Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
sharp : Vulnerability in librsvg dependency CVE-2026-96889 CVE-2026-114111, GHSA-wq5f-xc86-pv6w | High | 0.1% | 24 days ago | npm sharp |
Malicious release: Malicious code in captchetat-angularv8 (npm) GHSA-7crr-x792-cp3w, MAL-2026-17637 | Malicious | Not scored | 24 days ago | npm captchetat-angularv8 |
Malicious release: Malicious code in hardhat-init (npm) MAL-2026-17636 | Malicious | Not scored | 24 days ago | npm hardhat-init |
Malicious release: Malicious code in @badzz88/baileys (npm) GHSA-884c-mw3w-x2wg, MAL-2026-17341 | Malicious | Not scored | 24 days ago | npm @badzz88/baileys |
Malicious release: Malicious code in internallib_v23 (npm) MAL-2026-17632 | Malicious | Not scored | 24 days ago | npm internallib_v23 |
Malicious release: Malicious code in @pinecone-experience/messages (npm) GHSA-r9p9-pfmv-rc77, MAL-2026-17631 | Malicious | Not scored | 24 days ago | npm @pinecone-experience/messages |
Malicious release: Malicious code in internallib_v30 (npm) MAL-2026-17633 | Malicious | Not scored | 24 days ago | npm internallib_v30 |
Malicious release: Malicious code in internallib_v86 (npm) MAL-2026-17634 | Malicious | Not scored | 24 days ago | npm internallib_v86 |
Malicious release: Malicious code in internallib_v875 (npm) MAL-2026-17635 | Malicious | Not scored | 24 days ago | npm internallib_v875 |
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes CVE-2026-109345, GHSA-6688-9rhm-gjv2 | Medium | 0.3% | 24 days ago | npm dompurify |
smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line GHSA-r4xh-jqrq-34v2 | Medium | Not scored | 24 days ago | npm smol-toml |
Nx: OS command injection via git revisions and remote refs GHSA-w2vw-w76x-qr89 | High | Not scored | 24 days ago | npm nx |
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep` CVE-2026-104852, GHSA-7mx3-vvmw-hjmv | High | 0.4% | 24 days ago | npm @graphql-tools/utils |
fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values GHSA-jggr-w7fw-pc2j | Medium | Not scored | 24 days ago | npm fast-copy |
@vue/server-renderer: XSS via missing CR in attribute-name blacklist GHSA-g2v6-rqmx-r4w6 | High | Not scored | 24 days ago | npm @vue/server-renderer |
Ghost: Path Traversal Vulnerability in Ghost ImageSize Service BIT-ghost-2026-103290, BIT-ghost-2026-105683, CVE-2026-103290, CVE-2026-105683, GHSA-83rp-q473-j88c | Low | 0.3% | 24 days ago | npm ghost |
Ghost: Server-Side Request Forgery in Webhook Trigger BIT-ghost-2026-103287, BIT-ghost-2026-105682, CVE-2026-103287, CVE-2026-105682, GHSA-354h-gmhv-mr9c | Low | 0.2% | 24 days ago | npm ghost |
Ghost: Authorization Bypass in Comments Feature BIT-ghost-2026-103289, BIT-ghost-2026-105681, CVE-2026-103289, CVE-2026-105681, GHSA-6q6j-f24j-p477 | Medium | 0.3% | 24 days ago | npm ghost |
Ghost: Authorization Issue Allowed Author Role to Delete any Post BIT-ghost-2026-105680, CVE-2026-105680, GHSA-x3mg-q38v-m562 | Medium | 0.3% | 24 days ago | npm ghost |
Ghost: Stored XSS via File Uploads on Local Storage BIT-ghost-2026-104411, BIT-ghost-2026-105679, CVE-2026-104411, CVE-2026-105679, GHSA-gfjp-2p8f-94qv | High | 0.3% | 24 days ago | npm ghost |
Ghost: Editors Could Promote Staff Users to Their Own Role BIT-ghost-2026-104412, BIT-ghost-2026-105678, CVE-2026-104412, CVE-2026-105678, GHSA-4pvx-fwjj-8gpc | Medium | 0.2% | 24 days ago | npm ghost |
Ghost: Remote Code Execution via Theme Translation Files BIT-ghost-2026-104418, BIT-ghost-2026-105677, CVE-2026-104418, CVE-2026-105677, GHSA-jj74-hc2q-xrvm | High | 0.7% | 24 days ago | npm ghost |
Ghost: Path Traversal via Locale Setting BIT-ghost-2026-104417, BIT-ghost-2026-105676, CVE-2026-104417, CVE-2026-105676, GHSA-m382-6jw4-fmp6 | Medium | 0.4% | 24 days ago | npm ghost |
Ghost: Invite Token Disclosure in Ghost Admin API BIT-ghost-2026-104416, BIT-ghost-2026-105675, CVE-2026-104416, CVE-2026-105675, GHSA-v6q3-xqxm-6f5v | High | 0.4% | 24 days ago | npm ghost |
Ghost: Password Hash Ordering Disclosure in Ghost Admin API BIT-ghost-2026-104415, BIT-ghost-2026-105652, CVE-2026-104415, CVE-2026-105652, GHSA-53vv-xm9f-mm82 | Low | 0.3% | 24 days ago | npm ghost |
