Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
vm2 has Sandbox Breakout Through Null Proto Exception CVE-2026-44009, GHSA-9vg3-4rfj-wgcm | Critical | 1.0% | 08 May, 2026 | npm vm2 |
vm2 has sandbox breakout via `neutralizeArraySpeciesBatch` CVE-2026-44008, GHSA-9qj6-qjgg-37qq | Critical | 0.9% | 08 May, 2026 | npm vm2 |
Malicious release: Malicious code in tecken (npm) GHSA-4gxg-7rff-vvmx, MAL-2026-3397 | Malicious | Not scored | 08 May, 2026 | npm tecken |
Malicious release: Malicious code in coral-dev-proxy (npm) MAL-2026-3395 | Malicious | Not scored | 08 May, 2026 | npm coral-dev-proxy |
Malicious release: Malicious code in @gaia-codesearch/gaia-api-typescript (npm) MAL-2026-3394 | Malicious | Not scored | 08 May, 2026 | npm @gaia-codesearch/gaia-api-typescript |
Malicious release: Malicious code in @gaia-codesearch/gaia-api-python (npm) MAL-2026-3387 | Malicious | Not scored | 08 May, 2026 | npm @gaia-codesearch/gaia-api-python |
Malicious release: Malicious code in connect-perspectives-admintool (npm) MAL-2026-3417 | Malicious | Not scored | 08 May, 2026 | npm connect-perspectives-admintool |
Malicious release: Malicious code in msal-browser-1p (npm) MAL-2026-3419 | Malicious | Not scored | 08 May, 2026 | npm msal-browser-1p |
Malicious release: Malicious code in playgod (npm) MAL-2026-3374 | Malicious | Not scored | 08 May, 2026 | npm playgod |
Electerm users can run dangrous code through link or command line CVE-2026-43944, GHSA-mpm8-cx2p-626q | Critical | 0.4% | 08 May, 2026 | npm electerm |
Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor CVE-2026-43943, GHSA-q4p8-8j9m-8hxj | High | 0.2% | 08 May, 2026 | npm electerm |
Electerm's full process.env exposed to renderer via window.pre.env CVE-2026-43942, GHSA-37j4-88rp-2f6h | Medium | 0.1% | 08 May, 2026 | npm electerm |
Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click CVE-2026-43941, GHSA-fwf6-j56g-m97c | Critical | 0.4% | 08 May, 2026 | npm electerm |
Electerm runWidget has a path traversal that leads to arbitrary code execution CVE-2026-43940, GHSA-f77v-9vpc-6pjm | Critical | 0.2% | 08 May, 2026 | npm electerm |
short-video-maker has a path traversal vulnerability CVE-2026-8115, GHSA-935g-9rq5-q95c | Medium | 0.6% | 07 May, 2026 | npm short-video-maker |
mcp-ssh-tool has file transfer path policy bypass and bearer token comparison hardening GHSA-j7h9-2jh7-g967 | High | Not scored | 07 May, 2026 | npm mcp-ssh-tool |
nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect) CVE-2026-44589, GHSA-c2rm-g55x-8hr5 | Low | 0.2% | 07 May, 2026 | npm nuxt-og-image |
Compromised version of intercom-client published to npm GHSA-54pg-9963-v8vg | Critical | Not scored | 07 May, 2026 | npm intercom-client |
Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker CVE-2026-42553, GHSA-j944-w549-3453 | High | 0.3% | 07 May, 2026 | npm cinny |
youtube-regex vulnerable to Regex Denial of Service CVE-2025-65122, GHSA-vpxx-h23g-gxh2 | High | 0.3% | 07 May, 2026 | npm youtube-regex |
query-parser-string is vulnerable to Prototype Pollution CVE-2025-63704, GHSA-587p-w43q-4hjx | Critical | 0.5% | 07 May, 2026 | npm query-string-parser |
parse-ini is vulnerable to Prototype Pollution in index.js() CVE-2025-63703, GHSA-x72j-hv9f-qqh4 | Critical | 0.4% | 07 May, 2026 | npm parse-ini |
Malicious release: Malicious code in owa-analytics-utils (npm) MAL-2026-3373 | Malicious | Not scored | 07 May, 2026 | npm owa-analytics-utils |
next-npm-version is vulnerable to Command injection CVE-2025-63706, GHSA-2xx6-qf7x-grqh | Critical | 1.5% | 07 May, 2026 | npm @jswork/next-npm-version |
node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js CVE-2025-63705, GHSA-8jh2-3mw6-6pfm | High | 1.2% | 07 May, 2026 | npm node-ts-ocr |
