Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR CVE-2026-50556, GHSA-gxx4-3xcv-f8qx | High | 0.4% | 15 Jun, 2026 | npm @angular/platform-server |
@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-50555, GHSA-hqr9-c56f-3x7f | High | 0.3% | 15 Jun, 2026 | npm @angular/platform-server |
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) CVE-2026-53655, GHSA-vmf3-w455-68vh | Medium | 0.2% | 15 Jun, 2026 | npm tar |
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows CVE-2026-53632, GHSA-v6wh-96g9-6wx3 | Medium | 0.4% | 15 Jun, 2026 | npm launch-editor npm vite npm vite-plus |
vite: `server.fs.deny` bypass on Windows alternate paths CVE-2026-53571, GHSA-fx2h-pf6j-xcff | High | 0.6% | 15 Jun, 2026 | npm vite npm vite-plus |
Malicious release: Malicious code in @solana-labs/ancor (npm) GHSA-h2x5-cj9x-hvcc, MAL-2026-5786 | Malicious | Not scored | 15 Jun, 2026 | npm @solana-labs/ancor |
Malicious release: Malicious code in @solana-labs/spl-toke (npm) GHSA-6465-92w6-mgp8, MAL-2026-5787 | Malicious | Not scored | 15 Jun, 2026 | npm @solana-labs/spl-toke |
Malicious release: Malicious code in @solana-labs/web3js (npm) GHSA-pqhf-q5g8-6jpm, MAL-2026-5788 | Malicious | Not scored | 15 Jun, 2026 | npm @solana-labs/web3js |
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases CVE-2026-53550, GHSA-h67p-54hq-rp68 | Medium | 0.4% | 15 Jun, 2026 | npm js-yaml |
@babel/core: Arbitrary File Read via sourceMappingURL Comment CVE-2026-49356, GHSA-4x5r-pxfx-6jf8 | Low | 0.2% | 15 Jun, 2026 | npm @babel/core |
@angular/service-worker: Request Credential & Cache Policy Stripping CVE-2026-50184, GHSA-95qp-cmmw-mgqv | Medium | 0.2% | 15 Jun, 2026 | npm @angular/service-worker |
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo) CVE-2026-50171, GHSA-p3vc-36g9-x9gr | High | 0.3% | 15 Jun, 2026 | npm @angular/common |
@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache CVE-2026-50170, GHSA-q6f4-qqrg-jv6x | High | 0.4% | 15 Jun, 2026 | npm @angular/common |
@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS) CVE-2026-52725, GHSA-692r-grfm-v8x7 | Medium | 0.5% | 15 Jun, 2026 | npm @angular/core |
Malicious release: Malicious code in claude-cup (npm) MAL-2026-5789 | Malicious | Not scored | 15 Jun, 2026 | npm claude-cup |
Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities CVE-2026-50169, GHSA-gv2q-mqqv-365m | Medium | 0.2% | 15 Jun, 2026 | npm @angular/service-worker |
@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass CVE-2026-50168, GHSA-xrxm-cp7j-8xf6 | High | 0.2% | 15 Jun, 2026 | npm @angular/platform-server |
ws: Memory exhaustion DoS from tiny fragments and data chunks CVE-2026-48779, GHSA-96hv-2xvq-fx4p | High | 1.4% | 15 Jun, 2026 | npm ws |
Malicious release: Malicious code in mddriver (npm) GHSA-75f4-4w6r-vvch, MAL-2026-5791 | Malicious | Not scored | 15 Jun, 2026 | npm mddriver |
Malicious release: Malicious code in neural-network-scan (npm) MAL-2026-5794 | Malicious | Not scored | 15 Jun, 2026 | npm neural-network-scan |
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies CVE-2026-9595, GHSA-mx8g-39q3-5c79 | Medium | 0.2% | 15 Jun, 2026 | npm webpack-dev-server |
Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads CVE-2026-5038, GHSA-3p4h-7m6x-2hcm | High | 0.4% | 15 Jun, 2026 | npm multer |
Malicious release: Malicious code in nativescript-swisspost-imagepicker (npm) GHSA-vcxp-rm4v-qh5h, MAL-2026-5792 | Malicious | Not scored | 15 Jun, 2026 | npm nativescript-swisspost-imagepicker |
Malicious release: Malicious code in nativescript-swisspost-pcc-creative-editor (npm) GHSA-h5g9-q449-jr2c, MAL-2026-5793 | Malicious | Not scored | 15 Jun, 2026 | npm nativescript-swisspost-pcc-creative-editor |
Malicious release: Malicious code in ldpbootstrap-jquery (npm) GHSA-2m3g-j8c8-hx83, MAL-2026-5790 | Malicious | Not scored | 15 Jun, 2026 | npm ldpbootstrap-jquery |
