Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
jupyterlab-git extension: Stored XSS leading to RCE CVE-2026-54527, GHSA-f962-v9hr-pfg5, PYSEC-2026-2540, PYSEC-2026-2541 | Critical | 0.5% | 19 Jun, 2026 | PyPI jupyterlab-git PyPI jupyterlab-git-core npm @jupyterlab/git |
TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB) GHSA-9ggv-8w38-r7pm | Medium | Not scored | 19 Jun, 2026 | npm typeorm |
@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter CVE-2026-49336, GHSA-396q-4vc8-28x9 | Medium | 0.7% | 19 Jun, 2026 | npm @microsoft/kiota-http-fetchlibrary |
js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals CVE-2026-49293, GHSA-wp3c-266w-4qfq | High | 0.6% | 19 Jun, 2026 | npm js-toml |
OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source CVE-2026-57583, GHSA-9wxg-vf3r-56hc | Low | 0.2% | 19 Jun, 2026 | npm @openzeppelin/wizard npm @openzeppelin/wizard-cairo npm @openzeppelin/wizard-stellar npm @openzeppelin/wizard-stylus |
Malicious release: Malicious code in free-claude (npm) GHSA-7qpf-5pm7-57rh, MAL-2026-6232 | Malicious | Not scored | 19 Jun, 2026 | npm free-claude |
Malicious release: Malicious code in base_parts_ai (npm) MAL-2026-6228 | Malicious | Not scored | 19 Jun, 2026 | npm base_parts_ai |
Malicious release: Malicious code in routecraft (npm) GHSA-mw8m-x3ph-h3x7, MAL-2026-6229 | Malicious | Not scored | 19 Jun, 2026 | npm routecraft |
Malicious release: Malicious code in aikaf668897 (npm) MAL-2026-6216 | Malicious | Not scored | 19 Jun, 2026 | npm aikaf668897 |
Malicious release: Malicious code in aikaf6688812 (npm) MAL-2026-6215 | Malicious | Not scored | 19 Jun, 2026 | npm aikaf6688812 |
Malicious release: Malicious code in aikaf788812 (npm) MAL-2026-6217 | Malicious | Not scored | 19 Jun, 2026 | npm aikaf788812 |
Malicious release: Malicious code in create-mono-package (npm) MAL-2026-6222 | Malicious | Not scored | 19 Jun, 2026 | npm create-mono-package |
Malicious release: Malicious code in @chunklab/hexparse (npm) GHSA-fv23-ggqm-w99j, MAL-2026-6214 | Malicious | Not scored | 19 Jun, 2026 | npm @chunklab/hexparse |
Malicious release: Malicious code in @bytemend/mfebus (npm) GHSA-hfjj-fph3-hp6h, MAL-2026-6213 | Malicious | Not scored | 19 Jun, 2026 | npm @bytemend/mfebus |
Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync CVE-2026-58195, GHSA-vcv2-r9jh-99m5 | High | 0.6% | 19 Jun, 2026 | npm agentic-flow |
Malicious release: Malicious code in @briskforge/envcheck (npm) GHSA-g63v-8g6g-5p76, MAL-2026-6212 | Malicious | Not scored | 19 Jun, 2026 | npm @briskforge/envcheck |
Malicious release: Malicious code in @apexcraft/nano-key (npm) GHSA-8x7w-vjr2-7q4m, MAL-2026-6210 | Malicious | Not scored | 19 Jun, 2026 | npm @apexcraft/nano-key |
Malicious release: Malicious code in @apiwizards/auth-middleware (npm) MAL-2026-6211 | Malicious | Not scored | 19 Jun, 2026 | npm @apiwizards/auth-middleware |
Malicious release: Malicious code in @antoncarlos1/nodelamp (npm) GHSA-c3r7-wcqm-j4v8, MAL-2026-6209 | Malicious | Not scored | 19 Jun, 2026 | npm @antoncarlos1/nodelamp |
Malicious release: Malicious code in chai-assert-kit (npm) MAL-2026-6221 | Malicious | Not scored | 19 Jun, 2026 | npm chai-assert-kit |
Malicious release: Malicious code in chai-as-attested (npm) GHSA-v8fp-q6g9-vj9c, MAL-2026-6218 | Malicious | Not scored | 19 Jun, 2026 | npm chai-as-attested |
Malicious release: Malicious code in chai-as-uphelded (npm) GHSA-9gg4-phm5-h5g9, MAL-2026-6220 | Malicious | Not scored | 19 Jun, 2026 | npm chai-as-uphelded |
parse-server: Denial of service via exponential-time processing of deeply nested query operators BIT-parse-2026-57480, CVE-2026-57480, GHSA-cgxm-vr2f-6fj8 | High | 0.6% | 19 Jun, 2026 | npm parse-server |
Malicious release: Malicious code in new-mjs-eslint (npm) GHSA-m6jq-gwpx-8rj7, MAL-2026-6226 | Malicious | Not scored | 19 Jun, 2026 | npm new-mjs-eslint |
