Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification GHSA-mph8-9v29-pm42 | Medium | Not scored | 06 May, 2026 | npm @axonflow/sdk |
Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks CVE-2026-44374, GHSA-p7g9-rp3g-mgfg | Medium | 0.2% | 06 May, 2026 | npm @backstage/plugin-catalog-backend-module-unprocessed npm @backstage/plugin-catalog-unprocessed-entities npm @backstage/plugin-catalog-unprocessed-entities-common |
Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules CVE-2026-44372, GHSA-9phm-9p8f-hw5m | Medium | 0.3% | 06 May, 2026 | npm nitro npm nitropack |
Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` CVE-2026-44373, GHSA-5w89-w975-hf9q | Medium | 0.5% | 06 May, 2026 | npm nitro npm nitropack |
Malicious release: Malicious code in 24712-pl5004 (npm) MAL-2026-3361 | Malicious | Not scored | 06 May, 2026 | npm 24712-pl5004 |
fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver CVE-2026-44351, GHSA-gmvf-9v4p-v8jc | Critical | 0.3% | 06 May, 2026 | npm fast-jwt |
Malicious release: Malicious code in @paysafe-tracking/error-monitoring (npm) MAL-2026-3360 | Malicious | Not scored | 06 May, 2026 | npm @paysafe-tracking/error-monitoring |
Malicious release: Malicious code in 24712-pl4712 (npm) MAL-2026-3358 | Malicious | Not scored | 06 May, 2026 | npm 24712-pl4712 |
Malicious release: Malicious code in b2bneo-rest (npm) MAL-2026-3359 | Malicious | Not scored | 06 May, 2026 | npm b2bneo-rest |
Malicious release: Malicious code in 24712-plv2 (npm) MAL-2026-3357 | Malicious | Not scored | 06 May, 2026 | npm 24712-plv2 |
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering CVE-2026-44240, GHSA-rpmf-866q-6p89 | High | 0.5% | 06 May, 2026 | npm basic-ftp |
dssrf: every IPv6 category bypasses is_url_safe CVE-2026-44232, GHSA-8p33-q827-ghj5 | High | 0.4% | 06 May, 2026 | npm dssrf |
next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys GHSA-4c35-wcg5-mm9h | Medium | Not scored | 06 May, 2026 | npm next-intl |
mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true` GHSA-r27j-894h-3w3p | Low | Not scored | 06 May, 2026 | npm icu-minify |
Facebook React has a Denial of Service Vulnerability in React Server Components CVE-2026-23870, GHSA-rv78-f8rc-xrxh | High | 1.5% | 06 May, 2026 | npm react-server-dom-parcel npm react-server-dom-turbopack npm react-server-dom-webpack |
Auth.js SDK has Improper Permission Checking CVE-2026-42280, GHSA-8qjv-jj2q-x832 | High | 0.2% | 06 May, 2026 | npm auth0-js |
Flowise: Bcrypt Password Hash Exposure CVE-2026-8026, GHSA-8f47-4rh3-x44m | Medium | 0.3% | 06 May, 2026 | npm flowise |
Malicious release: Malicious code in money-badger-open-rpc (npm) GHSA-g6gf-368m-9pvf, MAL-2026-3353 | Malicious | Not scored | 06 May, 2026 | npm money-badger-open-rpc |
Malicious release: Malicious code in carbonite-internal (npm) MAL-2026-3352 | Malicious | Not scored | 06 May, 2026 | npm carbonite-internal |
Malicious release: Malicious code in forge-jsxy (npm) GHSA-hm2h-78wx-fpxp, MAL-2026-3609 | Malicious | Not scored | 06 May, 2026 | npm forge-jsxy |
sse-channel: SSE Injection via unsanitized event fields CVE-2026-44217, GHSA-84hm-wfh8-c5pg | Medium | 0.5% | 05 May, 2026 | npm sse-channel |
ip-address has XSS in Address6 HTML-emitting methods CVE-2026-42338, GHSA-v2v4-37r5-5v8g | Medium | 0.5% | 05 May, 2026 | npm ip-address |
Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection BIT-mongoose-2026-42334, CVE-2026-42334, GHSA-wpg9-53fq-2r8h | High | 0.3% | 05 May, 2026 | npm mongoose |
@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts GHSA-jxh8-jh77-xh6g | High | Not scored | 05 May, 2026 | npm @evomap/evolver |
@evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS GHSA-7xp7-m392-h92c | Medium | Not scored | 05 May, 2026 | npm @evomap/evolver |
@evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE) GHSA-cfcj-hqpf-hccf | High | Not scored | 05 May, 2026 | npm @evomap/evolver |
MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint CVE-2026-42281, GHSA-ph6f-2cvq-79hq | Critical | 1.6% | 05 May, 2026 | npm magicmirror |
open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname` CVE-2026-42260, GHSA-v228-72c7-fx8j | High | 0.3% | 05 May, 2026 | npm open-websearch |
parse-server: MFA SMS one-time password accepted twice under concurrent login BIT-parse-2026-43930, CVE-2026-43930, GHSA-jpq4-7fmq-q5fj | Low | 0.2% | 05 May, 2026 | npm parse-server |
ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs CVE-2026-43929, GHSA-j4rj-2jr5-m439 | High | 0.3% | 05 May, 2026 | npm ssrfcheck |
link-preview-js vulnerable to IPv6 and internal loopback attacks CVE-2026-43897, GHSA-4gp8-rjrq-ch6q | High | 0.7% | 05 May, 2026 | npm link-preview-js |
exiftool-vendored vulnerable to argument injection via newline characters in tag names CVE-2026-43893, GHSA-cw26-7653-2rp5 | High | 0.5% | 05 May, 2026 | npm exiftool-vendored |
Malicious release: Malicious code in @rivianlabs/bedrock (npm) MAL-2026-3348 | Malicious | Not scored | 05 May, 2026 | npm @rivianlabs/bedrock |
Malicious release: Malicious code in @rivianlabs/dc-fe-app-web-rivian-com (npm) MAL-2026-3349 | Malicious | Not scored | 05 May, 2026 | npm @rivianlabs/dc-fe-app-web-rivian-com |
Malicious release: Malicious code in @rivianlabs/dt-shop-bag-v0 (npm) MAL-2026-3351 | Malicious | Not scored | 05 May, 2026 | npm @rivianlabs/dt-shop-bag-v0 |
Malicious release: Malicious code in @rivianlabs/dt-lib-lumberjack (npm) MAL-2026-3350 | Malicious | Not scored | 05 May, 2026 | npm @rivianlabs/dt-lib-lumberjack |
OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes CVE-2026-45006, GHSA-cwj3-vqpp-pmxr | High | 0.5% | 05 May, 2026 | npm openclaw |
OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution CVE-2026-45004, GHSA-r39h-4c2p-3jxp | High | 0.1% | 05 May, 2026 | npm openclaw |
OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload CVE-2026-45005, GHSA-q8ff-7ffm-m3r9 | Medium | 0.3% | 05 May, 2026 | npm openclaw |
@workos/authkit-session has an Open Redirect via state-derived redirect target CVE-2026-42565, GHSA-vvvv-983w-r7pv | Medium | 0.2% | 05 May, 2026 | npm @workos/authkit-session |
@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin GHSA-g485-8j3v-p6x8 | High | Not scored | 05 May, 2026 | npm @tdurieux/anonymous_github |
Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods CVE-2026-42047, GHSA-2jf5-6wwv-vhxx | High | 0.4% | 05 May, 2026 | npm inngest |
LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution CVE-2026-42045, GHSA-xq4x-622m-q8fq | Medium | 0.3% | 05 May, 2026 | npm @lobehub/lobehub |
Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls CVE-2026-42856, GHSA-fj4g-2p96-q6m3 | High | 0.5% | 05 May, 2026 | npm network-ai |
Malicious release: Malicious code in deployment-core (npm) GHSA-gjhw-qg2j-wrvm, MAL-2026-3345 | Malicious | Not scored | 05 May, 2026 | npm deployment-core |
Malicious release: Malicious code in generator-go-circleci (npm) GHSA-xw4p-ff39-hmj4, MAL-2026-3346 | Malicious | Not scored | 05 May, 2026 | npm generator-go-circleci |
Malicious release: Malicious code in @bold-commerce/stacks-ui (npm) GHSA-mgm6-933c-v7m5, MAL-2026-3344 | Malicious | Not scored | 05 May, 2026 | npm @bold-commerce/stacks-ui |
Malicious release: Malicious code in @atlan/connectors (npm) GHSA-q5p9-629j-qg9g, MAL-2026-3343 | Malicious | Not scored | 05 May, 2026 | npm @atlan/connectors |
OpenClaw contains a symlink traversal vulnerability CVE-2026-43570, GHSA-35mw-5vvr-vrxc, GHSA-cr8r-7g2h-6wr6 | Medium | 0.3% | 05 May, 2026 | npm openclaw |
Malicious release: Malicious code in trevlo (npm) GHSA-64f2-864w-556j, MAL-2026-3340 | Malicious | Not scored | 05 May, 2026 | npm trevlo |