Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in nf-ui-components (npm) GHSA-9vr2-f57v-r6r2, MAL-2026-3339 | Malicious | Not scored | 05 May, 2026 | npm nf-ui-components |
fast-uri vulnerable to host confusion via percent-encoded authority delimiters CVE-2026-6322, GHSA-v39h-62p7-jpjc | High | 0.5% | 05 May, 2026 | npm fast-uri |
Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled Resource Consumption BIT-thrift-2026-43870, CVE-2026-43870, GHSA-526f-jxpj-jmg2 | High | 0.4% | 05 May, 2026 | npm thrift |
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking CVE-2026-42264, GHSA-q8qp-cvcw-x6jj | Critical | 0.8% | 05 May, 2026 | npm axios |
Malicious release: Malicious code in fanduel (npm) GHSA-mjhc-2rfg-vh93, MAL-2026-3334 | Malicious | Not scored | 04 May, 2026 | npm fanduel |
OpenClaw's Gateway Control UI bootstrap config required Gateway auth CVE-2026-44994, GHSA-93rg-2xm5-2p9v | Medium | 0.3% | 04 May, 2026 | npm openclaw |
OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes CVE-2026-44113, GHSA-5h3g-6xhh-rg6p | High | 0.2% | 04 May, 2026 | npm openclaw |
OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root CVE-2026-44112, GHSA-wppj-c6mr-83jj | High | 7.3% | 04 May, 2026 | npm openclaw |
Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) CVE-2026-41893, GHSA-vmfm-ch9h-5c7g | High | 0.3% | 04 May, 2026 | npm signalk-server |
OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs CVE-2026-44115, GHSA-x3h8-jrgh-p8jx | High | 0.4% | 04 May, 2026 | npm openclaw |
OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens CVE-2026-44118, GHSA-r6xh-pqhr-v4xh | High | 0.1% | 04 May, 2026 | npm openclaw |
OpenClaw: Workspace dotenv files cannot override connector endpoint hosts CVE-2026-45003, GHSA-55cf-xx38-4p9p | Medium | 0.1% | 04 May, 2026 | npm openclaw |
OpenClaw's ACP child sessions inherit subagent security envelope constraints CVE-2026-44997, GHSA-q3jj-46pq-826r | Medium | 0.2% | 04 May, 2026 | npm openclaw |
OpenClaw validates Zalo outbound photo URLs through the SSRF guard CVE-2026-44116, GHSA-2hh7-c75g-qj2r | Medium | 0.3% | 04 May, 2026 | npm openclaw |
@fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache Growth CVE-2026-7768, GHSA-qxhc-wx3p-2wmg | High | 0.3% | 04 May, 2026 | npm @fastify/accepts-serializer |
fast-uri vulnerable to path traversal via percent-encoded dot segments CVE-2026-6321, GHSA-q3j6-qgpj-74h6 | High | 0.6% | 04 May, 2026 | npm fast-uri |
Malicious release: Malicious code in lazyhtml-scripts (npm) MAL-2026-3331 | Malicious | Not scored | 04 May, 2026 | npm lazyhtml-scripts |
Malicious release: Malicious code in ms.analytics-web (npm) MAL-2026-3338 | Malicious | Not scored | 04 May, 2026 | npm ms.analytics-web |
VM2 Has a WASM Sandbox Escape CVE-2026-26956, GHSA-ffh4-j6h5-pg66 | Critical | 1.1% | 04 May, 2026 | npm vm2 |
VM2 Has a Sandbox Escape Issue via SuppressedError CVE-2026-26332, GHSA-55hx-c926-fr95 | Critical | 0.7% | 04 May, 2026 | npm vm2 |
VM2 Has Sandbox Breakout Through Inspect Function CVE-2026-24781, GHSA-v37h-5mfm-c47c | Critical | 1.2% | 04 May, 2026 | npm vm2 |
VM2 Has Sandbox Breakout Through Promise Species CVE-2026-24120, GHSA-qvjj-29qf-hp7p | Critical | 0.9% | 04 May, 2026 | npm vm2 |
Malicious release: Malicious code in api-typings (npm) GHSA-gjx9-hrcc-f6qj, MAL-2026-3329 | Malicious | Not scored | 04 May, 2026 | npm api-typings |
Malicious release: Malicious code in seek-pass (npm) GHSA-q39g-5xh5-89h3, MAL-2026-3330 | Malicious | Not scored | 04 May, 2026 | npm seek-pass |
Malicious release: Malicious code in pocpoc2626 (npm) MAL-2026-3328 | Malicious | Not scored | 04 May, 2026 | npm pocpoc2626 |
VM2 Sandbox Breakout Through __lookupGetter__ CVE-2026-24118, GHSA-grj5-jjm8-h35p | Critical | 0.9% | 04 May, 2026 | npm vm2 |
Malicious release: Malicious code in capacitor-plugin-service-worker (npm) GHSA-qg5c-9jmq-fpmf, MAL-2026-3327 | Malicious | Not scored | 04 May, 2026 | npm capacitor-plugin-service-worker |
