Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in vue-template-compiler-plugin (npm) GHSA-gvmg-cf54-7769, MAL-2026-3777 | Malicious | Not scored | 13 May, 2026 | npm vue-template-compiler-plugin |
Malicious release: Malicious code in @dropout-ai/runtime (npm) MAL-2026-3683 | Malicious | Not scored | 13 May, 2026 | npm @dropout-ai/runtime |
Malicious release: Malicious code in @design-system-coopeuch/web (npm) GHSA-vhjp-6vjm-vq35, MAL-2026-3653 | Malicious | Not scored | 13 May, 2026 | npm @design-system-coopeuch/web |
OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover CVE-2026-44720, GHSA-223g-f5mq-gw33 | Medium | 0.2% | 13 May, 2026 | npm openlearnx |
Astro: Server island encrypted parameters vulnerable to cross-component replay CVE-2026-45028, GHSA-xr5h-phrj-8vxv | Low | 0.1% | 13 May, 2026 | npm astro |
Malicious release: Malicious code in auth-javascript (npm) MAL-2026-3648 | Malicious | Not scored | 13 May, 2026 | npm auth-javascript |
Malicious release: Malicious code in iceberg-javascript (npm) MAL-2026-3649 | Malicious | Not scored | 13 May, 2026 | npm iceberg-javascript |
Malicious release: Malicious code in microsoft-applicationinsights-common (npm) MAL-2026-3650 | Malicious | Not scored | 13 May, 2026 | npm microsoft-applicationinsights-common |
Malicious release: Malicious code in ms-graph-types (npm) MAL-2026-3651 | Malicious | Not scored | 13 May, 2026 | npm ms-graph-types |
Malicious release: Malicious code in supabase-javascript (npm) MAL-2026-3652 | Malicious | Not scored | 13 May, 2026 | npm supabase-javascript |
SillyTavern has a SSRF vulnerability in the CORS proxy middleware CVE-2026-44652, GHSA-ccfq-2454-f5xw | Medium | 0.4% | 12 May, 2026 | npm sillytavern |
SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware CVE-2026-44651, GHSA-xc4x-2452-5gc9 | Medium | 0.3% | 12 May, 2026 | npm sillytavern |
SillyTavern has a Path Traversal issue CVE-2026-44650, GHSA-886q-f44j-h6wh | Critical | 0.6% | 12 May, 2026 | npm sillytavern |
SillyTavern has Authentication Bypass via SSO Header Injection CVE-2026-44649, GHSA-gxx6-h3g6-vwjh | Critical | 0.2% | 12 May, 2026 | npm sillytavern |
SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover CVE-2026-44648, GHSA-wmm3-h9qj-p5v6 | High | 0.4% | 12 May, 2026 | npm sillytavern |
Malicious release: Malicious code in @gusmano/reext (npm) MAL-2026-3684 | Malicious | Not scored | 12 May, 2026 | npm @gusmano/reext |
Malicious release: Malicious code in afk-react-intl (npm) MAL-2026-3616 | Malicious | Not scored | 12 May, 2026 | npm afk-react-intl |
Malicious release: Malicious code in katal-platform-versions (npm) MAL-2026-3617 | Malicious | Not scored | 12 May, 2026 | npm katal-platform-versions |
Malicious release: Malicious code in @a91082900/test_package (npm) MAL-2026-3680 | Malicious | Not scored | 12 May, 2026 | npm @a91082900/test_package |
Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page CVE-2025-65719, GHSA-94gr-w3q5-rfqr, PYSEC-2026-371 | Critical | 0.6% | 12 May, 2026 | PyPI kubectl-mcp-server npm kubectl-mcp-server |
Malicious release: Malicious code in aoflmkt (npm) MAL-2026-3614 | Malicious | Not scored | 12 May, 2026 | npm aoflmkt |
OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input CVE-2026-42074, GHSA-m77w-p5jj-xmhg | Critical | 0.6% | 12 May, 2026 | npm openclaude |
OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS CVE-2026-42073, GHSA-c73c-x77g-854r | Medium | 0.3% | 12 May, 2026 | npm @gitlawb/openclaude |
protobuf.js: Code injection in pbjs static output from crafted schema names CVE-2026-44295, GHSA-6r35-46g8-jcw9 | High | 0.4% | 12 May, 2026 | npm protobufjs-cli |
