Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` CVE-2026-54288, GHSA-rv63-4mwf-qqc2 | Medium | 0.1% | 16 Jun, 2026 | npm hono |
hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest CVE-2026-54289, GHSA-wgpf-jwqj-8h8p | Medium | 0.2% | 16 Jun, 2026 | npm hono |
hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard CVE-2026-54290, GHSA-88fw-hqm2-52qc | High | 0.3% | 16 Jun, 2026 | npm hono |
hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) CVE-2026-54286, GHSA-wwfh-h76j-fc44 | Medium | 0.4% | 16 Jun, 2026 | npm hono |
hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice CVE-2026-54287, GHSA-j6c9-x7qj-28xf | Medium | 0.3% | 16 Jun, 2026 | npm hono |
Astro: Reflected XSS via unescaped slot name CVE-2026-50146, GHSA-8hv8-536x-4wqp | High | 0.3% | 16 Jun, 2026 | npm astro |
Malicious release: Malicious code in vortnode (npm) GHSA-c3fw-fh7f-9h58, MAL-2026-5884 | Malicious | Not scored | 16 Jun, 2026 | npm vortnode |
Malicious release: Malicious code in wordpad-text-ui (npm) GHSA-83j8-j97r-9p9h, MAL-2026-5885 | Malicious | Not scored | 16 Jun, 2026 | npm wordpad-text-ui |
Nuxt dev server vite-node IPC socket is world-connectable on Linux CVE-2026-56301, GHSA-534h-c3cw-v3h9 | Medium | 0.1% | 16 Jun, 2026 | npm nuxt |
Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp` CVE-2026-56326, CVE-2026-56697, CVE-2026-56698, GHSA-c9cv-mq2m-ppp3 | Medium | 0.4% | 16 Jun, 2026 | npm nuxt |
Malicious release: Malicious code in claude-token-tracker-mcp (npm) GHSA-w56m-5ch4-5xjw, MAL-2026-10693 | Malicious | Not scored | 16 Jun, 2026 | npm claude-token-tracker-mcp |
Malicious release: Malicious code in obfus-jsxy (npm) GHSA-9xh7-qcrr-h88h, MAL-2026-5881 | Malicious | Not scored | 16 Jun, 2026 | npm obfus-jsxy |
Malicious release: Malicious code in redis-xyz (npm) GHSA-mc4w-cxr6-qw8r, MAL-2026-5883 | Malicious | Not scored | 16 Jun, 2026 | npm redis-xyz |
Malicious release: Malicious code in ioredis-os (npm) GHSA-68r3-8wgf-pv9g, MAL-2026-5879 | Malicious | Not scored | 16 Jun, 2026 | npm ioredis-os |
Malicious release: Malicious code in redis-type-os (npm) GHSA-w3ww-qq48-r4j9, MAL-2026-5882 | Malicious | Not scored | 16 Jun, 2026 | npm redis-type-os |
Malicious release: Malicious code in nat-ulid (npm) GHSA-wgqj-fphq-9x3q, MAL-2026-5880 | Malicious | Not scored | 16 Jun, 2026 | npm nat-ulid |
Malicious release: Malicious code in check-ulid (npm) GHSA-266v-958f-g596, MAL-2026-5877 | Malicious | Not scored | 16 Jun, 2026 | npm check-ulid |
Malicious release: Malicious code in hot-validation-sdk (npm) GHSA-86rx-hcgg-q42r, MAL-2026-5870 | Malicious | Not scored | 16 Jun, 2026 | npm hot-validation-sdk |
Malicious release: Malicious code in lucide-next (npm) GHSA-gqhv-66pr-h35f, MAL-2026-5871 | Malicious | Not scored | 16 Jun, 2026 | npm lucide-next |
Malicious release: Malicious code in pampipes (npm) GHSA-j43p-473c-2jjx, MAL-2026-5872 | Malicious | Not scored | 16 Jun, 2026 | npm pampipes |
Malicious release: Malicious code in fabric-graphics (npm) GHSA-p7vq-w45x-hmmj, MAL-2026-5869 | Malicious | Not scored | 16 Jun, 2026 | npm fabric-graphics |
Malicious release: Malicious code in rbac-auth (npm) GHSA-vhxh-pphh-cjmr, MAL-2026-5873 | Malicious | Not scored | 16 Jun, 2026 | npm rbac-auth |
Malicious release: Malicious code in terminal-pretty-logger (npm) GHSA-2266-qhvj-h8r5, MAL-2026-5866 | Malicious | Not scored | 16 Jun, 2026 | npm terminal-pretty-logger |
Malicious release: Malicious code in terminal-structured-logger (npm) GHSA-9ggp-5rq8-jmff, MAL-2026-5867 | Malicious | Not scored | 16 Jun, 2026 | npm terminal-structured-logger |
Malicious release: Malicious code in npmjs-doc-builder (npm) GHSA-jhx4-8pjp-h27w, MAL-2026-5865 | Malicious | Not scored | 16 Jun, 2026 | npm npmjs-doc-builder |
Malicious release: Malicious code in bign.tsm (npm) GHSA-pwrg-56mj-pq64, MAL-2026-5864 | Malicious | Not scored | 16 Jun, 2026 | npm bign.tsm |