Malicious release: Malicious code in @channel_bot/xa0 (npm) MAL-2026-3336 | Malicious | Not scored | 04 May, 2026 | npm @channel_bot/xa0 |
Malicious release: Malicious code in paychex-common-vendor-lib (npm) GHSA-64fr-896g-cjfw, MAL-2026-3326 | Malicious | Not scored | 04 May, 2026 | npm paychex-common-vendor-lib |
Malicious release: Malicious code in @t-in-one/save_application_hid_to_storage (npm) GHSA-99m3-vc85-ccc3, MAL-2026-3337 | Malicious | Not scored | 04 May, 2026 | npm @t-in-one/save_application_hid_to_storage |
Malicious release: Malicious code in @bank-widgets/whats-new (npm) MAL-2026-3335 | Malicious | Not scored | 04 May, 2026 | npm @bank-widgets/whats-new |
@puchunjie/doc-tools-mcp has a Path Traversal Issue CVE-2026-7738, GHSA-gcmm-c94j-j47x | Low | 0.3% | 04 May, 2026 | npm @puchunjie/doc-tools-mcp |
Malicious release: Malicious code in @b2b_blocker/hide_activation_error (npm) GHSA-97mp-8qgq-v82w, MAL-2026-3318 | Malicious | Not scored | 04 May, 2026 | npm @b2b_blocker/hide_activation_error |
Malicious release: Malicious code in @apple-pay-trust/check-apple-pay (npm) GHSA-c3f2-55m6-q284, MAL-2026-3316 | Malicious | Not scored | 04 May, 2026 | npm @apple-pay-trust/check-apple-pay |
Malicious release: Malicious code in @montanatonytest/app.web (npm) GHSA-g938-5928-2j43, MAL-2026-3321 | Malicious | Not scored | 04 May, 2026 | npm @montanatonytest/app.web |
Malicious release: Malicious code in @google-pay-trust/init-google-pay-result (npm) GHSA-mcg4-68w5-qh5p, MAL-2026-3319 | Malicious | Not scored | 04 May, 2026 | npm @google-pay-trust/init-google-pay-result |
Malicious release: Malicious code in @google-pay-trust/start (npm) GHSA-p2m3-4r92-xj4f, MAL-2026-3320 | Malicious | Not scored | 04 May, 2026 | npm @google-pay-trust/start |
Malicious release: Malicious code in @apple-pay-trust/destroy (npm) GHSA-r239-hc6j-wmm8, MAL-2026-3317 | Malicious | Not scored | 04 May, 2026 | npm @apple-pay-trust/destroy |
Malicious release: Malicious code in accesso-angular-cache-buster (npm) GHSA-66qr-2394-v3r3, MAL-2026-3276 | Malicious | Not scored | 04 May, 2026 | npm accesso-angular-cache-buster |
Malicious release: Malicious code in shopify-draggable (npm) GHSA-223c-5fg7-gqmv, MAL-2026-3282 | Malicious | Not scored | 04 May, 2026 | npm shopify-draggable |
Malicious release: Malicious code in tinfoil-shops (npm) GHSA-7p2r-cm6w-w768, MAL-2026-3284 | Malicious | Not scored | 04 May, 2026 | npm tinfoil-shops |
Malicious release: Malicious code in pos-next-react-native (npm) GHSA-9x65-cvfj-9vmq, MAL-2026-3281 | Malicious | Not scored | 04 May, 2026 | npm pos-next-react-native |
Malicious release: Malicious code in temhe-dev (npm) GHSA-f9jj-rhcp-rhf6, MAL-2026-3283 | Malicious | Not scored | 04 May, 2026 | npm temhe-dev |
Malicious release: Malicious code in pi-exa-mcp (npm) GHSA-fpc5-w8c8-3mhv, MAL-2026-3280 | Malicious | Not scored | 04 May, 2026 | npm pi-exa-mcp |
Malicious release: Malicious code in honcho-theme (npm) GHSA-gmrq-2vx2-vm67, MAL-2026-3278 | Malicious | Not scored | 04 May, 2026 | npm honcho-theme |
Malicious release: Malicious code in @kills_sh/bootstrap (npm) GHSA-gxfc-h756-8jpg, MAL-2026-3275 | Malicious | Not scored | 04 May, 2026 | npm @kills_sh/bootstrap |
Malicious release: Malicious code in wagner-horizon (npm) GHSA-mpqc-8h6h-24pr, MAL-2026-3286 | Malicious | Not scored | 04 May, 2026 | npm wagner-horizon |
Malicious release: Malicious code in muenxo (npm) GHSA-v98c-r2px-c675, MAL-2026-3279 | Malicious | Not scored | 04 May, 2026 | npm muenxo |
Malicious release: Malicious code in edj-shopify-theme (npm) GHSA-wwp3-h2pr-7cjh, MAL-2026-3277 | Malicious | Not scored | 04 May, 2026 | npm edj-shopify-theme |
Malicious release: Malicious code in vpi-guides (npm) GHSA-wx4g-457v-96wq, MAL-2026-3285 | Malicious | Not scored | 04 May, 2026 | npm vpi-guides |