protobuf.js: Denial of service from crafted field names in generated code CVE-2026-44294, GHSA-2pr8-phx7-x9h3 | Medium | 0.4% | 12 May, 2026 | npm protobufjs |
protobuf.js: Code injection through bytes field defaults in generated toObject code CVE-2026-44293, GHSA-66ff-xgx4-vchm | High | 0.4% | 12 May, 2026 | npm protobufjs |
protobuf.js: Prototype injection in generated message constructors CVE-2026-44292, GHSA-fx83-v9x8-x52w | Medium | 0.3% | 12 May, 2026 | npm protobufjs |
protobuf.js: Code generation gadget after prototype pollution CVE-2026-44291, GHSA-75px-5xx7-5xc7 | High | 0.5% | 12 May, 2026 | npm protobufjs |
protobuf.js: Process-wide denial of service through unsafe option paths CVE-2026-44290, GHSA-jvwf-75h9-cwgg | High | 0.4% | 12 May, 2026 | npm protobufjs |
protobuf.js: Denial of service through unbounded protobuf recursion CVE-2026-44289, GHSA-685m-2w69-288q | High | 0.6% | 12 May, 2026 | npm protobufjs |
protobufjs has overlong UTF-8 decoding CVE-2026-44288, GHSA-q6x5-8v7m-xcrf | Medium | 0.3% | 12 May, 2026 | npm @protobufjs/utf8 npm protobufjs |
protobuf.js is Vulnerable to OS Command Injection in the CLI CVE-2026-42290, GHSA-f84p-cvgm-xgjj | High | 0.1% | 12 May, 2026 | npm protobufjs-cli |
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode) CVE-2026-45091, GHSA-x3r2-fj3r-g5mv | Critical | 0.3% | 12 May, 2026 | Maven io.github.davidalmeidac:sealed-env-core npm sealed-env |
Malicious release: Malicious code in aoflcorp (npm) MAL-2026-3613 | Malicious | Not scored | 12 May, 2026 | npm aoflcorp |
Malicious release: Malicious code in jwscube (npm) GHSA-69rh-554m-m3w8, MAL-2026-3612 | Malicious | Not scored | 12 May, 2026 | npm jwscube |
Malicious release: Malicious code in justenv (npm) GHSA-fm9w-85jx-h7r4, MAL-2026-3611 | Malicious | Not scored | 12 May, 2026 | npm justenv |
Malicious release: Malicious code in mimecast-web-components (npm) MAL-2026-3618 | Malicious | Not scored | 12 May, 2026 | npm mimecast-web-components |
multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing CVE-2026-8162, GHSA-xh3c-6gcq-g4rv | High | 0.3% | 12 May, 2026 | npm multiparty |
multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception CVE-2026-8161, GHSA-qxch-whhj-8956 | High | 0.5% | 12 May, 2026 | npm multiparty |
multiparty vulnerable to ReDoS via filename parsing CVE-2026-8159, GHSA-65x3-rw7q-gx94 | High | 0.3% | 12 May, 2026 | npm multiparty |
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins CVE-2026-6402, GHSA-79cf-xcqc-c78w | Medium | 0.3% | 12 May, 2026 | npm webpack-dev-server |
Malicious release: Malicious code in 88q (npm) MAL-2026-3676 | Malicious | Not scored | 12 May, 2026 | npm 88q |
Malicious release: Malicious code in 66o (npm) MAL-2026-3674 | Malicious | Not scored | 12 May, 2026 | npm 66o |
Malicious release: Malicious code in 6cc (npm) MAL-2026-3675 | Malicious | Not scored | 12 May, 2026 | npm 6cc |
Malicious release: Malicious code in 0xegg2024 (npm) MAL-2026-3668 | Malicious | Not scored | 12 May, 2026 | npm 0xegg2024 |
Malicious release: Malicious code in @catamania/ui-components (npm) MAL-2026-3681 | Malicious | Not scored | 12 May, 2026 | npm @catamania/ui-components |
Malicious release: Malicious code in 01-0redi7qgbz0uv (npm) MAL-2026-3666 | Malicious | Not scored | 12 May, 2026 | npm 01-0redi7qgbz0uv |
Malicious release: Malicious code in 8q (npm) MAL-2026-3678 | Malicious | Not scored | 12 May, 2026 | npm 8q |
Malicious release: Malicious code in 100jsss (npm) MAL-2026-3669 | Malicious | Not scored | 12 May, 2026 | npm 100jsss |
Malicious release: Malicious code in 1mi (npm) MAL-2026-3672 | Malicious | Not scored | 12 May, 2026 | npm 1mi |