Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in tailwind-animatecss-uniform (npm) GHSA-hxvr-77vv-6r85, MAL-2026-17667 | Malicious | Not scored | 22 days ago | npm tailwind-animatecss-uniform |
Malicious release: Malicious code in animatecss-tailwind-adapter (npm) MAL-2026-17665 | Malicious | Not scored | 22 days ago | npm animatecss-tailwind-adapter |
Backstage has improper input validation in TechDocs Markdown extension configuration CVE-2026-106557, GHSA-f7v3-xhm6-w245 | High | 0.3% | 22 days ago | npm @backstage/plugin-techdocs-node |
Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory CVE-2026-106108, GHSA-vhhq-m2gm-rwc9 | Medium | 0.1% | 22 days ago | npm @quasar/app-vite |
Malicious release: Malicious code in tailwindcss-animatecss-keyframes (npm) GHSA-3g68-5jcj-q8rx, MAL-2026-17646 | Malicious | Not scored | 22 days ago | npm tailwindcss-animatecss-keyframes |
Malicious release: Malicious code in @ikyyjee/ikkysingle (npm) GHSA-84vp-jj79-gp79, MAL-2026-17356 | Malicious | Not scored | 22 days ago | npm @ikyyjee/ikkysingle |
Malicious release: Malicious code in @ikyyjee/ikyysinggle (npm) GHSA-7cp5-9c7x-jc22, MAL-2026-17357 | Malicious | Not scored | 22 days ago | npm @ikyyjee/ikyysinggle |
Malicious release: Malicious code in @ikyyjee/ikyysingle (npm) GHSA-jq3m-36mx-2xch, MAL-2026-17358 | Malicious | Not scored | 22 days ago | npm @ikyyjee/ikyysingle |
Backstage: Improper entity validation in deprecated Kubernetes services endpoint CVE-2026-106563, GHSA-r9ph-3637-55px | Medium | 0.2% | 22 days ago | npm @backstage/plugin-kubernetes-backend |
Backstage has incorrect authorization in search engine permission filtering CVE-2026-106562, GHSA-9325-vq29-gp3v | Medium | 0.2% | 22 days ago | npm @backstage/plugin-search-backend npm @backstage/plugin-search-backend-module-elasticsearch |
Backstage has a sensitive information disclosure in Kubernetes resource queries CVE-2026-106561, GHSA-p795-mqf2-36mf | Medium | 0.2% | 22 days ago | npm @backstage/plugin-kubernetes-backend |
Backstage: Improper repository path validation in a Scaffolder backend module CVE-2026-106560, GHSA-2cmg-v53w-8xfp | High | 0.3% | 22 days ago | npm @backstage/plugin-scaffolder-backend-module-confluence-to-markdown |
Backstage: Improper input validation in Confluence to Markdown scaffolder module CVE-2026-106559, GHSA-75qf-886x-5xf2 | Medium | 0.3% | 22 days ago | npm @backstage/plugin-scaffolder-backend-module-confluence-to-markdown |
Backstage: Improper validation of TechDocs MkDocs configuration CVE-2026-106558, GHSA-qmw3-745m-w99g | High | 0.5% | 22 days ago | npm @backstage/plugin-techdocs-node |
Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml CVE-2026-106510, GHSA-4488-j8vj-vqqv | High | 0.5% | 22 days ago | npm @backstage/plugin-techdocs-node |
Malicious release: Malicious code in random-certs (npm) GHSA-2cfv-92gp-9f6m, MAL-2026-17644 | Malicious | Not scored | 23 days ago | npm random-certs |
Malicious release: Malicious code in vectorizers (npm) GHSA-q8rg-7mvv-2c63, MAL-2026-17645 | Malicious | Not scored | 23 days ago | npm vectorizers |
Malicious release: Malicious code in waie-crash-baileys (npm) GHSA-5r5f-v5vv-289q, MAL-2026-17643 | Malicious | Not scored | 23 days ago | npm waie-crash-baileys |
Malicious release: Malicious code in personio-pipeline-projen (npm) MAL-2026-17642 | Malicious | Not scored | 23 days ago | npm personio-pipeline-projen |
Malicious release: Malicious code in troubleshooting (npm) MAL-2026-17641 | Malicious | Not scored | 23 days ago | npm troubleshooting |
Malicious release: Malicious code in browser-metrics-plugin.contrib (npm) MAL-2026-17640 | Malicious | Not scored | 23 days ago | npm browser-metrics-plugin.contrib |
Backstage: Improper validation of MkDocs theme configuration in TechDocs CVE-2026-106509, GHSA-8w7q-29mw-gf5c | High | 0.5% | 23 days ago | npm @backstage/plugin-techdocs-node |
Backstage has potential file exposure through local TechDocs publisher CVE-2026-106508, GHSA-cm77-ch27-6w6v | Medium | 0.4% | 23 days ago | npm @backstage/plugin-techdocs-node |
Backstage has improper input validation in scaffolder task list ordering CVE-2026-106506, GHSA-vwp5-f99x-x3rq | Medium | 0.2% | 23 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend CVE-2026-106505, GHSA-p75x-jh7p-ppcx | High | 0.3% | 23 days ago | npm @backstage/plugin-techdocs-node |
