Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenClaw: Discord allowFrom could bind to mutable display names CVE-2026-53849, GHSA-cw4q-gqg5-g38h | High | 0.3% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Exec allowlist could miss side effects from transparent command wrappers CVE-2026-53848, GHSA-cwpp-5962-q4f6 | Low | 0.2% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Active Memory write scope could mutate global config CVE-2026-53847, GHSA-x629-46cc-7xgw | Medium | 0.2% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install CVE-2026-53846, GHSA-24vr-rprv-67rf | High | 0.1% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Skill-command dispatch could skip before-tool-call hooks CVE-2026-53845, GHSA-68xw-r643-9p5w | Low | 0.2% | 16 Jun, 2026 | npm openclaw |
OpenClaw: memory-wiki shared search could miss session visibility checks CVE-2026-53844, GHSA-72fw-cqh5-f324 | Medium | 0.2% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Pairing-scoped device session could restore revoked node token authority CVE-2026-53843, GHSA-q99w-vh6v-q3v7 | High | 0.3% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution CVE-2026-53842, GHSA-fq9j-vw4w-fr6v | High | 0.1% | 16 Jun, 2026 | npm openclaw |
OpenClaw: Exported session HTML could keep unsafe markdown links CVE-2026-53841, GHSA-w9hf-3pp7-pvxv | Medium | 0.2% | 16 Jun, 2026 | npm openclaw |
OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin CVE-2026-53840, GHSA-rjxq-qqhf-8hwh | High | 0.2% | 16 Jun, 2026 | npm openclaw |
n8n: Merge Node SQL Mode Prototype Pollution CVE-2026-54311, GHSA-9c38-2mcm-q7f7 | Medium | 0.4% | 16 Jun, 2026 | npm n8n |
n8n: Prototype Pollution enables confused-deputy execution via public webhooks CVE-2026-54306, GHSA-2vff-hj5x-8gq7 | Medium | 0.3% | 16 Jun, 2026 | npm n8n |
n8n: Same-Origin XSS in Respond to Webhook Node CVE-2026-54301, GHSA-v733-mwr6-fgcm | High | 0.2% | 16 Jun, 2026 | npm n8n |
n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes CVE-2026-54308, GHSA-jvc7-762p-3743 | Medium | 0.3% | 16 Jun, 2026 | npm n8n |
n8n: Wrong OAuth Scope On Evaluations Test Run Creation Endpoint CVE-2026-56776, GHSA-hv7x-3x78-gx53 | Medium | 0.3% | 16 Jun, 2026 | npm n8n |
n8n: NoSQL Injection in MongoDB Node Find And Replace Operation CVE-2026-54313, GHSA-jpq7-226w-6cxx | Medium | 0.3% | 16 Jun, 2026 | npm n8n |
Malicious release: Malicious code in mastraqqq (npm) GHSA-7vj9-63m9-3x7f, MAL-2026-5913 | Malicious | Not scored | 16 Jun, 2026 | npm mastraqqq |
Malicious release: Malicious code in proto-bin (npm) MAL-2026-5921 | Malicious | Not scored | 16 Jun, 2026 | npm proto-bin |
n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes CVE-2026-54310, GHSA-c37g-w77q-m4vp | Medium | 0.5% | 16 Jun, 2026 | npm n8n |
n8n: Git Node Clone and Push Operations Bypass File Sandbox CVE-2026-49465, GHSA-5xp3-2w67-427v | Medium | 0.5% | 16 Jun, 2026 | npm n8n |
n8n: Python sandbox escape CVE-2026-49444, GHSA-9pq8-m8gp-4p53 | High | 0.4% | 16 Jun, 2026 | npm n8n |
Malicious release: Malicious code in utils-common-helpers (npm) GHSA-fq4g-5xjj-r935, MAL-2026-5911 | Malicious | Not scored | 16 Jun, 2026 | npm utils-common-helpers |
Malicious release: Malicious code in react-hook-use-debounce-throttle-12 (npm) GHSA-2x4w-64xc-78fv, MAL-2026-5909 | Malicious | Not scored | 16 Jun, 2026 | npm react-hook-use-debounce-throttle-12 |
Malicious release: Malicious code in chai-plugin-helper (npm) MAL-2026-5905 | Malicious | Not scored | 16 Jun, 2026 | npm chai-plugin-helper |
Malicious release: Malicious code in chain-chai-test (npm) GHSA-6626-c428-r9qf, MAL-2026-5908 | Malicious | Not scored | 16 Jun, 2026 | npm chain-chai-test |
