Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in json-spacer (npm) GHSA-hp4j-fxr5-4x88, MAL-2026-3008 | Malicious | Not scored | 23 Apr, 2026 | npm json-spacer |
Malicious release: Malicious code in changelog-cli-logger (npm) GHSA-43cm-q339-rpw7, MAL-2026-3005 | Malicious | Not scored | 23 Apr, 2026 | npm changelog-cli-logger |
Malicious release: Malicious code in changelog-utils-structured-logger (npm) GHSA-668m-2g35-3g72, MAL-2026-3006 | Malicious | Not scored | 23 Apr, 2026 | npm changelog-utils-structured-logger |
Malicious release: Malicious code in @nklkas/hyperliquid (npm) GHSA-p9qm-9r6f-v25r, MAL-2026-3004 | Malicious | Not scored | 23 Apr, 2026 | npm @nklkas/hyperliquid |
Malicious release: Malicious code in undicy-http (npm) GHSA-26cf-6cvr-mv4x, MAL-2026-3013 | Malicious | Not scored | 23 Apr, 2026 | npm undicy-http |
Malicious release: Malicious code in separadordeinfocc (npm) GHSA-8p9h-5jx3-gx7v, MAL-2026-3010 | Malicious | Not scored | 23 Apr, 2026 | npm separadordeinfocc |
Malicious release: Malicious code in vime-azl (npm) GHSA-3r8p-pjjh-h967, MAL-2026-3014 | Malicious | Not scored | 23 Apr, 2026 | npm vime-azl |
Malicious release: Malicious code in ts-bing (npm) GHSA-8fcp-g97g-6pwj, MAL-2026-3011 | Malicious | Not scored | 23 Apr, 2026 | npm ts-bing |
Malicious release: Malicious code in rollup-plugin-polyfill-route (npm) GHSA-9f4f-7957-69m9, MAL-2026-3009 | Malicious | Not scored | 23 Apr, 2026 | npm rollup-plugin-polyfill-route |
Malicious release: Malicious code in @amsterdam-local/forms-component-library (npm) GHSA-7w6c-9hfw-6385, MAL-2026-3003 | Malicious | Not scored | 23 Apr, 2026 | npm @amsterdam-local/forms-component-library |
Malicious release: Malicious code in ts-moduler (npm) GHSA-mq2j-jgm4-q5vv, MAL-2026-3012 | Malicious | Not scored | 23 Apr, 2026 | npm ts-moduler |
copilot-api has Reliance on Reverse DNS Resolution for a Security-Critical Action CVE-2026-6874, GHSA-3vr4-cvmg-7fx4 | Low | 0.3% | 23 Apr, 2026 | npm copilot-api |
Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write CVE-2026-42075, GHSA-r466-rxw4-3j9j | High | 0.6% | 22 Apr, 2026 | npm @evomap/evolver |
Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution CVE-2026-42076, GHSA-j5w5-568x-rq53 | Critical | 1.7% | 22 Apr, 2026 | npm @evomap/evolver |
Evolver has Prototype Pollution via `Object.assign()` in its mailbox store operations CVE-2026-42077, GHSA-2cjr-5v3h-v2w4 | Medium | 0.2% | 22 Apr, 2026 | npm @evomap/evolver |
Malicious release: Malicious code in @spinstorm/shared (npm) MAL-2026-2998 | Malicious | Not scored | 22 Apr, 2026 | npm @spinstorm/shared |
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided CVE-2026-41907, CVE-2026-41988, GHSA-w5hq-g745-h8pq | High | 0.4% | 22 Apr, 2026 | npm uuid |
MCPHub has Path Traversal via Malicious MCPB Manifest Name CVE-2026-79743, GHSA-p3h2-2j4p-p83g | High | 0.5% | 22 Apr, 2026 | npm @samanhappy/mcphub |
locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor CVE-2026-41886, GHSA-w937-fg2h-xhq2 | High | 0.1% | 22 Apr, 2026 | npm locize |
i18next-locize-backend has URL Injection via Unsanitized Path Parameters CVE-2026-41885, GHSA-mgcp-mfp8-3q45 | Medium | 0.2% | 22 Apr, 2026 | npm i18next-locize-backend |
i18next-http-middleware: HTTP response splitting and DoS via unsanitised Content-Language header CVE-2026-41683, GHSA-c3h8-g69v-pjrg | High | 0.3% | 22 Apr, 2026 | npm i18next-http-middleware |
xmldom: Uncontrolled recursion in XML serialization leads to DoS CVE-2026-41673, GHSA-2v35-w6hq-6mfw | High | 0.6% | 22 Apr, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom has XML injection through unvalidated DocumentType serialization CVE-2026-41674, GHSA-f6ww-3ggp-fr8h | High | 0.6% | 22 Apr, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom has XML node injection through unvalidated processing instruction serialization CVE-2026-41675, GHSA-x6wf-f3px-wcqx | High | 0.5% | 22 Apr, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom has XML node injection through unvalidated comment serialization CVE-2026-41672, GHSA-j759-j44w-7fr8 | High | 0.5% | 22 Apr, 2026 | npm @xmldom/xmldom npm xmldom |