Malicious release: Malicious code in mjs-eslint (npm) GHSA-r6f7-88jj-mg66, MAL-2026-6223 | Malicious | Not scored | 19 Jun, 2026 | npm mjs-eslint |
Malicious release: Malicious code in new-eslint-1 (npm) GHSA-72jg-rrr3-v685, MAL-2026-6225 | Malicious | Not scored | 19 Jun, 2026 | npm new-eslint-1 |
Malicious release: Malicious code in new-eslint (npm) GHSA-8h72-5mvw-5f6r, MAL-2026-6224 | Malicious | Not scored | 19 Jun, 2026 | npm new-eslint |
Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication CVE-2026-49357, GHSA-4hf8-5mjm-rfgq | High | 0.6% | 19 Jun, 2026 | npm line-desktop-mcp |
Malicious release: Malicious code in new-ts-helper (npm) GHSA-g793-594c-6gxf, MAL-2026-6227 | Malicious | Not scored | 19 Jun, 2026 | npm new-ts-helper |
Malicious release: Malicious code in chai-as-forgeted (npm) MAL-2026-6219 | Malicious | Not scored | 19 Jun, 2026 | npm chai-as-forgeted |
Network-AI: Improper Neutralization of Special Elements used in an OS Command CVE-2026-54051, GHSA-qw6v-5fcf-5666 | Critical | 0.5% | 19 Jun, 2026 | npm network-ai |
Malicious release: Malicious code in ts-esys (npm) GHSA-76f5-jq4m-cjc3, MAL-2026-6205 | Malicious | Not scored | 19 Jun, 2026 | npm ts-esys |
Malicious release: Malicious code in ts-ecro-helper (npm) GHSA-pw67-28xc-x677, MAL-2026-6204 | Malicious | Not scored | 19 Jun, 2026 | npm ts-ecro-helper |
Malicious release: Malicious code in mongoose-jsonify (npm) GHSA-6wmf-9mj4-fx3x, MAL-2026-6203 | Malicious | Not scored | 19 Jun, 2026 | npm mongoose-jsonify |
Malicious release: Malicious code in assert-kit (npm) GHSA-748x-3gxw-v7xv, MAL-2026-6200 | Malicious | Not scored | 19 Jun, 2026 | npm assert-kit |
Malicious release: Malicious code in eth-util (npm) GHSA-fq6v-3gxv-7rjv, MAL-2026-6201 | Malicious | Not scored | 19 Jun, 2026 | npm eth-util |
Malicious release: Malicious code in ethereum-gas-reporter (npm) GHSA-hr44-2g4q-fx38, MAL-2026-6202 | Malicious | Not scored | 19 Jun, 2026 | npm ethereum-gas-reporter |
Malicious release: Malicious code in build-tracker-n5p1 (npm) GHSA-chqj-php6-8x6m, MAL-2026-6196 | Malicious | Not scored | 19 Jun, 2026 | npm build-tracker-n5p1 |
ts-deepmerge: Prototype Method Override leads to DoS CVE-2026-12644, GHSA-87mf-gv2c-c62c | Medium | 0.5% | 19 Jun, 2026 | npm ts-deepmerge |
Malicious release: Malicious code in ts-big-ecro (npm) GHSA-3cg2-mrw5-67r6, MAL-2026-6199 | Malicious | Not scored | 19 Jun, 2026 | npm ts-big-ecro |
Malicious release: Malicious code in new-ecro-1 (npm) GHSA-j799-pq44-wq6g, MAL-2026-6198 | Malicious | Not scored | 19 Jun, 2026 | npm new-ecro-1 |
Malicious release: Malicious code in new-ecro (npm) GHSA-chhh-8532-pg35, MAL-2026-6197 | Malicious | Not scored | 19 Jun, 2026 | npm new-ecro |
Malicious release: Malicious code in node-slot (npm) GHSA-9243-vwcg-mpf3, MAL-2026-6191 | Malicious | Not scored | 19 Jun, 2026 | npm node-slot |
Malicious release: Malicious code in ordered-btree (npm) MAL-2026-6193 | Malicious | Not scored | 19 Jun, 2026 | npm ordered-btree |
Malicious release: Malicious code in @mep-exp/api-tools (npm) GHSA-g5jc-gx32-75x7, GHSA-q2pc-rvw2-7v5m, MAL-2026-6183 | Malicious | Not scored | 19 Jun, 2026 | npm @mep-exp/api-tools |
Malicious release: Malicious code in @qlab/component-intelligence (npm) MAL-2026-6184 | Malicious | Not scored | 19 Jun, 2026 | npm @qlab/component-intelligence |
Malicious release: Malicious code in nodepathbalance54 (npm) GHSA-hrp4-xprg-wqxw, MAL-2026-6192 | Malicious | Not scored | 19 Jun, 2026 | npm nodepathbalance54 |
Malicious release: Malicious code in conversa-sdk (npm) GHSA-8m82-6fp4-38m4, MAL-2026-6185 | Malicious | Not scored | 19 Jun, 2026 | npm conversa-sdk |
Malicious release: Malicious code in electron-internal-utils (npm) GHSA-38jw-23hm-vjr5, MAL-2026-6186 | Malicious | Not scored | 19 Jun, 2026 | npm electron-internal-utils |
Malicious release: Malicious code in eyee (npm) MAL-2026-6189 | Malicious | Not scored | 19 Jun, 2026 | npm eyee |