Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
cap-go/capacitor-native-biometric Authentication Bypass CVE-2026-56294, GHSA-vx5f-vmr6-32wf | Medium | 0.2% | 10 Feb, 2026 | npm @capgo/capacitor-native-biometric |
Cube Core is vulnerable to Denial of Service (DoS) via crafted request CVE-2026-25957, GHSA-9vph-2hvm-x66g | Medium | 0.4% | 09 Feb, 2026 | npm @cubejs-backend/server-core |
unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command) CVE-2026-25918, GHSA-4255-c27h-62m5 | Medium | 0.2% | 09 Feb, 2026 | npm @rage-against-the-pixel/unity-cli |
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection CVE-2026-25528, GHSA-v34v-rq6j-cj6p, PYSEC-2026-2584 | Medium | 0.3% | 09 Feb, 2026 | PyPI langsmith npm langsmith |
mcp-maigret vulnerable to command injection CVE-2026-2130, GHSA-2g7v-hghf-grg4 | Medium | 2.0% | 08 Feb, 2026 | npm mcp-maigret |
client-certificate-auth Vulnerable to Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect CVE-2026-25651, GHSA-m4w9-gch5-c2g4 | Medium | 0.2% | 06 Feb, 2026 | npm client-certificate-auth |
SCEditor has DOM XSS via emoticon URL/HTML injection CVE-2026-25581, GHSA-25fq-6qgg-qpj8 | Medium | 0.2% | 06 Feb, 2026 | npm sceditor |
payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments) CVE-2026-25574, GHSA-jq29-r496-r955 | Medium | 0.2% | 05 Feb, 2026 | npm payload |
Sandbox escape via infinite recursion and error objects CVE-2026-25533, GHSA-x39w-8vm5-5m3p | Medium | 0.3% | 05 Feb, 2026 | npm @enclave-vm/core npm enclave-vm |
n8n's domain allowlist bypass enables credential exfiltration CVE-2026-25631, GHSA-2xcx-75h9-vr9h | Medium | 0.3% | 04 Feb, 2026 | npm n8n |
OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction CVE-2026-25475, GHSA-r8g4-86fx-92mq | Medium | 0.8% | 04 Feb, 2026 | npm openclaw |
Qwik City has a CSRF Protection Bypass via Content-Type Header Validation CVE-2026-25151, GHSA-r666-8gjf-4v5f | Medium | 0.2% | 03 Feb, 2026 | npm @builder.io/qwik-city |
Qwik SSR XSS via Unsafe Virtual Node Serialization CVE-2026-25148, GHSA-m6jq-g7gq-5w3c | Medium | 0.4% | 03 Feb, 2026 | npm @builder.io/qwik-city |
Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing CVE-2026-1664, GHSA-r7x9-8ph7-w8cg | Medium | 0.5% | 03 Feb, 2026 | npm agents |
SignalK Server has Path Traversal leading to information disclosure CVE-2026-25228, GHSA-vrhw-v2hw-jffx | Medium | 0.4% | 02 Feb, 2026 | npm signalk-server |
jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation) CVE-2026-24043, GHSA-vm32-vv63-w422 | Medium | 0.3% | 02 Feb, 2026 | npm jspdf |
jsPDF has Shared State Race Condition in addJS Plugin CVE-2026-24040, GHSA-cjw8-79x6-5cj4 | Medium | 0.3% | 02 Feb, 2026 | npm jspdf |
@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator CVE-2026-25152, GHSA-w669-jj7h-88m9 | Medium | 0.4% | 30 Jan, 2026 | npm @backstage/plugin-techdocs-node |
LobeHub Vulnerable to Improper Authorization in Presigned Upload CVE-2026-23835, GHSA-wrrr-8jcv-wjf5 | Medium | 0.4% | 30 Jan, 2026 | npm @lobehub/chat |
NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter CVE-2026-24768, GHSA-3hmw-8mw3-rmpj | Medium | 0.3% | 28 Jan, 2026 | npm nocodb |
NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality CVE-2026-24767, GHSA-xr7v-j379-34v9 | Medium | 0.2% | 28 Jan, 2026 | npm nocodb |
NocoDB has Prototype Pollution in Connection Test Endpoint, Leading to DoS CVE-2026-24766, GHSA-95ff-46g6-6gw9 | Medium | 0.4% | 28 Jan, 2026 | npm nocodb |
vlt Mishandles Path Sanitization for tar CVE-2026-24909, GHSA-gf2c-jwcj-x929 | Medium | 0.2% | 27 Jan, 2026 | npm @vltpkg/tar |
StudioCMS has Authorization Bypass Through User-Controlled Key CVE-2026-24134, GHSA-8cw6-53m5-4932 | Medium | 0.3% | 27 Jan, 2026 | npm studiocms |
