Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows CVE-2026-67334, GHSA-2vg6-77g8-24mp | Medium | 0.3% | 07 Jul, 2026 | npm @better-auth/scim npm better-auth |
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive CVE-2026-53518, GHSA-7w99-5wm4-3g79 | High | 0.4% | 07 Jul, 2026 | npm @better-auth/oauth-provider npm better-auth |
@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints CVE-2026-53513, GHSA-5rr4-8452-hf4v | Critical | 0.2% | 07 Jul, 2026 | npm @better-auth/sso |
Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption CVE-2026-53517, GHSA-392p-2q2v-4372 | High | 0.4% | 07 Jul, 2026 | npm @better-auth/oauth-provider npm better-auth |
Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default CVE-2026-67336, GHSA-9h47-pqcx-hjr4 | Critical | 0.2% | 07 Jul, 2026 | npm better-auth |
Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp CVE-2026-67333, GHSA-86j7-9j95-vpqj | High | 0.3% | 07 Jul, 2026 | npm better-auth |
Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email CVE-2026-53516, GHSA-g38m-r43w-p2q7 | High | 0.3% | 07 Jul, 2026 | npm better-auth |
Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin CVE-2026-53514, GHSA-fmh4-wcc4-5jm3 | High | 0.2% | 07 Jul, 2026 | npm better-auth |
@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators CVE-2026-67332, GHSA-p2fr-6hmx-4528 | Medium | 0.3% | 07 Jul, 2026 | npm @better-auth/oauth-provider |
Malicious release: Malicious code in hello244b (npm) MAL-2026-6955 | Malicious | Not scored | 07 Jul, 2026 | npm hello244b |
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins CVE-2026-53512, GHSA-pw9m-5jxm-xr6h | Critical | 0.3% | 07 Jul, 2026 | npm better-auth |
@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060) CVE-2026-53509, GHSA-g84h-j7jj-x32p | Medium | 0.4% | 07 Jul, 2026 | npm @aborruso/ckan-mcp-server |
Malicious release: Malicious code in @whs4/whs4_npm (npm) GHSA-85fx-62wv-932x, MAL-2026-6946 | Malicious | Not scored | 07 Jul, 2026 | npm @whs4/whs4_npm |
Malicious release: Malicious code in whs4_npm_test (npm) GHSA-pjv5-35wr-prrm, MAL-2026-6952 | Malicious | Not scored | 07 Jul, 2026 | npm whs4_npm_test |
Malicious release: Malicious code in whs4_pnm (npm) GHSA-23v6-j5g5-7x9p, MAL-2026-6953 | Malicious | Not scored | 07 Jul, 2026 | npm whs4_pnm |
Malicious release: Malicious code in whs4_npm (npm) GHSA-3wm9-8rfp-wp25, MAL-2026-6951 | Malicious | Not scored | 07 Jul, 2026 | npm whs4_npm |
Malicious release: Malicious code in whs4_nmp (npm) GHSA-4fw4-5853-rqf8, MAL-2026-6950 | Malicious | Not scored | 07 Jul, 2026 | npm whs4_nmp |
Malicious release: Malicious code in wsh4_npm (npm) GHSA-6h38-53x2-5jhm, MAL-2026-6954 | Malicious | Not scored | 07 Jul, 2026 | npm wsh4_npm |
Malicious release: Malicious code in runtimedev-link (npm) GHSA-v63r-xv67-wj6q, MAL-2026-6948 | Malicious | Not scored | 07 Jul, 2026 | npm runtimedev-link |
Malicious release: Malicious code in polytrade (npm) GHSA-r7mv-rcm7-x7m3, MAL-2026-6939 | Malicious | Not scored | 07 Jul, 2026 | npm polytrade |
Malicious release: Malicious code in evm-typechain (npm) GHSA-c4gm-jp6q-h9hq, MAL-2026-6932 | Malicious | Not scored | 07 Jul, 2026 | npm evm-typechain |
Malicious release: Malicious code in load-nuxt-dev (npm) GHSA-6mpp-f748-7f4q, MAL-2026-6935 | Malicious | Not scored | 07 Jul, 2026 | npm load-nuxt-dev |
Malicious release: Malicious code in nuxt-fonts-devtools (npm) GHSA-hw4h-mjrw-4qv9, MAL-2026-6937 | Malicious | Not scored | 07 Jul, 2026 | npm nuxt-fonts-devtools |
Malicious release: Malicious code in load-nuxt (npm) GHSA-qqp7-wmv2-mp34, MAL-2026-6934 | Malicious | Not scored | 07 Jul, 2026 | npm load-nuxt |
Malicious release: Malicious code in hook-augmenting-module (npm) GHSA-53f9-qr7j-x48v, MAL-2026-6933 | Malicious | Not scored | 07 Jul, 2026 | npm hook-augmenting-module |
Malicious release: Malicious code in shopify-internel (npm) GHSA-fgr2-2c8j-mp2x, MAL-2026-6941 | Malicious | Not scored | 07 Jul, 2026 | npm shopify-internel |
