Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in focus-visible-polyfill-lite (npm) MAL-2026-17491 | Malicious | Not scored | 25 days ago | npm focus-visible-polyfill-lite |
Malicious release: Malicious code in virgil-cli (npm) MAL-2026-17630 | Malicious | Not scored | 26 days ago | npm virgil-cli |
Malicious release: Malicious code in @nagular/router (npm) MAL-2026-17500 | Malicious | Not scored | 27 days ago | npm @nagular/router |
Malicious release: Malicious code in @angularr/router (npm) MAL-2026-17494 | Malicious | Not scored | 27 days ago | npm @angularr/router |
Malicious release: Malicious code in @babell/core (npm) MAL-2026-17497 | Malicious | Not scored | 27 days ago | npm @babell/core |
Malicious release: Malicious code in @nagular/core (npm) MAL-2026-17499 | Malicious | Not scored | 27 days ago | npm @nagular/core |
Malicious release: Malicious code in @angularr/core (npm) MAL-2026-17493 | Malicious | Not scored | 27 days ago | npm @angularr/core |
Malicious release: Malicious code in @angularr/cli (npm) MAL-2026-17492 | Malicious | Not scored | 27 days ago | npm @angularr/cli |
Malicious release: Malicious code in express-enhanced (npm) MAL-2026-17489 | Malicious | Not scored | 27 days ago | npm express-enhanced |
Malicious release: Malicious code in express-fork (npm) MAL-2026-17490 | Malicious | Not scored | 27 days ago | npm express-fork |
Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values CVE-2026-114073, GHSA-fj2x-mqqp-3v2w | Medium | 0.2% | 27 days ago | npm trigger.dev |
Trigger.dev: Cross-environment deployment cancel CVE-2026-114079, GHSA-4672-hwv6-gq62 | Medium | 0.3% | 27 days ago | npm trigger.dev |
Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name CVE-2026-114081, GHSA-9q4r-4842-93vw | High | 0.4% | 27 days ago | npm trigger.dev |
Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId CVE-2026-114086, GHSA-59h8-w5q6-mfmp | Medium | 0.4% | 27 days ago | npm trigger.dev |
Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise CVE-2026-114087, GHSA-pqxw-g93w-hj9x | Critical | 0.5% | 27 days ago | npm trigger.dev |
Trigger.dev: V1 coordinator default-secret unauth Socket.IO CVE-2026-114088, GHSA-gg6r-gp4c-89hp | Critical | 0.4% | 27 days ago | npm trigger.dev |
Trigger.dev: Blind SSRF via alert-channel webhook CVE-2026-114076, GHSA-q567-cr4x-96w4 | Medium | 0.3% | 27 days ago | npm trigger.dev |
Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR) GHSA-pp95-gc86-jq6q | High | Not scored | 27 days ago | npm trigger.dev |
Malicious release: Malicious code in ui.dist.min.js (npm) GHSA-325f-rjxf-3gm9, MAL-2026-17460 | Malicious | Not scored | 27 days ago | npm ui.dist.min.js |
Malicious release: Malicious code in translate-base-font (npm) GHSA-grv5-7wp6-vw6h, MAL-2026-17458 | Malicious | Not scored | 27 days ago | npm translate-base-font |
Malicious release: Malicious code in ui-base-colors (npm) GHSA-qgqx-3mhx-jwx3, MAL-2026-17459 | Malicious | Not scored | 27 days ago | npm ui-base-colors |
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute CVE-2026-104872, GHSA-qqmp-wf37-98f9 | Medium | 0.2% | 27 days ago | npm @opentelemetry/instrumentation-cassandra-driver npm @opentelemetry/instrumentation-knex npm @opentelemetry/instrumentation-mongoose npm @opentelemetry/instrumentation-mysql +4 more |
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows CVE-2026-104871, GHSA-7g7c-h8rr-7p6q | Medium | 0.4% | 27 days ago | npm @angular/ssr |
@orpc/zod: Prototype injection in smart coercion CVE-2026-103918, GHSA-gcgf-fh7c-8gf2 | Medium | 0.2% | 27 days ago | npm @orpc/zod |
Malicious release: Malicious code in @smwebserver/static (npm) GHSA-qhx4-m546-6w2x, MAL-2026-17456 | Malicious | Not scored | 28 days ago | npm @smwebserver/static |
