Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size CVE-2026-70598, GHSA-pfmc-3mgc-p6fp | Low | 0.1% | 05 Aug, 2026 | npm electron |
@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate GHSA-pc2w-4mq8-32qw | Low | Not scored | 29 Jul, 2026 | npm @dynatrace-oss/dynatrace-mcp-server |
AWS CDK CodeBuild S3 Log Encryption Boolean Inversion GHSA-464c-974j-9xm6, GO-2026-6093 | Low | Not scored | 24 Jul, 2026 | Go github.com/aws/aws-cdk-go/awscdk Go github.com/aws/aws-cdk-go/awscdk/v2 Maven software.amazon.awscdk:aws-cdk-lib Maven software.amazon.awscdk:codebuild +7 more |
@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped CVE-2026-73425, GHSA-hp3v-mfqw-h74c | Low | 0.3% | 20 Jul, 2026 | npm @astrojs/netlify |
@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect CVE-2026-59730, GHSA-r557-wffq-wvrc | Low | 0.5% | 20 Jul, 2026 | npm @astrojs/node |
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands CVE-2026-59727, GHSA-7pw4-f3q4-r2p2 | Low | 0.4% | 20 Jul, 2026 | npm astro |
Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__ CVE-2026-54335, GHSA-28xv-ph75-77wh | Low | 0.4% | 14 Jul, 2026 | npm @feathersjs/commons |
Waku has an Open Redirect via `unstable_redirect` Helper CVE-2026-49456, GHSA-43fc-v873-qw85 | Low | 0.4% | 08 Jul, 2026 | npm waku |
@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url GHSA-rp72-5v5q-2446 | Low | Not scored | 26 Jun, 2026 | npm @cardano402/mcp-server |
neotoma has tenant isolation gap in relationship query endpoints GHSA-wrr4-782v-jhwh | Low | Not scored | 25 Jun, 2026 | npm neotoma |
parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change BIT-parse-2026-57481, CVE-2026-57481, GHSA-97pr-9hgg-3p8r | Low | 0.5% | 19 Jun, 2026 | npm parse-server |
Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe GHSA-h5jc-78hr-3pc9 | Low | Not scored | 19 Jun, 2026 | npm @sveltia/cms |
parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist BIT-parse-2026-55778, CVE-2026-55778, GHSA-v8x7-r927-cc93 | Low | 0.6% | 19 Jun, 2026 | npm parse-server |
OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source CVE-2026-57583, GHSA-9wxg-vf3r-56hc | Low | 0.2% | 19 Jun, 2026 | npm @openzeppelin/wizard npm @openzeppelin/wizard-cairo npm @openzeppelin/wizard-stellar npm @openzeppelin/wizard-stylus |
undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse CVE-2026-6733, GHSA-35p6-xmwp-9g52 | Low | 0.2% | 17 Jun, 2026 | npm undici |
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching CVE-2026-11525, GHSA-g8m3-5g58-fq7m | Low | 0.2% | 17 Jun, 2026 | npm undici |
Pi Agent: Race condition in Pi auth.json writes could expose stored credentials CVE-2026-54327, GHSA-r95r-rj6r-c39x | Low | 0.1% | 17 Jun, 2026 | npm @earendil-works/pi-coding-agent npm @mariozechner/pi-coding-agent |
Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass CVE-2026-54326, GHSA-7v5m-pr3q-6453 | Low | 0.2% | 16 Jun, 2026 | npm @earendil-works/pi-coding-agent npm @mariozechner/pi-coding-agent |
Cross-site scripting via <NoScript> slot content in Nuxt's head components CVE-2026-56317, GHSA-m3q2-p4fw-w38m | Low | 0.3% | 16 Jun, 2026 | npm nuxt |
OpenClaw: Bootstrap token replay could widen pending pairing scopes CVE-2026-53862, GHSA-9v8j-9c9g-w66c | Low | 0.1% | 16 Jun, 2026 | npm openclaw |
OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers CVE-2026-53860, GHSA-8j37-5w68-wj2g | Low | 0.2% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Empty-scope device re-pairing could confuse caller scope containment CVE-2026-53852, GHSA-8mg9-j9cf-54cj | Low | 0.2% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Exec allowlist could miss side effects from transparent command wrappers CVE-2026-53848, GHSA-cwpp-5962-q4f6 | Low | 0.2% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Skill-command dispatch could skip before-tool-call hooks CVE-2026-53845, GHSA-68xw-r643-9p5w | Low | 0.2% | 16 Jun, 2026 | npm openclaw |
Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json` GHSA-rq7w-g337-39qq | Low | Not scored | 15 Jun, 2026 | npm nuxt |
React Router: Potential CSRF via PUT/PATCH/DELETE document requests CVE-2026-53663, GHSA-84g9-w2xq-vcv6 | Low | 0.1% | 15 Jun, 2026 | npm @remix-run/server-runtime npm react-router |
@babel/core: Arbitrary File Read via sourceMappingURL Comment CVE-2026-49356, GHSA-4x5r-pxfx-6jf8 | Low | 0.2% | 15 Jun, 2026 | npm @babel/core |
OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement CVE-2026-53835, GHSA-3wqp-prf6-2m72 | Low | 0.2% | 12 Jun, 2026 | npm openclaw |
@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header CVE-2026-53607, GHSA-34pj-2622-jvxq | Low | 0.3% | 12 Jun, 2026 | npm apostrophe |
esbuild allows arbitrary file read when running the development server on Windows GHSA-g7r4-m6w7-qqqr | Low | Not scored | 12 Jun, 2026 | npm esbuild |
parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist BIT-parse-2026-53724, CVE-2026-53724, GHSA-7wqv-xjf3-x35v | Low | 0.3% | 12 Jun, 2026 | npm parse-server |
Papra HTTP redirect bypass can lead to SSRF via webhook delivery system CVE-2026-48051, GHSA-5g86-85rp-f9hx | Low | 0.3% | 10 Jun, 2026 | npm @papra/webhooks |
NocoDB: Missing Ownership Check in MCP Attachment Read CVE-2026-47388, GHSA-xxpj-q764-9r6q | Low | 0.3% | 05 Jun, 2026 | npm nocodb |
claude-mem: The computeObservationContentHash Function is Vulnerable to Hash Collision CVE-2026-11330, GHSA-5gvr-v6qv-h5mm | Low | 0.1% | 05 Jun, 2026 | npm claude-mem |
Keystone: GraphQL API Endpoint Lacks Query Depth Limits CVE-2026-10802, GHSA-45jq-c8xm-jfw9 | Low | 0.3% | 04 Jun, 2026 | npm @keystone-6/core |
DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption CVE-2026-10691, GHSA-r87g-78mx-3wg4 | Low | 0.4% | 03 Jun, 2026 | npm @wonderwhy-er/desktop-commander |
DesktopCommanderMCP is vulnerable to SSRF CVE-2026-10690, GHSA-5xx3-j724-wmx5 | Low | 0.2% | 03 Jun, 2026 | npm @wonderwhy-er/desktop-commander |
vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter CVE-2026-92962, GHSA-q3fm-4wcw-g57x | Low | 0.2% | 29 May, 2026 | npm vm2 |
Blitz has a Cross-site Scripting issue CVE-2026-9520, GHSA-h2p9-cr4h-px24 | Low | 0.3% | 26 May, 2026 | npm blitz |
postcss-selector-parser allows denial of service through uncontrolled AST recursion CVE-2026-9358, GHSA-w9m9-85wc-3x92 | Low | 0.3% | 24 May, 2026 | npm postcss-selector-parser |
NocoDB: Stale Auth Cache After API Token Deletion CVE-2026-46554, GHSA-f76x-f9vj-92jv | Low | 0.3% | 21 May, 2026 | npm nocodb |
NocoDB: Attachment Size Limit Bypass via Upload-by-URL CVE-2026-46553, GHSA-8rwr-f68v-cvw6 | Low | 0.4% | 21 May, 2026 | npm nocodb |
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation CVE-2026-46549, GHSA-m5qg-rvjq-727p | Low | 0.2% | 21 May, 2026 | npm nocodb |
Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning CVE-2026-46342, GHSA-g8wj-3cr3-6w7v | Low | 0.1% | 19 May, 2026 | npm @nuxt/nitro-server npm nuxt |
Summarize contains a missing authorization vulnerability CVE-2026-45244, GHSA-67gq-6q8c-qqh6 | Low | 0.2% | 18 May, 2026 | npm @steipete/summarize |
Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp GHSA-jgg6-4rpr-wfh7 | Low | Not scored | 18 May, 2026 | npm @mistralai/mistralai npm @mistralai/mistralai-azure npm @mistralai/mistralai-gcp |
Sveltia CMS: Stored XSS in entry summary rendering via entity-decoded HTML GHSA-97r8-rf7q-wmjw | Low | Not scored | 18 May, 2026 | npm @sveltia/cms |
@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue CVE-2026-8769, GHSA-866g-f22w-33x8 | Low | 0.6% | 17 May, 2026 | npm @ai-sdk/provider-utils |
@kilocode/cli Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2026-8766, GHSA-rpc6-9c4p-j5cg | Low | 0.3% | 17 May, 2026 | npm @kilocode/cli |
Turbo: Unexpected local code execution during Yarn Berry detection CVE-2026-45772, GHSA-3qcw-2rhx-2726 | Low | 0.4% | 15 May, 2026 | npm @turbo/codemod npm @turbo/workspaces npm turbo |