Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages CVE-2026-118257, GHSA-83rm-6c8r-g728 | High | Not scored | 1 day ago | npm @intlify/core npm @intlify/core-base npm @intlify/shared npm @intlify/vue-i18n-core +2 more |
Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list CVE-2026-118256, GHSA-8rc2-428q-7ww3 | Low | Not scored | 1 day ago | npm @intlify/core npm @intlify/core-base npm @intlify/vue-i18n-core npm petite-vue-i18n +1 more |
Highcharts Grid: `javascript:` URL in credits.href runs script on click CVE-2026-118255, GHSA-6hgp-fmhr-mrg4 | High | Not scored | 1 day ago | npm @highcharts/dashboards npm @highcharts/grid-pro |
Highcharts Grid parses pagination language options as HTML CVE-2026-118254, GHSA-r5wg-q8fc-p6w2 | High | Not scored | 1 day ago | npm @highcharts/grid-lite npm @highcharts/grid-pro |
Highcharts Dashboards parses fullscreen labels as HTML CVE-2026-118253, GHSA-58g7-7f52-h92c | High | Not scored | 1 day ago | npm @highcharts/dashboards |
Highcharts Dashboards parses sidebar component labels as HTML CVE-2026-118252, GHSA-rcqf-f6h2-ccg9 | High | Not scored | 1 day ago | npm @highcharts/dashboards |
Highcharts: `javascript:` URL in credits.href runs script on click CVE-2026-118251, GHSA-5793-x2q3-c3q7 | High | Not scored | 1 day ago | npm highcharts |
Malicious release: Malicious code in itsa-utils (npm) GHSA-x788-rmcm-4x49, MAL-2026-18363 | Malicious | Not scored | 1 day ago | npm itsa-utils |
Malicious release: Malicious code in itsa-react-checkbox (npm) GHSA-46r9-rx5f-hqqf, MAL-2026-18360 | Malicious | Not scored | 1 day ago | npm itsa-react-checkbox |
Highcharts: dotted series.keys paths write to Object.prototype CVE-2026-118250, GHSA-rmqc-xvr3-v46c | High | Not scored | 1 day ago | npm highcharts |
Highcharts: series column construction writes to Object.prototype CVE-2026-118249, GHSA-gfvx-2c2g-38wq | High | Not scored | 1 day ago | npm highcharts |
Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. CVE-2026-118247, GHSA-c75x-9x9h-28rm | Medium | Not scored | 1 day ago | npm @highcharts/dashboards npm @highcharts/grid-pro |
Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes CVE-2026-118246, GHSA-35rr-xwfh-x789 | High | Not scored | 1 day ago | npm highcharts |
Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace CVE-2026-118245, GHSA-grj7-r4jv-pw9j | High | Not scored | 1 day ago | npm @highcharts/dashboards |
Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing CVE-2026-118244, GHSA-65hg-cf3f-5m39 | High | Not scored | 1 day ago | npm highcharts |
Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` CVE-2026-118243, GHSA-jqgh-w3cc-7jqw | Medium | Not scored | 1 day ago | npm @highcharts/dashboards |
Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>` CVE-2026-118242, GHSA-6g3c-p4fg-xv47 | High | Not scored | 1 day ago | npm @highcharts/grid-lite npm @highcharts/grid-pro |
Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute` CVE-2026-116797, GHSA-5ghw-9mgr-jvx2 | High | Not scored | 1 day ago | npm @highcharts/dashboards npm @highcharts/grid-pro |
Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts CVE-2026-116796, GHSA-mw4f-gj5x-6xr4 | High | Not scored | 1 day ago | npm highcharts |
RE2JS: Quadratic-time denial of service in re2js lookbehind matching CVE-2026-116795, GHSA-gg6h-894w-4m9c | High | Not scored | 1 day ago | npm re2js |
Malicious release: Malicious code in transaction-info-generate-sdk (npm) GHSA-23j5-jj88-v9f3, MAL-2026-18362 | Malicious | Not scored | 1 day ago | npm transaction-info-generate-sdk |
Malicious release: Malicious code in mock-transactions-sdk (npm) GHSA-357r-x5jp-3p8f, MAL-2026-18361 | Malicious | Not scored | 1 day ago | npm mock-transactions-sdk |
Malicious release: Malicious code in black-spindle (npm) MAL-2026-18359 | Malicious | Not scored | 1 day ago | npm black-spindle |
Malicious release: Malicious code in @zmtcdn/components (npm) MAL-2026-18372 | Malicious | Not scored | 1 day ago | npm @zmtcdn/components |
Malicious release: Malicious code in @zmtcdn/ui (npm) MAL-2026-18373 | Malicious | Not scored | 1 day ago | npm @zmtcdn/ui |
