Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling CVE-2026-49253, GHSA-38j7-23hf-9mhc | High | 0.4% | 02 Jul, 2026 | npm electerm |
@conform-to/dom parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields CVE-2026-49250, GHSA-525m-7f82-2mf7 | High | 0.5% | 02 Jul, 2026 | npm @conform-to/dom |
Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true) GHSA-vv65-f55v-xm6g | High | Not scored | 02 Jul, 2026 | npm @grackle-ai/powerline npm @grackle-ai/runtime-sdk |
@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString CVE-2026-50290, GHSA-93q6-wwjh-jc6h | Medium | 0.5% | 02 Jul, 2026 | npm @asymmetric-effort/specifyjs |
@asymmetric-effort/specifyjs: No redirect target validation in secureFetch GHSA-j5qp-p44g-2m49 | Medium | Not scored | 02 Jul, 2026 | npm @asymmetric-effort/specifyjs |
@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction GHSA-2944-57xv-2682 | Medium | Not scored | 02 Jul, 2026 | npm @asymmetric-effort/specifyjs |
@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range) GHSA-xw57-23p8-9wc5 | Medium | Not scored | 02 Jul, 2026 | npm @asymmetric-effort/specifyjs |
@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state GHSA-qcr8-x557-7cp3 | Medium | Not scored | 02 Jul, 2026 | npm @asymmetric-effort/specifyjs |
@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection GHSA-5c7w-4wm3-85vw | Medium | Not scored | 02 Jul, 2026 | npm @asymmetric-effort/specifyjs |
@asymmetric-effort/specifyjs: URL parse failure silently allows request CVE-2026-50288, GHSA-8882-frvv-92w4 | High | 0.5% | 02 Jul, 2026 | npm @asymmetric-effort/specifyjs |
Malicious release: Malicious code in tailwind-animates (npm) GHSA-3cr6-gpr8-pjfm, MAL-2026-6727 | Malicious | Not scored | 02 Jul, 2026 | npm tailwind-animates |
Malicious release: Malicious code in db-convertor (npm) GHSA-p467-3jcx-48q5, MAL-2026-6726 | Malicious | Not scored | 02 Jul, 2026 | npm db-convertor |
Malicious release: Malicious code in @modhamanish/rn-mm-template (npm) GHSA-7v96-p295-826q, MAL-2026-6725 | Malicious | Not scored | 02 Jul, 2026 | npm @modhamanish/rn-mm-template |
Malicious release: Malicious code in @marketfront/actualordersnippetpopup (npm) MAL-2026-6763 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/actualordersnippetpopup |
Malicious release: Malicious code in @marketfront/advertisingdevtool (npm) MAL-2026-6764 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/advertisingdevtool |
Malicious release: Malicious code in @marketfront/bannerpopup (npm) MAL-2026-6765 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/bannerpopup |
Malicious release: Malicious code in @marketfront/baobabtech (npm) MAL-2026-6766 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/baobabtech |
Malicious release: Malicious code in @marketfront/basemarkettemplate (npm) MAL-2026-6767 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/basemarkettemplate |
Malicious release: Malicious code in @marketfront/blenderdevtool (npm) MAL-2026-6768 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/blenderdevtool |
Malicious release: Malicious code in @marketfront/captchaservice (npm) MAL-2026-6769 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/captchaservice |
Malicious release: Malicious code in @marketfront/changefilter (npm) MAL-2026-6770 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/changefilter |
Malicious release: Malicious code in @marketfront/commonecommerce (npm) MAL-2026-6771 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/commonecommerce |
Malicious release: Malicious code in @marketfront/customdealsfeed (npm) MAL-2026-6772 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/customdealsfeed |
Malicious release: Malicious code in @marketfront/designsystemdevtool (npm) MAL-2026-6773 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/designsystemdevtool |
Malicious release: Malicious code in @marketfront/devtoolsloader (npm) MAL-2026-6774 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/devtoolsloader |
