Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets CVE-2026-40895, GHSA-r4q5-vmmm-2653 | Medium | 0.5% | 14 Apr, 2026 | npm follow-redirects |
Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport) CVE-2026-40879, GHSA-hpwf-8g29-85qm | High | 0.3% | 14 Apr, 2026 | npm @nestjs/microservices |
Malicious release: Malicious code in getcardslib (npm) GHSA-4xvr-7wr9-qrcg, MAL-2026-2626 | Malicious | Not scored | 14 Apr, 2026 | npm getcardslib |
SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-ssh GHSA-p4h8-56qp-hpgv | High | Not scored | 14 Apr, 2026 | npm @aiondadotcom/mcp-ssh |
Malicious release: Malicious code in magentaa11y (npm) GHSA-q8qr-982j-49vc, MAL-2026-2632 | Malicious | Not scored | 13 Apr, 2026 | npm magentaa11y |
DbGate has cross site scripting via the SVG Icon String Handler component CVE-2026-6216, GHSA-j8j5-7r4h-vj2g | Low | 0.2% | 13 Apr, 2026 | npm dbgate-web |
simple-git Affected by Command Execution via Option-Parsing Bypass CVE-2026-28291, GHSA-jcxm-m3jx-f287 | High | 0.8% | 13 Apr, 2026 | npm simple-git |
Malicious release: Malicious code in walmart-internal (npm) GHSA-99jf-pgvm-hcgv, MAL-2026-2621 | Malicious | Not scored | 13 Apr, 2026 | npm walmart-internal |
Malicious release: Malicious code in @op-microfrontends/config (npm) GHSA-5wh3-m924-8fcv, MAL-2026-2590 | Malicious | Not scored | 13 Apr, 2026 | npm @op-microfrontends/config |
Malicious release: Malicious code in @sports-api/api-sdk (npm) GHSA-9pvf-233v-3fvc, MAL-2026-2595 | Malicious | Not scored | 13 Apr, 2026 | npm @sports-api/api-sdk |
Malicious release: Malicious code in @ids-alpha/theme (npm) GHSA-c58p-p36f-4c6c, MAL-2026-2586 | Malicious | Not scored | 13 Apr, 2026 | npm @ids-alpha/theme |
Malicious release: Malicious code in @mx-shared/utils (npm) GHSA-cgm3-286g-f28r, MAL-2026-2589 | Malicious | Not scored | 13 Apr, 2026 | npm @mx-shared/utils |
Malicious release: Malicious code in @dtc-campaign-wizard/campaign-wizard (npm) GHSA-grww-phc3-vfc4, MAL-2026-2581 | Malicious | Not scored | 13 Apr, 2026 | npm @dtc-campaign-wizard/campaign-wizard |
Malicious release: Malicious code in @sage-active/ui (npm) GHSA-jrjx-8vfw-xg4h, MAL-2026-2593 | Malicious | Not scored | 13 Apr, 2026 | npm @sage-active/ui |
Malicious release: Malicious code in @kucoin-gbiz-next/tools (npm) GHSA-mq43-24p4-jg9f, MAL-2026-2587 | Malicious | Not scored | 13 Apr, 2026 | npm @kucoin-gbiz-next/tools |
Malicious release: Malicious code in @zgny/onboarding-consumer (npm) GHSA-pr9f-7wph-jc3x, MAL-2026-2597 | Malicious | Not scored | 13 Apr, 2026 | npm @zgny/onboarding-consumer |
Malicious release: Malicious code in @spreadjs/js-calc (npm) GHSA-qm3m-hmcx-f8x4, MAL-2026-2596 | Malicious | Not scored | 13 Apr, 2026 | npm @spreadjs/js-calc |
Malicious release: Malicious code in @spoonflower/ui (npm) GHSA-rj3m-9925-f57q, MAL-2026-2594 | Malicious | Not scored | 13 Apr, 2026 | npm @spoonflower/ui |
Malicious release: Malicious code in @relxui/react (npm) GHSA-wpp4-q8gj-wfv9, MAL-2026-2592 | Malicious | Not scored | 13 Apr, 2026 | npm @relxui/react |
Malicious release: Malicious code in @pes-ui/components (npm) GHSA-ww6q-42qg-c93c, MAL-2026-2591 | Malicious | Not scored | 13 Apr, 2026 | npm @pes-ui/components |
Malicious release: Malicious code in @hrb-web/nuxt (npm) GHSA-xqfw-gvgh-hp79, MAL-2026-2585 | Malicious | Not scored | 13 Apr, 2026 | npm @hrb-web/nuxt |
Malicious release: Malicious code in wm-plugin-wm-smart-tip-dont-embed-tooltip (npm) GHSA-463v-xhcf-mqpw, MAL-2026-2622 | Malicious | Not scored | 13 Apr, 2026 | npm wm-plugin-wm-smart-tip-dont-embed-tooltip |
Malicious release: Malicious code in @guards-lib/auth (npm) GHSA-649h-jv39-hh5v, MAL-2026-2582 | Malicious | Not scored | 13 Apr, 2026 | npm @guards-lib/auth |
Malicious release: Malicious code in @bookiply/core (npm) GHSA-8mf9-v5mc-4ch3, MAL-2026-2579 | Malicious | Not scored | 13 Apr, 2026 | npm @bookiply/core |
Malicious release: Malicious code in @amplify-js/datastore (npm) GHSA-cqpc-xhmp-qr76, MAL-2026-2574 | Malicious | Not scored | 13 Apr, 2026 | npm @amplify-js/datastore |