Ghost: Stored XSS via Bookmark Card Images BIT-ghost-2026-104413, BIT-ghost-2026-105651, CVE-2026-104413, CVE-2026-105651, GHSA-347q-26qq-h2p6 | High | 0.3% | 24 days ago | npm ghost |
Ghost: Stored XSS via oEmbed Photo Responses BIT-ghost-2026-104414, BIT-ghost-2026-105650, CVE-2026-104414, CVE-2026-105650, GHSA-v3xr-g6p2-fvgv | High | 0.3% | 24 days ago | npm ghost |
Ghost: Stored XSS via SVG Uploads Bypassing Sanitization BIT-ghost-2026-105649, CVE-2026-105649, GHSA-8575-cr6v-7jh4 | High | 0.3% | 24 days ago | npm ghost |
Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses BIT-ghost-2026-105648, CVE-2026-105648, GHSA-r7f2-6fj8-6fg2 | Medium | 0.3% | 24 days ago | npm ghost |
Ghost: Server-Side Request Forgery in Bookmark Fetching BIT-ghost-2026-105647, CVE-2026-105647, GHSA-322m-ff4g-9vx9 | Medium | 0.2% | 24 days ago | npm ghost |
Ghost: Regular Expression Denial of Service in Content Import BIT-ghost-2026-105646, CVE-2026-105646, GHSA-fwh9-qg68-vxp4 | Medium | 0.3% | 24 days ago | npm ghost |
Ghost: Regular Expression Denial of Service in External Media Inliner BIT-ghost-2026-105645, CVE-2026-105645, GHSA-9m4w-fmjw-fvjq | Medium | 0.3% | 24 days ago | npm ghost |
Ghost : Stored XSS via SVG Files in Content Imports BIT-ghost-2026-105644, CVE-2026-105644, GHSA-hqq2-xqr2-fmx2 | Medium | 0.3% | 24 days ago | npm ghost |
Ghost: Stored XSS via Embed Card Previews BIT-ghost-2026-105643, CVE-2026-105643, GHSA-69qc-f5m6-889c | High | 0.3% | 24 days ago | npm ghost |
Ghost: Remote Code Execution via Bookmark Card Images BIT-ghost-2026-105642, CVE-2026-105642, GHSA-788w-68h3-cvxp | High | 0.3% | 24 days ago | npm ghost |
Malicious release: Malicious code in serpacksven (npm) GHSA-297h-8m5x-925p, MAL-2026-17625 | Malicious | Not scored | 24 days ago | npm serpacksven |
Malicious release: Malicious code in serpacksven2 (npm) GHSA-4pg5-wvv5-w7fg, MAL-2026-17627 | Malicious | Not scored | 24 days ago | npm serpacksven2 |
Malicious release: Malicious code in documenclient (npm) GHSA-648r-w4vm-vvvp, MAL-2026-17624 | Malicious | Not scored | 24 days ago | npm documenclient |
Malicious release: Malicious code in serpacksven1 (npm) GHSA-696v-rr55-26pc, MAL-2026-17626 | Malicious | Not scored | 24 days ago | npm serpacksven1 |
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control CVE-2026-104891, GHSA-jg6q-3qfh-r9f8 | High | 0.3% | 25 days ago | npm @insumermodel/mppx-condition-gate npm @insumermodel/mppx-token-gate |
Malicious release: Malicious code in css-nrmgzn-polyfill (npm) MAL-2026-17576 | Malicious | Not scored | 25 days ago | npm css-nrmgzn-polyfill |
Malicious release: Malicious code in css-eqxcdx-polyfill (npm) MAL-2026-17573 | Malicious | Not scored | 25 days ago | npm css-eqxcdx-polyfill |
Malicious release: Malicious code in css-kfvwax-polyfill (npm) MAL-2026-17575 | Malicious | Not scored | 25 days ago | npm css-kfvwax-polyfill |
Malicious release: Malicious code in css-gwqyid-polyfill (npm) MAL-2026-17574 | Malicious | Not scored | 25 days ago | npm css-gwqyid-polyfill |
Malicious release: Malicious code in css-yhpodl-polyfill (npm) MAL-2026-17578 | Malicious | Not scored | 25 days ago | npm css-yhpodl-polyfill |
Malicious release: Malicious code in css-vvgsze-polyfill (npm) MAL-2026-17577 | Malicious | Not scored | 25 days ago | npm css-vvgsze-polyfill |
Malicious release: Malicious code in dzyclutch (npm) GHSA-36rj-4crv-cmgm, MAL-2026-17619 | Malicious | Not scored | 25 days ago | npm dzyclutch |
Malicious release: Malicious code in @diezyclutch/baileys (npm) GHSA-5f29-482c-j4rr, MAL-2026-17618 | Malicious | Not scored | 25 days ago | npm @diezyclutch/baileys |
Malicious release: Malicious code in yonzoffic-baileys (npm) GHSA-8434-c34v-f7h8, MAL-2026-17413 | Malicious | Not scored | 25 days ago | npm yonzoffic-baileys |
Malicious release: Malicious code in dzyclutch-baileys (npm) GHSA-c936-2h58-8v2f, MAL-2026-17620 | Malicious | Not scored | 25 days ago | npm dzyclutch-baileys |