Malicious release: Malicious code in @marketfront/digitalherobannercarousel (npm) MAL-2026-6775 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/digitalherobannercarousel |
Malicious release: Malicious code in @marketfront/dynamicpageparams (npm) MAL-2026-6776 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/dynamicpageparams |
Malicious release: Malicious code in @marketfront/errorcounter (npm) MAL-2026-6777 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/errorcounter |
Malicious release: Malicious code in @marketfront/fashiononboardingpopup (npm) MAL-2026-6778 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/fashiononboardingpopup |
Malicious release: Malicious code in @marketfront/fingerprint (npm) MAL-2026-6779 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/fingerprint |
Malicious release: Malicious code in @marketfront/footer (npm) MAL-2026-6780 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/footer |
Malicious release: Malicious code in @marketfront/gotoauthpopup (npm) MAL-2026-6781 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/gotoauthpopup |
Malicious release: Malicious code in @marketfront/header (npm) MAL-2026-6782 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/header |
Malicious release: Malicious code in @marketfront/infopopup (npm) MAL-2026-6783 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/infopopup |
Malicious release: Malicious code in @marketfront/livestreampreviewpopup (npm) MAL-2026-6784 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/livestreampreviewpopup |
Malicious release: Malicious code in @marketfront/madvpopup (npm) MAL-2026-6785 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/madvpopup |
Malicious release: Malicious code in @marketfront/mychatspreloader (npm) MAL-2026-6786 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/mychatspreloader |
Malicious release: Malicious code in @marketfront/navbar (npm) MAL-2026-6787 | Malicious | Not scored | 02 Jul, 2026 | npm @marketfront/navbar |
OpenClaw MCP SSE redirects could forward Authorization headers CVE-2026-62208, GHSA-9c3v-684m-579c | Medium | 0.4% | 01 Jul, 2026 | npm openclaw |
Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token CVE-2026-50143, GHSA-6gr2-qh89-hxwm | High | 0.5% | 01 Jul, 2026 | npm @apify/actors-mcp-server |
Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier CVE-2026-58263, GHSA-rxcw-mc6f-6hr3 | High | 0.2% | 01 Jul, 2026 | npm jodit |
Jodit has prototype pollution via Jodit.configure() / ConfigMerge CVE-2026-54756, GHSA-5957-5c94-3v7w | Medium | 0.5% | 01 Jul, 2026 | npm jodit |
Malicious release: Malicious code in electron-orbit (npm) MAL-2026-6723 | Malicious | Not scored | 01 Jul, 2026 | npm electron-orbit |
@hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key CVE-2026-48819, GHSA-hhx9-57xq-r5rw | Medium | 0.3% | 01 Jul, 2026 | npm @hey-api/openapi-ts |
Malicious release: Malicious code in svgcraft-core (npm) GHSA-j9vc-q728-qcx4, MAL-2026-6715 | Malicious | Not scored | 01 Jul, 2026 | npm svgcraft-core |
Malicious release: Malicious code in test-pkg-yarn (npm) GHSA-r653-6655-p467, MAL-2026-6718 | Malicious | Not scored | 01 Jul, 2026 | npm test-pkg-yarn |
Malicious release: Malicious code in test-pkg-pnpm (npm) GHSA-7grv-5j2w-4wx3, MAL-2026-6716 | Malicious | Not scored | 01 Jul, 2026 | npm test-pkg-pnpm |
Malicious release: Malicious code in test-pkg-x0 (npm) GHSA-45jm-p8g6-hcxf, MAL-2026-6717 | Malicious | Not scored | 01 Jul, 2026 | npm test-pkg-x0 |
Malicious release: Malicious code in polymarket-toolkit (npm) GHSA-w7x3-5xp7-6pw8, MAL-2026-6713 | Malicious | Not scored | 01 Jul, 2026 | npm polymarket-toolkit |
Malicious release: Malicious code in polymarket-trading-developer-tool (npm) GHSA-qh4r-g8mr-v3xp, MAL-2026-6714 | Malicious | Not scored | 01 Jul, 2026 | npm polymarket-trading-developer-tool |