Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @tanstack/start-server-core (npm) GHSA-gg66-jfg8-rcgq, MAL-2026-3490 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/start-server-core |
Malicious release: Malicious code in @tanstack/start-static-server-functions (npm) GHSA-r9g7-9xhm-p5qp, MAL-2026-3491 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/start-static-server-functions |
Malicious release: Malicious code in @tanstack/start-storage-context (npm) GHSA-66j2-5c8h-j3f7, MAL-2026-3492 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/start-storage-context |
Malicious release: Malicious code in @tanstack/valibot-adapter (npm) GHSA-wvhh-9pj7-jw99, MAL-2026-3493 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/valibot-adapter |
Malicious release: Malicious code in @tanstack/virtual-file-routes (npm) GHSA-w9mx-wqhv-4cvw, MAL-2026-3494 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/virtual-file-routes |
Malicious release: Malicious code in @tanstack/vue-router-devtools (npm) GHSA-h7cj-xw74-w7h7, MAL-2026-3496 | Malicious | Not scored | 12 May, 2026 | npm @tanstack/vue-router-devtools |
Malicious release: Malicious code in @tanstack/vue-router-ssr-query (npm) GHSA-8rxr-9xrf-66wv, MAL-2026-3497 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/vue-router-ssr-query |
Malicious release: Malicious code in @tanstack/router-plugin (npm) GHSA-wp6c-87p2-r5xw, MAL-2026-3477 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/router-plugin |
Malicious release: Malicious code in @tanstack/vue-router (npm) GHSA-p6r2-524x-2vh3, MAL-2026-3495 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/vue-router |
Malicious release: Malicious code in @tanstack/router-generator (npm) GHSA-4fcj-3grh-9fhv, MAL-2026-3476 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/router-generator |
Malicious release: Malicious code in @tanstack/vue-start-server (npm) GHSA-fq44-7p43-9w49, MAL-2026-3500 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/vue-start-server |
Malicious release: Malicious code in @tanstack/router-devtools (npm) GHSA-fc8c-vpgv-4wqg, MAL-2026-3474 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/router-devtools |
Malicious release: Malicious code in @tanstack/vue-start (npm) GHSA-q3gx-rxh4-gv34, MAL-2026-3498 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/vue-start |
Malicious release: Malicious code in @tanstack/zod-adapter (npm) GHSA-xj4p-7xwr-q9jj, MAL-2026-3501 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/zod-adapter |
Malicious release: Malicious code in @tanstack/router-devtools-core (npm) GHSA-8jwm-h66c-fj6r, MAL-2026-3475 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/router-devtools-core |
Malicious release: Malicious code in @tanstack/router-core (npm) GHSA-r8f9-7pfq-w872, MAL-2026-3473 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/router-core |
Malicious release: Malicious code in @tanstack/router-cli (npm) GHSA-7xj7-65hc-69fc, MAL-2026-3472 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/router-cli |
Malicious release: Malicious code in @tanstack/react-start (npm) GHSA-7cm2-482j-9rxq, MAL-2026-3468 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/react-start |
Malicious release: Malicious code in @tanstack/react-start-server (npm) GHSA-xf53-jqmx-h45h, MAL-2026-3471 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/react-start-server |
Malicious release: Malicious code in @tanstack/react-start-rsc (npm) GHSA-hv5h-gqr4-76v3, MAL-2026-3470 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/react-start-rsc |
Malicious release: Malicious code in @tanstack/react-start-client (npm) GHSA-8j42-6cpx-3c7g, MAL-2026-3469 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/react-start-client |
Malicious release: Malicious code in @tanstack/react-router (npm) GHSA-5q7g-gw3w-r3rh, MAL-2026-3465 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/react-router |
Malicious release: Malicious code in @tanstack/react-router-ssr-query (npm) GHSA-q9q3-jp8x-cq8h, MAL-2026-3467 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/react-router-ssr-query |
