Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Flowise: File Upload Validation Bypass in createAttachment CVE-2026-41269, GHSA-rh7v-6w34-w2rr | High | 0.5% | 16 Apr, 2026 | npm flowise |
Flowise: Parameter Override Bypass Remote Command Execution CVE-2026-41268, GHSA-cvrr-qhgw-2mm6 | Critical | 17.4% | 16 Apr, 2026 | npm flowise npm flowise-components |
Flowise: Sensitive Data Leak in public-chatbotConfig CVE-2026-41266, GHSA-4jpm-cgx2-8h37 | High | 4.1% | 16 Apr, 2026 | npm flowise |
Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association CVE-2026-41267, GHSA-48m6-ch88-55mj | Critical | 0.3% | 16 Apr, 2026 | npm flowise |
Flowise: Code Injection in CSVAgent leads to Authenticated RCE CVE-2026-41137, GHSA-9wc7-mj3f-74xv | Critical | 1.5% | 16 Apr, 2026 | npm flowise npm flowise-components |
Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`. CVE-2026-41138, GHSA-f228-chmx-v6j6 | High | 0.6% | 16 Apr, 2026 | npm flowise npm flowise-components |
basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() CVE-2026-41324, GHSA-rp42-5vxx-qpwr | High | 0.3% | 16 Apr, 2026 | npm basic-ftp |
Official Clerk JavaScript SDKs: Middleware-based route protection bypass CVE-2026-41248, GHSA-vqx2-fgx2-5wq9 | Critical | 0.3% | 16 Apr, 2026 | npm @clerk/astro npm @clerk/nextjs npm @clerk/nuxt npm @clerk/shared |
electerm: electerm_install_script_CommandInjection Vulnerability Report CVE-2026-41500, GHSA-wxw2-rwmh-vr8f | Critical | 1.6% | 16 Apr, 2026 | npm electerm |
Flowise Execute Flow function has an SSRF vulnerability CVE-2026-56275, GHSA-9hrv-gvrv-6gf2 | Medium | 0.3% | 16 Apr, 2026 | npm flowise npm flowise-components |
Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) CVE-2026-43995, GHSA-qqvm-66q4-vf5c | Medium | 0.4% | 16 Apr, 2026 | npm flowise npm flowise-components |
Flowise: Path Traversal in Vector Store basePath CVE-2026-56273, GHSA-w6v6-49gh-mc9w | Medium | 0.5% | 16 Apr, 2026 | npm flowise npm flowise-components |
Flowise: Weak Default Token Hash Secret CVE-2026-56269, GHSA-m7mq-85xj-9x33 | Medium | 0.1% | 16 Apr, 2026 | npm flowise |
Flowise: Weak Default Express Session Secret CVE-2026-56278, GHSA-2qqc-p94c-hxwh | Critical | 0.5% | 16 Apr, 2026 | npm flowise |
Flowise: Weak Default JWT Secrets CVE-2026-56271, GHSA-cc4f-hjpj-g9p8 | Critical | 0.7% | 16 Apr, 2026 | npm flowise |
Flowise: Unauthenticated Information Disclosure of OAuth Secrets (Cleartext) via GET Request CVE-2026-56270, GHSA-6pcv-j4jx-m4vx | High | 2.0% | 16 Apr, 2026 | npm flowise |
OpenClaw: TOCTOU read in exec script preflight CVE-2026-43529, GHSA-gj9q-8w99-mp8j | Low | 0.1% | 16 Apr, 2026 | npm openclaw |
Flowise: Authenticated RCE Via MCP Adapters CVE-2026-40933, GHSA-c9gw-hvqq-f33r | Critical | 12.0% | 16 Apr, 2026 | npm flowise npm flowise-components |
PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart CVE-2026-41180, GHSA-533q-w4g6-5586 | High | 0.4% | 16 Apr, 2026 | npm psitransfer |
Mojic: Observable Timing Discrepancy in HMAC Verification CVE-2026-41244, GHSA-wqq3-wfmp-v85g | Medium | 0.1% | 16 Apr, 2026 | npm mojic |
@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes CVE-2026-41213, GHSA-jhm7-29pj-4xvf | Medium | 0.3% | 16 Apr, 2026 | npm @node-oauth/oauth2-server |
MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport CVE-2026-39313, GHSA-353c-v8x9-v7c3 | High | 0.5% | 16 Apr, 2026 | npm mcp-framework |
Malicious release: Malicious code in chai-as-ide (npm) GHSA-53p3-r84h-8pj3, MAL-2026-2890 | Malicious | Not scored | 16 Apr, 2026 | npm chai-as-ide |
Malicious release: Malicious code in chai-as-init (npm) GHSA-7cq2-px9f-cq3g, MAL-2026-2891 | Malicious | Not scored | 16 Apr, 2026 | npm chai-as-init |
