Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check) CVE-2026-59149, GHSA-8wqc-v2q8-vff2 | Medium | 0.5% | 09 Jul, 2026 | npm @mockoon/cli npm @mockoon/commons-server |
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft CVE-2026-59148, GHSA-rqx4-3f6q-3x2v | High | 0.3% | 09 Jul, 2026 | npm @mockoon/cli npm @mockoon/commons-server |
Malicious release: Malicious code in vite-pwa-config (npm) MAL-2026-10092 | Malicious | Not scored | 09 Jul, 2026 | npm vite-pwa-config |
Ghost: Paid gift memberships obtainable at minimal cost via the donations feature BIT-ghost-2026-59817, CVE-2026-59817, GHSA-xm43-3m56-w3wf | Medium | 0.4% | 09 Jul, 2026 | npm ghost |
n8n: Shared Credential Header Leak via HTTP Request Pagination Expression CVE-2026-59209, GHSA-q3j5-8vrg-4p9q | High | 0.4% | 09 Jul, 2026 | npm n8n |
Malicious release: Malicious code in dl-pp-latm (npm) MAL-2026-10086 | Malicious | Not scored | 09 Jul, 2026 | npm dl-pp-latm |
Malicious release: Malicious code in neon-poly-utls (npm) GHSA-3fwc-79pq-r47c, MAL-2026-10089 | Malicious | Not scored | 09 Jul, 2026 | npm neon-poly-utls |
Malicious release: Malicious code in chain-async-dom (npm) GHSA-4r3j-x465-77rv, MAL-2026-10082 | Malicious | Not scored | 09 Jul, 2026 | npm chain-async-dom |
Malicious release: Malicious code in clob-math-v2 (npm) MAL-2026-10083 | Malicious | Not scored | 09 Jul, 2026 | npm clob-math-v2 |
Malicious release: Malicious code in conversionvaluemanager (npm) GHSA-c8w9-r7mv-28q4, MAL-2026-10084 | Malicious | Not scored | 09 Jul, 2026 | npm conversionvaluemanager |
Malicious release: Malicious code in lovable-tager (npm) MAL-2026-10088 | Malicious | Not scored | 09 Jul, 2026 | npm lovable-tager |
Malicious release: Malicious code in eslint-plus (npm) MAL-2026-10087 | Malicious | Not scored | 09 Jul, 2026 | npm eslint-plus |
Malicious release: Malicious code in nonenull1 (npm) MAL-2026-10090 | Malicious | Not scored | 09 Jul, 2026 | npm nonenull1 |
Malicious release: Malicious code in cookie-js-ease (npm) MAL-2026-10058 | Malicious | Not scored | 09 Jul, 2026 | npm cookie-js-ease |
Malicious release: Malicious code in cookie-parser-es (npm) MAL-2026-10059 | Malicious | Not scored | 09 Jul, 2026 | npm cookie-parser-es |
Malicious release: Malicious code in cookie-parser-js (npm) MAL-2026-10060 | Malicious | Not scored | 09 Jul, 2026 | npm cookie-parser-js |
n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution CVE-2026-59208, GHSA-mq3m-f8x3-579w | High | 0.3% | 09 Jul, 2026 | npm n8n |
n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector CVE-2026-59207, GHSA-h44j-f5r5-ph73 | High | 0.4% | 09 Jul, 2026 | npm n8n |
n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration CVE-2026-59206, GHSA-75qm-gp28-rcq9 | High | 0.7% | 09 Jul, 2026 | npm n8n |
Malicious release: Malicious code in multer-orm (npm) MAL-2026-10064 | Malicious | Not scored | 09 Jul, 2026 | npm multer-orm |
Malicious release: Malicious code in express-router-engine (npm) MAL-2026-10063 | Malicious | Not scored | 09 Jul, 2026 | npm express-router-engine |
Malicious release: Malicious code in chunk-parser (npm) MAL-2026-10057 | Malicious | Not scored | 09 Jul, 2026 | npm chunk-parser |
Malicious release: Malicious code in type-slint (npm) GHSA-634c-4fgc-67w9, MAL-2026-10077 | Malicious | Not scored | 09 Jul, 2026 | npm type-slint |
Malicious release: Malicious code in nps-retrieval-diagnostics (npm) MAL-2026-10066 | Malicious | Not scored | 09 Jul, 2026 | npm nps-retrieval-diagnostics |
Malicious release: Malicious code in cursed-ecto-d3ab00 (npm) GHSA-9x5f-jcqq-j88c, MAL-2026-10061 | Malicious | Not scored | 09 Jul, 2026 | npm cursed-ecto-d3ab00 |
Malicious release: Malicious code in polymarket-apis (npm) GHSA-rwp8-c6qg-x8g3, MAL-2026-10067 | Malicious | Not scored | 09 Jul, 2026 | npm polymarket-apis |
