Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover CVE-2026-44648, GHSA-wmm3-h9qj-p5v6 | High | 0.4% | 12 May, 2026 | npm sillytavern |
protobuf.js: Code injection in pbjs static output from crafted schema names CVE-2026-44295, GHSA-6r35-46g8-jcw9 | High | 0.4% | 12 May, 2026 | npm protobufjs-cli |
protobuf.js: Code injection through bytes field defaults in generated toObject code CVE-2026-44293, GHSA-66ff-xgx4-vchm | High | 0.4% | 12 May, 2026 | npm protobufjs |
protobuf.js: Code generation gadget after prototype pollution CVE-2026-44291, GHSA-75px-5xx7-5xc7 | High | 0.5% | 12 May, 2026 | npm protobufjs |
protobuf.js: Process-wide denial of service through unsafe option paths CVE-2026-44290, GHSA-jvwf-75h9-cwgg | High | 0.4% | 12 May, 2026 | npm protobufjs |
protobuf.js: Denial of service through unbounded protobuf recursion CVE-2026-44289, GHSA-685m-2w69-288q | High | 0.6% | 12 May, 2026 | npm protobufjs |
protobuf.js is Vulnerable to OS Command Injection in the CLI CVE-2026-42290, GHSA-f84p-cvgm-xgjj | High | 0.1% | 12 May, 2026 | npm protobufjs-cli |
multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing CVE-2026-8162, GHSA-xh3c-6gcq-g4rv | High | 0.3% | 12 May, 2026 | npm multiparty |
multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception CVE-2026-8161, GHSA-qxch-whhj-8956 | High | 0.5% | 12 May, 2026 | npm multiparty |
multiparty vulnerable to ReDoS via filename parsing CVE-2026-8159, GHSA-65x3-rw7q-gx94 | High | 0.3% | 12 May, 2026 | npm multiparty |
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()` CVE-2026-44635, GHSA-pv5w-4p9q-p3v2 | High | 0.4% | 11 May, 2026 | npm kysely |
automagik-genie has a command injection vulnerability CVE-2026-30635, GHSA-64vr-4gr2-m642 | High | 1.0% | 11 May, 2026 | npm automagik-genie |
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up CVE-2026-45109, GHSA-26hh-7cqf-hhc6 | High | 0.6% | 11 May, 2026 | npm next |
Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`) CVE-2026-45061, GHSA-xh5j-727m-w6gg | High | 0.3% | 11 May, 2026 | npm budibase |
GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor CVE-2026-45033, GHSA-9ccr-r5hg-74gf | High | 0.4% | 11 May, 2026 | npm @github/copilot |
@theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function GHSA-mhwj-73qx-jqxm | High | Not scored | 11 May, 2026 | npm @theecryptochad/merge-guard |
@rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) CVE-2026-44483, GHSA-c567-44rc-m5hq | High | 0.4% | 11 May, 2026 | npm @rvf/set-get |
Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components CVE-2026-44579, GHSA-mg66-mrh9-m8jx | High | 0.7% | 11 May, 2026 | npm next |
Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades CVE-2026-44578, GHSA-c4j6-fc7j-m34r | High | 35.5% | 11 May, 2026 | npm next |
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes CVE-2026-44575, GHSA-267c-6grr-h53f | High | 1.6% | 11 May, 2026 | npm next |
Next.js has a Middleware / Proxy bypass through dynamic route parameter injection CVE-2026-44574, GHSA-492v-c6pp-mqqv | High | 0.6% | 11 May, 2026 | npm next |
Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n CVE-2026-44573, GHSA-36qx-fr4f-26g5 | High | 0.8% | 11 May, 2026 | npm next |
@vitejs/plugin-rsc has a Denial of Service Vulnerability in React Server Components GHSA-w94c-4vhp-22gx | High | Not scored | 11 May, 2026 | npm @vitejs/plugin-rsc |
Next.js Vulnerable to Denial of Service with Server Components GHSA-8h8q-6873-q5fj | High | Not scored | 11 May, 2026 | npm next |
Prometheus exporter process crash via malformed HTTP request CVE-2026-44902, GHSA-q7rr-3cgh-j5r3 | High | 0.5% | 11 May, 2026 | npm @opentelemetry/auto-instrumentations-node npm @opentelemetry/exporter-prometheus npm @opentelemetry/sdk-node |
