Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients CVE-2026-57135, GHSA-gqmf-56h7-rrpf | High | 0.4% | 18 Jun, 2026 | npm praisonai |
npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation CVE-2026-57134, GHSA-4qq2-2j2x-x62c | High | 0.4% | 18 Jun, 2026 | npm praisonai |
TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes CVE-2026-55661, GHSA-2vcc-5v34-9jc8 | Medium | 0.4% | 18 Jun, 2026 | npm @tinacms/mdx npm tinacms |
Hydro: Insufficient session expiration when recreating sessions CVE-2026-55617, GHSA-94jp-7776-qj6q | Medium | 0.5% | 18 Jun, 2026 | npm hydrooj |
http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody` CVE-2026-55603, GHSA-gcq2-9pq2-cxqm | High | 0.3% | 18 Jun, 2026 | npm http-proxy-middleware |
http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass CVE-2026-55602, GHSA-64mm-vxmg-q3vj | Medium | 0.4% | 18 Jun, 2026 | npm http-proxy-middleware |
piscina: Prototype Pollution Gadget → RCE via inherited options.filename CVE-2026-55388, GHSA-x9g3-xrwr-cwfg | High | 0.5% | 18 Jun, 2026 | npm piscina |
jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set() CVE-2026-55886, GHSA-vpmm-x3fm-qr5c | Medium | 0.5% | 18 Jun, 2026 | npm jodit |
Malicious release: Malicious code in @rafaelsene01/agent-flow (npm) GHSA-rhv6-f4px-2cf4, MAL-2026-6111 | Malicious | Not scored | 18 Jun, 2026 | npm @rafaelsene01/agent-flow |
Malicious release: Malicious code in stackus (npm) GHSA-x868-gvwf-qxg6, MAL-2026-6098 | Malicious | Not scored | 18 Jun, 2026 | npm stackus |
Malicious release: Malicious code in jwtmode (npm) MAL-2026-6093 | Malicious | Not scored | 18 Jun, 2026 | npm jwtmode |
Malicious release: Malicious code in requests-middleware (npm) GHSA-mxgq-rcpv-wrm9, MAL-2026-6096 | Malicious | Not scored | 18 Jun, 2026 | npm requests-middleware |
Malicious release: Malicious code in roblox-api-client (npm) GHSA-hmpp-mfgc-mq8p, MAL-2026-6097 | Malicious | Not scored | 18 Jun, 2026 | npm roblox-api-client |
Malicious release: Malicious code in intquery (npm) GHSA-w7f8-x6ww-hf3x, MAL-2026-6113 | Malicious | Not scored | 18 Jun, 2026 | npm intquery |
Malicious release: Malicious code in oem-agentic-shared (npm) GHSA-h957-h3mc-79qr, MAL-2026-6095 | Malicious | Not scored | 18 Jun, 2026 | npm oem-agentic-shared |
Malicious release: Malicious code in datacamp-light (npm) GHSA-j27q-7263-hr46, MAL-2026-6091 | Malicious | Not scored | 18 Jun, 2026 | npm datacamp-light |
Malicious release: Malicious code in data-utils-bcf2 (npm) MAL-2026-6090 | Malicious | Not scored | 18 Jun, 2026 | npm data-utils-bcf2 |
Malicious release: Malicious code in stream-read-35cf (npm) MAL-2026-6099 | Malicious | Not scored | 18 Jun, 2026 | npm stream-read-35cf |
Malicious release: Malicious code in fmt-helpers-794b (npm) GHSA-4wmf-8x9r-34cc, MAL-2026-6092 | Malicious | Not scored | 18 Jun, 2026 | npm fmt-helpers-794b |
Malicious release: Malicious code in data-utils-d703 (npm) GHSA-655h-34jr-cj9x, MAL-2026-6112 | Malicious | Not scored | 18 Jun, 2026 | npm data-utils-d703 |
Malicious release: Malicious code in string-tools-be6c (npm) GHSA-93cp-5ff7-p9m5, MAL-2026-6100 | Malicious | Not scored | 18 Jun, 2026 | npm string-tools-be6c |
Malicious release: Malicious code in color-utils-dee0 (npm) GHSA-f8p9-v2xw-79xc, MAL-2026-6089 | Malicious | Not scored | 18 Jun, 2026 | npm color-utils-dee0 |
Malicious release: Malicious code in type-check-816d (npm) GHSA-q7qm-cfrq-fg6g, MAL-2026-6101 | Malicious | Not scored | 18 Jun, 2026 | npm type-check-816d |
Malicious release: Malicious code in metrics-probe-88ad (npm) GHSA-qh3x-q57r-jq77, MAL-2026-6114 | Malicious | Not scored | 18 Jun, 2026 | npm metrics-probe-88ad |
Malicious release: Malicious code in metrics-probe-f256 (npm) GHSA-wrx9-4534-jwh6, MAL-2026-6094 | Malicious | Not scored | 18 Jun, 2026 | npm metrics-probe-f256 |
Malicious release: Malicious code in @ncurran/dc-selftest-33afb7 (npm) GHSA-42f8-8vgh-57px, MAL-2026-6102 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/dc-selftest-33afb7 |
