Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenClaw: Shell wrapper argv could change between approval and execution CVE-2026-53822, GHSA-2j8v-hwgc-x698 | High | 1.1% | 12 Jun, 2026 | npm Openclaw |
OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing CVE-2026-53821, GHSA-qjpc-qf9m-xwmr | High | 0.3% | 12 Jun, 2026 | npm openclaw |
OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn CVE-2026-53820, GHSA-qh2f-99mv-mrcf | Medium | 0.1% | 12 Jun, 2026 | npm openclaw |
Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass CVE-2026-53609, GHSA-6h5j-32cf-4253 | Critical | 0.3% | 12 Jun, 2026 | npm apostrophe |
@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag CVE-2026-53608, GHSA-wf43-fpp3-cf65 | High | 0.3% | 12 Jun, 2026 | npm @apostrophecms/seo |
Malicious release: Malicious code in ect-472839-ctf (npm) GHSA-9j3j-4vjh-6h88, MAL-2026-5718 | Malicious | Not scored | 12 Jun, 2026 | npm ect-472839-ctf |
Malicious release: Malicious code in ect-654321 (npm) GHSA-q226-9qx7-fxmj, MAL-2026-5719 | Malicious | Not scored | 12 Jun, 2026 | npm ect-654321 |
Malicious release: Malicious code in ect-839201 (npm) GHSA-v786-gqcj-q437, MAL-2026-5720 | Malicious | Not scored | 12 Jun, 2026 | npm ect-839201 |
Malicious release: Malicious code in ect-839201-ctf (npm) GHSA-g7vq-rhjq-x8rw, MAL-2026-5721 | Malicious | Not scored | 12 Jun, 2026 | npm ect-839201-ctf |
@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header CVE-2026-53607, GHSA-34pj-2622-jvxq | Low | 0.3% | 12 Jun, 2026 | npm apostrophe |
sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes CVE-2026-53606, GHSA-vccv-cmxp-4j9h | Medium | 0.2% | 12 Jun, 2026 | npm sanitize-html |
Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization CVE-2026-44311, GHSA-w22m-hvvm-xmwx | Medium | 0.3% | 12 Jun, 2026 | npm fabric |
Malicious release: Malicious code in claudechor (npm) GHSA-w7p9-gpj5-p2pw, MAL-2026-5717 | Malicious | Not scored | 12 Jun, 2026 | npm claudechor |
Malicious release: Malicious code in beamz (npm) MAL-2026-5716 | Malicious | Not scored | 12 Jun, 2026 | npm beamz |
Malicious release: Malicious code in chalk-plus-js (npm) MAL-2026-5709 | Malicious | Not scored | 12 Jun, 2026 | npm chalk-plus-js |
Malicious release: Malicious code in chalk-pro (npm) MAL-2026-5711 | Malicious | Not scored | 12 Jun, 2026 | npm chalk-pro |
Malicious release: Malicious code in jextic-eclib (npm) GHSA-fvh5-fhfx-3whm, MAL-2026-5712 | Malicious | Not scored | 12 Jun, 2026 | npm jextic-eclib |
Malicious release: Malicious code in chalk-plus-ts (npm) GHSA-247v-x9qw-cc59, MAL-2026-5710 | Malicious | Not scored | 12 Jun, 2026 | npm chalk-plus-ts |
esbuild allows arbitrary file read when running the development server on Windows GHSA-g7r4-m6w7-qqqr | Low | Not scored | 12 Jun, 2026 | npm esbuild |
Malicious release: Malicious code in vite-plugin-logo (npm) GHSA-cw37-h4jm-63xh, MAL-2026-5714 | Malicious | Not scored | 12 Jun, 2026 | npm vite-plugin-logo |
Malicious release: Malicious code in workflow-postgres-setup (npm) MAL-2026-5715 | Malicious | Not scored | 12 Jun, 2026 | npm workflow-postgres-setup |
Malicious release: Malicious code in vite-plugin-compress-js (npm) GHSA-jc9j-qfjm-7m7f, MAL-2026-5713 | Malicious | Not scored | 12 Jun, 2026 | npm vite-plugin-compress-js |
Malicious release: Malicious code in vite-svgr (npm) MAL-2026-5708 | Malicious | Not scored | 12 Jun, 2026 | npm vite-svgr |
parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL BIT-parse-2026-53726, CVE-2026-53726, GHSA-wmwx-jr2p-4j4r | Medium | 0.3% | 12 Jun, 2026 | npm parse-server |
parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied BIT-parse-2026-53725, CVE-2026-53725, GHSA-75v4-m273-5j49 | Medium | 0.3% | 12 Jun, 2026 | npm parse-server |
parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist BIT-parse-2026-53724, CVE-2026-53724, GHSA-7wqv-xjf3-x35v | Low | 0.3% | 12 Jun, 2026 | npm parse-server |
