Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments CVE-2026-114604, GHSA-c4qx-w738-7hr3 | High | Not scored | 8 days ago | npm @graphql-tools/utils |
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p) CVE-2026-116803, GHSA-mrv2-3pqr-j5jr | High | 0.2% | 8 days ago | npm dompurify |
Next.js: Denial of Service in App Router using Server Actions CVE-2026-94482, GHSA-p3m5-59mp-jv5r | High | 0.4% | 8 days ago | npm next |
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown CVE-2026-113872, GHSA-q7qp-rjg7-q26m | High | 0.4% | 8 days ago | npm multer |
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body CVE-2026-111181, GHSA-27r3-jxmh-p828 | High | 0.4% | 8 days ago | npm body-parser |
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse() CVE-2026-114144, GHSA-9qmh-m7c6-f92p | High | 0.4% | 9 days ago | npm toml |
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse() CVE-2026-114143, GHSA-9j65-hcg3-gc64 | High | 0.5% | 9 days ago | npm toml |
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype CVE-2026-114142, GHSA-h895-cgqg-jf52 | High | 0.4% | 9 days ago | npm tome npm toml |
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse() CVE-2026-114141, GHSA-4qx8-w7c3-pj3p | High | 0.4% | 9 days ago | npm toml |
Storybook dev server vulnerable to code injection from the local network CVE-2026-114126, GHSA-px85-f4q5-jh77 | High | 0.5% | 9 days ago | npm @storybook/addon-mcp npm @storybook/addon-vitest npm @storybook/core npm @storybook/core-server +2 more |
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) CVE-2026-111758, GHSA-gfr2-rv44-r23c | High | 0.5% | 10 days ago | npm markdown-it |
MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another CVE-2026-111770, GHSA-jm63-cq47-j5jp | High | Not scored | 10 days ago | npm @modelcontextprotocol/server |
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation CVE-2026-111768, GHSA-46jr-4wx8-v453 | High | Not scored | 10 days ago | npm @modelcontextprotocol/sdk npm @modelcontextprotocol/server |
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them CVE-2026-111767, GHSA-22jm-h49p-29qw | High | 0.3% | 10 days ago | npm @modelcontextprotocol/sdk |
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export CVE-2026-113711, GHSA-86wm-68pq-5jwq | High | 0.6% | 10 days ago | npm @apostrophecms/import-export npm apostrophe |
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service CVE-2026-113666, GHSA-j5rq-xfvr-p969 | High | 0.4% | 10 days ago | npm @apostrophecms/db-connect npm apostrophe |
follow-redirects array-form headers bypass cross-origin credential stripping CVE-2026-111756, GHSA-q3jh-wrc6-jgq8 | High | 0.5% | 10 days ago | npm follow-redirects |
@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR) CVE-2026-111751, GHSA-57xq-rjx2-v5xh | High | Not scored | 10 days ago | npm @angular/router |
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory CVE-2026-113658, GHSA-qhcq-9pm2-c9w9 | High | 0.6% | 10 days ago | npm apostrophe |
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows CVE-2026-112942, GHSA-587h-7wmj-h5pm | High | 1.3% | 10 days ago | npm launch-editor npm vite npm vite-plus |
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) CVE-2026-111752, GHSA-62vg-58rm-qff7 | High | Not scored | 10 days ago | npm @angular/router |
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes CVE-2026-111759, GHSA-r7fv-28h4-cvq7 | High | 0.6% | 11 days ago | npm markdown-it |
follow-redirects sensitiveHeaders regex escaping can expose credential headers CVE-2026-111755, GHSA-8r9p-f939-6h3c | High | 0.5% | 11 days ago | npm follow-redirects |
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint CVE-2026-109461, GHSA-xcx6-jx8p-x3h5 | High | 0.4% | 14 days ago | npm @azure/msal-node |
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor CVE-2026-87029, GHSA-55wc-3pg8-jfw6 | High | 0.3% | 15 days ago | npm undici |