Malicious release: Malicious code in identity-two-factor (npm) MAL-2026-18367 | Malicious | Not scored | 1 day ago | npm identity-two-factor |
Malicious release: Malicious code in spectral-net-probe (npm) MAL-2026-18368 | Malicious | Not scored | 1 day ago | npm spectral-net-probe |
Malicious release: Malicious code in glyphmatrix-fixture (npm) GHSA-vc33-3x34-x6jm, MAL-2026-18355 | Malicious | Not scored | 2 days ago | npm glyphmatrix-fixture |
Malicious release: Malicious code in ccsec-crypto-toolkit (npm) GHSA-2732-c6cp-rx5v, MAL-2026-18347 | Malicious | Not scored | 2 days ago | npm ccsec-crypto-toolkit |
Malicious release: Malicious code in ccsseecc-form-validator (npm) GHSA-h5wr-j55v-8m79, MAL-2026-18350 | Malicious | Not scored | 2 days ago | npm ccsseecc-form-validator |
Malicious release: Malicious code in csec-form-validatorr (npm) GHSA-ph3g-jrf5-8792, MAL-2026-18353 | Malicious | Not scored | 2 days ago | npm csec-form-validatorr |
Malicious release: Malicious code in ccsec-form-validator (npm) GHSA-r889-j2qv-2jv6, MAL-2026-18348 | Malicious | Not scored | 2 days ago | npm ccsec-form-validator |
Malicious release: Malicious code in csec-crypto-toolkit (npm) GHSA-v383-2358-576w, MAL-2026-18351 | Malicious | Not scored | 2 days ago | npm csec-crypto-toolkit |
Malicious release: Malicious code in ccsseecc-crypto-toolkit (npm) GHSA-v9xw-mxj4-fm5q, MAL-2026-18349 | Malicious | Not scored | 2 days ago | npm ccsseecc-crypto-toolkit |
Malicious release: Malicious code in csec-form-validator (npm) GHSA-wh86-6qm8-xgw2, MAL-2026-18352 | Malicious | Not scored | 2 days ago | npm csec-form-validator |
Malicious release: Malicious code in agentenact (npm) GHSA-7p7m-8jmq-qp93, MAL-2026-18346 | Malicious | Not scored | 2 days ago | npm agentenact |
dd-trace: ReDOS in URL query string obfuscation CVE-2026-116693, GHSA-x94g-w73q-hpcw | High | 0.4% | 2 days ago | npm dd-trace |
CKEditor: Cross-site scripting (XSS) in the engine package CVE-2026-116688, GHSA-rh54-vffm-5fvp | High | 0.5% | 2 days ago | npm @ckeditor/ckeditor5-engine npm ckeditor5 |
CKEditor: Cross-site scripting (XSS) in the engine package CVE-2026-116687, GHSA-v6mg-96c6-gmpq | Low | 0.3% | 2 days ago | npm @ckeditor/ckeditor5-engine npm ckeditor5 |
Malicious release: Malicious code in dsh-vm-tester (npm) GHSA-84fw-gj66-p5v3, MAL-2026-18345 | Malicious | Not scored | 2 days ago | npm dsh-vm-tester |
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length GHSA-f897-62hf-6gxq | High | Not scored | 2 days ago | npm @modelcontextprotocol/hono npm @modelcontextprotocol/node npm @modelcontextprotocol/sdk npm @modelcontextprotocol/server |
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization CVE-2026-116675, GHSA-mf2p-h6hf-fcwm | High | 0.3% | 2 days ago | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
systeminformation has prototype pollution in `networkStats()` via the interface name CVE-2026-116674, GHSA-7648-jmwf-vw7j | Medium | 0.3% | 2 days ago | npm systeminformation |
systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net CVE-2026-116673, GHSA-4vjg-vx72-qq4g | Low | 0.1% | 2 days ago | npm systeminformation |
Malicious release: Malicious code in @webapp-shared/login-vmok (npm) MAL-2026-18356 | Malicious | Not scored | 2 days ago | npm @webapp-shared/login-vmok |
Malicious release: Malicious code in adyen-web-v6 (npm) GHSA-r77r-rw3m-rjh5, MAL-2026-18344 | Malicious | Not scored | 2 days ago | npm adyen-web-v6 |
Malicious release: Malicious code in buttoncontent (npm) GHSA-6crh-vwr2-4qfp, MAL-2026-18339 | Malicious | Not scored | 2 days ago | npm buttoncontent |
Malicious release: Malicious code in macro-kernel-record-reader (npm) GHSA-32g3-f74c-pcxq, MAL-2026-18341 | Malicious | Not scored | 2 days ago | npm macro-kernel-record-reader |
Malicious release: Malicious code in fetch-hash-cache-atomic (npm) GHSA-w9mp-cvjp-jfqp, MAL-2026-18340 | Malicious | Not scored | 2 days ago | npm fetch-hash-cache-atomic |
Malicious release: Malicious code in string-target-mapper-hash (npm) GHSA-wfcx-722r-fg5h, MAL-2026-18342 | Malicious | Not scored | 2 days ago | npm string-target-mapper-hash |