Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @mlspace/inference-deploy (npm) MAL-2026-5022 | Malicious | Not scored | 28 May, 2026 | npm @mlspace/inference-deploy |
Malicious release: Malicious code in @mlspace/model-monitoring (npm) MAL-2026-5023 | Malicious | Not scored | 28 May, 2026 | npm @mlspace/model-monitoring |
Malicious release: Malicious code in @mlspace/model-registry (npm) MAL-2026-5024 | Malicious | Not scored | 28 May, 2026 | npm @mlspace/model-registry |
Malicious release: Malicious code in @mlspace/profile (npm) MAL-2026-5025 | Malicious | Not scored | 28 May, 2026 | npm @mlspace/profile |
Malicious release: Malicious code in @mlspace/shared-storage (npm) MAL-2026-5026 | Malicious | Not scored | 28 May, 2026 | npm @mlspace/shared-storage |
FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations CVE-2026-47717, GHSA-q3w6-q3hc-c5x6 | High | 1.4% | 27 May, 2026 | npm fuxa-server |
Malicious release: Malicious code in @polka-ui/config (npm) GHSA-8pwf-pjp8-jw22, MAL-2026-4834 | Malicious | Not scored | 27 May, 2026 | npm @polka-ui/config |
LiquidJS is Vulnerable to Remote Code Execution CVE-2026-45618, GHSA-gf2q-c269-pqgc | Critical | 0.8% | 27 May, 2026 | npm liquidjs |
Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata CVE-2026-48153, GHSA-4q6h-8p4v-67vq | High | 0.2% | 27 May, 2026 | npm @budibase/server |
Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL CVE-2026-48152, GHSA-3gp5-q4jw-3v94 | High | 0.3% | 27 May, 2026 | npm @budibase/server |
Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema CVE-2026-48151, GHSA-qhv3-wjg8-6fx6 | High | 0.2% | 27 May, 2026 | npm @budibase/server |
Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign CVE-2026-48150, GHSA-6xp4-cf37-ppjh | Critical | 0.3% | 27 May, 2026 | npm @budibase/server |
Budibase: Unvalidated VectorDB Host Parameter Enables SSRF CVE-2026-48148, GHSA-cv96-5348-p5p8 | Medium | 0.2% | 27 May, 2026 | npm @budibase/server |
Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker CVE-2026-48147, GHSA-wxq7-x3qp-vcr8 | Medium | 0.1% | 27 May, 2026 | npm @budibase/backend-core |
Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection CVE-2026-48146, GHSA-g6qx-g4pr-92v7 | High | 0.2% | 27 May, 2026 | npm @budibase/server |
Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step CVE-2026-48128, GHSA-6964-pp88-6wp9 | Medium | 0.3% | 27 May, 2026 | npm budibase |
LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex CVE-2026-45617, GHSA-r7g9-xpmj-5fcq | High | 0.5% | 27 May, 2026 | npm liquidjs |
LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) CVE-2026-45357, GHSA-hh27-hf48-9f5q | High | 0.4% | 27 May, 2026 | npm liquidjs |
Malicious release: Malicious code in bulletproof-json (npm) GHSA-w574-hfjv-7w24, MAL-2026-4833 | Malicious | Not scored | 27 May, 2026 | npm bulletproof-json |
Malicious release: Malicious code in editorial-code (npm) MAL-2026-4830 | Malicious | Not scored | 27 May, 2026 | npm editorial-code |
Malicious release: Malicious code in mse-authentication (npm) MAL-2026-4832 | Malicious | Not scored | 27 May, 2026 | npm mse-authentication |
Malicious release: Malicious code in editorial-mse-authentication-ui (npm) MAL-2026-4831 | Malicious | Not scored | 27 May, 2026 | npm editorial-mse-authentication-ui |
@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects CVE-2026-44979, GHSA-vhjm-w67q-g75c | Medium | 0.4% | 27 May, 2026 | npm @hapi/wreck |
@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters CVE-2026-44974, GHSA-36hh-x5p5-jgc8 | High | 0.5% | 27 May, 2026 | npm @hapi/content |
tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape CVE-2026-44705, GHSA-ph9p-34f9-6g65 | High | 0.4% | 27 May, 2026 | npm tmp |
LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()` CVE-2026-44646, GHSA-9x9p-qf8f-mvjg | Medium | 0.3% | 27 May, 2026 | npm liquidjs |
LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body CVE-2026-44645, GHSA-8xx9-69p8-7jp3 | Medium | 0.4% | 27 May, 2026 | npm liquidjs |
LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS CVE-2026-44644, GHSA-2qv6-9wx5-cwv4 | Medium | 0.3% | 27 May, 2026 | npm liquidjs |
FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass CVE-2026-43947, GHSA-rg3m-cfq7-g6h6 | High | 0.9% | 26 May, 2026 | npm fuxa-server |
FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue CVE-2026-43946, GHSA-fwcm-rqvw-j3p7 | High | 0.6% | 26 May, 2026 | npm fuxa-server |
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection CVE-2026-43945, GHSA-p69w-mmfv-xrfj | High | 0.8% | 26 May, 2026 | npm @frangoteam/fuxa |
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring CVE-2026-42462, GHSA-9rfg-v8g9-9367 | High | 0.2% | 26 May, 2026 | npm @fedify/fedify |
yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation CVE-2026-42089, GHSA-vv9j-gjw2-j8wp | High | 0.2% | 26 May, 2026 | npm yeoman-environment |
Malicious release: Malicious code in unleash-js (npm) GHSA-j5f8-3p7p-5c4c, MAL-2026-4827 | Malicious | Not scored | 26 May, 2026 | npm unleash-js |
Malicious release: Malicious code in wm-mapper (npm) GHSA-vqvw-vx7g-vp4p, MAL-2026-4826 | Malicious | Not scored | 26 May, 2026 | npm wm-mapper |
Malicious release: Malicious code in loadtest-browser-lib (npm) MAL-2026-4822 | Malicious | Not scored | 26 May, 2026 | npm loadtest-browser-lib |
Malicious release: Malicious code in @slipless/sdk (npm) MAL-2026-4815 | Malicious | Not scored | 26 May, 2026 | npm @slipless/sdk |
Malicious release: Malicious code in chainix (npm) GHSA-mrx8-p3w9-5cfm, MAL-2026-4817 | Malicious | Not scored | 26 May, 2026 | npm chainix |
Malicious release: Malicious code in token-me-uk (npm) MAL-2026-4819 | Malicious | Not scored | 26 May, 2026 | npm token-me-uk |
Malicious release: Malicious code in saturn-bail (npm) GHSA-948w-97g3-hvpp, MAL-2026-4818 | Malicious | Not scored | 26 May, 2026 | npm saturn-bail |
Malicious release: Malicious code in metricflow-tracker (npm) MAL-2026-4805 | Malicious | Not scored | 26 May, 2026 | npm metricflow-tracker |
Malicious release: Malicious code in web3-prices (npm) GHSA-g3vg-qhhh-pfv7, MAL-2026-4800 | Malicious | Not scored | 26 May, 2026 | npm web3-prices |
Malicious release: Malicious code in web3.prc (npm) GHSA-r4j3-79hx-xpr6, MAL-2026-4801 | Malicious | Not scored | 26 May, 2026 | npm web3.prc |
Malicious release: Malicious code in int-node (npm) GHSA-r4ww-65gv-rhv8, MAL-2026-4797 | Malicious | Not scored | 26 May, 2026 | npm int-node |
Malicious release: Malicious code in @fhkry/baileys (npm) GHSA-779h-825r-3p44, MAL-2026-4803 | Malicious | Not scored | 26 May, 2026 | npm @fhkry/baileys |
Malicious release: Malicious code in shop-minis (npm) GHSA-ghv6-vv2r-5f8v, MAL-2026-4807 | Malicious | Not scored | 26 May, 2026 | npm shop-minis |
Malicious release: Malicious code in fastjsonlog (npm) GHSA-82gw-34fc-qfwj, MAL-2026-4796 | Malicious | Not scored | 26 May, 2026 | npm fastjsonlog |
Malicious release: Malicious code in jsonlogbundler (npm) GHSA-hhf2-gfcc-vw45, MAL-2026-4798 | Malicious | Not scored | 26 May, 2026 | npm jsonlogbundler |
Malicious release: Malicious code in pdf-lib-enhanced (npm) GHSA-9qcm-qgjc-h848, MAL-2026-4799 | Malicious | Not scored | 26 May, 2026 | npm pdf-lib-enhanced |
Malicious release: Malicious code in xlsx-enhanced (npm) GHSA-j5gx-8qjw-gp5q, MAL-2026-4802 | Malicious | Not scored | 26 May, 2026 | npm xlsx-enhanced |