Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @t-in-one/safe_local_storage_token (npm) GHSA-r2p6-3gmf-chx9, MAL-2026-5045 | Malicious | Not scored | 29 May, 2026 | npm @t-in-one/safe_local_storage_token |
Malicious release: Malicious code in @t-in-one/form_product_token (npm) GHSA-r382-p83j-69fx, MAL-2026-5038 | Malicious | Not scored | 29 May, 2026 | npm @t-in-one/form_product_token |
Malicious release: Malicious code in @t-in-one/prefill_bundle_data_token (npm) GHSA-rm9j-3m66-35r4, MAL-2026-5041 | Malicious | Not scored | 29 May, 2026 | npm @t-in-one/prefill_bundle_data_token |
Malicious release: Malicious code in @capibar.chat/ui-kit (npm) GHSA-rwm6-rvqv-qv7c, MAL-2026-5031 | Malicious | Not scored | 29 May, 2026 | npm @capibar.chat/ui-kit |
Malicious release: Malicious code in @t-in-one/add_application_tid (npm) GHSA-vvr5-6j6h-rq49, MAL-2026-5036 | Malicious | Not scored | 29 May, 2026 | npm @t-in-one/add_application_tid |
Malicious release: Malicious code in @t-in-one/restore_application_hid_from_storage (npm) GHSA-w9v9-8839-82rr, MAL-2026-5044 | Malicious | Not scored | 29 May, 2026 | npm @t-in-one/restore_application_hid_from_storage |
FUXA provides guest and invalid-token access to protected read APIs in secure mode CVE-2026-47718, GHSA-r9g5-7q8j-958c | Medium | 0.5% | 28 May, 2026 | npm fuxa-server |
Shamefile has an arbitrary file read via shamefile.yaml in shame next CVE-2026-47144, GHSA-x6p3-76f2-xxvh, PYSEC-2026-3065 | Medium | 0.2% | 28 May, 2026 | PyPI shamefile crates.io shamefile npm shamefile |
Malicious release: Malicious code in @qlab/ui (npm) MAL-2026-4860 | Malicious | Not scored | 28 May, 2026 | npm @qlab/ui |
Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths CVE-2026-47676, GHSA-2gcr-mfcq-wcc3 | Medium | 0.3% | 28 May, 2026 | npm hono |
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection CVE-2026-47675, GHSA-3hrh-pfw6-9m5x | Medium | 0.2% | 28 May, 2026 | npm hono |
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 CVE-2026-47674, GHSA-xrhx-7g5j-rcj5 | Medium | 0.2% | 28 May, 2026 | npm hono |
Hono: JWT middleware accepts any Authorization scheme, not only Bearer CVE-2026-47673, GHSA-f577-qrjj-4474 | Medium | 0.2% | 28 May, 2026 | npm hono |
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments CVE-2026-47762, GHSA-v98h-vmpc-fpqv | High | 0.3% | 28 May, 2026 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection CVE-2026-47761, GHSA-vg35-5wq7-3x7w | High | 0.3% | 28 May, 2026 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs CVE-2026-47760, GHSA-mh5m-5hw4-5c69 | High | 0.2% | 28 May, 2026 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes CVE-2026-47759, GHSA-q742-qvgc-gc2f | High | 0.3% | 28 May, 2026 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
Malicious release: Malicious code in @neon-i18n/core-ui (npm) MAL-2026-5027 | Malicious | Not scored | 28 May, 2026 | npm @neon-i18n/core-ui |
Malicious release: Malicious code in hellowornd (npm) GHSA-4f9q-ffgq-5w82, MAL-2026-4839 | Malicious | Not scored | 28 May, 2026 | npm hellowornd |
Malicious release: Malicious code in @service-suppliers/reset_country_list (npm) GHSA-84hr-mv69-vj7f, MAL-2026-4850 | Malicious | Not scored | 28 May, 2026 | npm @service-suppliers/reset_country_list |
Malicious release: Malicious code in @service-suppliers/set_suppliers_loading_start (npm) GHSA-89m6-4f5j-7xj7, MAL-2026-4855 | Malicious | Not scored | 28 May, 2026 | npm @service-suppliers/set_suppliers_loading_start |
Malicious release: Malicious code in @service-user-notifications/set_refresh_interval (npm) GHSA-9h2v-ff64-858c, MAL-2026-4858 | Malicious | Not scored | 28 May, 2026 | npm @service-user-notifications/set_refresh_interval |
Malicious release: Malicious code in @service-user-notifications/reset_notifications_not_removable (npm) GHSA-f2q4-p8r2-p7qr, MAL-2026-4857 | Malicious | Not scored | 28 May, 2026 | npm @service-user-notifications/reset_notifications_not_removable |
Malicious release: Malicious code in @service-suppliers/set_suppliers_data (npm) GHSA-jpvq-j8hv-vf64, MAL-2026-4854 | Malicious | Not scored | 28 May, 2026 | npm @service-suppliers/set_suppliers_data |
Malicious release: Malicious code in @service-suppliers/set_suppliers_loading_stop (npm) GHSA-mh37-355g-cwf5, MAL-2026-4856 | Malicious | Not scored | 28 May, 2026 | npm @service-suppliers/set_suppliers_loading_stop |
Malicious release: Malicious code in @service-suppliers/set_selected_supplier_action_saga (npm) GHSA-v5p9-2r35-4xf9, MAL-2026-4853 | Malicious | Not scored | 28 May, 2026 | npm @service-suppliers/set_selected_supplier_action_saga |