Malicious release: Malicious code in @tanstack/react-router-devtools (npm) GHSA-qqw3-95q8-m7g4, MAL-2026-3466 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/react-router-devtools |
Malicious release: Malicious code in @tanstack/nitro-v2-vite-plugin (npm) GHSA-qj9f-x9rw-w5v3, MAL-2026-3464 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/nitro-v2-vite-plugin |
Malicious release: Malicious code in @tanstack/history (npm) GHSA-rmmr-r34h-pfm5, MAL-2026-3463 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/history |
Malicious release: Malicious code in @tanstack/eslint-plugin-start (npm) GHSA-8hwj-wqhq-3xw2, MAL-2026-3462 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/eslint-plugin-start |
Malicious release: Malicious code in @tanstack/eslint-plugin-router (npm) GHSA-4q7x-8jvq-jpfv, MAL-2026-3461 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/eslint-plugin-router |
Malicious release: Malicious code in @tanstack/arktype-adapter (npm) GHSA-5v49-5jh3-j7wg, MAL-2026-3460 | Malicious | Not scored | 11 May, 2026 | npm @tanstack/arktype-adapter |
Malicious release: Malicious code in @mistralai/mistralai (npm) GHSA-3q49-cfcf-g5fm, MAL-2026-3432 | Malicious | Not scored | 11 May, 2026 | npm @mistralai/mistralai |
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()` CVE-2026-44635, GHSA-pv5w-4p9q-p3v2 | High | 0.4% | 11 May, 2026 | npm kysely |
SandboxJS has a sandbox escape via Function.caller leakage of internal call op CVE-2026-43898, GHSA-g8f2-4f4f-5jqw | Critical | 0.5% | 11 May, 2026 | npm @nyariv/sandboxjs |
Mermaid: Improper sanitization of configuration leads to CSS injection CVE-2026-41159, GHSA-87f9-hvmw-gh4p | Medium | 0.5% | 11 May, 2026 | npm mermaid |
Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS CVE-2026-41150, GHSA-6m6c-36f7-fhxh | Medium | 0.4% | 11 May, 2026 | npm mermaid |
Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection CVE-2026-41149, GHSA-ghcm-xqfw-q4vr | Medium | 0.4% | 11 May, 2026 | npm mermaid |
Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection CVE-2026-41148, GHSA-xcj9-5m2h-648r | Medium | 0.3% | 11 May, 2026 | npm mermaid |
@steipete/summarize allows local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json CVE-2026-45222, GHSA-qp7v-gjgg-4mj6 | Medium | 0.1% | 11 May, 2026 | npm @steipete/summarize |
automagik-genie has a command injection vulnerability CVE-2026-30635, GHSA-64vr-4gr2-m642 | High | 1.0% | 11 May, 2026 | npm automagik-genie |
Malicious release: Malicious code in cplace-bmw-emt-mvp (npm) MAL-2026-3430 | Malicious | Not scored | 11 May, 2026 | npm cplace-bmw-emt-mvp |
WebdriverIO BrowserStack Service has a Command Injection issue CVE-2026-25244, GHSA-5c46-x3qw-q7j7 | Critical | 3.3% | 11 May, 2026 | npm @wdio/browserstack-service |
Malicious release: Malicious code in crypto-javascri (npm) MAL-2026-3508 | Malicious | Not scored | 11 May, 2026 | npm crypto-javascri |
Malicious release: Malicious code in @mimecast-ui/charts (npm) MAL-2026-3506 | Malicious | Not scored | 11 May, 2026 | npm @mimecast-ui/charts |
Malicious release: Malicious code in @mimecast-ui/components (npm) MAL-2026-3507 | Malicious | Not scored | 11 May, 2026 | npm @mimecast-ui/components |
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up CVE-2026-45109, GHSA-26hh-7cqf-hhc6 | High | 0.9% | 11 May, 2026 | npm next |
Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`) CVE-2026-45061, GHSA-xh5j-727m-w6gg | High | 0.3% | 11 May, 2026 | npm budibase |
Angular Expressions - Remote Code Execution using filters CVE-2026-44643, GHSA-pw8r-6689-xvf4 | Critical | 0.5% | 11 May, 2026 | npm angular-expressions |
GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor CVE-2026-45033, GHSA-9ccr-r5hg-74gf | High | 0.4% | 11 May, 2026 | npm @github/copilot |
Next.js's Middleware / Proxy redirects can be cache-poisoned CVE-2026-44572, GHSA-3g8h-86w9-wvmq | Medium | 0.3% | 11 May, 2026 | npm next |
@theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function GHSA-mhwj-73qx-jqxm | High | Not scored | 11 May, 2026 | npm @theecryptochad/merge-guard |
@rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) CVE-2026-44483, GHSA-c567-44rc-m5hq | High | 0.4% | 11 May, 2026 | npm @rvf/set-get |