Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack CVE-2026-46511, GHSA-x3x5-7h4h-gwxg | High | 0.3% | 19 May, 2026 | npm @haxtheweb/haxcms-nodejs |
Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover CVE-2026-46396, GHSA-jh3h-rpxg-fr36 | Critical | 0.2% | 19 May, 2026 | npm @haxtheweb/haxcms-nodejs npm @haxtheweb/iframe-loader npm @haxtheweb/video-player |
HAXcms: Private Key Disclosure via Broken HMAC Implementation CVE-2026-46395, GHSA-6c8g-9hfh-pq5h | Critical | 0.3% | 19 May, 2026 | npm @haxtheweb/haxcms-nodejs |
HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis CVE-2026-46391, GHSA-4fg7-f244-3j49 | High | 0.5% | 19 May, 2026 | npm @haxtheweb/open-apis |
HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft CVE-2026-46496, GHSA-2m6p-hm3w-6jm3 | Critical | 0.2% | 19 May, 2026 | npm @haxtheweb/haxcms-nodejs npm @haxtheweb/video-player |
HAXcms createSite SSRF Enables Arbitrary File Read CVE-2026-46393, GHSA-q862-gcgq-5m6g | High | 0.2% | 19 May, 2026 | npm @haxtheweb/haxcms-nodejs |
Malware in @opensearch-project/opensearch GHSA-27f5-xjrr-q9ff | Critical | Not scored | 19 May, 2026 | npm @opensearch-project/opensearch |
Malicious release: Malicious code in psxjson (npm) GHSA-cjgp-rvr9-v9w4, MAL-2026-4170 | Malicious | Not scored | 19 May, 2026 | npm psxjson |
Malicious release: Malicious code in paysafe-gbp-virtual-assistant-lib-fe (npm) MAL-2026-4169 | Malicious | Not scored | 19 May, 2026 | npm paysafe-gbp-virtual-assistant-lib-fe |
Malicious release: Malicious code in chai-as-attracted (npm) GHSA-f6hv-jpgr-c835, MAL-2026-4167 | Malicious | Not scored | 19 May, 2026 | npm chai-as-attracted |
Malicious release: Malicious code in chai-as-vec (npm) GHSA-g2hx-wqmp-2fhg, MAL-2026-4168 | Malicious | Not scored | 19 May, 2026 | npm chai-as-vec |
Malicious release: Malicious code in paysafe-gbp-virtual-terminal-lib-fe (npm) MAL-2026-4165 | Malicious | Not scored | 19 May, 2026 | npm paysafe-gbp-virtual-terminal-lib-fe |
Malicious release: Malicious code in identitysecuretokenserv (npm) GHSA-2g7g-rqj2-26hv, MAL-2026-4164 | Malicious | Not scored | 19 May, 2026 | npm identitysecuretokenserv |
ExifReader is vulnerable to denial of service via unbounded decompression of image metadata CVE-2026-8814, GHSA-rr89-w3h9-m66j | Medium | 0.5% | 19 May, 2026 | npm exifreader |
ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag CVE-2026-8813, GHSA-h64w-w9pr-82m4 | High | 0.5% | 19 May, 2026 | npm exifreader |
Malicious release: Malicious code in @apps-home-dashboard/events (npm) MAL-2026-4160 | Malicious | Not scored | 19 May, 2026 | npm @apps-home-dashboard/events |
Malicious release: Malicious code in @openclaw-cn/toutiao-ops (npm) GHSA-76rr-f54j-qv4x, MAL-2026-3844 | Malicious | Not scored | 19 May, 2026 | npm @openclaw-cn/toutiao-ops |
Malicious release: Malicious code in @starmind/collector-cli (npm) GHSA-g8pp-x86c-7rvv, MAL-2026-3845 | Malicious | Not scored | 19 May, 2026 | npm @starmind/collector-cli |
Malicious release: Malicious code in @openclaw-cn/feishu (npm) GHSA-pmr7-7grm-gj36, MAL-2026-3842 | Malicious | Not scored | 19 May, 2026 | npm @openclaw-cn/feishu |
Malicious release: Malicious code in @openclaw-cn/cli (npm) GHSA-rfwx-q579-pqpc, MAL-2026-3841 | Malicious | Not scored | 19 May, 2026 | npm @openclaw-cn/cli |
Malicious release: Malicious code in openclaw-cn (npm) GHSA-w2fv-p53h-wcph, MAL-2026-3847 | Malicious | Not scored | 19 May, 2026 | npm openclaw-cn |
Malicious release: Malicious code in @openclaw-cn/libsignal (npm) GHSA-wcjp-mfw5-77g8, MAL-2026-3843 | Malicious | Not scored | 19 May, 2026 | npm @openclaw-cn/libsignal |
Malicious release: Malicious code in @cap-js/openapi (npm) MAL-2026-4161 | Malicious | Not scored | 19 May, 2026 | npm @cap-js/openapi |
Malicious release: Malicious code in vfat-tools (npm) GHSA-jxh5-v495-r962, MAL-2026-4179 | Malicious | Not scored | 19 May, 2026 | npm vfat-tools |
Malicious release: Malicious code in sickle-wrapper (npm) GHSA-f64g-9rx5-4jxf, MAL-2026-4178 | Malicious | Not scored | 19 May, 2026 | npm sickle-wrapper |
