Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Backstage: Insufficient audience validation in the Cloudflare Access auth provider CVE-2026-106457, GHSA-q333-f498-w2x7 | High | 0.3% | 23 days ago | npm @backstage/plugin-auth-backend-module-cloudflare-access-provider |
Backstage: Inconsistent credential enforcement for overlapping proxy routes CVE-2026-106456, GHSA-472h-9c5j-prrr | Medium | 0.2% | 23 days ago | npm @backstage/plugin-proxy-backend |
Backstage: Improper validation of MkDocs plugin configuration in TechDocs CVE-2026-106455, GHSA-q38j-6vcm-2f5m | High | 0.3% | 23 days ago | npm @backstage/plugin-techdocs-node |
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) CVE-2026-106446, GHSA-8r5x-fm3f-whwj | Critical | 0.8% | 23 days ago | npm handlebars |
Handlebars: JavaScript Injection via Own Property Check Bypass CVE-2026-106445, GHSA-p8wg-vrv2-v86f | Critical | 0.6% | 23 days ago | npm handlebars |
Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates CVE-2026-106444, GHSA-xw65-4hp5-5hc7 | Medium | 0.3% | 23 days ago | npm handlebars |
Malicious release: Malicious code in css-jptvix-polyfill (npm) MAL-2026-17638 | Malicious | Not scored | 23 days ago | npm css-jptvix-polyfill |
LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration CVE-2026-106120, GHSA-fwxr-j5w2-587m | Medium | 0.4% | 23 days ago | npm liquidjs |
LangChain: MongoDBChatMessageHistory query injection can allow cross-session access CVE-2026-106119, GHSA-m6rx-h84q-8r95 | Medium | 0.5% | 23 days ago | npm @langchain/mongodb |
Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories CVE-2026-106109, GHSA-q9mq-245r-4g93 | Medium | 0.1% | 23 days ago | npm @quasar/app-vite |
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained CVE-2026-106107, GHSA-5m6h-8g35-p3m7 | High | 0.3% | 23 days ago | npm @quasar/app-vite |
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable CVE-2026-106106, GHSA-r5mf-4r5x-q78f | High | 0.3% | 23 days ago | npm @quasar/app-vite npm @quasar/render-ssr-error |
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions CVE-2026-106105, GHSA-fh39-c73x-5pjv | High | 0.1% | 23 days ago | npm @quasar/app-vite npm @quasar/cli npm @quasar/ssl-certificate |
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server CVE-2026-106104, GHSA-68jq-fhch-4xq4 | High | 0.4% | 23 days ago | npm quasar |
Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile CVE-2026-106103, GHSA-wmpw-j6qv-mw88 | High | 0.3% | 23 days ago | npm @quasar/icongenie |
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead() CVE-2026-106102, GHSA-pq96-jpmf-w254 | Critical | 0.3% | 23 days ago | npm quasar |
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service CVE-2026-106101, GHSA-89vp-x45c-52cq | Low | 0.3% | 23 days ago | npm quasar |
Payload: Field-level write access bypass in Payload on MongoDB CVE-2026-106100, GHSA-4ww4-68q3-h7g5 | High | 0.2% | 23 days ago | npm @payloadcms/db-mongodb |
Payload: Uploaded XML files could execute same-origin JavaScript CVE-2026-105868, GHSA-9qpg-3cf8-w33x | High | 0.2% | 23 days ago | npm payload |
Payload: Client uploads could overwrite S3 objects CVE-2026-105867, GHSA-7vg8-29qx-jgj8 | High | 0.2% | 23 days ago | npm @payloadcms/storage-s3 |
Payload: Unauthenticated account-lockout denial of service CVE-2026-105866, GHSA-v5gf-vpjc-pc7w | Medium | 0.4% | 23 days ago | npm payload |
Payload: Incomplete validation during the upload file lifecycle CVE-2026-105865, GHSA-p223-2wr2-j562 | High | 0.4% | 23 days ago | npm payload |
@payloadcms/plugin-multi-tenant has a cross-tenant create issue CVE-2026-105864, GHSA-xhm9-gwgw-3q2q | Medium | 0.2% | 23 days ago | npm @payloadcms/plugin-multi-tenant |
Payload authentication token field handling issue CVE-2026-105863, GHSA-66wr-7vmr-p5jq | Critical | 0.4% | 23 days ago | npm payload |
