Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in axis-charts (npm) MAL-2026-3077 | Malicious | Not scored | 25 Apr, 2026 | npm axis-charts |
Malicious release: Malicious code in js-component-explorer (npm) MAL-2026-3032 | Malicious | Not scored | 25 Apr, 2026 | npm js-component-explorer |
simple-git is vulnerable to Remote Code Execution CVE-2026-6951, GHSA-hffm-xvc3-vprc | High | 0.9% | 25 Apr, 2026 | npm simple-git |
Malicious release: Malicious code in @tochka-ui/foundation (npm) GHSA-hf3j-mx5g-jc8r, MAL-2026-3069 | Malicious | Not scored | 24 Apr, 2026 | npm @tochka-ui/foundation |
Malicious release: Malicious code in @frengki0707/google-cloud-clone (npm) MAL-2026-3060 | Malicious | Not scored | 24 Apr, 2026 | npm @frengki0707/google-cloud-clone |
electerm has Command Injection via runLinux funtion CVE-2026-41501, GHSA-8x35-hph8-37hq | Critical | 1.3% | 24 Apr, 2026 | npm electerm |
Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) GHSA-39h7-pwv7-rc3x | Medium | Not scored | 24 Apr, 2026 | npm @excalidraw/excalidraw npm @excalidraw/mermaid-to-excalidraw |
Malicious release: Malicious code in @alfa.life.mapp/app.web (npm) GHSA-68cm-x784-c9gw, MAL-2026-3052 | Malicious | Not scored | 24 Apr, 2026 | npm @alfa.life.mapp/app.web |
Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses CVE-2026-12537, GHSA-wpqr-6v78-jr5g | Critical | 0.2% | 24 Apr, 2026 | GitHub Actions google-github-actions/run-gemini-cli npm @google/gemini-cli |
Malicious release: Malicious code in @m0ntana/app.web (npm) GHSA-m6jr-4x3f-2ph2, MAL-2026-3065 | Malicious | Not scored | 24 Apr, 2026 | npm @m0ntana/app.web |
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` CVE-2026-42044, GHSA-3w6x-2g7m-8v23 | Critical | 0.6% | 24 Apr, 2026 | npm axios |
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 CVE-2026-42043, GHSA-pmwg-cvhr-8vh7 | Critical | 0.7% | 24 Apr, 2026 | npm axios |
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion CVE-2026-42042, GHSA-xx6v-rp6x-q39c | Medium | 0.2% | 24 Apr, 2026 | npm axios |
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy CVE-2026-42041, GHSA-w9j2-pvgh-6h63 | Medium | 0.7% | 24 Apr, 2026 | npm axios |
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams CVE-2026-42040, GHSA-xhjh-pmcv-23jw | Low | 0.2% | 24 Apr, 2026 | npm axios |
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data CVE-2026-42039, GHSA-62hf-57xw-28j9 | Medium | 0.8% | 24 Apr, 2026 | npm axios |
Axios: no_proxy bypass via IP alias allows SSRF CVE-2026-42038, GHSA-m7pr-hjqh-92cm | High | 0.3% | 24 Apr, 2026 | npm axios |
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream CVE-2026-42037, GHSA-445q-vr5w-6q77 | Medium | 0.3% | 24 Apr, 2026 | npm axios |
Axios: HTTP adapter streamed responses bypass maxContentLength CVE-2026-42036, GHSA-vf2m-468p-8v99 | Medium | 0.3% | 24 Apr, 2026 | npm axios |
Axios: Header Injection via Prototype Pollution CVE-2026-42035, GHSA-6chq-wfr3-2hj9 | High | 0.4% | 24 Apr, 2026 | npm axios |
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 CVE-2026-42034, GHSA-5c9x-8gcm-mpgx | Medium | 0.3% | 24 Apr, 2026 | npm axios |
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking CVE-2026-42033, GHSA-pf86-5x62-jrwf | High | 0.9% | 24 Apr, 2026 | npm axios |
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer CVE-2026-41680, GHSA-6v9c-7cg6-27q7 | High | 0.3% | 24 Apr, 2026 | npm marked |
Claude Code: Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution CVE-2026-40068, GHSA-q5hj-mxqh-vv77 | High | 0.3% | 24 Apr, 2026 | npm @anthropic-ai/claude-code |
Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover CVE-2026-42239, GHSA-4f9j-vr4p-642r | High | 0.3% | 24 Apr, 2026 | npm @budibase/backend-core |
RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions CVE-2026-42190, GHSA-m2m6-cff5-3w7c | Medium | 0.1% | 24 Apr, 2026 | npm rwsdk |
Malicious release: Malicious code in model-poc-suhail (npm) GHSA-cpqg-wgv2-g29r, MAL-2026-3030 | Malicious | Not scored | 24 Apr, 2026 | npm model-poc-suhail |
liquidjs has a Denial of Service via circular block reference in layout CVE-2026-41311, GHSA-4rc3-7j7w-m548 | High | 0.4% | 24 Apr, 2026 | npm liquidjs |
Malicious release: Malicious code in auth0-ui-components-docs (npm) GHSA-78cj-64p5-2wh5, MAL-2026-3024 | Malicious | Not scored | 24 Apr, 2026 | npm auth0-ui-components-docs |
Malicious release: Malicious code in next-rwa (npm) GHSA-qr67-r552-v99q, MAL-2026-3025 | Malicious | Not scored | 24 Apr, 2026 | npm next-rwa |
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output CVE-2026-41305, GHSA-qx2v-qp2m-jg93 | Medium | 0.2% | 24 Apr, 2026 | npm postcss |
Malicious release: Malicious code in wrapped-logger-utils (npm) GHSA-wm52-75j2-vmr3, MAL-2026-3027 | Malicious | Not scored | 24 Apr, 2026 | npm wrapped-logger-utils |
Malicious release: Malicious code in sagat-core (npm) GHSA-53hj-4c4g-2wqq, MAL-2026-3026 | Malicious | Not scored | 24 Apr, 2026 | npm sagat-core |
Malicious release: Malicious code in amplitude-ma-ts (npm) GHSA-987f-7782-4mjj, MAL-2026-3028 | Malicious | Not scored | 24 Apr, 2026 | npm amplitude-ma-ts |
OpenClaw: Slack thread context could include messages from non-allowlisted senders CVE-2026-41358, GHSA-qm77-8qjp-4vcm | Low | 0.1% | 23 Apr, 2026 | npm openclaw |
Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) CVE-2026-41321, GHSA-88gm-j2wx-58h6 | Low | 0.2% | 23 Apr, 2026 | npm @astrojs/cloudflare |
OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment CVE-2026-41900, GHSA-8h25-q488-4hxw | Critical | 0.9% | 23 Apr, 2026 | npm openlearnx |
Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers CVE-2026-33318, GHSA-prp4-2f49-fcgp | High | 0.5% | 23 Apr, 2026 | npm @actual-app/sync-server |
OpenClaw: Paired-device pairing actions were not limited to the caller device CVE-2026-41909, GHSA-xrq9-jm7v-g9h7 | Medium | 0.2% | 23 Apr, 2026 | npm openclaw |
OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization CVE-2026-41908, GHSA-v8qf-fr4g-28p2 | Low | 0.2% | 23 Apr, 2026 | npm openclaw |
Malicious release: Malicious code in lightspark-js (npm) MAL-2026-3021 | Malicious | Not scored | 23 Apr, 2026 | npm lightspark-js |
Malicious release: Malicious code in @bitwarden/cli (npm) GHSA-g98r-qjhg-4fmr, MAL-2026-3020 | Malicious | Not scored | 23 Apr, 2026 | npm @bitwarden/cli |
Malicious release: Malicious code in microsoft-employee-experience (npm) MAL-2026-3018 | Malicious | Not scored | 23 Apr, 2026 | npm microsoft-employee-experience |
Malicious release: Malicious code in hls.js (npm) GHSA-pq9g-f2rr-m4hw, MAL-2026-3019 | Malicious | Not scored | 23 Apr, 2026 | npm hls.js |
Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed CVE-2026-41322, GHSA-c57f-mm3j-27q9 | Medium | 0.3% | 23 Apr, 2026 | npm @astrojs/node |
Malicious release: Malicious code in react-spa-npm (npm) GHSA-5w76-h44f-4xfp, MAL-2026-3017 | Malicious | Not scored | 23 Apr, 2026 | npm react-spa-npm |
n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests CVE-2026-41495, GHSA-pfm2-2mhg-8wpx | Medium | 0.3% | 23 Apr, 2026 | npm n8n-mcp |
Malicious release: Malicious code in amazon-q-developer-streaming-client (npm) MAL-2026-3016 | Malicious | Not scored | 23 Apr, 2026 | npm amazon-q-developer-streaming-client |
Malicious release: Malicious code in eth-logger (npm) GHSA-fxxj-hw8x-wvvh, MAL-2026-3029 | Malicious | Not scored | 23 Apr, 2026 | npm eth-logger |
Malicious release: Malicious code in json-dec (npm) GHSA-3wh6-59mv-jpvw, MAL-2026-3007 | Malicious | Not scored | 23 Apr, 2026 | npm json-dec |