Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API CVE-2026-112954, GHSA-rqgm-cfrp-4hx8 | Medium | 0.4% | 9 days ago | npm apostrophe |
ApostropheCMS: Exposure of Sensitive Information via predictable export filenames CVE-2026-112953, GHSA-5gc8-frw3-3vqm | Medium | 0.6% | 9 days ago | npm @apostrophecms/import-export |
ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user CVE-2026-112952, GHSA-f66c-mpj2-3r8h | Medium | 0.3% | 9 days ago | npm apostrophe |
ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix CVE-2026-112951, GHSA-vmgj-9cwm-cf3h | Medium | 0.3% | 9 days ago | npm apostrophe |
Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix CVE-2026-112950, GHSA-xp26-3454-mjgp | Medium | 0.5% | 9 days ago | npm @vitest/mocker |
Vitest: Code injection via unauthenticated manual mock registration CVE-2026-112949, GHSA-qxg6-89mg-rqv8 | Medium | 0.3% | 9 days ago | npm @vitest/mocker |
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file CVE-2026-112948, GHSA-p458-7748-mcp3 | Medium | 0.4% | 9 days ago | npm @vitest/browser npm @vitest/ui npm vite-plus |
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` CVE-2026-112947, GHSA-vfpm-58rq-9qcg | Medium | 0.5% | 9 days ago | npm vite npm vite-plus |
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine CVE-2026-112946, GHSA-rq7h-c2jc-7f22 | Medium | 0.9% | 9 days ago | npm vite npm vite-plus |
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors CVE-2026-112944, GHSA-r825-w8mm-5pxw | Medium | 0.7% | 9 days ago | npm launch-editor npm vite npm vite-plus |
launch-editor: escapeCmdArgs() omits % escaping on Windows CVE-2026-112943, GHSA-698v-4r3x-3vcv | Medium | 0.4% | 9 days ago | npm launch-editor npm vite npm vite-plus |
@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR) CVE-2026-111754, GHSA-w739-gvwx-grc3 | Medium | Not scored | 9 days ago | npm @angular/platform-server |
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding CVE-2026-110306, GHSA-w74x-v6f9-j3xg | Medium | 0.3% | 9 days ago | npm fast-uri |
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization CVE-2026-110180, GHSA-wjr9-j795-jxcr | Medium | 0.3% | 9 days ago | npm fast-uri |
Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths CVE-2026-109955, CVE-2026-111757, GHSA-5r4p-p66f-jhc7 | Medium | 0.3% | 10 days ago | npm hono |
ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process CVE-2026-111997, GHSA-rxp7-6hxx-x8q5 | Medium | 0.3% | 11 days ago | npm ip-address |
Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes CVE-2026-102527, GHSA-2x6f-rp82-ppmj | Medium | 0.2% | 14 days ago | npm nuxt-og-image |
ApostropheCMS: Page REST API authorization bypass CVE-2026-110904, CVE-2026-113670, GHSA-2j32-q6rx-h844 | Medium | 0.3% | 14 days ago | npm apostrophe |
Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped CVE-2026-110870, GHSA-g73g-hqqh-jr95 | Medium | 0.3% | 14 days ago | npm nodemailer |
@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL CVE-2026-110861, GHSA-44jh-23m7-hpcf | Medium | 0.2% | 14 days ago | npm @better-auth/drizzle-adapter npm @better-auth/kysely-adapter npm better-auth |
qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS) CVE-2026-110816, GHSA-6pq8-jhm2-2vcw | Medium | 0.4% | 15 days ago | npm qs |
Appium: Symlink based Zip Slip in @appium/support ZIP extraction CVE-2026-103975, GHSA-qfxx-c367-67f8 | Medium | 0.6% | 15 days ago | npm @appium/support |
obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields CVE-2026-77362, GHSA-43r2-c7g8-prc8 | Medium | 0.2% | 16 days ago | npm obsidian-tc |
obsidian-tc : Symlink read-ACL scope bypass via lexical path checks CVE-2026-77361, GHSA-c5xx-h28h-f682 | Medium | 0.1% | 16 days ago | npm obsidian-tc |
Backstage: Improper access control in backend action invocation CVE-2026-106495, GHSA-3xr5-8w6c-p5gw | Medium | 0.2% | 17 days ago | npm @backstage/backend-defaults |
obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default CVE-2026-77364, GHSA-cvp8-vvgf-69q4 | Medium | 0.2% | 17 days ago | npm obsidian-tc |
fast-jwt: Verifier cache accepts expired JWTs without iat. CVE-2026-107719, GHSA-x937-hj6v-793p | Medium | 0.3% | 21 days ago | npm fast-jwt |