Backstage has sensitive information exposure in scaffolder task logs CVE-2026-106504, GHSA-4xvq-3m68-h444 | Medium | 0.3% | 23 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage: Scaffolder action input authorization bypass CVE-2026-106503, GHSA-hmp2-4m7g-22cv | High | 0.5% | 23 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage may expose sensitive information in Scaffolder task failure events CVE-2026-106502, GHSA-95p4-vv4g-jxxm | Medium | 0.3% | 23 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage: Sensitive information exposure in Scaffolder CVE-2026-106501, GHSA-g2v8-7jhw-pp8p | Critical | 0.5% | 23 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage: Improper task state validation in Scaffolder backend CVE-2026-106500, GHSA-xvgh-hmx8-9xxf | High | 0.3% | 23 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage: Secret-derived values may be exposed in scaffolder task logs CVE-2026-106499, GHSA-mfvq-x7vr-rgqg | Medium | 0.3% | 23 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage: Improper URL validation in catalog entity placeholder resolution CVE-2026-106498, GHSA-qgvj-qcf8-xq73 | High | 0.3% | 23 days ago | npm @backstage/plugin-catalog-backend |
Backstage: Inconsistent enforcement of allowed location types during catalog processing CVE-2026-106496, GHSA-pcmq-25r3-5w9v | Medium | 0.2% | 23 days ago | npm @backstage/plugin-catalog-backend |
Backstage: Improper input validation in cloud storage URL readers CVE-2026-106494, GHSA-7649-wm97-w3j3 | Medium | 0.3% | 23 days ago | npm @backstage/backend-defaults |
Backstage: Cloud storage catalog locations may cross configured storage boundaries CVE-2026-106493, GHSA-xvh9-35w9-42m4 | Medium | 0.3% | 23 days ago | npm @backstage/backend-defaults npm @backstage/plugin-catalog-backend-module-aws npm @backstage/plugin-catalog-backend-module-azure |
Backstage: Improper preservation of access restrictions during service credential delegation CVE-2026-106492, GHSA-cq7v-rfgc-5c7v | High | 0.2% | 23 days ago | npm @backstage/backend-defaults |
Backstage: Improper input validation in proxy-backend CVE-2026-106491, GHSA-9ghw-48h5-v2w5 | Medium | 0.3% | 23 days ago | npm @backstage/plugin-proxy-backend |
Backstage: Improper input validation in TechDocs static content requests CVE-2026-106490, GHSA-7mfx-xg57-53c9 | Medium | 0.4% | 23 days ago | npm @backstage/plugin-techdocs-backend |
Backstage: Improper authorization enforcement for TechDocs static content CVE-2026-106489, GHSA-rg9r-hr7g-5gc2 | Medium | 0.3% | 23 days ago | npm @backstage/plugin-techdocs-backend |
Backstage: Improper authentication in the OIDC provider CVE-2026-106488, GHSA-826h-28h9-65hg | High | 0.3% | 23 days ago | npm @backstage/plugin-auth-backend-module-oidc-provider |
Backstage: Unsupported catalog cluster authentication mode in kubernetes backend CVE-2026-106487, GHSA-h53x-hjx6-25gr | Medium | 0.3% | 23 days ago | npm @backstage/plugin-kubernetes-backend |
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions CVE-2026-106486, GHSA-g8rx-f7m5-7794 | Critical | 0.4% | 23 days ago | npm @backstage/plugin-scaffolder-backend-module-bitbucket-cloud npm @backstage/plugin-scaffolder-backend-module-bitbucket-server |
Backstage has improper authorization in GitLab organizational user ingestion CVE-2026-106463, GHSA-gp6m-x9vw-5c5x | Medium | 0.2% | 23 days ago | npm @backstage/plugin-catalog-backend-module-gitlab |
Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback CVE-2026-106462, GHSA-29gx-h2m3-xw44 | Medium | 0.2% | 23 days ago | npm @backstage/plugin-scaffolder-backend npm @backstage/plugin-scaffolder-backend-module-azure npm @backstage/plugin-scaffolder-backend-module-bitbucket-cloud npm @backstage/plugin-scaffolder-backend-module-bitbucket-server +2 more |
Backstage: Incorrect authorization in scaffolder task listing CVE-2026-106461, GHSA-7hfw-grcm-cqm6 | Medium | 0.2% | 23 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization CVE-2026-106460, GHSA-xm5q-p7w3-x6cp | Medium | 0.3% | 23 days ago | npm @backstage/plugin-auth-node |
Backstage: Improper input validation in Sentry scaffolder actions CVE-2026-106459, GHSA-g734-fhp4-7mfp | High | 0.2% | 23 days ago | npm @backstage/plugin-scaffolder-backend-module-sentry |
Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates CVE-2026-106458, GHSA-c36c-cf6r-ghgj | Medium | 0.3% | 23 days ago | npm @backstage/plugin-catalog-backend-module-bitbucket-server |
Backstage: Insufficient audience validation in the Cloudflare Access auth provider CVE-2026-106457, GHSA-q333-f498-w2x7 | High | 0.3% | 23 days ago | npm @backstage/plugin-auth-backend-module-cloudflare-access-provider |
Backstage: Inconsistent credential enforcement for overlapping proxy routes CVE-2026-106456, GHSA-472h-9c5j-prrr | Medium | 0.2% | 23 days ago | npm @backstage/plugin-proxy-backend |