Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in path-addon (npm) GHSA-hqv8-vf3j-m8q6, MAL-2026-3311 | Malicious | Not scored | 01 May, 2026 | npm path-addon |
Malicious release: Malicious code in gweb-build-system (npm) GHSA-4jrp-wqpx-xfgc, MAL-2026-3310 | Malicious | Not scored | 01 May, 2026 | npm gweb-build-system |
Malicious release: Malicious code in service-gateway (npm) GHSA-6vc9-m5v7-7m4f, MAL-2026-3313 | Malicious | Not scored | 30 Apr, 2026 | npm service-gateway |
Malicious release: Malicious code in intercom-client (npm) GHSA-4594-wxqv-j3pm, MAL-2026-3204 | Malicious | Not scored | 30 Apr, 2026 | npm intercom-client |
Clerk has an authorization bypass when combining organization, billing, or reverification checks CVE-2026-42349, GHSA-w24r-5266-9c3c | High | 0.2% | 30 Apr, 2026 | npm @clerk/astro npm @clerk/backend npm @clerk/chrome-extension npm @clerk/clerk-expo +13 more |
n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders CVE-2026-42449, GHSA-56c3-vfp2-5qqj | High | 0.2% | 30 Apr, 2026 | npm n8n-mcp |
Malicious release: Malicious code in eslint-plugin-skyscanner-dates (npm) GHSA-29h9-fw37-6xhc, MAL-2026-3202 | Malicious | Not scored | 30 Apr, 2026 | npm eslint-plugin-skyscanner-dates |
Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS BIT-jupyter-base-notebook-2026-40171, BIT-jupyter-notebook-2026-40171, BIT-jupyterlab-2026-40171, CVE-2026-40171, GHSA-rch3-82jr-f9w9, PYSEC-2026-2538, PYSEC-2026-2682 | High | 0.5% | 30 Apr, 2026 | PyPI jupyterlab PyPI notebook npm @jupyter-notebook/help-extension npm @jupyterlab/help-extension |
Malicious release: Malicious code in sirens-lament (npm) GHSA-j844-qq6j-rj39, MAL-2026-3200 | Malicious | Not scored | 30 Apr, 2026 | npm sirens-lament |
Malicious release: Malicious code in blackbeards-navigator (npm) GHSA-cfpj-hqgr-45g3, MAL-2026-3199 | Malicious | Not scored | 30 Apr, 2026 | npm blackbeards-navigator |
Malicious release: Malicious code in apple-internal-security-audit-v99 (npm) GHSA-66w7-4qx2-62w2, MAL-2026-3305 | Malicious | Not scored | 30 Apr, 2026 | npm apple-internal-security-audit-v99 |
Malicious release: Malicious code in react-dnd-14 (npm) MAL-2026-3196 | Malicious | Not scored | 30 Apr, 2026 | npm react-dnd-14 |
mcp-server-semgrep has a Command Injection issue CVE-2026-7446, GHSA-86hp-qxqp-w9wv | Medium | 1.5% | 30 Apr, 2026 | npm mcp-server-semgrep |
Malicious release: Malicious code in tanstack (npm) GHSA-5w4c-85pv-cwhv, MAL-2026-3190 | Malicious | Not scored | 29 Apr, 2026 | npm tanstack |
Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool CVE-2026-41686, GHSA-p7fg-763f-g4gf | Medium | 0.1% | 29 Apr, 2026 | npm @anthropic-ai/sdk |
i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters CVE-2026-42353, GHSA-jfgf-83c5-2c4m | High | 0.4% | 29 Apr, 2026 | npm i18next-http-middleware |
OpenClaw: Webchat audio embedding could read local files without local-root containment CVE-2026-44996, GHSA-gfg9-5357-hv4c | Medium | 0.3% | 29 Apr, 2026 | npm openclaw |
OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners CVE-2026-44991, GHSA-c28g-vh7m-fm7v | Medium | 0.2% | 29 Apr, 2026 | npm openclaw |
n8n has XML Node Prototype Pollution that to RCE CVE-2026-42232, GHSA-hqr4-h3xv-9m3r | Critical | 0.5% | 29 Apr, 2026 | npm n8n |
Malicious release: Malicious code in @breezeai-frontend/cargo-ui (npm) GHSA-648m-8w8j-gqr3, MAL-2026-3183 | Malicious | Not scored | 29 Apr, 2026 | npm @breezeai-frontend/cargo-ui |
n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE CVE-2026-42231, GHSA-q5f4-99jv-pgg5 | Critical | 0.9% | 29 Apr, 2026 | npm n8n |
n8n Vulnerable to XSS via MCP OAuth client CVE-2026-42235, GHSA-537j-gqpc-p7fq | High | 0.3% | 29 Apr, 2026 | npm n8n |
n8n's Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay CVE-2026-42226, GHSA-r4v6-9fqc-w5jr | High | 0.3% | 29 Apr, 2026 | npm n8n |
n8n has a Python Task Runner Sandbox Escape Vulnerability CVE-2026-42234, GHSA-44v6-jhgm-p3m4 | High | 0.4% | 29 Apr, 2026 | npm n8n |
n8n has Public API Variables IDOR that Allows Cross-Project Secret Disclosure CVE-2026-42227, GHSA-756q-gq9h-fp22 | Medium | 0.2% | 29 Apr, 2026 | npm n8n |