AdonisJS: Unencoded route parameters can produce open redirects CVE-2026-107718, GHSA-2m6q-8v3h-jqww | Medium | 0.3% | 21 days ago | npm @adonisjs/http-server |
fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache) CVE-2026-107721, GHSA-687g-22h4-j4w4 | Medium | 0.3% | 21 days ago | npm fast-jwt |
music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort CVE-2026-107389, GHSA-5gfj-9q3v-qfp3 | Medium | 0.2% | 21 days ago | npm music-metadata |
music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS CVE-2026-107388, GHSA-jjpr-9cvf-cq55 | Medium | 0.2% | 21 days ago | npm music-metadata |
music-metadata: Uncontrolled memory allocation in APEv2 parser CVE-2026-107387, GHSA-53v6-4h7p-p4gj | Medium | 0.2% | 21 days ago | npm music-metadata |
MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS BIT-mariadb-2026-107382, BIT-mariadb-min-2026-107382, BIT-mysql-client-2026-107382, CVE-2026-107382, GHSA-cx2f-j9fh-8g68 | Medium | 0.2% | 21 days ago | npm mariadb |
msgpack5: Partial options disable prototype protection CVE-2026-107301, GHSA-8hq7-ggx2-cc6m | Medium | 0.4% | 21 days ago | npm msgpack5 |
msgpack5: Reserved byte can cause unbounded stream buffering CVE-2026-107299, GHSA-26wq-p25c-j6fv | Medium | 0.4% | 21 days ago | npm msgpack5 |
msgpack5: Deeply nested input can exhaust the decoder stack CVE-2026-107298, GHSA-24ch-f2g6-9hhh | Medium | 0.4% | 21 days ago | npm msgpack5 |
msgpack5: Quadratic parsing in the streaming decoder CVE-2026-107297, GHSA-gcx5-hxj7-gpqq | Medium | 0.4% | 21 days ago | npm msgpack5 |
Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory CVE-2026-106108, GHSA-vhhq-m2gm-rwc9 | Medium | 0.1% | 22 days ago | npm @quasar/app-vite |
Backstage: Improper entity validation in deprecated Kubernetes services endpoint CVE-2026-106563, GHSA-r9ph-3637-55px | Medium | 0.2% | 22 days ago | npm @backstage/plugin-kubernetes-backend |
Backstage has incorrect authorization in search engine permission filtering CVE-2026-106562, GHSA-9325-vq29-gp3v | Medium | 0.2% | 22 days ago | npm @backstage/plugin-search-backend npm @backstage/plugin-search-backend-module-elasticsearch |
Backstage has a sensitive information disclosure in Kubernetes resource queries CVE-2026-106561, GHSA-p795-mqf2-36mf | Medium | 0.2% | 22 days ago | npm @backstage/plugin-kubernetes-backend |
Backstage: Improper input validation in Confluence to Markdown scaffolder module CVE-2026-106559, GHSA-75qf-886x-5xf2 | Medium | 0.3% | 22 days ago | npm @backstage/plugin-scaffolder-backend-module-confluence-to-markdown |
Backstage has potential file exposure through local TechDocs publisher CVE-2026-106508, GHSA-cm77-ch27-6w6v | Medium | 0.4% | 23 days ago | npm @backstage/plugin-techdocs-node |
Backstage has improper input validation in scaffolder task list ordering CVE-2026-106506, GHSA-vwp5-f99x-x3rq | Medium | 0.2% | 23 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage has sensitive information exposure in scaffolder task logs CVE-2026-106504, GHSA-4xvq-3m68-h444 | Medium | 0.3% | 23 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage may expose sensitive information in Scaffolder task failure events CVE-2026-106502, GHSA-95p4-vv4g-jxxm | Medium | 0.3% | 23 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage: Secret-derived values may be exposed in scaffolder task logs CVE-2026-106499, GHSA-mfvq-x7vr-rgqg | Medium | 0.3% | 23 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage: Inconsistent enforcement of allowed location types during catalog processing CVE-2026-106496, GHSA-pcmq-25r3-5w9v | Medium | 0.2% | 23 days ago | npm @backstage/plugin-catalog-backend |
Backstage: Improper input validation in cloud storage URL readers CVE-2026-106494, GHSA-7649-wm97-w3j3 | Medium | 0.3% | 23 days ago | npm @backstage/backend-defaults |
Backstage: Cloud storage catalog locations may cross configured storage boundaries CVE-2026-106493, GHSA-xvh9-35w9-42m4 | Medium | 0.3% | 23 days ago | npm @backstage/backend-defaults npm @backstage/plugin-catalog-backend-module-aws npm @backstage/plugin-catalog-backend-module-azure |