Malicious release: Malicious code in @hpcc/js-api (npm) GHSA-fgh2-xw72-9637, MAL-2026-2584 | Malicious | Not scored | 13 Apr, 2026 | npm @hpcc/js-api |
Malicious release: Malicious code in @bokehjs/core (npm) GHSA-j77c-vj44-wvq4, MAL-2026-2578 | Malicious | Not scored | 13 Apr, 2026 | npm @bokehjs/core |
Malicious release: Malicious code in @hmm-app/api (npm) GHSA-j8vp-wwjq-48wg, MAL-2026-2583 | Malicious | Not scored | 13 Apr, 2026 | npm @hmm-app/api |
Malicious release: Malicious code in @ascend-ops/web-client (npm) GHSA-pqfr-rjg4-pjg3, MAL-2026-2575 | Malicious | Not scored | 13 Apr, 2026 | npm @ascend-ops/web-client |
Malicious release: Malicious code in @aircall-ecosystem/integrations-msteams-frontend (npm) GHSA-rcxh-h57p-p3vc, MAL-2026-2573 | Malicious | Not scored | 13 Apr, 2026 | npm @aircall-ecosystem/integrations-msteams-frontend |
Malicious release: Malicious code in @cash-web/no-hardcoded-font-styles (npm) GHSA-vr8g-rf3p-m3gw, MAL-2026-2580 | Malicious | Not scored | 13 Apr, 2026 | npm @cash-web/no-hardcoded-font-styles |
Malicious release: Malicious code in stats-api-js-client (npm) GHSA-7vg9-wgj5-3cpj, MAL-2026-2607 | Malicious | Not scored | 13 Apr, 2026 | npm stats-api-js-client |
Malicious release: Malicious code in twilio-video.js (npm) GHSA-j373-p8fj-3gfq, MAL-2026-2610 | Malicious | Not scored | 13 Apr, 2026 | npm twilio-video.js |
Malicious release: Malicious code in trade-in-lib (npm) GHSA-m6r9-8g63-rpqp, MAL-2026-2609 | Malicious | Not scored | 13 Apr, 2026 | npm trade-in-lib |
Malicious release: Malicious code in ih-icon (npm) GHSA-mgvv-m58f-pv4w, MAL-2026-2604 | Malicious | Not scored | 13 Apr, 2026 | npm ih-icon |
Malicious release: Malicious code in ccn-common-react-library (npm) GHSA-p4qp-5cq3-7wp3, MAL-2026-2599 | Malicious | Not scored | 13 Apr, 2026 | npm ccn-common-react-library |
Malicious release: Malicious code in cms-site-api-js-client (npm) GHSA-q428-3gx7-pq9x, MAL-2026-2600 | Malicious | Not scored | 13 Apr, 2026 | npm cms-site-api-js-client |
Malicious release: Malicious code in babel-plugin-fbtee (npm) GHSA-q9p9-vqx4-g8jq, MAL-2026-2598 | Malicious | Not scored | 13 Apr, 2026 | npm babel-plugin-fbtee |
Malicious release: Malicious code in etsy-advocacy (npm) GHSA-rm5h-fvwx-q9x4, MAL-2026-2602 | Malicious | Not scored | 13 Apr, 2026 | npm etsy-advocacy |
Malicious release: Malicious code in kaltura-ngx-client (npm) GHSA-2cfm-8wwp-vpfx, MAL-2026-2605 | Malicious | Not scored | 13 Apr, 2026 | npm kaltura-ngx-client |
Malicious release: Malicious code in symphony-core (npm) GHSA-6vc2-8rcw-cxg8, MAL-2026-2608 | Malicious | Not scored | 13 Apr, 2026 | npm symphony-core |
Malicious release: Malicious code in mdb-react-sortable (npm) GHSA-99fw-xhm5-2382, MAL-2026-2606 | Malicious | Not scored | 13 Apr, 2026 | npm mdb-react-sortable |
Malicious release: Malicious code in experian-design-system-themes (npm) GHSA-qqrr-w9xm-5w7g, MAL-2026-2603 | Malicious | Not scored | 13 Apr, 2026 | npm experian-design-system-themes |
Malicious release: Malicious code in dwaiter-company-web (npm) GHSA-rv36-9mrp-x3ch, MAL-2026-2601 | Malicious | Not scored | 13 Apr, 2026 | npm dwaiter-company-web |
Malicious release: Malicious code in @b2b-portal/core (npm) GHSA-jj8x-58xf-9jwx, MAL-2026-2576 | Malicious | Not scored | 13 Apr, 2026 | npm @b2b-portal/core |
Malicious release: Malicious code in @b2b-portal/kit (npm) GHSA-rpg7-m5pq-947p, MAL-2026-2577 | Malicious | Not scored | 13 Apr, 2026 | npm @b2b-portal/kit |
Malicious release: Malicious code in pubnub-element (npm) GHSA-pccr-9vgc-6fx6, MAL-2026-2635 | Malicious | Not scored | 13 Apr, 2026 | npm pubnub-element |
Malicious release: Malicious code in babel-plugin-blocks (npm) GHSA-9h8x-6qpc-9v5g, MAL-2026-2631 | Malicious | Not scored | 13 Apr, 2026 | npm babel-plugin-blocks |
Malicious release: Malicious code in seaport-core-16 (npm) GHSA-xwxq-h8q6-2494, MAL-2026-2636 | Malicious | Not scored | 13 Apr, 2026 | npm seaport-core-16 |
Malicious release: Malicious code in markdownlint-rule-link-pattern (npm) GHSA-q3xp-j858-q9xf, MAL-2026-2633 | Malicious | Not scored | 13 Apr, 2026 | npm markdownlint-rule-link-pattern |