Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in lab-helper (npm) GHSA-gqf6-7j7q-9x94, MAL-2026-5835 | Malicious | Not scored | 15 Jun, 2026 | npm lab-helper |
Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json` GHSA-rq7w-g337-39qq | Low | Not scored | 15 Jun, 2026 | npm nuxt |
Malicious release: Malicious code in @wacrot/infra-data-kit (npm) MAL-2026-5834 | Malicious | Not scored | 15 Jun, 2026 | npm @wacrot/infra-data-kit |
Malicious release: Malicious code in tn-advertisement (npm) GHSA-96gg-hmjq-f55m, GHSA-j2c8-6hx3-7994, MAL-2026-5838, SNYK-JS-TNADVERTISEMENT-19003450 | Malicious | Not scored | 15 Jun, 2026 | npm tn-advertisement |
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations CVE-2026-48988, GHSA-6v5v-wf23-fmfq | Medium | 0.4% | 15 Jun, 2026 | npm markdown-it |
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation CVE-2026-54285, GHSA-8988-4f7v-96qf | Medium | 0.4% | 15 Jun, 2026 | npm @opentelemetry/core |
Nest: Middleware Bypass on Fastify via Trailing Slash CVE-2026-54281, GHSA-6v32-fjc9-9qf6 | High | 0.5% | 15 Jun, 2026 | npm @nestjs/platform-fastify |
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow CVE-2026-54257, GHSA-q6m5-f73j-m9mc | Critical | 0.4% | 15 Jun, 2026 | npm electron |
Malicious release: Malicious code in postcss-minify-selector (npm) GHSA-gwv6-f7j6-4xc8, MAL-2026-5837 | Malicious | Not scored | 15 Jun, 2026 | npm postcss-minify-selector |
YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution CVE-2026-50880, GHSA-68mc-h6h8-79wj | Critical | 0.5% | 15 Jun, 2026 | npm youtransfer |
Remotion: arbitrary file write vulnerability CVE-2026-30121, GHSA-g6pc-6676-c23j | Critical | 0.3% | 15 Jun, 2026 | npm remotion |
Remotion: remote code execution (RCE) vulnerability CVE-2026-30120, GHSA-2jqp-f4gr-44fr | Critical | 0.8% | 15 Jun, 2026 | npm remotion |
UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()` CVE-2026-48125, GHSA-9h5v-pfqq-x599 | Medium | 0.5% | 15 Jun, 2026 | npm ua-parser-js |
protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names CVE-2026-54271, GHSA-pr59-h9ph-3fr8 | High | 0.3% | 15 Jun, 2026 | npm protobufjs-cli |
protobufjs: Memory amplification from preserved unknown fields in binary decode CVE-2026-54270, GHSA-94rc-8x27-4472 | Medium | 0.4% | 15 Jun, 2026 | npm protobufjs |
DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output CVE-2026-65899, GHSA-vxr8-fq34-vvx9 | Medium | 0.4% | 15 Jun, 2026 | npm dompurify |
Malicious release: Malicious code in yunxin-overmind-comment (npm) MAL-2026-5833 | Malicious | Not scored | 15 Jun, 2026 | npm yunxin-overmind-comment |
Malicious release: Malicious code in @intentsolution/database-security-scanner (npm) GHSA-gx76-7hhh-jcj2, MAL-2026-5825 | Malicious | Not scored | 15 Jun, 2026 | npm @intentsolution/database-security-scanner |
Malicious release: Malicious code in index-ulid (npm) GHSA-95pm-8vrw-2wrp, MAL-2026-5827 | Malicious | Not scored | 15 Jun, 2026 | npm index-ulid |
Malicious release: Malicious code in dms-backend (npm) MAL-2026-5826 | Malicious | Not scored | 15 Jun, 2026 | npm dms-backend |
Malicious release: Malicious code in ogd-platform (npm) MAL-2026-5828 | Malicious | Not scored | 15 Jun, 2026 | npm ogd-platform |
React Router: Potential CSRF via PUT/PATCH/DELETE document requests CVE-2026-53663, GHSA-84g9-w2xq-vcv6 | Low | 0.1% | 15 Jun, 2026 | npm @remix-run/server-runtime npm react-router |
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE CVE-2026-53633, GHSA-g8mr-85jm-7xhm | Critical | 0.9% | 15 Jun, 2026 | npm @vitest/browser npm vite-plus |
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes CVE-2026-65900, GHSA-gvmj-g25r-r7wr | Medium | 0.3% | 15 Jun, 2026 | npm dompurify |
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content CVE-2026-49978, GHSA-rp9w-3fw7-7cwq | Medium | 0.4% | 15 Jun, 2026 | npm dompurify |
DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects CVE-2026-65901, GHSA-x4vx-rjvf-j5p4 | Medium | 0.3% | 15 Jun, 2026 | npm dompurify |
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR` CVE-2026-65902, GHSA-76mc-f452-cxcm | Medium | 0.4% | 15 Jun, 2026 | npm dompurify |
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks CVE-2026-49458, GHSA-hpcv-96wg-7vj8 | Medium | 0.4% | 15 Jun, 2026 | npm dompurify |
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM CVE-2026-49459, GHSA-r47g-fvhr-h676 | Medium | 0.4% | 15 Jun, 2026 | npm dompurify |
Malicious release: Malicious code in vend-utilities (npm) MAL-2026-5832 | Malicious | Not scored | 15 Jun, 2026 | npm vend-utilities |
Malicious release: Malicious code in cardano-addresses-docs (npm) MAL-2026-5802 | Malicious | Not scored | 15 Jun, 2026 | npm cardano-addresses-docs |
Malicious release: Malicious code in @resolvx/core (npm) GHSA-5fvj-272r-496w, MAL-2026-5798 | Malicious | Not scored | 15 Jun, 2026 | npm @resolvx/core |
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection CVE-2026-82661, GHSA-268h-hp4c-crq3 | Medium | 0.3% | 15 Jun, 2026 | npm nodemailer |
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization CVE-2026-82660, GHSA-wqvq-jvpq-h66f | Medium | 0.3% | 15 Jun, 2026 | npm nodemailer |
Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception CVE-2026-82662, GHSA-r7g4-qg5f-qqm2 | High | 0.2% | 15 Jun, 2026 | npm nodemailer |
Malicious release: Malicious code in boardflow (npm) GHSA-38x4-9p94-xg4p, MAL-2026-5799 | Malicious | Not scored | 15 Jun, 2026 | npm boardflow |
Malicious release: Malicious code in boardstep (npm) MAL-2026-5800 | Malicious | Not scored | 15 Jun, 2026 | npm boardstep |
protobufjs: Denial of service through unbounded Any expansion during JSON conversion CVE-2026-48712, GHSA-wcpc-wj8m-hjx6 | High | 0.5% | 15 Jun, 2026 | npm protobufjs |
protobufjs : Schema-derived names can shadow runtime-significant properties CVE-2026-54269, GHSA-f38q-mgvj-vph7 | Medium | 0.4% | 15 Jun, 2026 | npm protobufjs npm protobufjs-cli |
@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker CVE-2026-54264, GHSA-qxh6-94w6-9r5p | High | 0.4% | 15 Jun, 2026 | npm @angular/service-worker |
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate) CVE-2026-54268, GHSA-48r7-hpm6-gfxm | High | 0.6% | 15 Jun, 2026 | npm @angular/common |
Malicious release: Malicious code in flow-lending (npm) GHSA-pgcr-8w67-72j9, MAL-2026-5803 | Malicious | Not scored | 15 Jun, 2026 | npm flow-lending |
@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning CVE-2026-54266, GHSA-39pv-4j6c-2g6v | High | 0.1% | 15 Jun, 2026 | npm @angular/common |
Malicious release: Malicious code in flow-lending-sdk (npm) GHSA-r79w-4mcq-g2fm, MAL-2026-5804 | Malicious | Not scored | 15 Jun, 2026 | npm flow-lending-sdk |
Malicious release: Malicious code in flowdefi (npm) GHSA-24j3-x8g2-c23q, MAL-2026-5806 | Malicious | Not scored | 15 Jun, 2026 | npm flowdefi |
Malicious release: Malicious code in surf-lending (npm) GHSA-6762-f2rg-qwfv, MAL-2026-5808 | Malicious | Not scored | 15 Jun, 2026 | npm surf-lending |
Malicious release: Malicious code in bodega-sdk (npm) GHSA-m774-6g93-j76m, MAL-2026-5801 | Malicious | Not scored | 15 Jun, 2026 | npm bodega-sdk |
Malicious release: Malicious code in flowcardano (npm) GHSA-7wqh-42c8-vqcx, MAL-2026-5805 | Malicious | Not scored | 15 Jun, 2026 | npm flowcardano |
@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS) CVE-2026-54265, GHSA-58w9-8g37-x9v5 | Medium | 0.3% | 15 Jun, 2026 | npm @angular/compiler |
Angular: Template and Attribute Namespace Sanitization Bypass (XSS) CVE-2026-50557, GHSA-f3m7-gqxr-g87x | Medium | 0.4% | 15 Jun, 2026 | npm @angular/compiler npm @angular/core |