Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
ws: Uninitialized memory disclosure CVE-2026-45736, GHSA-58qx-3vcg-4xpx | High | 0.7% | 15 May, 2026 | npm ws |
smtp-server's command parser memory exhaustion denial-of-service CVE-2026-38728, GHSA-fv2f-rw9f-v9cm | High | 0.6% | 15 May, 2026 | npm smtp-server |
Malicious release: Malicious code in @datatrain/passenger-v3 (npm) MAL-2026-3802 | Malicious | Not scored | 15 May, 2026 | npm @datatrain/passenger-v3 |
Malicious release: Malicious code in dowload_ebok_como_leer_el_futbol_by_ruud_gullit_8qd97 (npm) GHSA-26wq-8rv4-pr98, MAL-2026-3795 | Malicious | Not scored | 15 May, 2026 | npm dowload_ebok_como_leer_el_futbol_by_ruud_gullit_8qd97 |
Malicious release: Malicious code in dowload_ebok_terra_incognita_urania_by_ian_mcdonald_um4vu (npm) GHSA-46mf-fcf5-frhf, MAL-2026-3798 | Malicious | Not scored | 15 May, 2026 | npm dowload_ebok_terra_incognita_urania_by_ian_mcdonald_um4vu |
Malicious release: Malicious code in dowload_ebok_also_an_octopus_by_maggie_tokuda_hall_ah2ip (npm) GHSA-5h56-6f6c-4m4f, MAL-2026-3794 | Malicious | Not scored | 15 May, 2026 | npm dowload_ebok_also_an_octopus_by_maggie_tokuda_hall_ah2ip |
Malicious release: Malicious code in dowload_ebok_the_testament_of_solomon_by_king_solomon_frederick_cornwallis_conybeare_5201c (npm) GHSA-cgc9-hq34-3978, MAL-2026-3799 | Malicious | Not scored | 15 May, 2026 | npm dowload_ebok_the_testament_of_solomon_by_king_solomon_frederick_cornwallis_conybeare_5201c |
Malicious release: Malicious code in the_secret_of_running_by_hans_van_dijk_ron_van_megen_02jsk (npm) GHSA-gqq6-4xhc-x38f, MAL-2026-3801 | Malicious | Not scored | 15 May, 2026 | npm the_secret_of_running_by_hans_van_dijk_ron_van_megen_02jsk |
Malicious release: Malicious code in dowload_ebok_stalking_jack_the_ripper_by_kerri_maniscalco_james_patterson_b529t (npm) GHSA-gx89-7jf6-wf89, MAL-2026-3797 | Malicious | Not scored | 15 May, 2026 | npm dowload_ebok_stalking_jack_the_ripper_by_kerri_maniscalco_james_patterson_b529t |
Malicious release: Malicious code in dowload_ebok_the_upside_of_unrequited_by_becky_albertalli_2jgmw (npm) GHSA-p3hv-ff6m-fcxx, MAL-2026-3800 | Malicious | Not scored | 15 May, 2026 | npm dowload_ebok_the_upside_of_unrequited_by_becky_albertalli_2jgmw |
Malicious release: Malicious code in dowload_ebok_los_enemigos_del_comercio_by_antonio_escohotado_6t2l4 (npm) GHSA-r33v-27px-qhf6, MAL-2026-3796 | Malicious | Not scored | 15 May, 2026 | npm dowload_ebok_los_enemigos_del_comercio_by_antonio_escohotado_6t2l4 |
Malicious release: Malicious code in browser-interaction-time-utils (npm) GHSA-39gr-8vr4-pr2p, MAL-2026-3786 | Malicious | Not scored | 15 May, 2026 | npm browser-interaction-time-utils |
Malicious release: Malicious code in jenkins-forge-utils (npm) GHSA-4w53-v6c9-xmmg, MAL-2026-3790 | Malicious | Not scored | 15 May, 2026 | npm jenkins-forge-utils |
Malicious release: Malicious code in jenkins-for-jira (npm) GHSA-5wcf-4xgg-jf7f, MAL-2026-3788 | Malicious | Not scored | 15 May, 2026 | npm jenkins-for-jira |
Malicious release: Malicious code in browser-interaction-time-demo (npm) GHSA-664m-cw9c-fqgv, MAL-2026-3785 | Malicious | Not scored | 15 May, 2026 | npm browser-interaction-time-demo |
Malicious release: Malicious code in atlassian-marathon-asset-pipeline (npm) GHSA-9gpq-xqfp-fc5x, MAL-2026-3782 | Malicious | Not scored | 15 May, 2026 | npm atlassian-marathon-asset-pipeline |
Malicious release: Malicious code in atlassian-jenkins-helper-utils (npm) GHSA-fv63-2mmg-59wx, MAL-2026-3781 | Malicious | Not scored | 15 May, 2026 | npm atlassian-jenkins-helper-utils |
Malicious release: Malicious code in marathon-assets (npm) GHSA-vm5r-rvm8-p85f, MAL-2026-3792 | Malicious | Not scored | 15 May, 2026 | npm marathon-assets |
Malicious release: Malicious code in jenkins-forge-app (npm) GHSA-vx6x-92w6-f9gc, MAL-2026-3789 | Malicious | Not scored | 15 May, 2026 | npm jenkins-forge-app |
Malicious release: Malicious code in json-pretty-logs (npm) GHSA-4gww-8cvc-jcx5, MAL-2026-3791 | Malicious | Not scored | 15 May, 2026 | npm json-pretty-logs |
Malicious release: Malicious code in babel-6-compatibility (npm) GHSA-g73c-gvfg-p745, MAL-2026-3783 | Malicious | Not scored | 15 May, 2026 | npm babel-6-compatibility |
