Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
actual Allows Electron to Run As Node CVE-2026-42890, GHSA-7rvm-xjpp-63r9 | Medium | 0.1% | 08 Jun, 2026 | npm actual |
Malicious release: Malicious code in @zimmo/last_search (npm) MAL-2026-5328 | Malicious | Not scored | 08 Jun, 2026 | npm @zimmo/last_search |
Malicious release: Malicious code in @listings/energy-labels (npm) MAL-2026-5327 | Malicious | Not scored | 08 Jun, 2026 | npm @listings/energy-labels |
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews. CVE-2026-47430, GHSA-q42j-x8rq-pjg6 | Critical | 0.7% | 08 Jun, 2026 | npm cordova-plugin-inappbrowser |
Malicious release: Malicious code in quickwinston (npm) MAL-2026-5365 | Malicious | Not scored | 08 Jun, 2026 | npm quickwinston |
Malicious release: Malicious code in classwind-utils (npm) GHSA-ghrw-2645-5c47, MAL-2026-5307 | Malicious | Not scored | 08 Jun, 2026 | npm classwind-utils |
Malicious release: Malicious code in regexp-ts (npm) GHSA-5p9w-932r-cr5f, MAL-2026-5310 | Malicious | Not scored | 08 Jun, 2026 | npm regexp-ts |
Malicious release: Malicious code in nodemon-lint (npm) GHSA-cjg8-jrqm-2q9r, MAL-2026-5309 | Malicious | Not scored | 08 Jun, 2026 | npm nodemon-lint |
Malicious release: Malicious code in chai-mocks (npm) GHSA-5wqh-hxqx-c6j3, MAL-2026-5306 | Malicious | Not scored | 08 Jun, 2026 | npm chai-mocks |
Malicious release: Malicious code in nodemon-copack (npm) GHSA-pw2c-3h97-j57f, MAL-2026-5308 | Malicious | Not scored | 08 Jun, 2026 | npm nodemon-copack |
Malicious release: Malicious code in zer0one-dnslog (npm) MAL-2026-5366 | Malicious | Not scored | 08 Jun, 2026 | npm zer0one-dnslog |
Malicious release: Malicious code in consumerweb-authflow (npm) MAL-2026-5297 | Malicious | Not scored | 07 Jun, 2026 | npm consumerweb-authflow |
Malicious release: Malicious code in sequoia-engineering (npm) GHSA-5r3g-3x22-r8qm, MAL-2026-5291 | Malicious | Not scored | 07 Jun, 2026 | npm sequoia-engineering |
Malicious release: Malicious code in @solana-labs/web3-js (npm) MAL-2026-5363 | Malicious | Not scored | 07 Jun, 2026 | npm @solana-labs/web3-js |
Malicious release: Malicious code in @solana-labs/etherjs (npm) MAL-2026-5362 | Malicious | Not scored | 07 Jun, 2026 | npm @solana-labs/etherjs |
Malicious release: Malicious code in unifi-portal (npm) MAL-2026-5289 | Malicious | Not scored | 06 Jun, 2026 | npm unifi-portal |
Malicious release: Malicious code in encrypted-archive (npm) MAL-2026-5286 | Malicious | Not scored | 06 Jun, 2026 | npm encrypted-archive |
Malicious release: Malicious code in uisp-connector (npm) MAL-2026-5288 | Malicious | Not scored | 06 Jun, 2026 | npm uisp-connector |
Malicious release: Malicious code in uhd-setup (npm) MAL-2026-5287 | Malicious | Not scored | 06 Jun, 2026 | npm uhd-setup |
NocoDB: OAuth Tokens Persist Through Security Events CVE-2026-53926, GHSA-g72g-r7m4-9x4g | Medium | 0.4% | 05 Jun, 2026 | npm nocodb |
DbGate: Remote Code Execution via functionName injection in loadReader endpoint CVE-2026-48017, GHSA-hv83-ggc4-v385 | High | 0.5% | 05 Jun, 2026 | npm dbgate-api |
Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP CVE-2026-47684, GHSA-q4x5-8cj6-52wg | High | 0.2% | 05 Jun, 2026 | npm @sync-in/server |
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate CVE-2026-47670, GHSA-wm5r-5qp3-5vxf | Critical | 1.8% | 05 Jun, 2026 | npm dbgate-api |
DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE CVE-2026-47669, GHSA-h535-j5hr-mv56 | Critical | 0.5% | 05 Jun, 2026 | npm dbgate |
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner CVE-2026-47668, GHSA-8v3q-9vmx-36vc | Critical | 3.9% | 05 Jun, 2026 | npm dbgate-serve |
