Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in marginfi-client-v2 (npm) GHSA-mg4f-cqgw-456w, MAL-2026-3729 | Malicious | Not scored | 14 May, 2026 | npm marginfi-client-v2 |
Malicious release: Malicious code in marginfi-v2-ui-state (npm) GHSA-wqj8-2fc2-qmv5, MAL-2026-3730 | Malicious | Not scored | 14 May, 2026 | npm marginfi-v2-ui-state |
Malicious release: Malicious code in hardhat-core-utils (npm) GHSA-h9fg-9ffp-7m86, MAL-2026-3728 | Malicious | Not scored | 14 May, 2026 | npm hardhat-core-utils |
Malicious release: Malicious code in evm-utils (npm) GHSA-pg4w-crfc-wrmq, MAL-2026-3726 | Malicious | Not scored | 14 May, 2026 | npm evm-utils |
Malicious release: Malicious code in solidity-lib (npm) GHSA-rmqj-f2pw-q258, MAL-2026-3735 | Malicious | Not scored | 14 May, 2026 | npm solidity-lib |
Malicious release: Malicious code in web3-utils-core (npm) GHSA-xmv4-ff4p-v7fp, MAL-2026-3740 | Malicious | Not scored | 14 May, 2026 | npm web3-utils-core |
Malicious release: Malicious code in foundry-utils (npm) GHSA-2v87-4h57-69g2, MAL-2026-3727 | Malicious | Not scored | 14 May, 2026 | npm foundry-utils |
Malicious release: Malicious code in viem-utils-core (npm) GHSA-8fj3-3mhp-6qr2, MAL-2026-3739 | Malicious | Not scored | 14 May, 2026 | npm viem-utils-core |
Malicious release: Malicious code in viem-core (npm) GHSA-v37v-hv8c-27c6, MAL-2026-3737 | Malicious | Not scored | 14 May, 2026 | npm viem-core |
dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport CVE-2026-42559, GHSA-89vp-x53w-74fx, GHSA-fvh2-gm75-j4j7, RUSTSEC-2026-0140, RUSTSEC-2026-0189 | High | 0.3% | 14 May, 2026 | crates.io dynoxide-rs npm dynoxide |
FlowiseAI Vulnerable to Credential Data Leak CVE-2026-46443, GHSA-7g73-99r4-m4mj | High | 0.3% | 14 May, 2026 | npm flowise |
FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape CVE-2026-46442, GHSA-9rvc-vf7m-pgm2 | Critical | 33.0% | 14 May, 2026 | npm flowise |
FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment CVE-2026-46441, GHSA-hp26-q66v-q2w7 | High | 0.3% | 14 May, 2026 | npm flowise |
Flowise has an MCP Security Bypass that Enables RCE CVE-2026-56274, GHSA-m99r-2hxc-cp3q | High | 7.5% | 14 May, 2026 | npm flowise npm flowise-components |
FlowiseAI Exposes Basic Auth Credentials via API CVE-2026-46440, GHSA-php6-83fg-gw3g | Critical | 0.2% | 14 May, 2026 | npm flowise |
FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment CVE-2026-42863, GHSA-5wxp-qjgq-fx6m | High | 0.3% | 14 May, 2026 | npm flowise |
FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment CVE-2026-42862, GHSA-x5v6-pj28-cwwm | High | 0.2% | 14 May, 2026 | npm flowise |
FlowiseAI has Mass Assignment in Variable Update Endpoint that Allows Cross-Workspace Resource Reassignment CVE-2026-42861, GHSA-6fw7-3q8r-m5vj | High | 0.3% | 14 May, 2026 | npm flowise |
Strapi may leak sensitive data via relational filtering due to lack of query sanitization CVE-2026-27886, GHSA-rjg2-95x7-8qmx | Critical | 1.9% | 14 May, 2026 | npm @strapi/strapi |
Strapi Upload Plugin MIME Validation Bypass via Content API CVE-2026-22707, GHSA-pcw7-5633-82vv | Medium | 0.2% | 14 May, 2026 | npm @strapi/upload |
Malicious release: Malicious code in @convera/ui-shared (npm) GHSA-wc9j-96q7-v8pq, MAL-2026-3724 | Malicious | Not scored | 14 May, 2026 | npm @convera/ui-shared |
Malicious release: Malicious code in npmjs_ethers-common (npm) GHSA-xjqh-ppr3-mrhj, MAL-2026-3721 | Malicious | Not scored | 13 May, 2026 | npm npmjs_ethers-common |
Malicious release: Malicious code in npmjs_solc-helper (npm) GHSA-83h3-h848-fqr8, MAL-2026-3723 | Malicious | Not scored | 13 May, 2026 | npm npmjs_solc-helper |
Malicious release: Malicious code in npmjs_hardhat-common (npm) GHSA-6w5w-56vc-rg6h, MAL-2026-3722 | Malicious | Not scored | 13 May, 2026 | npm npmjs_hardhat-common |
