Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Electron: Crash in clipboard.readImage() on malformed clipboard image data CVE-2026-34781, GHSA-f37v-82c4-4x64 | Low | 0.1% | 07 Apr, 2026 | npm electron |
Electron: Named window.open targets not scoped to the opener's browsing context CVE-2026-34765, GHSA-f3pv-wv63-48x8 | High | 0.3% | 07 Apr, 2026 | npm electron |
Malicious release: Malicious code in @aspect-security/argon2 (npm) GHSA-4fc4-v9cp-846x, MAL-2026-2505 | Malicious | Not scored | 07 Apr, 2026 | npm @aspect-security/argon2 |
Malicious release: Malicious code in argon2-napi (npm) MAL-2026-2511 | Malicious | Not scored | 07 Apr, 2026 | npm argon2-napi |
Malicious release: Malicious code in @langgraphjs/toolkit (npm) GHSA-pq32-2vxj-cr62, MAL-2026-2509 | Malicious | Not scored | 07 Apr, 2026 | npm @langgraphjs/toolkit |
Malicious release: Malicious code in devkitx (npm) GHSA-x77g-g3p5-frhh, MAL-2026-2871 | Malicious | Not scored | 07 Apr, 2026 | npm devkitx |
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling CVE-2026-39365, GHSA-4w7w-66w2-5vf9 | Medium | 0.9% | 06 Apr, 2026 | npm vite |
Vite: `server.fs.deny` bypassed with queries CVE-2026-39364, GHSA-v2wj-q39q-566r | High | 2.3% | 06 Apr, 2026 | npm vite |
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket CVE-2026-39363, GHSA-p9ff-h696-f583 | High | 3.4% | 06 Apr, 2026 | npm vite |
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection') CVE-2026-35515, GHSA-36xv-jgw5-4q75 | Medium | 0.2% | 06 Apr, 2026 | npm @nestjs/core |
Malicious release: Malicious code in frontend-backoffice (npm) MAL-2026-2525 | Malicious | Not scored | 06 Apr, 2026 | npm frontend-backoffice |
Malicious release: Malicious code in use-form-builder-plugin (npm) GHSA-pj48-5mp2-8r94, MAL-2026-2529 | Malicious | Not scored | 06 Apr, 2026 | npm use-form-builder-plugin |
Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution CVE-2026-34148, GHSA-gm9m-gwc4-hwgp | High | 0.6% | 06 Apr, 2026 | npm @fedify/fedify npm @fedify/vocab-runtime |
Malicious release: Malicious code in a2a-chat-canvas (npm) GHSA-pf4w-8h65-5h66, MAL-2026-2524 | Malicious | Not scored | 06 Apr, 2026 | npm a2a-chat-canvas |
Malicious release: Malicious code in request-js-validator (npm) GHSA-wrcq-4545-xm9w, MAL-2026-2526 | Malicious | Not scored | 06 Apr, 2026 | npm request-js-validator |
Malicious release: Malicious code in nerite-security-audit (npm) MAL-2026-2499 | Malicious | Not scored | 06 Apr, 2026 | npm nerite-security-audit |
Malicious release: Malicious code in totally-safe-util (npm) MAL-2026-2500 | Malicious | Not scored | 06 Apr, 2026 | npm totally-safe-util |
Malicious release: Malicious code in df-sandbox-test (npm) GHSA-89fq-wqxj-rcpg, MAL-2026-2498 | Malicious | Not scored | 06 Apr, 2026 | npm df-sandbox-test |
Malicious release: Malicious code in commerce-utils (npm) MAL-2026-2497 | Malicious | Not scored | 06 Apr, 2026 | npm commerce-utils |
Malicious release: Malicious code in chess-sec-ssrf1 (npm) MAL-2026-2496 | Malicious | Not scored | 06 Apr, 2026 | npm chess-sec-ssrf1 |
@elgentos/magento2-dev-mcp vulnerable to command injection CVE-2026-5603, GHSA-xqv9-qr76-hfq2 | Low | 0.9% | 05 Apr, 2026 | npm @elgentos/magento2-dev-mcp |
@nor2/heim-mcp vulnerable to command injection CVE-2026-5602, GHSA-wx4p-jr66-jfp9 | Low | 0.9% | 05 Apr, 2026 | npm @nor2/heim-mcp |
Malicious release: Malicious code in cloudera (npm) MAL-2026-2495 | Malicious | Not scored | 05 Apr, 2026 | npm cloudera |
Malicious release: Malicious code in cloudera-poc (npm) MAL-2026-2493 | Malicious | Not scored | 05 Apr, 2026 | npm cloudera-poc |
Malicious release: Malicious code in admin0911 (npm) GHSA-hr5g-wqxg-m42m, MAL-2026-2492 | Malicious | Not scored | 05 Apr, 2026 | npm admin0911 |