Malicious release: Malicious code in polymarket-trader-apis (npm) GHSA-773r-gj6w-h338, MAL-2026-10072 | Malicious | Not scored | 09 Jul, 2026 | npm polymarket-trader-apis |
Malicious release: Malicious code in polymarket-kelly-math (npm) MAL-2026-10068 | Malicious | Not scored | 09 Jul, 2026 | npm polymarket-kelly-math |
Malicious release: Malicious code in polymarket-kelly-stake-math (npm) GHSA-q8cr-mw55-69x7, MAL-2026-10070 | Malicious | Not scored | 09 Jul, 2026 | npm polymarket-kelly-stake-math |
Malicious release: Malicious code in polymarket-kit (npm) MAL-2026-10071 | Malicious | Not scored | 09 Jul, 2026 | npm polymarket-kit |
Malicious release: Malicious code in polymarket-kelly-maths (npm) MAL-2026-10069 | Malicious | Not scored | 09 Jul, 2026 | npm polymarket-kelly-maths |
Malicious release: Malicious code in es6-codify (npm) GHSA-7q22-q58w-5f27, MAL-2026-10062 | Malicious | Not scored | 09 Jul, 2026 | npm es6-codify |
Malicious release: Malicious code in webrix-docs1 (npm) MAL-2026-10081 | Malicious | Not scored | 09 Jul, 2026 | npm webrix-docs1 |
Malicious release: Malicious code in webrix-docs (npm) MAL-2026-10080 | Malicious | Not scored | 09 Jul, 2026 | npm webrix-docs |
Malicious release: Malicious code in vybscan-testbed-obfuscated-postinstall (npm) GHSA-43r2-4jr2-rhjf, MAL-2026-10079 | Malicious | Not scored | 09 Jul, 2026 | npm vybscan-testbed-obfuscated-postinstall |
Malicious release: Malicious code in vybscan-testbed-inert-postinstall (npm) GHSA-cwcf-rmgg-qg9w, MAL-2026-10078 | Malicious | Not scored | 09 Jul, 2026 | npm vybscan-testbed-inert-postinstall |
Malicious release: Malicious code in ts-eslint-jest (npm) GHSA-r8h6-7hvm-3xcp, MAL-2026-10076 | Malicious | Not scored | 09 Jul, 2026 | npm ts-eslint-jest |
Malicious release: Malicious code in nodemon-gulp (npm) GHSA-wqr5-5c9r-9rj7, MAL-2026-10065 | Malicious | Not scored | 09 Jul, 2026 | npm nodemon-gulp |
Malicious release: Malicious code in chai-as-modified (npm) GHSA-mq6v-3fqr-9cp6, MAL-2026-10043 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-modified |
Malicious release: Malicious code in chai-as-buffered (npm) GHSA-jvvq-ph8p-7cc9, MAL-2026-10041 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-buffered |
Malicious release: Malicious code in chai-await-dom (npm) GHSA-5368-rr57-2vg7, MAL-2026-10049 | Malicious | Not scored | 09 Jul, 2026 | npm chai-await-dom |
Malicious release: Malicious code in chai-as-staged (npm) GHSA-fchw-g3j3-hxh3, MAL-2026-10047 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-staged |
Malicious release: Malicious code in chain-chai-async (npm) GHSA-wqgh-vp7f-x5q6, MAL-2026-10055 | Malicious | Not scored | 09 Jul, 2026 | npm chain-chai-async |
Malicious release: Malicious code in chai-as-align (npm) GHSA-8vcr-xf6w-wg45, MAL-2026-10039 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-align |
Malicious release: Malicious code in chai-promised-test (npm) MAL-2026-10052 | Malicious | Not scored | 09 Jul, 2026 | npm chai-promised-test |
Malicious release: Malicious code in chain-chai-await (npm) GHSA-v7w8-4wfr-cvwf, MAL-2026-10056 | Malicious | Not scored | 09 Jul, 2026 | npm chain-chai-await |
Malicious release: Malicious code in chai-as-serialized (npm) GHSA-9q7j-cc9w-c9rf, MAL-2026-10044 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-serialized |
Malicious release: Malicious code in chai-as-thread (npm) GHSA-pjgc-4vf2-4cj7, MAL-2026-10048 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-thread |
Malicious release: Malicious code in chai-as-balanced (npm) MAL-2026-10040 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-balanced |
Malicious release: Malicious code in chai-deflect (npm) GHSA-7p2p-g2j6-w6v3, MAL-2026-10051 | Malicious | Not scored | 09 Jul, 2026 | npm chai-deflect |