Malicious release: Malicious code in sam-package (npm) MAL-2026-5807 | Malicious | Not scored | 15 Jun, 2026 | npm sam-package |
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning CVE-2026-54267, GHSA-rgjc-h3x7-9mwg | High | 0.4% | 15 Jun, 2026 | npm @angular/core |
Malicious release: Malicious code in field-plus (npm) GHSA-wcq8-7m2v-8r69, MAL-2026-5777 | Malicious | Not scored | 15 Jun, 2026 | npm field-plus |
Malicious release: Malicious code in ing-feat-itsme-oidc-authentication (npm) MAL-2026-5780 | Malicious | Not scored | 15 Jun, 2026 | npm ing-feat-itsme-oidc-authentication |
Malicious release: Malicious code in portal-backend (npm) GHSA-6j4w-8j7h-8c6c, MAL-2026-5781 | Malicious | Not scored | 15 Jun, 2026 | npm portal-backend |
Malicious release: Malicious code in token-prices-cron (npm) GHSA-qp5c-f568-8r3h, MAL-2026-5782 | Malicious | Not scored | 15 Jun, 2026 | npm token-prices-cron |
Malicious release: Malicious code in vaults-monitor-cron (npm) GHSA-7ff8-rw9g-fj84, MAL-2026-5784 | Malicious | Not scored | 15 Jun, 2026 | npm vaults-monitor-cron |
Malicious release: Malicious code in hemi-supply-cron (npm) GHSA-49hx-4cwp-rqgh, MAL-2026-5779 | Malicious | Not scored | 15 Jun, 2026 | npm hemi-supply-cron |
Malicious release: Malicious code in hemi-earn-actions (npm) GHSA-hjwc-fchg-m65q, MAL-2026-5778 | Malicious | Not scored | 15 Jun, 2026 | npm hemi-earn-actions |
Malicious release: Malicious code in vault-strategies (npm) GHSA-43qg-3v2q-g62x, MAL-2026-5783 | Malicious | Not scored | 15 Jun, 2026 | npm vault-strategies |
Malicious release: Malicious code in ve-hemi-rewards (npm) GHSA-wx43-hfx3-xw46, MAL-2026-5785 | Malicious | Not scored | 15 Jun, 2026 | npm ve-hemi-rewards |
Multer vulnerable to Denial of Service via deeply nested field names CVE-2026-5079, GHSA-72gw-mp4g-v24j | High | 0.3% | 15 Jun, 2026 | npm multer |
Malicious release: Malicious code in unico-android (npm) MAL-2026-5829 | Malicious | Not scored | 15 Jun, 2026 | npm unico-android |
Malicious release: Malicious code in unicocheck-ios (npm) MAL-2026-5831 | Malicious | Not scored | 15 Jun, 2026 | npm unicocheck-ios |
Malicious release: Malicious code in unico-check (npm) MAL-2026-5830 | Malicious | Not scored | 15 Jun, 2026 | npm unico-check |
Malicious release: Malicious code in nic-datagov (npm) MAL-2026-5836 | Malicious | Not scored | 15 Jun, 2026 | npm nic-datagov |
Malicious release: Malicious code in um4r719-baileys (npm) GHSA-cfvv-rh9x-qqvj, MAL-2026-5774 | Malicious | Not scored | 15 Jun, 2026 | npm um4r719-baileys |
jsonata: Function Binding Prototype Pollution via hasOwnProperty Override CVE-2026-12208, GHSA-663r-x48j-fg8p | Medium | 0.3% | 15 Jun, 2026 | npm jsonata |
Malicious release: Malicious code in npx-whoami-demo (npm) GHSA-3mmq-8798-7f4v, MAL-2026-5772 | Malicious | Not scored | 14 Jun, 2026 | npm npx-whoami-demo |
Malicious release: Malicious code in ltidiconf (npm) GHSA-qv73-635h-wqmp, MAL-2026-5767 | Malicious | Not scored | 14 Jun, 2026 | npm ltidiconf |
Malicious release: Malicious code in npm-sandbox-research-e9f0 (npm) GHSA-76w8-rxxx-vjcg, MAL-2026-5762 | Malicious | Not scored | 14 Jun, 2026 | npm npm-sandbox-research-e9f0 |
Malicious release: Malicious code in npm-sandbox-ping-c8f2a (npm) GHSA-w249-c3rp-ffwq, MAL-2026-5757 | Malicious | Not scored | 14 Jun, 2026 | npm npm-sandbox-ping-c8f2a |
Malicious release: Malicious code in npm-sandbox-research-c5d6 (npm) GHSA-54f7-37vp-p38f, MAL-2026-5760 | Malicious | Not scored | 14 Jun, 2026 | npm npm-sandbox-research-c5d6 |
Malicious release: Malicious code in npm-sandbox-research-8b2f (npm) GHSA-qxgv-pg7p-c4qr, MAL-2026-5758 | Malicious | Not scored | 14 Jun, 2026 | npm npm-sandbox-research-8b2f |
Malicious release: Malicious code in npm-sandbox-research-d7e8 (npm) GHSA-r53w-2vfx-w3p4, MAL-2026-5761 | Malicious | Not scored | 14 Jun, 2026 | npm npm-sandbox-research-d7e8 |