Payload: Bypassed sanitization of user uploaded SVGs CVE-2026-105862, GHSA-2pwp-2369-8fg3 | High | 0.3% | 23 days ago | npm payload |
Payload external upload trust validation issue CVE-2026-105861, GHSA-pj5h-5q6c-3pfx | High | 0.1% | 23 days ago | npm payload |
Payload has a tenant authorization bypass in Multi-Tenant Plugin CVE-2026-105860, GHSA-p96c-xwx8-3cqj | High | 0.2% | 23 days ago | npm @payloadcms/plugin-multi-tenant |
Payload: Unauthorized update to collection documents CVE-2026-105859, GHSA-f7hx-52q9-hcrf | Critical | 0.3% | 23 days ago | npm payload |
Payload: Remote Code Execution through first-register CVE-2026-105858, GHSA-97rh-rhh2-7vjv | High | 0.5% | 23 days ago | npm payload |
Payload Form Builder has an RCE issue CVE-2026-105857, GHSA-r488-j9vj-wx3q | Critical | 0.4% | 23 days ago | npm @payloadcms/plugin-form-builder |
Payload didn't enforce field-level password update restrictions CVE-2026-105855, GHSA-fx49-4h83-wjv9 | High | 0.2% | 23 days ago | npm payload |
Payload: ReDoS in Multipart Content-Type Validation CVE-2026-105854, GHSA-2g7p-5934-q4w7 | High | 0.4% | 23 days ago | npm payload |
Payload vulnerable to API key disclosure through ordinary document reads CVE-2026-105849, GHSA-238x-w2j9-gwwr | High | 0.3% | 23 days ago | npm payload |
Payload Ecommerce has an order confirmation validation issue CVE-2026-105850, GHSA-8r29-2mp2-pmrw | High | 0.3% | 23 days ago | npm @payloadcms/plugin-ecommerce |
Payload relationship-query authorization bypass CVE-2026-105852, GHSA-7c34-32v3-j575 | Medium | 0.3% | 23 days ago | npm payload |
Payload: Token refresh and password reset responses may expose restricted user fields CVE-2026-105853, GHSA-xgv3-crq2-6f69 | High | 0.3% | 23 days ago | npm payload |
Payload: Field access control bypass on auth collections CVE-2026-105851, GHSA-vc4h-q48j-5hcx | Critical | 0.2% | 23 days ago | npm payload |
Payload: Insufficient Access Control in Stripe REST Proxy CVE-2026-105848, GHSA-r9v2-gg2j-22q5 | Medium | 0.2% | 23 days ago | npm @payloadcms/plugin-stripe |
Payload: Improper access control for MCP API keys CVE-2026-105806, GHSA-2q76-m6w6-qgc6 | High | 0.3% | 23 days ago | npm @payloadcms/plugin-mcp |
Payload: Prototype pollution in Payload Import Export plugin CVE-2026-105844, GHSA-qf28-8hc6-vwrp | Critical | 0.7% | 23 days ago | npm @payloadcms/plugin-import-export |
Payload: SQL Injection in SQLite and Postgres CVE-2026-105845, GHSA-v49j-62m6-pgrr | Critical | 0.4% | 23 days ago | npm payload |
Payload: Untrusted redirect URL parameter exploit CVE-2026-105846, GHSA-w84c-53h3-mc2g | Medium | 0.2% | 23 days ago | npm @payloadcms/next npm payload |
Payload: Polymorphic join queries could disclose hidden fields CVE-2026-105847, GHSA-fpww-c55p-cjv6 | High | 0.2% | 23 days ago | npm payload |
Payload: Password hashes use insufficient PBKDF2 iterations CVE-2026-105804, GHSA-q6mq-ch85-c8mm | Medium | 0.1% | 23 days ago | npm payload |
Payload: Sort queries could expose protected field information CVE-2026-105805, GHSA-9g87-32v6-3c2r | Medium | 0.3% | 23 days ago | npm payload |
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server CVE-2026-104850, GHSA-6qxp-vccf-f47h | High | 0.2% | 23 days ago | npm @modelcontextprotocol/client npm @modelcontextprotocol/sdk |
i18next-http-backend incomplete URL validation permits SSRF CVE-2026-105800, GHSA-xvq9-wjp8-hwqf | Low | 0.3% | 24 days ago | npm i18next-http-backend |
LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values CVE-2026-105799, GHSA-5x6v-p487-7qh2 | Low | 0.3% | 24 days ago | npm @langchain/redis |
Malicious release: Malicious code in @kxa/xbails (npm) GHSA-7gvw-4c75-pc6p, MAL-2026-17363 | Malicious | Not scored | 24 days ago | npm @kxa/xbails |
sharp : Vulnerability in librsvg dependency CVE-2026-96889 CVE-2026-114111, GHSA-wq5f-xc86-pv6w | High | 0.1% | 24 days ago | npm sharp |