Malicious release: Malicious code in @b2bneo-rest/api-csf (npm) MAL-2026-3365 | Malicious | Not scored | 07 May, 2026 | npm @b2bneo-rest/api-csf |
vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution CVE-2026-44007, GHSA-8hg8-63c5-gwmx | Critical | 1.0% | 07 May, 2026 | npm vm2 |
vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape CVE-2026-43998, GHSA-cp6g-6699-wx9c | High | 0.7% | 07 May, 2026 | npm vm2 |
vm2's Transformer Fast-Path Bypass Exposes Internal State Variable CVE-2026-44003, GHSA-wp5r-2gw5-m7q7 | Medium | 0.2% | 07 May, 2026 | npm vm2 |
vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak CVE-2026-44002, GHSA-v27g-jcqj-v8rw | Medium | 0.2% | 07 May, 2026 | npm vm2 |
vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary CVE-2026-44000, GHSA-mpf8-4hx2-7cjg | High | 0.2% | 07 May, 2026 | npm vm2 |
vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion CVE-2026-44004, GHSA-6785-pvv7-mvg7 | High | 0.4% | 07 May, 2026 | npm vm2 |
vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS) CVE-2026-44001, GHSA-hw58-p9xv-2mjh | High | 0.4% | 07 May, 2026 | npm vm2 |
vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape CVE-2026-43999, GHSA-947f-4v7f-x2v8 | Critical | 1.0% | 07 May, 2026 | npm vm2 |
vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape CVE-2026-44005, GHSA-vwrp-x96c-mhwq | Critical | 0.8% | 07 May, 2026 | npm vm2 |
vm2 Access to Host Object Enables Sandbox Escape CVE-2026-43997, GHSA-47x8-96vw-5wg6 | Critical | 1.0% | 07 May, 2026 | npm vm2 |
Malicious release: Malicious code in mrdaa-frontend (npm) GHSA-r3r7-xhf7-xf87, MAL-2026-3363 | Malicious | Not scored | 07 May, 2026 | npm mrdaa-frontend |
vm2 has a Sandbox Escape Vulnerability CVE-2026-44006, GHSA-qcp4-v2jj-fjx8 | Critical | 0.8% | 07 May, 2026 | npm vm2 |
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect CVE-2026-44503, GHSA-7j59-v9qr-6fq9, GO-2026-5224, PYSEC-2026-2647 | High | 0.6% | 07 May, 2026 | Go github.com/microsoft/kiota-http-go Maven com.microsoft.kiota:microsoft-kiota-abstractions NuGet Microsoft.Kiota.Abstractions PyPI microsoft-kiota-http +1 more |
Malicious release: Malicious code in 24712-pl5006 (npm) MAL-2026-3362 | Malicious | Not scored | 07 May, 2026 | npm 24712-pl5006 |
Vercel: Non-interactive mode includes CLI arguments in suggested command output CVE-2026-44479, GHSA-pgf8-2hgj-grqg | Medium | 0.2% | 07 May, 2026 | npm vercel |
Malicious release: Malicious code in camelotlabs-config (npm) GHSA-7972-958m-rqjg, MAL-2026-3640 | Malicious | Not scored | 07 May, 2026 | npm camelotlabs-config |
Malicious release: Malicious code in camelotlabs-core (npm) GHSA-pf82-f9wr-54vx, MAL-2026-3641 | Malicious | Not scored | 07 May, 2026 | npm camelotlabs-core |
Malicious release: Malicious code in camelotlabs-sdk (npm) GHSA-wx8x-c4rg-8rg7, MAL-2026-3642 | Malicious | Not scored | 07 May, 2026 | npm camelotlabs-sdk |
Malicious release: Malicious code in camelotlabs-utils (npm) GHSA-2j2p-88v8-7xrm, MAL-2026-3643 | Malicious | Not scored | 07 May, 2026 | npm camelotlabs-utils |
Malicious release: Malicious code in camelotlabs-worker (npm) GHSA-4mgg-vrvh-32xg, MAL-2026-3644 | Malicious | Not scored | 07 May, 2026 | npm camelotlabs-worker |
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests CVE-2026-44456, GHSA-9vqf-7f2p-gf9v | Medium | 0.2% | 06 May, 2026 | npm hono |
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection CVE-2026-44455, GHSA-69xw-7hcm-h432 | Medium | 0.1% | 06 May, 2026 | npm hono |
Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix CVE-2026-44437, GHSA-69xr-m8h6-h664 | Medium | 0.2% | 06 May, 2026 | npm @angular/ssr |
@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening GHSA-cqmh-pcgr-q42f | Medium | Not scored | 06 May, 2026 | npm @axonflow/openclaw |