Malicious release: Malicious code in @service-suppliers/set_country_list (npm) GHSA-w4v4-3hx5-qm6x, MAL-2026-4851 | Malicious | Not scored | 28 May, 2026 | npm @service-suppliers/set_country_list |
Malicious release: Malicious code in @service-suppliers/set_initial_loaded (npm) GHSA-w965-p32r-r94f, MAL-2026-4852 | Malicious | Not scored | 28 May, 2026 | npm @service-suppliers/set_initial_loaded |
Malicious release: Malicious code in @service-suppliers/fetch-suppliers-watcher-saga (npm) GHSA-f638-f27j-mwxw, MAL-2026-4847 | Malicious | Not scored | 28 May, 2026 | npm @service-suppliers/fetch-suppliers-watcher-saga |
Malicious release: Malicious code in @polka-ui/loads (npm) GHSA-f6p3-64q3-f7m2, MAL-2026-4843 | Malicious | Not scored | 28 May, 2026 | npm @polka-ui/loads |
Malicious release: Malicious code in @hcs-hybrid/uirouter-core (npm) GHSA-j5c6-cvw9-pvw5, MAL-2026-4841 | Malicious | Not scored | 28 May, 2026 | npm @hcs-hybrid/uirouter-core |
Malicious release: Malicious code in @polka-ui/recoc (npm) GHSA-jfp7-28fm-4363, MAL-2026-4845 | Malicious | Not scored | 28 May, 2026 | npm @polka-ui/recoc |
Malicious release: Malicious code in @polka-ui/reco (npm) GHSA-jp28-c5rf-vp9c, MAL-2026-4844 | Malicious | Not scored | 28 May, 2026 | npm @polka-ui/reco |
Malicious release: Malicious code in @service-suppliers/fetch-initial-suppliers-watcher-saga (npm) GHSA-r54g-7f23-p3xr, MAL-2026-4846 | Malicious | Not scored | 28 May, 2026 | npm @service-suppliers/fetch-initial-suppliers-watcher-saga |
Malicious release: Malicious code in @polka-ui/configuration (npm) GHSA-r7px-75rx-x9r7, MAL-2026-4842 | Malicious | Not scored | 28 May, 2026 | npm @polka-ui/configuration |
Malicious release: Malicious code in @bcs-bank-complex-ui/deeplink (npm) GHSA-w552-5pj3-2xrg, MAL-2026-4840 | Malicious | Not scored | 28 May, 2026 | npm @bcs-bank-complex-ui/deeplink |
Malicious release: Malicious code in @service-suppliers/fetch_initial_suppliers_action_saga (npm) GHSA-w5vj-vfr4-3hjw, MAL-2026-4848 | Malicious | Not scored | 28 May, 2026 | npm @service-suppliers/fetch_initial_suppliers_action_saga |
Malicious release: Malicious code in @service-suppliers/fetch_suppliers_country_list_action_saga (npm) GHSA-www8-35vq-694c, MAL-2026-4849 | Malicious | Not scored | 28 May, 2026 | npm @service-suppliers/fetch_suppliers_country_list_action_saga |
Malicious release: Malicious code in justsaying-docs (npm) MAL-2026-4838 | Malicious | Not scored | 28 May, 2026 | npm justsaying-docs |
Malicious release: Malicious code in nemo-reporter (npm) GHSA-358g-x45v-57vw, MAL-2026-4836 | Malicious | Not scored | 28 May, 2026 | npm nemo-reporter |
json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio CVE-2026-9673, GHSA-g27c-q7cp-mhx6 | Medium | 0.2% | 28 May, 2026 | npm json-2-csv |
Malicious release: Malicious code in @cloudplatform-single-spa/svp-s3-storage (npm) GHSA-228p-vq38-23gh, MAL-2026-4988 | Malicious | Not scored | 28 May, 2026 | npm @cloudplatform-single-spa/svp-s3-storage |
Malicious release: Malicious code in @cloudplatform-single-spa/ml-ai-agents-agent (npm) GHSA-2429-p3v5-m6p7, MAL-2026-4933 | Malicious | Not scored | 28 May, 2026 | npm @cloudplatform-single-spa/ml-ai-agents-agent |
Malicious release: Malicious code in @cloudplatform-single-spa/dataplatform (npm) GHSA-2m8v-gg54-p274, MAL-2026-4903 | Malicious | Not scored | 28 May, 2026 | npm @cloudplatform-single-spa/dataplatform |
Malicious release: Malicious code in @cloudplatform-single-spa/cp-api-gw (npm) GHSA-37f8-7crp-99x7, MAL-2026-4901 | Malicious | Not scored | 28 May, 2026 | npm @cloudplatform-single-spa/cp-api-gw |
Malicious release: Malicious code in @cloudplatform-single-spa/svp-interfaces (npm) GHSA-3h4q-c5w7-j6c3, MAL-2026-4984 | Malicious | Not scored | 28 May, 2026 | npm @cloudplatform-single-spa/svp-interfaces |
Malicious release: Malicious code in @cloudplatform-single-spa/business-solutions (npm) GHSA-5r3c-vc42-xhw6, MAL-2026-4893 | Malicious | Not scored | 28 May, 2026 | npm @cloudplatform-single-spa/business-solutions |
Malicious release: Malicious code in @cloudplatform-single-spa/cnapp-ui (npm) GHSA-5wwp-555m-83g9, MAL-2026-4898 | Malicious | Not scored | 28 May, 2026 | npm @cloudplatform-single-spa/cnapp-ui |
Malicious release: Malicious code in @cloudplatform-single-spa/support (npm) GHSA-7wmg-h7hh-5m93, MAL-2026-4975 | Malicious | Not scored | 28 May, 2026 | npm @cloudplatform-single-spa/support |
Malicious release: Malicious code in @cloudplatform-single-spa/ssh-keys (npm) GHSA-7xjw-q57c-jjh9, MAL-2026-4972 | Malicious | Not scored | 28 May, 2026 | npm @cloudplatform-single-spa/ssh-keys |