Malicious release: Malicious code in @ts-internal/shared-lib (npm) MAL-2026-5863 | Malicious | Not scored | 16 Jun, 2026 | npm @ts-internal/shared-lib |
Malicious release: Malicious code in vitest-pro (npm) MAL-2026-5862 | Malicious | Not scored | 16 Jun, 2026 | npm vitest-pro |
Malicious release: Malicious code in solana-js-client (npm) GHSA-w6xx-m24v-5674, MAL-2026-5860 | Malicious | Not scored | 16 Jun, 2026 | npm solana-js-client |
Malicious release: Malicious code in solana-mev-bot (npm) GHSA-8gg8-q73f-wv82, MAL-2026-5861 | Malicious | Not scored | 16 Jun, 2026 | npm solana-mev-bot |
Malicious release: Malicious code in carousel-controller-mixin (npm) GHSA-cm93-hx95-m69r, MAL-2026-5856 | Malicious | Not scored | 16 Jun, 2026 | npm carousel-controller-mixin |
Malicious release: Malicious code in setka-editor (npm) GHSA-4626-p8q4-554f, MAL-2026-5859 | Malicious | Not scored | 16 Jun, 2026 | npm setka-editor |
Malicious release: Malicious code in event-metrics-q3x7 (npm) GHSA-hw6h-jfr8-q9v4, MAL-2026-5857 | Malicious | Not scored | 16 Jun, 2026 | npm event-metrics-q3x7 |
Malicious release: Malicious code in metrics-pipeline-d8k2 (npm) GHSA-77q5-c2w3-pc44, MAL-2026-5858 | Malicious | Not scored | 16 Jun, 2026 | npm metrics-pipeline-d8k2 |
Malicious release: Malicious code in tailwind-typography-style (npm) GHSA-xw83-9jhm-jj7j, MAL-2026-5854 | Malicious | Not scored | 16 Jun, 2026 | npm tailwind-typography-style |
Malicious release: Malicious code in sp-api-dev-assistant-mcp-server (npm) GHSA-hgm9-w4fm-65m9, MAL-2026-5853 | Malicious | Not scored | 16 Jun, 2026 | npm sp-api-dev-assistant-mcp-server |
Malicious release: Malicious code in epm-service-module-v2 (npm) GHSA-633w-wc3j-7jrf, MAL-2026-5851 | Malicious | Not scored | 16 Jun, 2026 | npm epm-service-module-v2 |
Malicious release: Malicious code in vemos-sdk (npm) GHSA-xfv6-m3cj-53m7, MAL-2026-5855 | Malicious | Not scored | 15 Jun, 2026 | npm vemos-sdk |
Malicious release: Malicious code in richtext-editor-ui (npm) GHSA-fgqx-cjm6-75x2, MAL-2026-5852 | Malicious | Not scored | 15 Jun, 2026 | npm richtext-editor-ui |
Malicious release: Malicious code in reading-cookies (npm) GHSA-mf62-v96j-mg7g, MAL-2026-5847 | Malicious | Not scored | 15 Jun, 2026 | npm reading-cookies |
Malicious release: Malicious code in prettier_v2 (npm) GHSA-cmfj-34j9-8w66, MAL-2026-5846 | Malicious | Not scored | 15 Jun, 2026 | npm prettier_v2 |
Malicious release: Malicious code in browserslist-db-sync (npm) GHSA-mfw9-5hqc-vc53, MAL-2026-5842 | Malicious | Not scored | 15 Jun, 2026 | npm browserslist-db-sync |
Malicious release: Malicious code in prettier_v1 (npm) GHSA-q835-5j9v-22qg, MAL-2026-5845 | Malicious | Not scored | 15 Jun, 2026 | npm prettier_v1 |
Malicious release: Malicious code in slow-surf (npm) GHSA-4qxq-82wv-jq32, MAL-2026-5848 | Malicious | Not scored | 15 Jun, 2026 | npm slow-surf |
Malicious release: Malicious code in numdifftools (npm) GHSA-fv2r-6vq4-5x8r, MAL-2026-5844 | Malicious | Not scored | 15 Jun, 2026 | npm numdifftools |
Malicious release: Malicious code in chai-smart-assert (npm) GHSA-897c-qgxj-rv65, MAL-2026-5843 | Malicious | Not scored | 15 Jun, 2026 | npm chai-smart-assert |
Malicious release: Malicious code in vite-enhancer-config (npm) GHSA-gmwm-6xjg-8wxr, MAL-2026-5850 | Malicious | Not scored | 15 Jun, 2026 | npm vite-enhancer-config |
Malicious release: Malicious code in vite-configu-react (npm) GHSA-rg5g-54x4-p2gg, MAL-2026-5849 | Malicious | Not scored | 15 Jun, 2026 | npm vite-configu-react |
i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names CVE-2026-48714, GHSA-f49m-vf83-692w | Critical | 0.5% | 15 Jun, 2026 | npm i18next-http-middleware |
i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string CVE-2026-48713, GHSA-2933-q333-qg83 | Critical | 0.5% | 15 Jun, 2026 | npm i18next-fs-backend |