Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
XSS in Ghost's ActivityPub client BIT-ghost-2026-53950, CVE-2026-53950, GHSA-xpp7-93x6-v29m | High | 0.4% | 24 Jun, 2026 | npm @tryghost/activitypub |
Ghost Content API filter bypass reveals private fields BIT-ghost-2026-53949, CVE-2026-53949, GHSA-jx35-x7fj-vgpr | Medium | 0.4% | 24 Jun, 2026 | npm ghost |
Ghost: File Upload Content-Type Spoofing BIT-ghost-2026-53948, CVE-2026-53948, GHSA-944x-pm95-3jpr | Medium | 0.2% | 24 Jun, 2026 | npm ghost |
Ghost: Member existence leak via magic link sign-in response BIT-ghost-2026-53947, CVE-2026-53947, GHSA-chgm-3698-jm42 | Medium | 0.3% | 24 Jun, 2026 | npm ghost |
Ghost: Mobiledoc image-size fetch SSRF BIT-ghost-2026-53946, CVE-2026-53946, GHSA-g366-23fw-ggp6 | Medium | 0.2% | 24 Jun, 2026 | npm ghost |
Ghost: Server-side request forgery via DNS rebinding in external request handling BIT-ghost-2026-53945, CVE-2026-53945, GHSA-ch52-px8q-f22j | Medium | 0.2% | 24 Jun, 2026 | npm ghost |
Ghost: Private IP filtering bypass to make server-side requests to internal services BIT-ghost-2026-53944, CVE-2026-53944, GHSA-wvp2-4qqp-4h3r | Medium | 0.3% | 24 Jun, 2026 | npm ghost |
Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header BIT-ghost-2026-53943, CVE-2026-53943, GHSA-62q6-4hv4-vjrw | Critical | 0.4% | 24 Jun, 2026 | npm ghost |
Malicious release: Malicious code in @kl-dolphin/swim (npm) GHSA-rr7c-77w4-j8c8, MAL-2026-6402 | Malicious | Not scored | 24 Jun, 2026 | npm @kl-dolphin/swim |
Malicious release: Malicious code in zenith-utils (npm) MAL-2026-6401 | Malicious | Not scored | 24 Jun, 2026 | npm zenith-utils |
Malicious release: Malicious code in normalize-plus (npm) GHSA-fr34-v6cp-fc49, MAL-2026-6399 | Malicious | Not scored | 24 Jun, 2026 | npm normalize-plus |
Malicious release: Malicious code in ui-core-system (npm) GHSA-9x83-p3mj-p224, MAL-2026-6398 | Malicious | Not scored | 24 Jun, 2026 | npm ui-core-system |
Malicious release: Malicious code in ldapaotest (npm) GHSA-67gf-qg4g-4qfw, MAL-2026-6397 | Malicious | Not scored | 24 Jun, 2026 | npm ldapaotest |
Malicious release: Malicious code in cccmyssr2 (npm) MAL-2026-6391 | Malicious | Not scored | 24 Jun, 2026 | npm cccmyssr2 |
Malicious release: Malicious code in cccmyssr-util (npm) MAL-2026-6390 | Malicious | Not scored | 24 Jun, 2026 | npm cccmyssr-util |
Malicious release: Malicious code in cccmyssr3 (npm) MAL-2026-6392 | Malicious | Not scored | 24 Jun, 2026 | npm cccmyssr3 |
Malicious release: Malicious code in react-campaign-optimizer (npm) GHSA-m55j-v4cf-p5w5, MAL-2026-6395 | Malicious | Not scored | 24 Jun, 2026 | npm react-campaign-optimizer |
Malicious release: Malicious code in signup-embedder (npm) GHSA-8j4q-hx83-pfq9, MAL-2026-6396 | Malicious | Not scored | 24 Jun, 2026 | npm signup-embedder |
Malicious release: Malicious code in chai-as-predicted (npm) MAL-2026-6393 | Malicious | Not scored | 24 Jun, 2026 | npm chai-as-predicted |
Malicious release: Malicious code in hs-locale-management (npm) GHSA-rv32-4gr2-5g7w, MAL-2026-6394 | Malicious | Not scored | 24 Jun, 2026 | npm hs-locale-management |
Malicious release: Malicious code in rapidsearch (npm) GHSA-p52q-jhm3-m38v, MAL-2026-6388 | Malicious | Not scored | 24 Jun, 2026 | npm rapidsearch |
Malicious release: Malicious code in multer-express (npm) GHSA-vvr6-9g6q-v5w3, MAL-2026-6387 | Malicious | Not scored | 24 Jun, 2026 | npm multer-express |
Malicious release: Malicious code in eth_accounts (npm) GHSA-72wp-5hhw-xhfc, MAL-2026-6385 | Malicious | Not scored | 24 Jun, 2026 | npm eth_accounts |
Malicious release: Malicious code in vercel-api-client (npm) GHSA-9634-pgqf-xjgr, MAL-2026-6389 | Malicious | Not scored | 24 Jun, 2026 | npm vercel-api-client |
Malicious release: Malicious code in evmdotjs (npm) GHSA-jc2j-9j5f-fc2w, MAL-2026-6386 | Malicious | Not scored | 24 Jun, 2026 | npm evmdotjs |