probe-image-size: Quadratic-time Denial of Service in the SVG Parser CVE-2026-104861, GHSA-gjj5-9665-rwrc | High | 0.4% | 28 days ago | npm probe-image-size |
@nx/docker: OS command injection in the @nx/docker release pipeline CVE-2026-104859, GHSA-6vc5-vf29-ffr2 | High | 0.1% | 28 days ago | npm @nx/docker |
Nx daemon and plugin worker sockets are accessible to other local users CVE-2026-104854, GHSA-w3vv-58gj-gw77 | High | 0.1% | 28 days ago | npm nx |
Nx: Path traversal in nx migrate package-migrations extraction CVE-2026-104853, GHSA-hrvq-x7jp-36xv | Medium | 0.2% | 28 days ago | npm nx |
Tinypool: Prototype Pollution Gadget to RCE in run() options CVE-2026-104849, GHSA-85c8-ppgw-ccpr | Critical | 0.5% | 28 days ago | npm tinypool |
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution CVE-2026-104848, GHSA-5gmw-xhrv-c9v3 | Critical | 0.5% | 28 days ago | npm tinypool |
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages CVE-2026-94544, GHSA-3w37-wq28-93x7 | Medium | 0.2% | 28 days ago | npm next |
Next.js has cache poisoning of SSG and ISR pages in self-hosted applications CVE-2026-94543, GHSA-4jqv-mc3x-m676 | Medium | 0.5% | 28 days ago | npm next |
Next.js has information disclosure in development server's Model Context Protocol endpoint CVE-2026-94486, GHSA-39w2-rjm5-chcv | Low | 0.1% | 28 days ago | npm next |
Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass CVE-2026-94485, GHSA-f87g-xv8r-7p7x | Medium | 0.2% | 28 days ago | npm next |
Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service CVE-2026-94484, GHSA-mcj8-r9mp-w47p | Medium | 0.2% | 28 days ago | npm next |
Next.js has Server-Side Request Forgery in Image Optimization CVE-2026-94483, GHSA-cjq9-62q9-8jv4 | High | 0.3% | 28 days ago | npm next |
ProseMirror has a XSS vulnerability in prosemirror-view's paste handling CVE-2026-104847, GHSA-c8x8-7fp4-3x9w | High | 0.3% | 28 days ago | npm prosemirror-view |
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw) CVE-2026-104846, GHSA-p6vx-979v-rg4c | Critical | 0.3% | 28 days ago | npm seroval |
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization CVE-2026-104845, GHSA-jp82-f5mq-hwhp | High | 0.4% | 28 days ago | npm seroval |
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion CVE-2026-104844, GHSA-rj75-hqrm-r3gf | Medium | 0.4% | 28 days ago | npm postcss-selector-parser |
Malicious release: Malicious code in kartykgithub-ph-f (npm) GHSA-x2m2-w3gv-m5wg, MAL-2026-17426 | Malicious | Not scored | 28 days ago | npm kartykgithub-ph-f |
Malicious release: Malicious code in kartykgithub-ph-e (npm) GHSA-7hq7-x7ww-7cxr, MAL-2026-17425 | Malicious | Not scored | 28 days ago | npm kartykgithub-ph-e |
Malicious release: Malicious code in kartykgithub-ph-b (npm) GHSA-27m4-jjxc-69wf, MAL-2026-17424 | Malicious | Not scored | 28 days ago | npm kartykgithub-ph-b |
Malicious release: Malicious code in @erlanzz/baileys (npm) MAL-2026-17440 | Malicious | Not scored | 28 days ago | npm @erlanzz/baileys |
Malicious release: Malicious code in @smart-dev-wa/baileys (npm) MAL-2026-17442 | Malicious | Not scored | 28 days ago | npm @smart-dev-wa/baileys |
Malicious release: Malicious code in danz-bails (npm) MAL-2026-17444 | Malicious | Not scored | 28 days ago | npm danz-bails |
Malicious release: Malicious code in mikuhostt-baileys (npm) MAL-2026-17447 | Malicious | Not scored | 28 days ago | npm mikuhostt-baileys |
Malicious release: Malicious code in wailib (npm) MAL-2026-17451 | Malicious | Not scored | 28 days ago | npm wailib |
Malicious release: Malicious code in illusion-datalab (npm) GHSA-834w-x8gq-8rmx, MAL-2026-17423 | Malicious | Not scored | 28 days ago | npm illusion-datalab |