NocoDB: Missing Ownership Check in MCP Attachment Read CVE-2026-47388, GHSA-xxpj-q764-9r6q | Low | 0.3% | 05 Jun, 2026 | npm nocodb |
NocoDB: Stored Cross-Site Scripting via Form View Redirect URL CVE-2026-47387, GHSA-hj85-ph9q-78jg | High | 0.4% | 05 Jun, 2026 | npm nocodb |
NocoDB: OAuth Authorization Code Race Condition CVE-2026-47386, GHSA-8m7c-hf24-5g47 | Medium | 0.3% | 05 Jun, 2026 | npm nocodb |
NocoDB: Path Traversal via SQLite Source Filename CVE-2026-47385, GHSA-wvqj-9wv4-7ff5 | Medium | 0.4% | 05 Jun, 2026 | npm nocodb |
NocoDB: SQL Injection via Column Title in Bulk GroupBy CVE-2026-47384, GHSA-p8wx-5f39-w3x4 | Medium | 0.4% | 05 Jun, 2026 | npm nocodb |
NocoDB: Stored Cross-Site Scripting via Row Comments CVE-2026-47383, GHSA-jf3g-4gwg-4h66 | High | 0.4% | 05 Jun, 2026 | npm nocodb |
NocoDB: Server-Side Request Forgery via Database Connection Host CVE-2026-47382, GHSA-w43h-r5m5-p832 | Medium | 0.4% | 05 Jun, 2026 | npm nocodb |
NocoDB: Cross-Workspace Integration Use in Connection Test CVE-2026-47381, GHSA-96fh-m4r8-6v9v | Medium | 0.4% | 05 Jun, 2026 | npm nocodb |
NocoDB: User Enumeration via Sign-In Timing CVE-2026-47380, GHSA-jr54-jwhj-55gp | Medium | 0.3% | 05 Jun, 2026 | npm nocodb |
NocoDB: Plaintext Password Comparison in Shared Views CVE-2026-47379, GHSA-qhxg-623c-cfjm | Medium | 0.4% | 05 Jun, 2026 | npm nocodb |
NocoDB: Hidden Column Exposure in Public Shared View Endpoints CVE-2026-47378, GHSA-4w6r-5c2j-qf5f | Medium | 0.4% | 05 Jun, 2026 | npm nocodb |
NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin CVE-2026-47377, GHSA-rvp5-9p55-f5rp | Medium | 0.4% | 05 Jun, 2026 | npm nocodb |
NocoDB: Reflected Cross-Site Scripting via Password Reset Token CVE-2026-47376, GHSA-6xcx-7qmg-vjfq | Medium | 0.4% | 05 Jun, 2026 | npm nocodb |
NocoDB: Postgres SQL Injection in Formula `ARRAYSORT` CVE-2026-47375, GHSA-cxv7-gmmp-228p | Medium | 0.4% | 05 Jun, 2026 | npm nocodb |
NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints CVE-2026-47279, GHSA-9wgh-m22w-9xj8 | Medium | 0.4% | 05 Jun, 2026 | npm nocodb |
MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration CVE-2026-47250, GHSA-6mx4-4h42-r8vh | Medium | 0.4% | 05 Jun, 2026 | npm mcp-server-kubernetes |
Malicious release: Malicious code in reactvora (npm) GHSA-x4gw-cjrp-c89f, MAL-2026-5270 | Malicious | Not scored | 05 Jun, 2026 | npm reactvora |
claude-mem: The computeObservationContentHash Function is Vulnerable to Hash Collision CVE-2026-11330, GHSA-5gvr-v6qv-h5mm | Low | 0.1% | 05 Jun, 2026 | npm claude-mem |
Malicious release: Malicious code in glyphr (npm) GHSA-c988-j68q-h8h4, MAL-2026-5269 | Malicious | Not scored | 05 Jun, 2026 | npm glyphr |
Malicious release: Malicious code in ulid-os (npm) GHSA-fxhm-35h8-7jc7, MAL-2026-5268 | Malicious | Not scored | 05 Jun, 2026 | npm ulid-os |
decompress: Arbitrary File Write via Archive Extraction (Zip Slip) CVE-2026-10732, GHSA-h39j-r5qq-r9mm | Medium | 0.5% | 05 Jun, 2026 | npm decompress |
Malicious release: Malicious code in autotel-vitest (npm) GHSA-2x3q-hrjf-x554, MAL-2026-5232 | Malicious | Not scored | 05 Jun, 2026 | npm autotel-vitest |
Malicious release: Malicious code in autotel-cli (npm) GHSA-3729-344x-9v28, MAL-2026-5216 | Malicious | Not scored | 05 Jun, 2026 | npm autotel-cli |
Malicious release: Malicious code in autotel-subscribers (npm) GHSA-37wr-f689-9c3c, MAL-2026-5230 | Malicious | Not scored | 05 Jun, 2026 | npm autotel-subscribers |
Malicious release: Malicious code in autotel-mcp (npm) GHSA-3wmg-66hp-xhv9, MAL-2026-5223 | Malicious | Not scored | 05 Jun, 2026 | npm autotel-mcp |