Malicious release: Malicious code in simplisafe-gatsby (npm) GHSA-4h74-54qw-vx37, GHSA-grcq-xfr7-4vpm, MAL-2026-6379 | Malicious | Not scored | 24 Jun, 2026 | npm simplisafe-gatsby |
Malicious release: Malicious code in macos-ci-utils (npm) GHSA-9gfp-2g8v-p678, MAL-2026-6378 | Malicious | Not scored | 24 Jun, 2026 | npm macos-ci-utils |
Malicious release: Malicious code in linux-ci-utils (npm) MAL-2026-6377 | Malicious | Not scored | 24 Jun, 2026 | npm linux-ci-utils |
Malicious release: Malicious code in system-core-utils (npm) MAL-2026-6380 | Malicious | Not scored | 24 Jun, 2026 | npm system-core-utils |
Malicious release: Malicious code in bn-lint (npm) MAL-2026-6376 | Malicious | Not scored | 24 Jun, 2026 | npm bn-lint |
Malicious release: Malicious code in evil-pkg (npm) GHSA-p67r-jq7p-6g7v, MAL-2026-6374 | Malicious | Not scored | 24 Jun, 2026 | npm evil-pkg |
Malicious release: Malicious code in gpt-chat-cli (npm) MAL-2026-6375 | Malicious | Not scored | 24 Jun, 2026 | npm gpt-chat-cli |
Malicious release: Malicious code in hardhat-test-log (npm) MAL-2026-6369 | Malicious | Not scored | 24 Jun, 2026 | npm hardhat-test-log |
Malicious release: Malicious code in dbt-language-server (npm) GHSA-w54g-2v55-m5vr, MAL-2026-6367 | Malicious | Not scored | 24 Jun, 2026 | npm dbt-language-server |
Malicious release: Malicious code in hyperpure (npm) GHSA-q5m5-95fv-6hgf, MAL-2026-6370 | Malicious | Not scored | 24 Jun, 2026 | npm hyperpure |
Malicious release: Malicious code in decimal-format-utils (npm) GHSA-63g4-gv37-rfv8, MAL-2026-6368 | Malicious | Not scored | 24 Jun, 2026 | npm decimal-format-utils |
Malicious release: Malicious code in rollup-runtime-polyfill-core (npm) GHSA-cx5m-r6wc-pp56, MAL-2026-6372 | Malicious | Not scored | 24 Jun, 2026 | npm rollup-runtime-polyfill-core |
Malicious release: Malicious code in assertcore (npm) GHSA-8f9p-rcjg-hhx4, MAL-2026-6365 | Malicious | Not scored | 24 Jun, 2026 | npm assertcore |
Malicious release: Malicious code in backpack-ios (npm) MAL-2026-6366 | Malicious | Not scored | 24 Jun, 2026 | npm backpack-ios |
Malicious release: Malicious code in llm-traces-app (npm) MAL-2026-6371 | Malicious | Not scored | 24 Jun, 2026 | npm llm-traces-app |
Malicious release: Malicious code in twilio-voice-js-reference-components (npm) GHSA-5wvr-g236-9w68, GHSA-6547-hjjw-237x, MAL-2026-6373 | Malicious | Not scored | 24 Jun, 2026 | npm twilio-voice-js-reference-components |
Malicious release: Malicious code in openllmapi (npm) MAL-2026-6364 | Malicious | Not scored | 24 Jun, 2026 | npm openllmapi |
Malicious release: Malicious code in monty-data (npm) MAL-2026-6362 | Malicious | Not scored | 24 Jun, 2026 | npm monty-data |
Malicious release: Malicious code in npmkekw (npm) MAL-2026-6363 | Malicious | Not scored | 24 Jun, 2026 | npm npmkekw |
Malicious release: Malicious code in tailwind-textform-fill (npm) GHSA-4wh6-h6rw-f94h, MAL-2026-6360 | Malicious | Not scored | 24 Jun, 2026 | npm tailwind-textform-fill |
Malicious release: Malicious code in html-to-gutenberg (npm) GHSA-2gqj-wrf5-35w8, MAL-2026-6359 | Malicious | Not scored | 24 Jun, 2026 | npm html-to-gutenberg |
Malicious release: Malicious code in fetch-page-assets (npm) GHSA-vxq2-vhm7-7mhq, MAL-2026-6358 | Malicious | Not scored | 24 Jun, 2026 | npm fetch-page-assets |
Malicious release: Malicious code in vscode-test-web (npm) GHSA-vxwh-gqjr-fxcw, MAL-2026-6361 | Malicious | Not scored | 24 Jun, 2026 | npm vscode-test-web |
Style Dictionary - Prototype Pollution in convertTokenData utility function CVE-2026-54639, GHSA-vj5c-m527-mpff | High | 0.4% | 24 Jun, 2026 | npm style-dictionary |
Malicious release: Malicious code in delta-time-32bb (npm) MAL-2026-6351 | Malicious | Not scored | 23 Jun, 2026 | npm delta-time-32bb |