Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in joi-pack (npm) MAL-2026-3765 | Malicious | Not scored | 14 May, 2026 | npm joi-pack |
Malicious release: Malicious code in chai-as-regulated (npm) MAL-2026-3753 | Malicious | Not scored | 14 May, 2026 | npm chai-as-regulated |
Malicious release: Malicious code in prisma-callback (npm) GHSA-rj6f-xp57-j95c, MAL-2026-3770 | Malicious | Not scored | 14 May, 2026 | npm prisma-callback |
Malicious release: Malicious code in node-ci-utils (npm) MAL-2026-3767 | Malicious | Not scored | 14 May, 2026 | npm node-ci-utils |
Malicious release: Malicious code in ethers-abstract-signer (npm) GHSA-2f7m-g9qw-8288, MAL-2026-3760 | Malicious | Not scored | 14 May, 2026 | npm ethers-abstract-signer |
Malicious release: Malicious code in typography-stylecss (npm) MAL-2026-3776 | Malicious | Not scored | 14 May, 2026 | npm typography-stylecss |
Malicious release: Malicious code in claw-subagent-service (npm) MAL-2026-3757 | Malicious | Not scored | 14 May, 2026 | npm claw-subagent-service |
Malicious release: Malicious code in prettier-lint-lenz (npm) GHSA-8558-w8j5-67wq, MAL-2026-3769 | Malicious | Not scored | 14 May, 2026 | npm prettier-lint-lenz |
Malicious release: Malicious code in glob-helper (npm) MAL-2026-3764 | Malicious | Not scored | 14 May, 2026 | npm glob-helper |
Malicious release: Malicious code in cache-poisoning-pwn-demo (npm) MAL-2026-3751 | Malicious | Not scored | 14 May, 2026 | npm cache-poisoning-pwn-demo |
Malicious release: Malicious code in ethers-signing-key (npm) GHSA-4h8m-265v-jp4c, MAL-2026-3761 | Malicious | Not scored | 14 May, 2026 | npm ethers-signing-key |
Malicious release: Malicious code in exxpress-utils (npm) MAL-2026-3763 | Malicious | Not scored | 14 May, 2026 | npm exxpress-utils |
Malicious release: Malicious code in ts-build-optimize (npm) GHSA-c22w-53x6-4jf5, MAL-2026-3774 | Malicious | Not scored | 14 May, 2026 | npm ts-build-optimize |
Malicious release: Malicious code in rimraf-utils (npm) MAL-2026-3772 | Malicious | Not scored | 14 May, 2026 | npm rimraf-utils |
Malicious release: Malicious code in nock-helper (npm) MAL-2026-3766 | Malicious | Not scored | 14 May, 2026 | npm nock-helper |
Malicious release: Malicious code in npmjs_web3-util (npm) GHSA-qjvc-v9v6-xh96, MAL-2026-3768 | Malicious | Not scored | 14 May, 2026 | npm npmjs_web3-util |
Malicious release: Malicious code in chalk-utils (npm) MAL-2026-3755 | Malicious | Not scored | 14 May, 2026 | npm chalk-utils |
Malicious release: Malicious code in bigint.fs (npm) GHSA-pcvf-7w5m-j39j, MAL-2026-3750 | Malicious | Not scored | 14 May, 2026 | npm bigint.fs |
Malicious release: Malicious code in cheerio-tool (npm) MAL-2026-3756 | Malicious | Not scored | 14 May, 2026 | npm cheerio-tool |
Malicious release: Malicious code in chalk-pack (npm) MAL-2026-3754 | Malicious | Not scored | 14 May, 2026 | npm chalk-pack |
Malicious release: Malicious code in env-threads (npm) MAL-2026-3759 | Malicious | Not scored | 14 May, 2026 | npm env-threads |
Malicious release: Malicious code in dotenvv-tool (npm) MAL-2026-3758 | Malicious | Not scored | 14 May, 2026 | npm dotenvv-tool |
Malicious release: Malicious code in @aiscene/aiserver (npm) MAL-2026-3747 | Malicious | Not scored | 14 May, 2026 | npm @aiscene/aiserver |
Apostrophe has stored XSS via javascript: URL in Image Widget Link CVE-2026-45011, GHSA-5f64-7vfc-rcx6 | High | 0.3% | 14 May, 2026 | npm apostrophe |
Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation CVE-2026-45013, GHSA-gf43-24g3-5hw2 | High | 0.3% | 14 May, 2026 | npm apostrophe |
Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget CVE-2026-45012, GHSA-pr28-mf3q-qpg6 | High | 0.2% | 14 May, 2026 | npm apostrophe |
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` CVE-2026-44990, GHSA-rpr9-rxv7-x643 | Critical | 0.7% | 14 May, 2026 | npm sanitize-html |
Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections GHSA-7rx4-c5vx-g8w3 | High | Not scored | 14 May, 2026 | npm @karakeep/sdk |
Malicious release: Malicious code in node-ipc (npm) GHSA-pvh2-rg5g-69v7, MAL-2026-3744 | Malicious | Not scored | 14 May, 2026 | npm node-ipc |
TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function GHSA-9m65-766c-r333 | Medium | Not scored | 14 May, 2026 | npm @tanstack/start-server-core |
FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover CVE-2026-46480, GHSA-wxrr-jp8m-qq7f | High | 0.3% | 14 May, 2026 | npm flowise |
FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover CVE-2026-46479, GHSA-mq53-pc65-wjc4 | High | 0.3% | 14 May, 2026 | npm flowise |
FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover CVE-2026-46478, GHSA-7j65-65cr-6644 | High | 0.3% | 14 May, 2026 | npm flowise |
FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover CVE-2026-46477, GHSA-5h9v-837x-m97r | High | 0.3% | 14 May, 2026 | npm flowise |
FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover CVE-2026-46476, GHSA-728h-4mwj-f2p4 | High | 0.3% | 14 May, 2026 | npm flowise |
FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover CVE-2026-46475, GHSA-78pr-c5x5-jggc | High | 0.3% | 14 May, 2026 | npm flowise |
FlowiseAI: Vector Store No Permission Checks CVE-2026-46444, GHSA-hmg2-jjjx-jcp2 | High | 0.3% | 14 May, 2026 | npm flowise |
n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints CVE-2026-45732, GHSA-6h4j-wcr9-2vg7 | High | 0.4% | 14 May, 2026 | npm n8n |
n8n Has a Source Control Pull SQL Injection CVE-2026-44792, GHSA-mhrx-qhrj-673w | High | 0.4% | 14 May, 2026 | npm n8n |
n8n Has an XML Node Prototype Pollution Patch Bypass CVE-2026-44791, GHSA-wrwr-h859-xh2r | Critical | 0.5% | 14 May, 2026 | npm n8n |
n8n Has an Arbitrary File Read via Git Node CVE-2026-44790, GHSA-57g9-58c2-xjg3 | Critical | 0.5% | 14 May, 2026 | npm n8n |
n8n: HTTP Request Node Pagination Prototype Pollution to RCE CVE-2026-44789, GHSA-c8xv-5998-g76h | Critical | 0.5% | 14 May, 2026 | npm n8n |
@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input CVE-2026-42853, GHSA-hcwq-x9fw-8cfq | Medium | 0.5% | 14 May, 2026 | npm @apostrophecms/cli |
Malicious release: Malicious code in sol-coverage (npm) GHSA-2vvj-3f2x-2mc8, MAL-2026-3734 | Malicious | Not scored | 14 May, 2026 | npm sol-coverage |
Malicious release: Malicious code in deltaprime-primeloans (npm) GHSA-6g47-m62r-7wj3, MAL-2026-3725 | Malicious | Not scored | 14 May, 2026 | npm deltaprime-primeloans |
Malicious release: Malicious code in viem-helpers (npm) GHSA-6j7v-gxjq-5vcx, MAL-2026-3738 | Malicious | Not scored | 14 May, 2026 | npm viem-helpers |
Malicious release: Malicious code in solidity-linter (npm) GHSA-92cg-ff5w-63xq, MAL-2026-3736 | Malicious | Not scored | 14 May, 2026 | npm solidity-linter |
Malicious release: Malicious code in mrgn-utils (npm) GHSA-99vf-q329-gx7v, MAL-2026-3733 | Malicious | Not scored | 14 May, 2026 | npm mrgn-utils |
Malicious release: Malicious code in mrgn-ui (npm) GHSA-f57p-w8xr-mc5m, MAL-2026-3732 | Malicious | Not scored | 14 May, 2026 | npm mrgn-ui |
Malicious release: Malicious code in mrgn-common (npm) GHSA-gf4w-q3vx-9xj2, MAL-2026-3731 | Malicious | Not scored | 14 May, 2026 | npm mrgn-common |