Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only) CVE-2026-82259, GHSA-fpg4-jhqr-589c | High | 0.5% | 28 Feb, 2026 | npm @sveltejs/kit |
@fastify/middie has Improper Path Normalization when Using Path-Scoped Middleware CVE-2026-2880, GHSA-8p85-9qpw-fwgw | High | 0.4% | 27 Feb, 2026 | npm @fastify/middie |
CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage CVE-2026-26862, GHSA-jfrq-hj9f-c8qx | High | 0.4% | 27 Feb, 2026 | npm clevertap-web-sdk |
CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function CVE-2026-26861, GHSA-j5mf-6rh3-rhgg | High | 0.2% | 27 Feb, 2026 | npm clevertap-web-sdk |
Nest has a Fastify URL Encoding Middleware Bypass CVE-2026-2293, GHSA-r4wm-x892-vjmx | High | 0.8% | 27 Feb, 2026 | npm @nestjs/platform-fastify |
Multer vulnerable to Denial of Service via incomplete cleanup CVE-2026-3304, GHSA-xf7r-hgr6-v32p | High | 0.7% | 27 Feb, 2026 | npm multer |
Multer vulnerable to Denial of Service via resource exhaustion CVE-2026-2359, GHSA-v52c-386h-88mc | High | 0.7% | 27 Feb, 2026 | npm multer |
Angular i18n vulnerable to Cross-Site Scripting CVE-2026-27970, GHSA-prjf-86w9-mfqv | High | 0.5% | 26 Feb, 2026 | npm @angular/core |
Koa has Host Header Injection via ctx.hostname CVE-2026-27959, GHSA-7gcc-r8m5-44qm | High | 0.4% | 26 Feb, 2026 | npm koa |
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions CVE-2026-27904, GHSA-23c5-xmqv-rm74 | High | 0.5% | 26 Feb, 2026 | npm minimatch |
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments CVE-2026-27903, GHSA-7r86-cg39-jmmj | High | 0.6% | 26 Feb, 2026 | npm minimatch |
TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist CVE-2026-27818, GHSA-w789-49fc-v8hr | High | 0.3% | 26 Feb, 2026 | npm terriajs-server |
n8n Vulnerable to Stored XSS via Various Nodes CVE-2026-27578, GHSA-2p9h-rqjw-gm92 | High | 0.2% | 25 Feb, 2026 | npm n8n |
Storybook Dev Server is Vulnerable to WebSocket Hijacking CVE-2026-27148, GHSA-mjf5-7g4m-gx5w | High | 0.6% | 25 Feb, 2026 | npm storybook |
n8n has Arbitrary File Read via Python Code Node Sandbox Escape CVE-2026-27494, GHSA-mmgg-m5j7-f83h | High | 0.4% | 25 Feb, 2026 | npm n8n |
LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader CVE-2026-27795, GHSA-mphv-75cg-56wg | High | 0.2% | 25 Feb, 2026 | npm @langchain/community |
Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize CVE-2026-27829, GHSA-cj9f-h6r6-4cx2 | High | 0.3% | 25 Feb, 2026 | npm @astrojs/node |
Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo CVE-2026-27700, GHSA-xh87-mx6m-69f3 | High | 0.3% | 25 Feb, 2026 | npm hono |
Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions CVE-2026-27610, GHSA-jhp4-jvq3-w5xr | High | 0.4% | 25 Feb, 2026 | npm parse-dashboard |
Parse Dashboard is Missing CSRF Protection for its Agent Endpoint CVE-2026-27609, GHSA-3534-xp88-25rc | High | 0.2% | 25 Feb, 2026 | npm parse-dashboard |
Rollup 4 has Arbitrary File Write via Path Traversal CVE-2026-27606, GHSA-mw96-cpmx-2vgc | High | 1.7% | 25 Feb, 2026 | npm rollup |
Astro has memory exhaustion DoS due to missing request body size limit in Server Actions CVE-2026-27729, GHSA-jm64-8m5q-4qh8 | High | 0.5% | 24 Feb, 2026 | npm @astrojs/node |
yapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent CVE-2025-70058, GHSA-663h-2vr3-ghrj | High | 0.2% | 23 Feb, 2026 | npm yapi-vendor |
OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace CVE-2026-32060, GHSA-r5fq-947m-xm57 | High | 0.8% | 19 Feb, 2026 | npm openclaw |
Feathers exposes internal headers via unencrypted session cookie CVE-2026-27193, GHSA-9m9c-vpv5-9g85 | High | 0.4% | 19 Feb, 2026 | npm @feathersjs/authentication-oauth |