Malicious release: Malicious code in chai-as-optimized (npm) GHSA-g99c-rjxw-f6jg, MAL-2026-2895 | Malicious | Not scored | 16 Apr, 2026 | npm chai-as-optimized |
Malicious release: Malicious code in lightweight-charts-4.1 (npm) MAL-2026-2817 | Malicious | Not scored | 16 Apr, 2026 | npm lightweight-charts-4.1 |
Malicious release: Malicious code in modern-events (npm) GHSA-wwr2-883g-52c2, MAL-2026-2914 | Malicious | Not scored | 16 Apr, 2026 | npm modern-events |
@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option CVE-2026-33804, GHSA-v9ww-2j6r-98q6 | Critical | 0.3% | 16 Apr, 2026 | npm @fastify/middie |
@fastify/static vulnerable to path traversal in directory listing CVE-2026-6410, GHSA-pr96-94w5-mx2h | Medium | 0.5% | 16 Apr, 2026 | npm @fastify/static |
@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes CVE-2026-6270, GHSA-72c6-fx6q-fr5w | Critical | 0.5% | 16 Apr, 2026 | npm @fastify/middie |
Malicious release: Malicious code in sanitize-url (npm) MAL-2026-2701 | Malicious | Not scored | 16 Apr, 2026 | npm sanitize-url |
@fastify/static vulnerable to route guard bypass via encoded path separators CVE-2026-6414, GHSA-x428-ghpx-8j92 | Medium | 0.4% | 16 Apr, 2026 | npm @fastify/static |
Malicious release: Malicious code in conventional-changelog-dash (npm) MAL-2026-2700 | Malicious | Not scored | 16 Apr, 2026 | npm conventional-changelog-dash |
Malicious release: Malicious code in youpin (npm) MAL-2026-2806 | Malicious | Not scored | 16 Apr, 2026 | npm youpin |
Malicious release: Malicious code in winston-prisma (npm) MAL-2026-2805 | Malicious | Not scored | 16 Apr, 2026 | npm winston-prisma |
Malicious release: Malicious code in transcript-viewer-ui-demo (npm) MAL-2026-2804 | Malicious | Not scored | 16 Apr, 2026 | npm transcript-viewer-ui-demo |
Malicious release: Malicious code in tailwind-configuration (npm) MAL-2026-2803 | Malicious | Not scored | 16 Apr, 2026 | npm tailwind-configuration |
Malicious release: Malicious code in synthetics-sdk-node (npm) MAL-2026-2802 | Malicious | Not scored | 16 Apr, 2026 | npm synthetics-sdk-node |
Malicious release: Malicious code in sfx-data (npm) MAL-2026-2801 | Malicious | Not scored | 16 Apr, 2026 | npm sfx-data |
Malicious release: Malicious code in separadordeinfo (npm) MAL-2026-2800 | Malicious | Not scored | 16 Apr, 2026 | npm separadordeinfo |
Malicious release: Malicious code in rtxaspnet (npm) MAL-2026-2799 | Malicious | Not scored | 16 Apr, 2026 | npm rtxaspnet |
Malicious release: Malicious code in request-easy-validator (npm) GHSA-6h5g-9vvm-x5jj, MAL-2026-2798 | Malicious | Not scored | 16 Apr, 2026 | npm request-easy-validator |
Malicious release: Malicious code in relion-node (npm) MAL-2026-2797 | Malicious | Not scored | 16 Apr, 2026 | npm relion-node |
Malicious release: Malicious code in relion-chain (npm) MAL-2026-2796 | Malicious | Not scored | 16 Apr, 2026 | npm relion-chain |
Malicious release: Malicious code in react-appfabric-shell (npm) MAL-2026-2795 | Malicious | Not scored | 16 Apr, 2026 | npm react-appfabric-shell |
Malicious release: Malicious code in puzzle-fragment (npm) MAL-2026-2794 | Malicious | Not scored | 16 Apr, 2026 | npm puzzle-fragment |
Malicious release: Malicious code in pil2-stark-js (npm) MAL-2026-2793 | Malicious | Not scored | 16 Apr, 2026 | npm pil2-stark-js |
Malicious release: Malicious code in pil2-proofman-js (npm) MAL-2026-2792 | Malicious | Not scored | 16 Apr, 2026 | npm pil2-proofman-js |
Malicious release: Malicious code in payments-ui (npm) MAL-2026-2791 | Malicious | Not scored | 16 Apr, 2026 | npm payments-ui |
Malicious release: Malicious code in package-with-import-assertions (npm) MAL-2026-2790 | Malicious | Not scored | 16 Apr, 2026 | npm package-with-import-assertions |