Malicious release: Malicious code in @not-nemo/crypto-tracker (npm) GHSA-hv5v-f7p3-36rp, MAL-2026-2491 | Malicious | Not scored | 05 Apr, 2026 | npm @not-nemo/crypto-tracker |
Malicious release: Malicious code in @needl-ai/common (npm) MAL-2026-2716 | Malicious | Not scored | 05 Apr, 2026 | npm @needl-ai/common |
defu: Prototype pollution via `__proto__` key in defaults argument CVE-2026-35209, GHSA-737v-mqg7-c878 | High | 0.4% | 04 Apr, 2026 | npm defu |
Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries CVE-2026-35442, GHSA-38hg-ww64-rrwc | High | 0.3% | 04 Apr, 2026 | npm directus |
Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver GHSA-6q22-g298-grjh | High | Not scored | 04 Apr, 2026 | npm directus |
Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits CVE-2026-35441, GHSA-ph52-67fq-75wj | Medium | 0.4% | 04 Apr, 2026 | npm directus |
Directus: Sensitive fields exposed in revision history CVE-2026-39943, GHSA-mvv8-v4jj-g47j | Medium | 0.2% | 04 Apr, 2026 | npm directus |
Directus: TUS Upload Authorization Bypass Allows Arbitrary File Overwrite CVE-2026-35412, GHSA-qqmv-5p3g-px89 | High | 0.3% | 04 Apr, 2026 | npm directus |
Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import CVE-2026-35409, GHSA-wv3h-5fx7-966h | High | 0.3% | 04 Apr, 2026 | npm directus |
Directus: GraphQL Schema SDL Disclosure Setting CVE-2026-35413, GHSA-wxwm-3fxv-mrvx | Medium | 0.3% | 04 Apr, 2026 | npm directus |
Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow CVE-2026-35410, GHSA-cf45-hxwj-4cfj | Medium | 0.3% | 04 Apr, 2026 | npm directus |
Directus: Open Redirect in Admin 2FA Setup Page CVE-2026-35411, GHSA-q75c-4gmv-mg9x | Medium | 0.3% | 04 Apr, 2026 | npm directus |
Directus: Path Traversal and Broken Access Control in File Management API CVE-2026-39942, GHSA-393c-p46r-7c95 | High | 0.2% | 04 Apr, 2026 | npm directus |
Directus: Missing Cross-Origin Opener Policy CVE-2026-35408, GHSA-8m32-p958-jg99 | Critical | 0.2% | 04 Apr, 2026 | npm directus |
@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url CVE-2026-35394, GHSA-5qhv-x9j4-c3vm | High | 0.4% | 04 Apr, 2026 | npm @mobilenext/mobile-mcp |
@stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags CVE-2026-106447, GHSA-5jg4-p4qw-cgfr | High | 0.5% | 04 Apr, 2026 | npm @stablelib/cbor |
@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding CVE-2026-106448, GHSA-w48f-fwg7-ww6p | High | 0.4% | 04 Apr, 2026 | npm @stablelib/cbor |
@hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing CVE-2026-115728, CVE-2026-35213, GHSA-jg4p-7fhp-p32p | High | 0.5% | 04 Apr, 2026 | npm @hapi/content |
Parse Server: File upload Content-Type override via extension mismatch BIT-parse-2026-35200, CVE-2026-35200, GHSA-vr5f-2r24-w5hc | Low | 0.2% | 04 Apr, 2026 | npm parse-server |
fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation) CVE-2026-35042, GHSA-hm7r-c7qw-ghp6 | High | 0.2% | 03 Apr, 2026 | npm fast-jwt |
Electron: Use-after-free in offscreen shared texture release() callback CVE-2026-34764, GHSA-8x5q-pvf5-64mp | Medium | 0.1% | 03 Apr, 2026 | npm electron |
SandboxJS: Sandbox Escape via Prop Object Leak in New Handler CVE-2026-34217, GHSA-hg73-4w7g-q96w | Medium | 0.3% | 03 Apr, 2026 | npm @nyariv/sandboxjs |
SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser CVE-2026-34211, GHSA-8pfc-jjgw-6g26 | Medium | 0.4% | 03 Apr, 2026 | npm @nyariv/sandboxjs |
SandboxJS: Sandbox integrity escape CVE-2026-34208, GHSA-2gg9-6p7w-6cpj | Critical | 0.6% | 03 Apr, 2026 | npm @nyariv/sandboxjs |
OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter CVE-2026-34511, GHSA-9jpj-g8vv-j5mf | High | 0.2% | 03 Apr, 2026 | npm openclaw |