n8n Vulnerable to Unauthenticated Denial of Service via MCP Client Registration CVE-2026-42236, GHSA-49m9-pgww-9vq6 | High | 0.5% | 29 Apr, 2026 | npm n8n |
n8n Vulnerable to Hijacking of Unauthenticated Chat Execution CVE-2026-42228, GHSA-f77h-j2v7-g6mw | Medium | 0.4% | 29 Apr, 2026 | npm n8n |
Malicious release: Malicious code in @breezeai-frontend/tailwind-config (npm) GHSA-2vqh-whcm-r27x, MAL-2026-3184 | Malicious | Not scored | 29 Apr, 2026 | npm @breezeai-frontend/tailwind-config |
n8n has SQL Injection in SeaTable Node CVE-2026-42229, GHSA-mp4j-h6gh-f6mp | Medium | 0.3% | 29 Apr, 2026 | npm n8n |
n8n has Open Redirect in MCP OAuth Consent Flow CVE-2026-42230, GHSA-f6x8-65q6-j9m9 | Medium | 0.2% | 29 Apr, 2026 | npm n8n |
n8n has SQL Injection in Oracle Database Node via Limit Field CVE-2026-42233, GHSA-r6jc-mpqw-m755 | Medium | 0.3% | 29 Apr, 2026 | npm n8n |
n8n has SQL Injection in Snowflake and MySQL Nodes CVE-2026-42237, GHSA-hp3c-vfpm-q4f7 | Medium | 0.3% | 29 Apr, 2026 | npm n8n |
Malicious release: Malicious code in ac-sasskit-beta (npm) GHSA-3v69-72f9-jpjc, MAL-2026-3186 | Malicious | Not scored | 29 Apr, 2026 | npm ac-sasskit-beta |
Malicious release: Malicious code in apple-appstore-full-library-utility (npm) GHSA-jqp6-fcpv-q663, MAL-2026-3187 | Malicious | Not scored | 29 Apr, 2026 | npm apple-appstore-full-library-utility |
Malicious release: Malicious code in apple-security-internal-scanner-v3 (npm) GHSA-fqqh-jjx6-5vcg, MAL-2026-3188 | Malicious | Not scored | 29 Apr, 2026 | npm apple-security-internal-scanner-v3 |
Malicious release: Malicious code in apple-infra-stealth-audit (npm) GHSA-54w7-66gf-95g9, MAL-2026-3167 | Malicious | Not scored | 29 Apr, 2026 | npm apple-infra-stealth-audit |
Malicious release: Malicious code in internal-sys-audit-check (npm) GHSA-5wqf-mvwr-p55r, MAL-2026-3174 | Malicious | Not scored | 29 Apr, 2026 | npm internal-sys-audit-check |
Malicious release: Malicious code in apple-internal-config (npm) GHSA-66g4-jx7f-f88p, MAL-2026-3168 | Malicious | Not scored | 29 Apr, 2026 | npm apple-internal-config |
Malicious release: Malicious code in frank-newton3-final-audit (npm) GHSA-f8rm-m6f5-6gcv, MAL-2026-3171 | Malicious | Not scored | 29 Apr, 2026 | npm frank-newton3-final-audit |
Malicious release: Malicious code in frank-newton3-user-hunt (npm) GHSA-g86r-cgww-vqq4, MAL-2026-3172 | Malicious | Not scored | 29 Apr, 2026 | npm frank-newton3-user-hunt |
Malicious release: Malicious code in gcp-internal-research-poc (npm) GHSA-hrw3-c2cr-c3gv, MAL-2026-3173 | Malicious | Not scored | 29 Apr, 2026 | npm gcp-internal-research-poc |
Malicious release: Malicious code in frank-newton3-db-final (npm) GHSA-qjhq-w9mx-q3p5, MAL-2026-3169 | Malicious | Not scored | 29 Apr, 2026 | npm frank-newton3-db-final |
Malicious release: Malicious code in apple-infra-escape-audit (npm) GHSA-vghq-gwcj-xxxw, MAL-2026-3166 | Malicious | Not scored | 29 Apr, 2026 | npm apple-infra-escape-audit |
Malicious release: Malicious code in frank-newton3-db-poc (npm) GHSA-x8j3-v2c6-jxwj, MAL-2026-3170 | Malicious | Not scored | 29 Apr, 2026 | npm frank-newton3-db-poc |
Malicious release: Malicious code in react-native-parallax-scroll-view-updated (npm) GHSA-482r-xhg9-23r3, MAL-2026-3262 | Malicious | Not scored | 29 Apr, 2026 | npm react-native-parallax-scroll-view-updated |
Malicious release: Malicious code in enterprise-auth-gateway-core (npm) GHSA-55c3-wf4r-225q, MAL-2026-3259 | Malicious | Not scored | 29 Apr, 2026 | npm enterprise-auth-gateway-core |
Malicious release: Malicious code in @corp-infra/sso-gateway-core (npm) GHSA-563q-j42j-86qv, MAL-2026-3254 | Malicious | Not scored | 29 Apr, 2026 | npm @corp-infra/sso-gateway-core |
Malicious release: Malicious code in @enterprise-core/auth-gateway-bridge (npm) GHSA-627r-xf4j-2cqq, MAL-2026-3255 | Malicious | Not scored | 29 Apr, 2026 | npm @enterprise-core/auth-gateway-bridge |
Malicious release: Malicious code in @internal-infra/core-sso-bridge (npm) GHSA-67rg-vhjj-qrqq, MAL-2026-3256 | Malicious | Not scored | 29 Apr, 2026 | npm @internal-infra/core-sso-bridge |
Malicious release: Malicious code in @tech-global/internal-gateway-core (npm) GHSA-cpv8-2wx4-xfvv, MAL-2026-3258 | Malicious | Not scored | 29 Apr, 2026 | npm @tech-global/internal-gateway-core |