Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw) CVE-2026-104846, GHSA-p6vx-979v-rg4c | Critical | 0.3% | 28 days ago | npm seroval |
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization CVE-2026-104845, GHSA-jp82-f5mq-hwhp | High | 0.4% | 28 days ago | npm seroval |
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion CVE-2026-104844, GHSA-rj75-hqrm-r3gf | Medium | 0.4% | 28 days ago | npm postcss-selector-parser |
Malicious release: Malicious code in kartykgithub-ph-f (npm) GHSA-x2m2-w3gv-m5wg, MAL-2026-17426 | Malicious | Not scored | 28 days ago | npm kartykgithub-ph-f |
Malicious release: Malicious code in kartykgithub-ph-e (npm) GHSA-7hq7-x7ww-7cxr, MAL-2026-17425 | Malicious | Not scored | 28 days ago | npm kartykgithub-ph-e |
Malicious release: Malicious code in kartykgithub-ph-b (npm) GHSA-27m4-jjxc-69wf, MAL-2026-17424 | Malicious | Not scored | 28 days ago | npm kartykgithub-ph-b |
Malicious release: Malicious code in @erlanzz/baileys (npm) MAL-2026-17440 | Malicious | Not scored | 28 days ago | npm @erlanzz/baileys |
Malicious release: Malicious code in @smart-dev-wa/baileys (npm) MAL-2026-17442 | Malicious | Not scored | 28 days ago | npm @smart-dev-wa/baileys |
Malicious release: Malicious code in danz-bails (npm) MAL-2026-17444 | Malicious | Not scored | 28 days ago | npm danz-bails |
Malicious release: Malicious code in mikuhostt-baileys (npm) MAL-2026-17447 | Malicious | Not scored | 28 days ago | npm mikuhostt-baileys |
Malicious release: Malicious code in wailib (npm) MAL-2026-17451 | Malicious | Not scored | 28 days ago | npm wailib |
Malicious release: Malicious code in illusion-datalab (npm) GHSA-834w-x8gq-8rmx, MAL-2026-17423 | Malicious | Not scored | 28 days ago | npm illusion-datalab |
figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width CVE-2026-96780, GHSA-62ch-8vmq-8xm7 | High | 0.5% | 28 days ago | npm figlet |
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects CVE-2026-104183, GHSA-mjw6-4jj6-33hc | Medium | 0.2% | 28 days ago | npm stream-json |
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk CVE-2026-104182, GHSA-hqr4-qq8f-hg3x | Medium | 0.2% | 28 days ago | npm stream-json |
KaTeX: Existing prototype pollution can bypass trust restrictions CVE-2026-103923, GHSA-238p-pmpm-9mq7 | Low | 0.3% | 29 days ago | npm katex |
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path CVE-2026-103922, GHSA-rvm3-566m-v7fv | Critical | 0.3% | 29 days ago | Maven com.capacitorjs:core SwiftURL github.com/ionic-team/capacitor-swift-pm npm @capacitor/android npm @capacitor/ios |
Zod can exhaust memory while validating oversized constrained collections CVE-2023-54404, GHSA-mrhx-c7xc-m3w5 | High | 0.3% | 29 days ago | npm zod |
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor CVE-2026-103921, GHSA-6fw5-9hq8-w87g | High | 0.3% | 29 days ago | npm @graphql-tools/executor-legacy-ws |
Malicious release: Malicious code in @kelvdra/baileys (npm) MAL-2026-17362 | Malicious | Not scored | 29 days ago | npm @kelvdra/baileys |
Malicious release: Malicious code in @bottino/baileys (npm) GHSA-qg7r-f2jp-2mmx, MAL-2026-17351 | Malicious | Not scored | 29 days ago | npm @bottino/baileys |
devalue: Residual sparse-array CPU amplification in uneval GHSA-hx4r-w6wj-j8fg | Medium | Not scored | 29 days ago | npm devalue |
devalue: Repeated primitive strings cause quadratic expansion in uneval GHSA-mcm9-63f2-9j32 | High | Not scored | 29 days ago | npm devalue |
next.js cache leak across root param values in nested 'use cache' functions CVE-2026-103004, GHSA-h694-7cp9-m8p3 | Medium | 0.3% | 29 days ago | npm next |
devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated GHSA-wf3x-273g-mvxv | Low | Not scored | 29 days ago | npm devalue |
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation GHSA-r9w8-h9r3-54w4 | High | Not scored | 29 days ago | npm devalue |
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise GHSA-x5rw-q4pp-hg5g | High | Not scored | 29 days ago | npm devalue |
devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion GHSA-4q55-j62x-fr9h | Medium | Not scored | 29 days ago | npm devalue |
Malicious release: Malicious code in online-header (npm) MAL-2026-17420 | Malicious | Not scored | 29 days ago | npm online-header |
Ghost: Authorization Bypass in Comment Like Feature BIT-ghost-2026-103288, CVE-2026-103288, GHSA-qrh6-cwg3-343x | High | 0.2% | 29 days ago | npm ghost |
Malicious release: Malicious code in @bluewin/utils (npm) MAL-2026-17437 | Malicious | Not scored | 29 days ago | npm @bluewin/utils |
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env CVE-2026-102992, GHSA-67c8-pqhq-4rmx | Critical | 0.5% | 29 days ago | npm piscina |
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) CVE-2026-102990, GHSA-c475-qrg2-pj4r | High | 0.4% | 29 days ago | npm basic-ftp |
Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters CVE-2026-101896, GHSA-ff3f-86qr-9cv3 | High | 0.8% | 30 Sep, 2026 | npm @angular/router |
DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS CVE-2026-109344, GHSA-p98j-92pf-mc4p | Medium | 0.2% | 30 Sep, 2026 | npm dompurify |
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges CVE-2026-101899, GHSA-44g4-m2mj-wpvx | Medium | 0.5% | 30 Sep, 2026 | npm axios |
Satori-generated SVG has improper escaping CVE-2026-94545, GHSA-wx4j-mvgx-mqwp | Medium | 1.1% | 30 Sep, 2026 | npm satori |
Astro: Malformed port in the Host header can crash the Node adapter CVE-2026-102984, GHSA-qh8j-hqjv-7m4x | High | 0.4% | 30 Sep, 2026 | npm @astrojs/node |
Astro: Netlify Image CDN allowlist bypass enables SSRF CVE-2026-102983, GHSA-4233-jc72-56c5 | Medium | 0.3% | 30 Sep, 2026 | npm @astrojs/netlify |
Next.js: Remote Code Execution in next/og ImageResponse GHSA-vcvr-r3jv-pc5j | Critical | Not scored | 30 Sep, 2026 | npm next |
Nest: Unbounded memory growth in the NestJS TCP microservice transport GHSA-96h4-vgxj-gvm2 | Medium | Not scored | 30 Sep, 2026 | npm @nestjs/microservices |
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets GHSA-9c5c-9qcx-q35q | High | Not scored | 30 Sep, 2026 | npm @nestjs/platform-fastify |
Malicious release: Malicious code in com.epi.e2e_test (npm) MAL-2026-17415 | Malicious | Not scored | 30 Sep, 2026 | npm com.epi.e2e_test |
Malicious release: Malicious code in @hanzofc/baileys (npm) MAL-2026-17354 | Malicious | Not scored | 30 Sep, 2026 | npm @hanzofc/baileys |
Malicious release: Malicious code in @japofc/baileys (npm) MAL-2026-17359 | Malicious | Not scored | 30 Sep, 2026 | npm @japofc/baileys |
Malicious release: Malicious code in @lendkzn/xntaabail (npm) MAL-2026-17364 | Malicious | Not scored | 30 Sep, 2026 | npm @lendkzn/xntaabail |
Malicious release: Malicious code in @levvicode/baileys (npm) MAL-2026-17366 | Malicious | Not scored | 30 Sep, 2026 | npm @levvicode/baileys |
Malicious release: Malicious code in @noxleyss/baileys (npm) MAL-2026-17369 | Malicious | Not scored | 30 Sep, 2026 | npm @noxleyss/baileys |
Malicious release: Malicious code in @nyzzpedia/baileys-new (npm) MAL-2026-17370 | Malicious | Not scored | 30 Sep, 2026 | npm @nyzzpedia/baileys-new |
Malicious release: Malicious code in @queenanya/baileys (npm) MAL-2026-17373 | Malicious | Not scored | 30 Sep, 2026 | npm @queenanya/baileys |