Feathers has an origin validation bypass via prefix matching CVE-2026-27192, GHSA-mp4x-c34x-wv3x | High | 0.3% | 19 Feb, 2026 | npm @feathersjs/authentication-oauth |
Feathers has an open redirect in OAuth callback enables account takeover CVE-2026-27191, GHSA-ppf9-4ffw-hh4p | High | 0.3% | 19 Feb, 2026 | npm @feathersjs/authentication-oauth |
CPU exhaustion in SvelteKit remote form deserialization (experimental only) CVE-2026-82261, GHSA-88qp-p4qg-rqm6 | High | 0.5% | 19 Feb, 2026 | npm @sveltejs/kit |
Memory exhaustion in SvelteKit remote form deserialization (experimental only) CVE-2026-82260, GHSA-vrhm-gvg7-fpcf | High | 0.5% | 19 Feb, 2026 | npm @sveltejs/kit |
eBay API MCP Server Affected by Environment Variable Injection CVE-2026-27203, GHSA-97rm-xj73-33jh | High | 0.4% | 19 Feb, 2026 | npm ebay-mcp |
OpenClaw replaced a deprecated sandbox hash algorithm CVE-2026-28479, GHSA-fh3f-q9qw-93j9 | High | 0.2% | 19 Feb, 2026 | npm openclaw |
jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property) CVE-2026-25940, GHSA-p5xg-68wr-hm3m | High | 0.5% | 19 Feb, 2026 | npm jspdf |
jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method CVE-2026-25755, GHSA-9vjf-qc39-jprp | High | 1.0% | 19 Feb, 2026 | npm jspdf |
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions CVE-2026-25535, GHSA-67pg-wm7f-q7fj | High | 0.8% | 19 Feb, 2026 | npm jspdf |
Fabric.js Affected by Stored XSS via SVG Export CVE-2026-27013, GHSA-hfvx-25r5-qc3w | High | 0.3% | 18 Feb, 2026 | npm fabric |
OpenClaw: Docker container escape via unvalidated bind mount config injection CVE-2026-27002, GHSA-w235-x559-36mg | High | 0.5% | 18 Feb, 2026 | npm openclaw |
OpenClaw: Unsanitized CWD path injection into LLM prompts CVE-2026-27001, GHSA-2qj5-gwg2-xwc4 | High | 0.2% | 18 Feb, 2026 | npm openclaw |
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern CVE-2026-26996, GHSA-3ppc-4f35-3m26 | High | 0.6% | 18 Feb, 2026 | npm minimatch |
Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation CVE-2026-26318, GHSA-5vv4-hvf7-2h46 | High | 1.3% | 18 Feb, 2026 | npm systeminformation |
Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path CVE-2026-26280, GHSA-9c88-49p5-5ggf | High | 1.4% | 18 Feb, 2026 | npm systeminformation |
Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde CVE-2026-26974, GHSA-w7h5-55jg-cq2f | High | 0.6% | 18 Feb, 2026 | npm @tygo-van-den-hurk/slyde |
OpenClaw has an authentication bypass in sandbox browser bridge server CVE-2026-28468, GHSA-h9g4-589h-68xv | High | 0.2% | 18 Feb, 2026 | npm openclaw |
OpenClaw has two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension CVE-2026-28451, GHSA-x22m-j5qq-j49m | High | 0.3% | 18 Feb, 2026 | npm openclaw |
OpenClaw has a LFI in BlueBubbles media path handling CVE-2026-29611, GHSA-rwj8-p9vq-25gv | High | 0.3% | 18 Feb, 2026 | npm openclaw |
OpenClaw: Prevent shell injection in macOS keychain credential write CVE-2026-27487, GHSA-4564-pvr2-qq4h | High | 1.4% | 18 Feb, 2026 | npm openclaw |
OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writes CVE-2026-28462, GHSA-gq9c-wg68-gwj2 | High | 0.5% | 18 Feb, 2026 | npm openclaw |
OpenClaw affected by potential code execution via unsafe hook module path handling in Gateway CVE-2026-28456, GHSA-v6c6-vqqg-w888 | High | 0.5% | 18 Feb, 2026 | npm openclaw |
OpenClaw's unsanitized session ID enables path traversal in transcript file operations CVE-2026-28482, GHSA-5xfq-5mr7-426q | High | 0.2% | 18 Feb, 2026 | npm openclaw |
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction CVE-2026-26960, GHSA-83g3-92jg-28cx | High | 0.3% | 18 Feb, 2026 | npm tar |
OpenClaw inter-session prompts could be treated as direct user instructions GHSA-w5c7-9qqw-6645 | High | Not scored | 18 Feb, 2026 | npm openclaw |