@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading CVE-2026-41640, GHSA-4948-f92q-f432 | High | 1.9% | 22 Apr, 2026 | npm @nocobase/database |
@nocobase/plugin-collection-sql: SQL Validation Bypass Through Missing `checkSQL` Call CVE-2026-41641, GHSA-wrwh-c28m-9jjh | High | 1.8% | 22 Apr, 2026 | npm @nocobase/plugin-collection-sql |
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters CVE-2026-41650, GHSA-gh4j-gqv2-49f6 | Medium | 0.2% | 22 Apr, 2026 | npm fast-xml-parser |
Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping CVE-2026-41591, GHSA-x9fj-57fh-c8wq | Medium | 0.2% | 22 Apr, 2026 | npm @marko/runtime-tags npm marko |
i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite CVE-2026-41693, GHSA-8847-338w-5hcj | High | 0.3% | 22 Apr, 2026 | npm i18next-fs-backend |
i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes CVE-2026-41692, GHSA-6457-mxpq-4fqq | Medium | 0.1% | 22 Apr, 2026 | npm i18nextify |
i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns CVE-2026-41691, GHSA-q89c-q3h5-w34g | Critical | 0.3% | 22 Apr, 2026 | npm i18next-http-backend |
i18next-http-middleware: Prototype pollution and path traversal via user-controlled language and namespace parameters CVE-2026-41690, GHSA-5fgg-jcpf-8jjw | High | 0.3% | 22 Apr, 2026 | npm i18next-http-middleware |
DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) CVE-2026-41240, GHSA-h7mw-gpvr-xq4m | Medium | 0.3% | 22 Apr, 2026 | npm dompurify |
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode CVE-2026-41239, GHSA-crv5-9vww-q3g8 | Medium | 0.2% | 22 Apr, 2026 | npm dompurify |
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback CVE-2026-41238, GHSA-v9jr-rg53-9pgp | Medium | 0.3% | 22 Apr, 2026 | npm dompurify |
Malicious release: Malicious code in @stlm/common-ui (npm) GHSA-694m-qj2w-cp8j, MAL-2026-2997 | Malicious | Not scored | 22 Apr, 2026 | npm @stlm/common-ui |
engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection GHSA-2r2p-4cgf-hv7h | High | Not scored | 22 Apr, 2026 | npm engramx |
Malicious release: Malicious code in sparkling-sdk (npm) GHSA-hw2r-2jh6-9mqr, MAL-2026-2996 | Malicious | Not scored | 22 Apr, 2026 | npm sparkling-sdk |
Malicious release: Malicious code in color-studio (npm) GHSA-qcph-mvf5-hgf2, MAL-2026-2995 | Malicious | Not scored | 22 Apr, 2026 | npm color-studio |
@saltcorn/data: Tenant user role is used for tenant creation role check GHSA-9237-rg5p-rhfw | High | Not scored | 22 Apr, 2026 | npm @saltcorn/data |
Malicious release: Malicious code in @openwebconcept/design-tokens (npm) GHSA-gj25-264w-qww3, MAL-2026-2993 | Malicious | Not scored | 22 Apr, 2026 | npm @openwebconcept/design-tokens |
Malicious release: Malicious code in @openwebconcept/theme-owc (npm) GHSA-wqjr-fc46-m68m, MAL-2026-2994 | Malicious | Not scored | 22 Apr, 2026 | npm @openwebconcept/theme-owc |
Malicious release: Malicious code in @automagik/genie (npm) GHSA-ppw4-42v6-538v, MAL-2026-2992 | Malicious | Not scored | 22 Apr, 2026 | npm @automagik/genie |
Malicious release: Malicious code in pgserve (npm) GHSA-v892-cmx2-hjq8, MAL-2026-2991 | Malicious | Not scored | 22 Apr, 2026 | npm pgserve |
Malicious release: Malicious code in @bmg-web/bmg-dialog (npm) MAL-2026-2985 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-dialog |
Malicious release: Malicious code in @bmg-web/bmg-checkbox (npm) MAL-2026-2983 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-checkbox |
Malicious release: Malicious code in etsyapp (npm) MAL-2026-2990 | Malicious | Not scored | 22 Apr, 2026 | npm etsyapp |
Malicious release: Malicious code in @bmg-web/bmg-collapse (npm) MAL-2026-2984 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-collapse |
Malicious release: Malicious code in @bmg-web/bmg-grid (npm) MAL-2026-2988 | Malicious | Not scored | 22 Apr, 2026 | npm @bmg-web/bmg-grid |