Malicious release: Malicious code in babel-6-compatibility-utils (npm) GHSA-v7j4-27f9-8w4v, MAL-2026-3784 | Malicious | Not scored | 15 May, 2026 | npm babel-6-compatibility-utils |
Malicious release: Malicious code in simple-date-diff-utils (npm) GHSA-v86f-6r8q-pw54, MAL-2026-3793 | Malicious | Not scored | 15 May, 2026 | npm simple-date-diff-utils |
Malicious release: Malicious code in aliyun-internal-config (npm) GHSA-67cr-79v2-fp32, MAL-2026-3780 | Malicious | Not scored | 15 May, 2026 | npm aliyun-internal-config |
Malicious release: Malicious code in frank-at-alibaba-internal (npm) GHSA-hgq6-j7x3-3p37, MAL-2026-3787 | Malicious | Not scored | 15 May, 2026 | npm frank-at-alibaba-internal |
Malicious release: Malicious code in alicloud-pop-core (npm) GHSA-mm75-x3w9-c25r, MAL-2026-3779 | Malicious | Not scored | 15 May, 2026 | npm alicloud-pop-core |
Malicious release: Malicious code in cdp-core (npm) MAL-2026-3752 | Malicious | Not scored | 15 May, 2026 | npm cdp-core |
Malicious release: Malicious code in deepl-sync (npm) GHSA-qvrg-265v-cqvc, MAL-2026-3745 | Malicious | Not scored | 14 May, 2026 | npm deepl-sync |
@ranfdev/deepobj has a Prototype Pollution vulnerability CVE-2026-46509, GHSA-x7q7-fchv-8h2j | High | 0.3% | 14 May, 2026 | npm @ranfdev/deepobj |
@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol CVE-2026-45366, GHSA-r8j5-8747-88cm | Medium | 0.1% | 14 May, 2026 | npm @utcp/http |
@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation GHSA-wf8q-wvv8-p8jf | Critical | Not scored | 14 May, 2026 | npm @samanhappy/mcphub |
Svelte: SSR XSS via Insecure Promise Serialization in hydratable GHSA-f3cj-j4f6-wq85 | Medium | Not scored | 14 May, 2026 | npm svelte |
electerm's encrypt method not safe enough CVE-2026-45787, GHSA-g29v-q6h7-76wh | Medium | 0.1% | 14 May, 2026 | npm electerm |
Electerm Local code through electerm's single-instance socket CVE-2026-45353, GHSA-7p5m-v798-f8vv | Critical | 0.1% | 14 May, 2026 | npm electerm |
DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval CVE-2026-45311, GHSA-wx44-2q6h-j6p8 | Critical | 0.6% | 14 May, 2026 | crates.io deepseek-tui crates.io deepseek-tui-cli npm deepseek-tui |
DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool CVE-2026-45310, GHSA-96ff-gc8g-wpvg | High | 0.3% | 14 May, 2026 | crates.io deepseek-tui crates.io deepseek-tui-cli npm deepseek-tui |
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State CVE-2026-42573, GHSA-rcqx-6q8c-2c42 | Medium | 0.3% | 14 May, 2026 | npm svelte |
Svelte: ReDoS in `<svelte:element>` Tag Validation CVE-2026-42567, GHSA-9rmh-mm8f-r9h6 | Medium | 0.5% | 14 May, 2026 | npm svelte |
Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order CVE-2026-45665, GHSA-cqp4-qqvg-3787 | High | 0.3% | 14 May, 2026 | npm open-webui |
Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution CVE-2026-45395, GHSA-p4fx-23fq-jfg6 | High | 0.4% | 14 May, 2026 | npm open-webui |
Svelte devalue: DoS via sparse array deserialization CVE-2026-42570, GHSA-77vg-94rm-hx3p | High | 0.4% | 14 May, 2026 | npm devalue |
Open WebUI Has Stored Cross-Site Scripting in SVG Renderer CVE-2026-45346, GHSA-r29h-37fj-x2w6 | Medium | 0.2% | 14 May, 2026 | npm open-webui |
Svelte SSR vulnerable to cross-site scripting via spread attributes CVE-2026-42599, GHSA-pr6f-5x2q-rwfp | Medium | 0.2% | 14 May, 2026 | npm svelte |
Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark CVE-2026-45058, GHSA-jgg9-rw32-44pj | Critical | 0.2% | 14 May, 2026 | npm electerm |
Malicious release: Malicious code in @pelmnaads/naads-common-logger (npm) MAL-2026-3748 | Malicious | Not scored | 14 May, 2026 | npm @pelmnaads/naads-common-logger |
Malicious release: Malicious code in exxpress-tool (npm) MAL-2026-3762 | Malicious | Not scored | 14 May, 2026 | npm exxpress-tool |
Malicious release: Malicious code in sysbin (npm) MAL-2026-3773 | Malicious | Not scored | 14 May, 2026 | npm sysbin |
Malicious release: Malicious code in tsliverhome (npm) GHSA-pchc-8c97-59c8, MAL-2026-3775 | Malicious | Not scored | 14 May, 2026 | npm tsliverhome |
Malicious release: Malicious code in @webapp-next/store (npm) MAL-2026-3749 | Malicious | Not scored | 14 May, 2026 | npm @webapp-next/store |
Malicious release: Malicious code in request-logger-canary (npm) GHSA-hvf9-xwj5-pqqj, MAL-2026-3771 | Malicious | Not scored | 14 May, 2026 | npm request-logger-canary |