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation CVE-2026-87018, GHSA-qrxm-fqhp-jwvm | High | 0.2% | 15 days ago | npm undici |
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering CVE-2026-109932, GHSA-9fm3-97px-rjf6 | High | 0.3% | 15 days ago | npm undici |
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser CVE-2026-109924, GHSA-4qv8-2p9j-2685 | High | 0.3% | 15 days ago | npm undici |
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings CVE-2026-109869, GHSA-xjj6-f33q-929c | High | 0.3% | 15 days ago | npm undici |
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens CVE-2026-109841, GHSA-f72v-6w45-q472 | High | 0.3% | 15 days ago | npm undici |
AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity CVE-2026-104150, GHSA-524c-h47v-m3h8 | High | 0.4% | 15 days ago | npm @adonisjs/http-server |
OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths CVE-2026-100409, GHSA-2vc4-c4r6-p6v6 | High | 0.3% | 15 days ago | npm @opennextjs/cloudflare |
undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake CVE-2026-109855, GHSA-qq8j-7v2v-3rwp | High | 0.3% | 15 days ago | npm undici |
Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service CVE-2026-110872, GHSA-4g23-2xm8-66gc | High | 0.4% | 16 days ago | npm nodemailer |
Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing CVE-2026-110871, GHSA-39m8-27wv-hr27 | High | 0.4% | 16 days ago | npm nodemailer |
Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service CVE-2026-110869, GHSA-4ffr-jq9g-5ffx | High | 0.4% | 16 days ago | npm nodemailer |
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning CVE-2026-86063, GHSA-pq7j-f95f-qfcv | High | 0.2% | 17 days ago | npm @anthropic-ai/claude-code |
Qwik: Crashing any Qwik Server via Resource thenable CVE-2026-84994, GHSA-x586-xvc8-g7q6 | High | 0.5% | 17 days ago | npm @builder.io/qwik npm @qwik.dev/core |
better-auth: Device login approval does not show the requesting client or permissions CVE-2026-109346, GHSA-q84f-53jg-9ppm | High | 0.3% | 18 days ago | npm better-auth |
Tina: Code injection via unescaped Git branch name in generated client source CVE-2026-108259, GHSA-pwhx-cvv3-qj5c | High | 0.3% | 21 days ago | npm @tinacms/cli |
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS CVE-2026-108260, GHSA-c42q-qvc3-j6vg | High | 0.3% | 21 days ago | npm @tinacms/web-components |
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set CVE-2026-107720, GHSA-8wpc-h4q6-8fxv | High | 0.3% | 22 days ago | npm fast-jwt |
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array CVE-2026-107723, GHSA-5hjw-83fp-phq9 | High | 0.5% | 22 days ago | npm fast-jwt |
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery CVE-2026-107724, GHSA-g3jj-5cmm-3hxx | High | 0.3% | 22 days ago | npm fast-jwt |
music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master CVE-2026-107391, GHSA-f94x-6692-553q | High | 0.3% | 22 days ago | npm music-metadata |
music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7) CVE-2026-107392, GHSA-8j4c-6x6g-rq3j | High | 0.4% | 22 days ago | npm music-metadata |
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES BIT-mariadb-2026-107385, BIT-mariadb-min-2026-107385, BIT-mysql-client-2026-107385, CVE-2026-107385, GHSA-r3rv-jm3r-62q2 | High | 0.4% | 22 days ago | npm mariadb |
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries) BIT-mariadb-2026-107384, BIT-mariadb-min-2026-107384, BIT-mysql-client-2026-107384, CVE-2026-107384, GHSA-v6pj-gxxw-phfw | High | 0.4% | 22 days ago | npm mariadb |
MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters BIT-mariadb-2026-107383, BIT-mariadb-min-2026-107383, BIT-mysql-client-2026-107383, CVE-2026-107383, GHSA-48qf-xh34-q73r | High | 0.4% | 22 days ago | npm mariadb |
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort CVE-2026-107375, GHSA-r223-96jv-q533 | High | 0.3% | 22 days ago | npm generator-jhipster |