Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in react-svg-animator (npm) GHSA-g99g-mw45-jjhj, MAL-2026-5079 | Malicious | Not scored | 29 May, 2026 | npm react-svg-animator |
Malicious release: Malicious code in ethers-errors (npm) GHSA-6726-235v-9wxv, MAL-2026-5065 | Malicious | Not scored | 29 May, 2026 | npm ethers-errors |
Malicious release: Malicious code in gcp-api-enabler (npm) GHSA-r3rp-65c5-5cjh, MAL-2026-5071 | Malicious | Not scored | 29 May, 2026 | npm gcp-api-enabler |
Malicious release: Malicious code in @timelycare/core (npm) GHSA-47m4-3287-24vc, MAL-2026-5055 | Malicious | Not scored | 29 May, 2026 | npm @timelycare/core |
Malicious release: Malicious code in @rsi-community/hub-client-app (npm) GHSA-6rcg-q5qx-9qhp, MAL-2026-5050 | Malicious | Not scored | 29 May, 2026 | npm @rsi-community/hub-client-app |
Malicious release: Malicious code in @timelycare/api (npm) GHSA-h3x2-x2gh-2hcm, MAL-2026-5052 | Malicious | Not scored | 29 May, 2026 | npm @timelycare/api |
Malicious release: Malicious code in @tc-core/provider-service (npm) GHSA-rrgc-v65r-26g4, MAL-2026-5051 | Malicious | Not scored | 29 May, 2026 | npm @tc-core/provider-service |
Malicious release: Malicious code in foundry-config (npm) GHSA-29c8-wfhx-h778, MAL-2026-5070 | Malicious | Not scored | 29 May, 2026 | npm foundry-config |
Malicious release: Malicious code in @cplace-project-planning-fe/cf-project-planning (npm) GHSA-4hrw-8228-63r2, MAL-2026-5048 | Malicious | Not scored | 29 May, 2026 | npm @cplace-project-planning-fe/cf-project-planning |
Malicious release: Malicious code in codex-devcontainer-install (npm) GHSA-frcf-f9wx-gq64, MAL-2026-5062 | Malicious | Not scored | 29 May, 2026 | npm codex-devcontainer-install |
Malicious release: Malicious code in ethers-hash (npm) GHSA-mrrv-5vqm-j285, MAL-2026-5066 | Malicious | Not scored | 29 May, 2026 | npm ethers-hash |
Malicious release: Malicious code in @timelycare/common (npm) GHSA-mf79-x3p8-p4px, MAL-2026-5053 | Malicious | Not scored | 29 May, 2026 | npm @timelycare/common |
Malicious release: Malicious code in @lir-portal/web-components (npm) GHSA-pvc4-pwx8-4c4g, MAL-2026-5049 | Malicious | Not scored | 29 May, 2026 | npm @lir-portal/web-components |
AgenticMail API/storage and outbound relay hardening fixes CVE-2026-47255, GHSA-wjjv-3mj2-39hf | High | 0.3% | 29 May, 2026 | npm @agenticmail/api npm @agenticmail/core |
Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers BIT-parse-2026-47248, CVE-2026-47248, GHSA-8cph-rgr4-g5vj | Medium | 0.3% | 29 May, 2026 | npm parse-server |
NodeVM observability builtins leak host process and HTTP request data CVE-2026-47141, GHSA-9g8x-92q2-p28f | Medium | 0.4% | 29 May, 2026 | npm vm2 |
NodeVM network builtin exclusions bypass via internal _http_client and _http_server CVE-2026-47139, GHSA-r9pm-gxmw-wv6p | High | 0.4% | 29 May, 2026 | npm vm2 |
NodeVM builtin denylist bypass via process and inspector/promises allows host code execution CVE-2026-47140, GHSA-rp36-8xq3-r6c4 | Critical | 1.0% | 29 May, 2026 | npm vm2 |
vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass CVE-2026-47210, GHSA-6j2x-vhqr-qr7q | Critical | 1.7% | 29 May, 2026 | npm vm2 |
vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE CVE-2026-47137, GHSA-m4wx-m65x-ghrr | Critical | 0.4% | 29 May, 2026 | npm vm2 |
vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain CVE-2026-47209, GHSA-c4cf-2hgv-2qv6 | High | 0.3% | 29 May, 2026 | npm vm2 |
vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks CVE-2026-47135, GHSA-m5q2-4fm3-vfqp | High | 0.3% | 29 May, 2026 | npm vm2 |
vm2 is Vulnerable to Sandbox Breakout Through Promise Species CVE-2026-47208, GHSA-76w7-j9cq-rx2j | Critical | 1.0% | 29 May, 2026 | npm vm2 |
vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter CVE-2026-92962, GHSA-q3fm-4wcw-g57x | Low | 0.2% | 29 May, 2026 | npm vm2 |
vm2 has a Sandbox Escape issue CVE-2026-47131, GHSA-v6mx-mf47-r5wg | Critical | 0.8% | 29 May, 2026 | npm vm2 |
Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` CVE-2026-47200, GHSA-hg3f-28rg-4jxj | Medium | 0.2% | 29 May, 2026 | npm @nuxt/nitro-server npm nuxt |
OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates CVE-2026-35674, GHSA-hw9r-h9mr-4jff | High | 0.3% | 29 May, 2026 | npm openclaw |
OpenClaw: Browser debug/export routes could reuse already-open blocked tabs CVE-2026-35673, GHSA-hcm3-8f6r-6xwg | Medium | 0.2% | 29 May, 2026 | npm openclaw |
OpenClaw: QQBot native approval buttons did not enforce configured approver identity CVE-2026-35630, GHSA-mgq6-vr84-7m2j | High | 0.2% | 29 May, 2026 | npm openclaw |
OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy CVE-2026-34507, GHSA-w4v6-g3wm-w36c | Critical | 0.1% | 29 May, 2026 | npm openclaw |
OpenClaw's Slack plugin approvals used the exec approver gate for plugin actions CVE-2026-32906, GHSA-wv26-j37q-2g7p | Medium | 0.2% | 29 May, 2026 | npm openclaw |
OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes CVE-2026-32905, GHSA-xr4f-mjxj-w6w5 | High | 0.2% | 29 May, 2026 | npm openclaw |
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVE-2026-44495, GHSA-3g43-6gmg-66jw | High | 0.9% | 29 May, 2026 | npm axios |
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` CVE-2026-44494, GHSA-35jp-ww65-95wh | High | 1.1% | 29 May, 2026 | npm axios |
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718) CVE-2026-44492, GHSA-pjwm-pj3p-43mv | High | 12.3% | 29 May, 2026 | npm axios |
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions CVE-2026-44490, GHSA-898c-q2cr-xwhg | High | 0.3% | 29 May, 2026 | npm axios |
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix CVE-2026-44489, GHSA-654m-c8p4-x5fp | Medium | 0.2% | 29 May, 2026 | npm axios |
HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint CVE-2026-48527, GHSA-g2g8-95qg-v35h | High | 0.2% | 29 May, 2026 | npm @haxtheweb/haxcms-nodejs |
Malicious release: Malicious code in tiny-naturalsort (npm) GHSA-mqp5-9r9w-8hg4, MAL-2026-5030 | Malicious | Not scored | 29 May, 2026 | npm tiny-naturalsort |
Malicious release: Malicious code in sorenson-webfonts (npm) GHSA-jfh5-5qvf-47fj, MAL-2026-5028 | Malicious | Not scored | 29 May, 2026 | npm sorenson-webfonts |
Malicious release: Malicious code in @t-in-one/add_application (npm) GHSA-2rqm-cx7p-43hx, MAL-2026-5034 | Malicious | Not scored | 29 May, 2026 | npm @t-in-one/add_application |
Malicious release: Malicious code in @t-in-one/send_add_application (npm) GHSA-33cg-q6pj-vg3j, MAL-2026-5046 | Malicious | Not scored | 29 May, 2026 | npm @t-in-one/send_add_application |
Malicious release: Malicious code in @t-in-one/prefill_credit_data_token (npm) GHSA-38v2-g3qx-w6fr, MAL-2026-5042 | Malicious | Not scored | 29 May, 2026 | npm @t-in-one/prefill_credit_data_token |
Malicious release: Malicious code in @sber-ecom-core/sberpay-widget (npm) GHSA-6rfw-m3fj-7g8q, MAL-2026-5032 | Malicious | Not scored | 29 May, 2026 | npm @sber-ecom-core/sberpay-widget |
Malicious release: Malicious code in @t-in-one/prefill_transformers_data_token (npm) GHSA-7jj3-323f-22v4, MAL-2026-5043 | Malicious | Not scored | 29 May, 2026 | npm @t-in-one/prefill_transformers_data_token |
Malicious release: Malicious code in @t-in-one/add_app_middleware_token (npm) GHSA-86f7-96xp-23wm, MAL-2026-5033 | Malicious | Not scored | 29 May, 2026 | npm @t-in-one/add_app_middleware_token |
Malicious release: Malicious code in @t-in-one/get_application_hid (npm) GHSA-9ghf-xffg-p5gx, MAL-2026-5039 | Malicious | Not scored | 29 May, 2026 | npm @t-in-one/get_application_hid |
Malicious release: Malicious code in @t-in-one/application_id_storage_key_token (npm) GHSA-cwhq-qx36-9hhq, MAL-2026-5037 | Malicious | Not scored | 29 May, 2026 | npm @t-in-one/application_id_storage_key_token |
Malicious release: Malicious code in @t-in-one/only_difference_payload (npm) GHSA-h594-x75p-ghjh, MAL-2026-5040 | Malicious | Not scored | 29 May, 2026 | npm @t-in-one/only_difference_payload |
Malicious release: Malicious code in @t-in-one/add_application_service_token (npm) GHSA-p76m-g6ch-9pg3, MAL-2026-5035 | Malicious | Not scored | 29 May, 2026 | npm @t-in-one/add_application_service_token |