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input CVE-2026-44728, GHSA-fv7c-fp4j-7gwp | High | 0.1% | 08 May, 2026 | npm @babel/plugin-transform-modules-systemjs |
MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys CVE-2026-44680, GHSA-cfw5-68c4-ffqp | High | 1.5% | 08 May, 2026 | npm @mikro-orm/knex npm @mikro-orm/sql |
open-webui Vulnerable to Stored XSS via Model Description CVE-2026-44721, GHSA-gf5m-wcrh-7928, PYSEC-2026-2725 | High | 0.3% | 08 May, 2026 | PyPI open-webui npm open-webui |
n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure GHSA-8g7g-hmwm-6rv2 | High | Not scored | 08 May, 2026 | npm n8n-mcp |
n8n-mcp webhook and API client paths has an authenticated SSRF CVE-2026-44694, GHSA-cmrh-wvq6-wm9r | High | 0.2% | 08 May, 2026 | npm n8n-mcp |
fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes CVE-2026-44665, GHSA-5wm8-gmm8-39j9 | High | 0.2% | 08 May, 2026 | npm fast-xml-builder |
Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor CVE-2026-43943, GHSA-q4p8-8j9m-8hxj | High | 0.2% | 08 May, 2026 | npm electerm |
mcp-ssh-tool has file transfer path policy bypass and bearer token comparison hardening GHSA-j7h9-2jh7-g967 | High | Not scored | 07 May, 2026 | npm mcp-ssh-tool |
Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker CVE-2026-42553, GHSA-j944-w549-3453 | High | 0.3% | 07 May, 2026 | npm cinny |
youtube-regex vulnerable to Regex Denial of Service CVE-2025-65122, GHSA-vpxx-h23g-gxh2 | High | 0.3% | 07 May, 2026 | npm youtube-regex |
node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js CVE-2025-63705, GHSA-8jh2-3mw6-6pfm | High | 1.2% | 07 May, 2026 | npm node-ts-ocr |
vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape CVE-2026-43998, GHSA-cp6g-6699-wx9c | High | 0.7% | 07 May, 2026 | npm vm2 |
vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary CVE-2026-44000, GHSA-mpf8-4hx2-7cjg | High | 0.2% | 07 May, 2026 | npm vm2 |
vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion CVE-2026-44004, GHSA-6785-pvv7-mvg7 | High | 0.4% | 07 May, 2026 | npm vm2 |
vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS) CVE-2026-44001, GHSA-hw58-p9xv-2mjh | High | 0.4% | 07 May, 2026 | npm vm2 |
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect CVE-2026-44503, GHSA-7j59-v9qr-6fq9, GO-2026-5224, PYSEC-2026-2647 | High | 0.6% | 07 May, 2026 | Go github.com/microsoft/kiota-http-go Maven com.microsoft.kiota:microsoft-kiota-abstractions NuGet Microsoft.Kiota.Abstractions PyPI microsoft-kiota-http +1 more |
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering CVE-2026-44240, GHSA-rpmf-866q-6p89 | High | 0.5% | 06 May, 2026 | npm basic-ftp |
dssrf: every IPv6 category bypasses is_url_safe CVE-2026-44232, GHSA-8p33-q827-ghj5 | High | 0.4% | 06 May, 2026 | npm dssrf |
Facebook React has a Denial of Service Vulnerability in React Server Components CVE-2026-23870, GHSA-rv78-f8rc-xrxh | High | 1.5% | 06 May, 2026 | npm react-server-dom-parcel npm react-server-dom-turbopack npm react-server-dom-webpack |
Auth.js SDK has Improper Permission Checking CVE-2026-42280, GHSA-8qjv-jj2q-x832 | High | 0.2% | 06 May, 2026 | npm auth0-js |
Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection BIT-mongoose-2026-42334, CVE-2026-42334, GHSA-wpg9-53fq-2r8h | High | 0.3% | 05 May, 2026 | npm mongoose |
@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts GHSA-jxh8-jh77-xh6g | High | Not scored | 05 May, 2026 | npm @evomap/evolver |
@evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE) GHSA-cfcj-hqpf-hccf | High | Not scored | 05 May, 2026 | npm @evomap/evolver |
open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname` CVE-2026-42260, GHSA-v228-72c7-fx8j | High | 0.3% | 05 May, 2026 | npm open-websearch |
ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs CVE-2026-43929, GHSA-j4rj-2jr5-m439 | High | 0.3% | 05 May, 2026 | npm ssrfcheck |