Malicious release: Malicious code in ethers-wordlist (npm) GHSA-jrxm-h3fx-2p68, MAL-2026-3720 | Malicious | Not scored | 13 May, 2026 | npm ethers-wordlist |
Malicious release: Malicious code in ethers-web (npm) MAL-2026-3711 | Malicious | Not scored | 13 May, 2026 | npm ethers-web |
Malicious release: Malicious code in ethers-json-wallet (npm) MAL-2026-3709 | Malicious | Not scored | 13 May, 2026 | npm ethers-json-wallet |
Malicious release: Malicious code in ethers-logger (npm) MAL-2026-3710 | Malicious | Not scored | 13 May, 2026 | npm ethers-logger |
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions CVE-2026-22706, GHSA-hvp3-26wx-g2w4 | Low | 0.3% | 13 May, 2026 | npm @strapi/admin npm @strapi/plugin-users-permissions |
Strapi Vulnerable to SQL Injection in Content Type Builder CVE-2026-22599, GHSA-3xcq-8mjw-h6mx | Critical | 1.2% | 13 May, 2026 | npm @strapi/content-type-builder npm @strapi/plugin-content-type-builder |
Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying CVE-2025-64526, GHSA-7mqx-wwh4-f9fw | Medium | 0.5% | 13 May, 2026 | npm @strapi/plugin-users-permissions |
vm2 Has a Sandbox Breakout Using Async Generator CVE-2026-45411, GHSA-248r-7h7q-cr24 | Critical | 0.6% | 13 May, 2026 | npm vm2 |
Malicious release: Malicious code in chia-network (npm) MAL-2026-3663 | Malicious | Not scored | 13 May, 2026 | npm chia-network |
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion CVE-2026-45740, GHSA-jggg-4jg4-v7c6 | High | 0.3% | 13 May, 2026 | npm protobufjs |
claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh CVE-2026-45136, GHSA-g3xq-3gmv-qq8g | High | 0.2% | 13 May, 2026 | npm claude-code-cache-fix |
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning CVE-2026-45134, GHSA-3644-q5cj-c5c7, PYSEC-2026-2555, PYSEC-2026-2560, PYSEC-2026-2582 | High | 0.2% | 13 May, 2026 | PyPI langchain PyPI langchain-classic PyPI langsmith npm langsmith |
Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name CVE-2026-44724, GHSA-hvx9-hwr7-wjj9 | High | 0.9% | 13 May, 2026 | npm systeminformation |
Malicious release: Malicious code in load-bufferjs (npm) GHSA-95gm-9mgw-p2cf, MAL-2026-3658 | Malicious | Not scored | 13 May, 2026 | npm load-bufferjs |
Malicious release: Malicious code in buffer-export (npm) GHSA-w8m4-mmqv-qq77, MAL-2026-3656 | Malicious | Not scored | 13 May, 2026 | npm buffer-export |
Malicious release: Malicious code in chai-as-streamed (npm) GHSA-r2pr-8h52-3v7x, MAL-2026-3657 | Malicious | Not scored | 13 May, 2026 | npm chai-as-streamed |
Malicious release: Malicious code in hello-world-pkg-value-value-p (npm) MAL-2026-3714 | Malicious | Not scored | 13 May, 2026 | npm hello-world-pkg-value-value-p |
Malicious release: Malicious code in truffle-js (npm) MAL-2026-3717 | Malicious | Not scored | 13 May, 2026 | npm truffle-js |
Malicious release: Malicious code in hardhat-common (npm) MAL-2026-3712 | Malicious | Not scored | 13 May, 2026 | npm hardhat-common |
Malicious release: Malicious code in hardhat-core (npm) MAL-2026-3713 | Malicious | Not scored | 13 May, 2026 | npm hardhat-core |
Malicious release: Malicious code in ethers-io (npm) MAL-2026-3708 | Malicious | Not scored | 13 May, 2026 | npm ethers-io |
Malicious release: Malicious code in solc-helper (npm) MAL-2026-3715 | Malicious | Not scored | 13 May, 2026 | npm solc-helper |
Malicious release: Malicious code in ethers-common (npm) MAL-2026-3707 | Malicious | Not scored | 13 May, 2026 | npm ethers-common |
Malicious release: Malicious code in truffle-helper (npm) MAL-2026-3716 | Malicious | Not scored | 13 May, 2026 | npm truffle-helper |
Malicious release: Malicious code in web3-common (npm) MAL-2026-3718 | Malicious | Not scored | 13 May, 2026 | npm web3-common |
Malicious release: Malicious code in web3-core-js (npm) MAL-2026-3719 | Malicious | Not scored | 13 May, 2026 | npm web3-core-js |