Malicious release: Malicious code in chai-as-polished (npm) GHSA-jpr9-h23w-g7gg, MAL-2026-5901 | Malicious | Not scored | 16 Jun, 2026 | npm chai-as-polished |
Malicious release: Malicious code in chai-as-tokenized (npm) GHSA-4hvx-q2w4-f48v, MAL-2026-5902 | Malicious | Not scored | 16 Jun, 2026 | npm chai-as-tokenized |
Malicious release: Malicious code in chai-guid (npm) GHSA-g8gv-g8mr-x8pc, MAL-2026-5903 | Malicious | Not scored | 16 Jun, 2026 | npm chai-guid |
Malicious release: Malicious code in chai-plugin-kit (npm) MAL-2026-5906 | Malicious | Not scored | 16 Jun, 2026 | npm chai-plugin-kit |
Malicious release: Malicious code in chai-plugin (npm) MAL-2026-5904 | Malicious | Not scored | 16 Jun, 2026 | npm chai-plugin |
Malicious release: Malicious code in chai-solidity-testkit (npm) MAL-2026-5907 | Malicious | Not scored | 16 Jun, 2026 | npm chai-solidity-testkit |
Malicious release: Malicious code in chai-as-decrypted (npm) GHSA-w7rc-qq2w-vqhg, MAL-2026-5900 | Malicious | Not scored | 16 Jun, 2026 | npm chai-as-decrypted |
Malicious release: Malicious code in uidai_reusable_components (npm) GHSA-8gm2-m96j-547g, MAL-2026-5910 | Malicious | Not scored | 16 Jun, 2026 | npm uidai_reusable_components |
Malicious release: Malicious code in easyllmai (npm) MAL-2026-5895 | Malicious | Not scored | 16 Jun, 2026 | npm easyllmai |
Malicious release: Malicious code in caspian-day-js (npm) MAL-2026-5892 | Malicious | Not scored | 16 Jun, 2026 | npm caspian-day-js |
Malicious release: Malicious code in strict-engine-peer (npm) MAL-2026-5898 | Malicious | Not scored | 16 Jun, 2026 | npm strict-engine-peer |
Malicious release: Malicious code in jest-test-plugin-utils (npm) GHSA-7969-jc8h-fp32, MAL-2026-5896 | Malicious | Not scored | 16 Jun, 2026 | npm jest-test-plugin-utils |
Malicious release: Malicious code in noderzero (npm) MAL-2026-5897 | Malicious | Not scored | 16 Jun, 2026 | npm noderzero |
Malicious release: Malicious code in create-vercel-integration (npm) MAL-2026-5894 | Malicious | Not scored | 16 Jun, 2026 | npm create-vercel-integration |
Malicious release: Malicious code in @dsft/ft-utils (npm) GHSA-2578-g4v9-hc4p, MAL-2026-5890 | Malicious | Not scored | 16 Jun, 2026 | npm @dsft/ft-utils |
Malicious release: Malicious code in @dsft/ft-element (npm) GHSA-5g88-35hm-8xr7, MAL-2026-5889 | Malicious | Not scored | 16 Jun, 2026 | npm @dsft/ft-element |
Malicious release: Malicious code in stripe-cli-init-plugin (npm) MAL-2026-5899 | Malicious | Not scored | 16 Jun, 2026 | npm stripe-cli-init-plugin |
Astro: XSS via Unescaped Attribute Names in Spread Props CVE-2026-54298, GHSA-jrpj-wcv7-9fh9 | Medium | 0.2% | 16 Jun, 2026 | npm astro |
Malicious release: Malicious code in conducts (npm) GHSA-93mx-rvh8-rm26, MAL-2026-5887 | Malicious | Not scored | 16 Jun, 2026 | npm conducts |
Malicious release: Malicious code in atlassian-forge-skills (npm) GHSA-7gj4-qpcp-64p2, MAL-2026-5891 | Malicious | Not scored | 16 Jun, 2026 | npm atlassian-forge-skills |
Malicious release: Malicious code in claude-jar (npm) MAL-2026-5893 | Malicious | Not scored | 16 Jun, 2026 | npm claude-jar |
Malicious release: Malicious code in @vantuz/sdk-core (npm) GHSA-pxhh-8x7x-7g7j, MAL-2026-5886 | Malicious | Not scored | 16 Jun, 2026 | npm @vantuz/sdk-core |
Astro: Host header SSRF in prerendered error page fetch CVE-2026-54299, GHSA-2pvr-wf23-7pc7 | High | 0.3% | 16 Jun, 2026 | npm astro |
@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config CVE-2026-54300, GHSA-529g-xq4f-cw38 | Medium | 0.3% | 16 Jun, 2026 | npm @astrojs/netlify |
Malicious release: Malicious code in middleware-jwt (npm) GHSA-g9mr-rvmw-fg9c, MAL-2026-5888 | Malicious | Not scored | 16 Jun, 2026 | npm middleware-jwt |