Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @cplace-workflow-fe/cf-workflow (npm) GHSA-fmm7-x566-j93x, MAL-2026-3427 | Malicious | Not scored | 11 May, 2026 | npm @cplace-workflow-fe/cf-workflow |
Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces CVE-2026-44581, GHSA-ffhc-5mcf-pf4q | Medium | 0.2% | 11 May, 2026 | npm next |
Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting CVE-2026-44582, GHSA-vfv6-92ff-j949 | Low | 0.2% | 11 May, 2026 | npm next |
Next.js has cross-site scripting in beforeInteractive scripts with untrusted input CVE-2026-44580, GHSA-gx5p-jg67-6x7h | Medium | 0.2% | 11 May, 2026 | npm next |
Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components CVE-2026-44579, GHSA-mg66-mrh9-m8jx | High | 0.7% | 11 May, 2026 | npm next |
Next.js has a Denial of Service in the Image Optimization API CVE-2026-44577, GHSA-h64f-5h5j-jqjh | Medium | 0.7% | 11 May, 2026 | npm next |
Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades CVE-2026-44578, GHSA-c4j6-fc7j-m34r | High | 35.5% | 11 May, 2026 | npm next |
Next.js vulnerable to cache poisoning in React Server Component responses CVE-2026-44576, GHSA-wfc6-r584-vfw7 | Medium | 0.3% | 11 May, 2026 | npm next |
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes CVE-2026-44575, GHSA-267c-6grr-h53f | High | 1.6% | 11 May, 2026 | npm next |
Next.js has a Middleware / Proxy bypass through dynamic route parameter injection CVE-2026-44574, GHSA-492v-c6pp-mqqv | High | 0.6% | 11 May, 2026 | npm next |
Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n CVE-2026-44573, GHSA-36qx-fr4f-26g5 | High | 0.8% | 11 May, 2026 | npm next |
@vitejs/plugin-rsc has a Denial of Service Vulnerability in React Server Components GHSA-w94c-4vhp-22gx | High | Not scored | 11 May, 2026 | npm @vitejs/plugin-rsc |
Next.js Vulnerable to Denial of Service with Server Components GHSA-8h8q-6873-q5fj | High | Not scored | 11 May, 2026 | npm next |
Prometheus exporter process crash via malformed HTTP request CVE-2026-44902, GHSA-q7rr-3cgh-j5r3 | High | 0.5% | 11 May, 2026 | npm @opentelemetry/auto-instrumentations-node npm @opentelemetry/exporter-prometheus npm @opentelemetry/sdk-node |
Malicious release: Malicious code in byvendors (npm) MAL-2026-3423 | Malicious | Not scored | 11 May, 2026 | npm byvendors |
Malicious release: Malicious code in pp-react-v5 (npm) MAL-2026-3509 | Malicious | Not scored | 11 May, 2026 | npm pp-react-v5 |
Malicious release: Malicious code in briantreehttp (npm) MAL-2026-3639 | Malicious | Not scored | 11 May, 2026 | npm briantreehttp |
Malicious release: Malicious code in ac-sasskit (npm) MAL-2026-3415 | Malicious | Not scored | 10 May, 2026 | npm ac-sasskit |
Malicious release: Malicious code in rsflows-pexml (npm) GHSA-m2qp-j4c5-7m6m, MAL-2026-3422 | Malicious | Not scored | 10 May, 2026 | npm rsflows-pexml |
Malicious release: Malicious code in noon-contracts (npm) GHSA-qj9j-8fcr-pjq2, MAL-2026-3420 | Malicious | Not scored | 10 May, 2026 | npm noon-contracts |
Malicious release: Malicious code in post-purchase-bundler (npm) MAL-2026-3412 | Malicious | Not scored | 10 May, 2026 | npm post-purchase-bundler |
Malicious release: Malicious code in @miurba/alcazaba (npm) MAL-2026-3410 | Malicious | Not scored | 10 May, 2026 | npm @miurba/alcazaba |
Malicious release: Malicious code in mw-filesystem-events-nodream (npm) MAL-2026-3409 | Malicious | Not scored | 10 May, 2026 | npm mw-filesystem-events-nodream |
Malicious release: Malicious code in dit-envv (npm) GHSA-m6q4-79qp-v6vp, MAL-2026-3645 | Malicious | Not scored | 10 May, 2026 | npm dit-envv |
Malicious release: Malicious code in erslove (npm) GHSA-r4pq-fh5v-934h, MAL-2026-3646 | Malicious | Not scored | 10 May, 2026 | npm erslove |