parse-server: Server option routeAllowList is bypassable through batch sub-requests BIT-parse-2026-50008, CVE-2026-50008, GHSA-p84r-h6rx-f2xr | Medium | 0.3% | 12 Jun, 2026 | npm parse-server |
form-data: CRLF injection in form-data via unescaped multipart field names and filenames CVE-2026-12143, GHSA-hmw2-7cc7-3qxx | High | 0.7% | 12 Jun, 2026 | npm form-data |
Malicious release: Malicious code in friendly-greeter-demo (npm) GHSA-47h6-x596-wmmx, MAL-2026-5704 | Malicious | Not scored | 12 Jun, 2026 | npm friendly-greeter-demo |
Malicious release: Malicious code in theta-connector (npm) GHSA-9vfq-xv95-fh28, MAL-2026-5705 | Malicious | Not scored | 12 Jun, 2026 | npm theta-connector |
Malicious release: Malicious code in theta-kit (npm) GHSA-ccpw-cfwc-qgw4, MAL-2026-5706 | Malicious | Not scored | 12 Jun, 2026 | npm theta-kit |
Malicious release: Malicious code in ttspc-server-sample (npm) GHSA-55wh-p7q3-vh4p, MAL-2026-5707 | Malicious | Not scored | 12 Jun, 2026 | npm ttspc-server-sample |
Malicious release: Malicious code in eslint-plugin-mistica-local-rules (npm) MAL-2026-5703 | Malicious | Not scored | 12 Jun, 2026 | npm eslint-plugin-mistica-local-rules |
Malicious release: Malicious code in vite-react-toolkit (npm) GHSA-4vwq-cp5w-hx5g, MAL-2026-5701 | Malicious | Not scored | 12 Jun, 2026 | npm vite-react-toolkit |
Malicious release: Malicious code in transportator (npm) GHSA-6wwm-jx4f-p4xq, MAL-2026-5700 | Malicious | Not scored | 12 Jun, 2026 | npm transportator |
Malicious release: Malicious code in chai-web3-testkit (npm) GHSA-j8qr-4p5h-mwqj, MAL-2026-5699 | Malicious | Not scored | 12 Jun, 2026 | npm chai-web3-testkit |
Malicious release: Malicious code in internallib_v856 (npm) GHSA-9jj2-f2qc-pm2j, MAL-2026-5694 | Malicious | Not scored | 12 Jun, 2026 | npm internallib_v856 |
Malicious release: Malicious code in internallib_v984 (npm) GHSA-24jp-936m-6fg4, MAL-2026-5695 | Malicious | Not scored | 12 Jun, 2026 | npm internallib_v984 |
Malicious release: Malicious code in voyager-web (npm) GHSA-3vr9-xc7m-h6qx, MAL-2026-5696 | Malicious | Not scored | 12 Jun, 2026 | npm voyager-web |
Malicious release: Malicious code in web-model-bridge (npm) GHSA-69cw-2vc8-9jm7, MAL-2026-5697 | Malicious | Not scored | 12 Jun, 2026 | npm web-model-bridge |
Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL CVE-2026-53722, GHSA-934w-87qh-qr26 | Medium | 0.3% | 12 Jun, 2026 | npm nuxt |
Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher CVE-2026-53721, GHSA-mm7m-92g8-7m47 | High | 0.4% | 12 Jun, 2026 | npm nuxt |
LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access CVE-2026-48121, GHSA-98xf-r82g-9mhx | Medium | 0.4% | 12 Jun, 2026 | npm @langchain/langgraph-checkpoint-mongodb |
Malicious release: Malicious code in ecto-win-flag-q2m7 (npm) GHSA-22wq-6mfh-69qv, MAL-2026-5692 | Malicious | Not scored | 12 Jun, 2026 | npm ecto-win-flag-q2m7 |
Malicious release: Malicious code in @malwguy/ecto-corsair-whisper-3d2a7c (npm) GHSA-636m-vpq6-g454, MAL-2026-5685 | Malicious | Not scored | 12 Jun, 2026 | npm @malwguy/ecto-corsair-whisper-3d2a7c |
Malicious release: Malicious code in ecto-rust-read-f3a9c1 (npm) GHSA-9h8h-37p7-873r, MAL-2026-5689 | Malicious | Not scored | 12 Jun, 2026 | npm ecto-rust-read-f3a9c1 |
Malicious release: Malicious code in sea-bound-siren (npm) GHSA-cp5x-35vp-rj7j, MAL-2026-5693 | Malicious | Not scored | 12 Jun, 2026 | npm sea-bound-siren |
Malicious release: Malicious code in ecto-corsair-flag-x9m4 (npm) GHSA-f7w9-m44f-pvf9, MAL-2026-5686 | Malicious | Not scored | 12 Jun, 2026 | npm ecto-corsair-flag-x9m4 |
Malicious release: Malicious code in ecto-flag-read-m7p2 (npm) GHSA-ggf2-rhq7-qqgg, MAL-2026-5687 | Malicious | Not scored | 12 Jun, 2026 | npm ecto-flag-read-m7p2 |
Malicious release: Malicious code in ecto-spirit-win-k4n8 (npm) GHSA-h2hh-hg37-42gq, MAL-2026-5691 | Malicious | Not scored | 12 Jun, 2026 | npm ecto-spirit-win-k4n8 |