Malicious release: Malicious code in @antv/graphin-graphscope (npm) GHSA-24cj-39cv-3v39, MAL-2026-4024 | Malicious | Not scored | 19 May, 2026 | npm @antv/graphin-graphscope |
Malicious release: Malicious code in timeago.js (npm) GHSA-24rg-886p-mgcf, MAL-2026-4156 | Malicious | Not scored | 19 May, 2026 | npm timeago.js |
Malicious release: Malicious code in @antv/g-mobile-canvas (npm) GHSA-24wr-fjmp-cp62, MAL-2026-3925 | Malicious | Not scored | 19 May, 2026 | npm @antv/g-mobile-canvas |
Malicious release: Malicious code in @antv/l7-renderer (npm) GHSA-2cx2-5qc6-g927, MAL-2026-4049 | Malicious | Not scored | 19 May, 2026 | npm @antv/l7-renderer |
Malicious release: Malicious code in @antv/smart-color (npm) GHSA-2f69-wx92-323w, MAL-2026-4085 | Malicious | Not scored | 19 May, 2026 | npm @antv/smart-color |
Malicious release: Malicious code in @antv/l7-source (npm) GHSA-2g4c-8h8p-3hx7, MAL-2026-4051 | Malicious | Not scored | 19 May, 2026 | npm @antv/l7-source |
Malicious release: Malicious code in @antv/x6-vue3-shape (npm) GHSA-2h7w-4897-2pcq, MAL-2026-4117 | Malicious | Not scored | 19 May, 2026 | npm @antv/x6-vue3-shape |
Malicious release: Malicious code in @antv/vis-predict-engine (npm) GHSA-2jfm-x3p5-q6cq, MAL-2026-4094 | Malicious | Not scored | 19 May, 2026 | npm @antv/vis-predict-engine |
Malicious release: Malicious code in @antv/chart-node-g6 (npm) GHSA-2qrw-8mg6-hjhv, MAL-2026-3858 | Malicious | Not scored | 19 May, 2026 | npm @antv/chart-node-g6 |
Malicious release: Malicious code in echarts-for-react (npm) GHSA-2w6w-qxwv-qv2q, MAL-2026-4132 | Malicious | Not scored | 19 May, 2026 | npm echarts-for-react |
Malicious release: Malicious code in @antv/g-mobile-webgl (npm) GHSA-337r-7h6j-v8v6, MAL-2026-3928 | Malicious | Not scored | 19 May, 2026 | npm @antv/g-mobile-webgl |
Malicious release: Malicious code in @antv/g-math (npm) GHSA-38wc-54fv-gf4h, MAL-2026-3923 | Malicious | Not scored | 19 May, 2026 | npm @antv/g-math |
Malicious release: Malicious code in @antv/g6-ssr (npm) GHSA-3c58-vgw8-2cvf, MAL-2026-3996 | Malicious | Not scored | 19 May, 2026 | npm @antv/g6-ssr |
Malicious release: Malicious code in @antv/g-gesture (npm) GHSA-3c6p-cx95-q59f, MAL-2026-3919 | Malicious | Not scored | 19 May, 2026 | npm @antv/g-gesture |
Malicious release: Malicious code in @antv/g-plugin-dragndrop (npm) GHSA-3mp5-g4hw-8695, MAL-2026-3943 | Malicious | Not scored | 19 May, 2026 | npm @antv/g-plugin-dragndrop |
Malicious release: Malicious code in @antv/l7-layers (npm) GHSA-3x2v-mwgf-c97h, MAL-2026-4041 | Malicious | Not scored | 19 May, 2026 | npm @antv/l7-layers |
Malicious release: Malicious code in @antv/x6-plugin-snapline (npm) GHSA-3x74-245r-5hqw, MAL-2026-4109 | Malicious | Not scored | 19 May, 2026 | npm @antv/x6-plugin-snapline |
Malicious release: Malicious code in @antv/li-sam-assets (npm) GHSA-3xmh-6mvr-59p8, MAL-2026-4064 | Malicious | Not scored | 19 May, 2026 | npm @antv/li-sam-assets |
Malicious release: Malicious code in @antv/g-image-exporter (npm) GHSA-43gp-g42f-r82g, MAL-2026-3837 | Malicious | Not scored | 19 May, 2026 | npm @antv/g-image-exporter |
Malicious release: Malicious code in @antv/x6 (npm) GHSA-45hr-5496-7mgx, MAL-2026-3839 | Malicious | Not scored | 19 May, 2026 | npm @antv/x6 |
Malicious release: Malicious code in @antv/gpt-vis-ssr (npm) GHSA-45m4-36r5-4mx3, MAL-2026-4021 | Malicious | Not scored | 19 May, 2026 | npm @antv/gpt-vis-ssr |
Malicious release: Malicious code in @antv/g-mobile-svg (npm) GHSA-45mw-h867-v337, MAL-2026-3927 | Malicious | Not scored | 19 May, 2026 | npm @antv/g-mobile-svg |
Malicious release: Malicious code in @antv/async-hook (npm) GHSA-467p-2qgm-r2xr, MAL-2026-3851 | Malicious | Not scored | 19 May, 2026 | npm @antv/async-hook |
Malicious release: Malicious code in @antv/dw-analyzer (npm) GHSA-496v-jcj6-2m74, MAL-2026-3875 | Malicious | Not scored | 19 May, 2026 | npm @antv/dw-analyzer |
Malicious release: Malicious code in @antv/g2-extension-3d (npm) GHSA-4fj7-9pjm-wv8c, MAL-2026-3975 | Malicious | Not scored | 19 May, 2026 | npm @antv/g2-extension-3d |