Malicious release: Malicious code in @rsi-community/hub-schema (npm) GHSA-j83r-w4f8-v7m9, MAL-2026-3414 | Malicious | Not scored | 09 May, 2026 | npm @rsi-community/hub-schema |
Malicious release: Malicious code in @matjp/dvi-decode (npm) MAL-2026-3404 | Malicious | Not scored | 09 May, 2026 | npm @matjp/dvi-decode |
Malicious release: Malicious code in apple-mycelium-fix (npm) GHSA-fjcr-w74v-m2qw, MAL-2026-3416 | Malicious | Not scored | 09 May, 2026 | npm apple-mycelium-fix |
Hono has CSS Declaration Injection via Style Object Values in JSX SSR CVE-2026-44458, GHSA-qp7p-654g-cw7p | Medium | 0.2% | 09 May, 2026 | npm hono |
Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() CVE-2026-44459, GHSA-hm8q-7f3q-5f36 | Low | 0.2% | 09 May, 2026 | npm hono |
@profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module GHSA-v6wj-c83f-v46x | Critical | Not scored | 09 May, 2026 | npm @profullstack/mcp-server |
Velocity.js has a Prototype Pollution vulnerability through #set path assignment CVE-2026-44966, GHSA-j658-c2gf-x6pq | Critical | 0.5% | 09 May, 2026 | npm velocityjs |
Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage CVE-2026-44457, GHSA-p77w-8qqv-26rm | Medium | 0.2% | 09 May, 2026 | npm hono |
@yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools CVE-2026-44895, GHSA-8jr5-6gvj-rfpf | Critical | 0.4% | 09 May, 2026 | npm @yoda.digital/gitlab-mcp-server |
Malicious release: Malicious code in haswons (npm) MAL-2026-3647 | Malicious | Not scored | 09 May, 2026 | npm haswons |
Malicious release: Malicious code in oneblk-design-system (npm) MAL-2026-3421 | Malicious | Not scored | 08 May, 2026 | npm oneblk-design-system |
eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fields CVE-2026-44214, GHSA-m9g3-3g99-mhpx | Medium | 0.3% | 08 May, 2026 | npm eventsource-encoder |
Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability CVE-2026-44211, GHSA-5c57-rqjx-35g2 | Critical | 0.2% | 08 May, 2026 | npm cline |
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input CVE-2026-44728, GHSA-fv7c-fp4j-7gwp | High | 0.1% | 08 May, 2026 | npm @babel/plugin-transform-modules-systemjs |
@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry GHSA-qhh4-458h-xwh2 | Medium | Not scored | 08 May, 2026 | npm @cyclonedx/cdxgen |
Malicious release: Malicious code in devsite-youtube (npm) MAL-2026-3418 | Malicious | Not scored | 08 May, 2026 | npm devsite-youtube |
Malicious release: Malicious code in typo-crypto (npm) MAL-2026-3400 | Malicious | Not scored | 08 May, 2026 | npm typo-crypto |
MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys CVE-2026-44680, GHSA-cfw5-68c4-ffqp | High | 1.5% | 08 May, 2026 | npm @mikro-orm/knex npm @mikro-orm/sql |
open-webui Vulnerable to Stored XSS via Model Description CVE-2026-44721, GHSA-gf5m-wcrh-7928, PYSEC-2026-2725 | High | 0.3% | 08 May, 2026 | PyPI open-webui npm open-webui |
Malicious release: Malicious code in money-badger-open-rpc-test-bugbount (npm) MAL-2026-3399 | Malicious | Not scored | 08 May, 2026 | npm money-badger-open-rpc-test-bugbount |
n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure GHSA-8g7g-hmwm-6rv2 | High | Not scored | 08 May, 2026 | npm n8n-mcp |
n8n-mcp webhook and API client paths has an authenticated SSRF CVE-2026-44694, GHSA-cmrh-wvq6-wm9r | High | 0.2% | 08 May, 2026 | npm n8n-mcp |
fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes CVE-2026-44665, GHSA-5wm8-gmm8-39j9 | High | 0.2% | 08 May, 2026 | npm fast-xml-builder |
fast-xml-builder Comment Value regex can be bypassed CVE-2026-44664, GHSA-45c6-75p6-83cc | Medium | 0.2% | 08 May, 2026 | npm fast-xml-builder |
vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL` CVE-2026-92963, GHSA-2cm2-m3w5-gp2f | Medium | 0.3% | 08 May, 2026 | npm vm2 |