Malicious release: Malicious code in annotator-harvardx (npm) GHSA-hpvm-wxmp-gcxg, MAL-2026-6930 | Malicious | Not scored | 07 Jul, 2026 | npm annotator-harvardx |
Malicious release: Malicious code in rnx-align-deps (npm) GHSA-q28c-5m68-92hm, MAL-2026-6940 | Malicious | Not scored | 07 Jul, 2026 | npm rnx-align-deps |
Malicious release: Malicious code in some-theme (npm) GHSA-wcc7-m55m-mh57, MAL-2026-6942 | Malicious | Not scored | 07 Jul, 2026 | npm some-theme |
Malicious release: Malicious code in nonexistent-package (npm) GHSA-wxvr-4mc8-3qvj, MAL-2026-6936 | Malicious | Not scored | 07 Jul, 2026 | npm nonexistent-package |
Malicious release: Malicious code in tx-guard-snap (npm) GHSA-8w4p-m2h2-2wj5, MAL-2026-6943 | Malicious | Not scored | 07 Jul, 2026 | npm tx-guard-snap |
Phoenix: Presence keys colliding with `Object.prototype` members break existence checks CVE-2026-56812, EEF-CVE-2026-56812, GHSA-63mc-hw7g-86rr | Medium | 0.8% | 07 Jul, 2026 | Hex phoenix npm phoenix |
Malicious release: Malicious code in chai-sdk (npm) GHSA-xc9r-f5wv-cvxx, MAL-2026-6931 | Malicious | Not scored | 07 Jul, 2026 | npm chai-sdk |
Malicious release: Malicious code in chai-chain-dom (npm) GHSA-2gcw-jv94-7mfq, MAL-2026-6919 | Malicious | Not scored | 07 Jul, 2026 | npm chai-chain-dom |
Malicious release: Malicious code in jsf-utils (npm) GHSA-2jff-wp39-wgch, MAL-2026-6921 | Malicious | Not scored | 07 Jul, 2026 | npm jsf-utils |
Malicious release: Malicious code in notifier-utils (npm) GHSA-vg5w-f83q-fhmj, MAL-2026-6923 | Malicious | Not scored | 07 Jul, 2026 | npm notifier-utils |
Malicious release: Malicious code in crypto-base58 (npm) GHSA-frf3-wxv2-p559, MAL-2026-6920 | Malicious | Not scored | 07 Jul, 2026 | npm crypto-base58 |
Malicious release: Malicious code in typescript-base58 (npm) GHSA-rff8-755c-wqvw, MAL-2026-6925 | Malicious | Not scored | 07 Jul, 2026 | npm typescript-base58 |
Malicious release: Malicious code in solana-address-codec (npm) GHSA-9jx5-jcp6-qmqq, MAL-2026-6924 | Malicious | Not scored | 07 Jul, 2026 | npm solana-address-codec |
Malicious release: Malicious code in base58-cli (npm) GHSA-fg2f-v569-6wqv, MAL-2026-6918 | Malicious | Not scored | 07 Jul, 2026 | npm base58-cli |
Malicious release: Malicious code in @sqlite-list/schema-generator (npm) GHSA-2859-847v-c4v9, MAL-2026-6916 | Malicious | Not scored | 07 Jul, 2026 | npm @sqlite-list/schema-generator |
Malicious release: Malicious code in @sqlite-list/sql-creator (npm) GHSA-9hmc-5fx9-73cp, MAL-2026-6917 | Malicious | Not scored | 07 Jul, 2026 | npm @sqlite-list/sql-creator |
Malicious release: Malicious code in @sqlite-access/nodesql (npm) GHSA-m2mh-6v6x-qh4f, MAL-2026-6914 | Malicious | Not scored | 07 Jul, 2026 | npm @sqlite-access/nodesql |
Malicious release: Malicious code in @sqlite-list/createsql (npm) GHSA-www8-7fg3-xg79, MAL-2026-6915 | Malicious | Not scored | 07 Jul, 2026 | npm @sqlite-list/createsql |
Malicious release: Malicious code in mcp-server-pg (npm) GHSA-cfv7-74pc-vmff, MAL-2026-6922 | Malicious | Not scored | 07 Jul, 2026 | npm mcp-server-pg |
Malicious release: Malicious code in @engagehub/test-claim (npm) GHSA-q6cv-rc8j-6pp7, MAL-2026-6912 | Malicious | Not scored | 07 Jul, 2026 | npm @engagehub/test-claim |
Malicious release: Malicious code in brunomenozzi-test-pkg (npm) GHSA-hpc6-h2fp-hcpj, MAL-2026-6913 | Malicious | Not scored | 07 Jul, 2026 | npm brunomenozzi-test-pkg |
Malicious release: Malicious code in zreactjs (npm) GHSA-9xx3-2pvq-3fmq, MAL-2026-7447 | Malicious | Not scored | 07 Jul, 2026 | npm zreactjs |
Malicious release: Malicious code in zircuit-vault (npm) GHSA-r2vw-pjhw-fffh, MAL-2026-7446 | Malicious | Not scored | 07 Jul, 2026 | npm zircuit-vault |
Malicious release: Malicious code in zircuit-oracle (npm) GHSA-chhx-3jfh-88w2, MAL-2026-7444 | Malicious | Not scored | 07 Jul, 2026 | npm zircuit-oracle |