Hono vulnerable to XSS through ErrorBoundary component CVE-2026-24771, GHSA-9r54-q6cx-xmh5 | Medium | 0.4% | 27 Jan, 2026 | npm hono |
Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) CVE-2026-24473, GHSA-w332-q679-j88p | Medium | 0.5% | 27 Jan, 2026 | npm hono |
Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception CVE-2026-24472, GHSA-6wqw-2p9w-4vw4 | Medium | 0.5% | 27 Jan, 2026 | npm hono |
Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing CVE-2026-24398, GHSA-r354-f388-2fhh | Medium | 0.3% | 27 Jan, 2026 | npm hono |
pnpm has Path Traversal via arbitrary file permission modification CVE-2026-24131, GHSA-v253-rj99-jwpq | Medium | 0.3% | 26 Jan, 2026 | npm pnpm |
pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip) CVE-2026-23888, GHSA-6pfh-p556-v868 | Medium | 0.5% | 26 Jan, 2026 | npm pnpm |
pnpm has Windows-specific tarball Path Traversal CVE-2026-23889, GHSA-6x96-7vc8-cm3p | Medium | 0.5% | 26 Jan, 2026 | npm pnpm |
pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin CVE-2026-23890, GHSA-xpqm-wm3m-f34h | Medium | 0.5% | 26 Jan, 2026 | npm pnpm |
pnpm has symlink traversal in file:/git dependencies CVE-2026-24056, GHSA-m733-5w8f-5ggw | Medium | 0.5% | 26 Jan, 2026 | npm pnpm |
Withdrawn Advisory: eslint has a Stack Overflow when serializing objects with circular references CVE-2025-50537, GHSA-p5wg-g6qr-c7cg | Medium | 0.2% | 26 Jan, 2026 | npm eslint |
@backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass CVE-2026-24047, GHSA-2p49-45hj-7mc9 | Medium | 0.5% | 21 Jan, 2026 | npm @backstage/cli-common |
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions CVE-2025-13465, GHSA-xxjr-mmjv-4gpg | Medium | 1.8% | 21 Jan, 2026 | npm lodash npm lodash-amd npm lodash-es npm lodash.unset |
Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation CVE-2026-21852, GHSA-jh7p-qr78-84p7 | Medium | 27.5% | 21 Jan, 2026 | npm @anthropic-ai/claude-code |
binary-parser library has a code injection vulnerability CVE-2026-1245, GHSA-m39p-34qh-rh3w | Medium | 0.6% | 20 Jan, 2026 | npm binary-parser |
Turbo Frame responses can restore stale session cookies CVE-2025-66803, GHSA-qppm-g56g-fpvp | Medium | 0.3% | 20 Jan, 2026 | npm @hotwired/turbo |
Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM GHSA-38cw-85xc-xr9x | Medium | Not scored | 16 Jan, 2026 | npm @veramo/data-store |
Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability CVE-2025-15104, GHSA-fccg-7w3p-w66f | Medium | 0.5% | 16 Jan, 2026 | Maven nu.validator:validator npm vnu-jar |
Pepr Has Overly Permissive RBAC ClusterRole in Admin Mode CVE-2026-23634, GHSA-w54x-r83c-x79q | Medium | 0.2% | 15 Jan, 2026 | npm pepr |
svelte vulnerable to Cross-site Scripting CVE-2025-15265, GHSA-6738-r8g5-qwp3 | Medium | 0.3% | 15 Jan, 2026 | npm svelte |
Outray cli is vulnerable to race conditions in tunnels creation CVE-2026-22820, GHSA-3pqc-836w-jgr7 | Medium | 0.2% | 13 Jan, 2026 | npm outray |
Outray has a Race Condition in the cli's webapp CVE-2026-22819, GHSA-45hj-9x76-wp9g | Medium | 0.2% | 13 Jan, 2026 | npm outray |
Quill is vulnerable to XSS via HTML export feature CVE-2025-15056, GHSA-v3m3-f69x-jf25 | Medium | 0.3% | 13 Jan, 2026 | npm quill |
tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability CVE-2026-22809, GHSA-q5f6-qxm2-mcqm | Medium | 0.1% | 13 Jan, 2026 | npm tarteaucitronjs |
n8n: Webhook Node IP Whitelist Bypass via Partial String Matching CVE-2025-68949, GHSA-w96v-gf22-crwp | Medium | 0.3% | 13 Jan, 2026 | npm n8n |
Ghost has SSRF via External Media Inliner BIT-ghost-2026-22597, CVE-2026-22597, GHSA-vmc4-9828-r48r | Medium | 0.3% | 08 Jan, 2026 | npm ghost |
Elliptic Uses a Cryptographic Primitive with a Risky Implementation CVE-2025-14505, GHSA-848j-6mx2-7j84 | Medium | 0.2% | 08 Jan, 2026 | npm elliptic |