious | Not scored | 21 days ago | npm @bellaxchuu/familyxtrx |
Malicious release: Malicious code in @bellaxchuu/overbugs (npm) GHSA-mhqg-97g5-qg8m, MAL-2026-17677 | Malicious | Not scored | 21 days ago | npm @bellaxchuu/overbugs |
Malicious release: Malicious code in @bellaxchuu/libsignal-node (npm) GHSA-3x55-8979-2xhq, MAL-2026-17676 | Malicious | Not scored | 21 days ago | npm @bellaxchuu/libsignal-node |
Malicious release: Malicious code in @bellaxchuu/privatebails (npm) GHSA-46rh-wx96-cw47, MAL-2026-17346 | Malicious | Not scored | 21 days ago | npm @bellaxchuu/privatebails |
Malicious release: Malicious code in @bellaxchuu/flowblue (npm) GHSA-4gc8-pmgh-hx47, MAL-2026-17345 | Malicious | Not scored | 21 days ago | npm @bellaxchuu/flowblue |