Malicious release: Malicious code in npm-sandbox-research-f1g2 (npm) GHSA-5786-jcjh-w75f, MAL-2026-6116 | Malicious | Not scored | 18 Jun, 2026 | npm npm-sandbox-research-f1g2 |
Malicious release: Malicious code in @ncurran/sandbox-recon-7c4e1a (npm) GHSA-6h2p-j374-h5qj, MAL-2026-6104 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/sandbox-recon-7c4e1a |
Malicious release: Malicious code in @ncurran/sandbox-recon-880538 (npm) GHSA-829r-722f-73rg, MAL-2026-6105 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/sandbox-recon-880538 |
Malicious release: Malicious code in @ncurran/sandbox-recon-uac-4e7c (npm) GHSA-88j8-4jpx-79xj, MAL-2026-6110 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/sandbox-recon-uac-4e7c |
Malicious release: Malicious code in @ncurran/sandbox-recon-sys-6a3f (npm) GHSA-8xvr-4p7v-395p, MAL-2026-6109 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/sandbox-recon-sys-6a3f |
Malicious release: Malicious code in @ncurran/sandbox-recon-9b2d4f (npm) GHSA-c462-2ggc-2wj2, MAL-2026-6106 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/sandbox-recon-9b2d4f |
Malicious release: Malicious code in npm-sandbox-research-a1b2 (npm) GHSA-jw25-p682-fhw6, MAL-2026-6115 | Malicious | Not scored | 18 Jun, 2026 | npm npm-sandbox-research-a1b2 |
Malicious release: Malicious code in @ncurran/sandbox-recon-sys-5b2c (npm) GHSA-qqj4-fh9f-5v33, MAL-2026-6107 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/sandbox-recon-sys-5b2c |
Malicious release: Malicious code in @ncurran/sandbox-recon-sys-5f1b (npm) GHSA-v27g-px49-r9w8, MAL-2026-6108 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/sandbox-recon-sys-5f1b |
Malicious release: Malicious code in @ncurran/dc-selftest-ba0ad4 (npm) GHSA-vgm9-c9cx-8cvv, MAL-2026-6103 | Malicious | Not scored | 18 Jun, 2026 | npm @ncurran/dc-selftest-ba0ad4 |
Malicious release: Malicious code in vite-common-utils (npm) GHSA-6wm7-cff3-322r, MAL-2026-6088 | Malicious | Not scored | 17 Jun, 2026 | npm vite-common-utils |
Malicious release: Malicious code in uol-simple-api-futebol (npm) MAL-2026-6087 | Malicious | Not scored | 17 Jun, 2026 | npm uol-simple-api-futebol |
Malicious release: Malicious code in ai-chat-helper (npm) MAL-2026-6086 | Malicious | Not scored | 17 Jun, 2026 | npm ai-chat-helper |
Malicious release: Malicious code in @hotcappuccino/nodepull (npm) GHSA-r3fv-99xj-m7pw, MAL-2026-6085 | Malicious | Not scored | 17 Jun, 2026 | npm @hotcappuccino/nodepull |
Malicious release: Malicious code in @array-util/nodepull (npm) GHSA-qhxp-5mv2-773f, MAL-2026-6084 | Malicious | Not scored | 17 Jun, 2026 | npm @array-util/nodepull |
Malicious release: Malicious code in pino-slite (npm) GHSA-4m74-rvqg-rg5w, MAL-2026-6078 | Malicious | Not scored | 17 Jun, 2026 | npm pino-slite |
Malicious release: Malicious code in set-proto-chain (npm) GHSA-7p39-r7q7-jcv7, MAL-2026-6079 | Malicious | Not scored | 17 Jun, 2026 | npm set-proto-chain |
Malicious release: Malicious code in ebpf-tracker-action (npm) MAL-2026-6077 | Malicious | Not scored | 17 Jun, 2026 | npm ebpf-tracker-action |
Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests CVE-2026-48814, GHSA-r78r-rwrf-rjwp | Critical | 0.4% | 17 Jun, 2026 | npm network-ai |
Malicious release: Malicious code in opt-archetype-check (npm) GHSA-fq5h-gc4g-76cp, MAL-2026-6075 | Malicious | Not scored | 17 Jun, 2026 | npm opt-archetype-check |
Malicious release: Malicious code in nano-perf (npm) GHSA-4236-g67q-42fc, MAL-2026-11204 | Malicious | Not scored | 17 Jun, 2026 | npm nano-perf |
Malicious release: Malicious code in @civitatis/bot-ui (npm) MAL-2026-6069 | Malicious | Not scored | 17 Jun, 2026 | npm @civitatis/bot-ui |
Malicious release: Malicious code in libsc-runtime-telemetry (npm) MAL-2026-6070 | Malicious | Not scored | 17 Jun, 2026 | npm libsc-runtime-telemetry |
Malicious release: Malicious code in @mastra/observability (npm) GHSA-cgqj-9hhw-gw7x, MAL-2026-6073 | Malicious | Not scored | 17 Jun, 2026 | npm @mastra/observability |