Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in strapi-plugin-blurhash (npm) GHSA-xvmq-9hxp-c2h5, MAL-2026-2452 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-blurhash |
Malicious release: Malicious code in strapi-plugin-advanced-uuid (npm) GHSA-cjvp-jrwf-6853, MAL-2026-2450 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-advanced-uuid |
Malicious release: Malicious code in strapi-plugin-guardarian-ext (npm) GHSA-cmqm-7h4x-mhj6, MAL-2026-2463 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-guardarian-ext |
Malicious release: Malicious code in strapi-plugin-health-check (npm) GHSA-4jjh-xhm5-454q, MAL-2026-2465 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-health-check |
Malicious release: Malicious code in strapi-plugin-debug-tools (npm) GHSA-g2g2-54v3-w4w2, MAL-2026-2459 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-debug-tools |
Malicious release: Malicious code in strapi-plugin-content-sync (npm) GHSA-252m-cq46-x44h, MAL-2026-2455 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-content-sync |
Malicious release: Malicious code in strapi-plugin-cms-tools (npm) GHSA-5746-8pgw-jwqj, MAL-2026-2453 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-cms-tools |
Malicious release: Malicious code in strapi-plugin-hextest (npm) GHSA-9vgr-gp6c-6937, MAL-2026-2466 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-hextest |
Malicious release: Malicious code in strapi-plugin-finseven (npm) GHSA-x87x-x3f6-6c94, MAL-2026-2461 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-finseven |
Malicious release: Malicious code in strapi-plugin-nordica (npm) GHSA-vq87-37pj-9m5x, MAL-2026-2471 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-nordica |
Malicious release: Malicious code in strapi-plugin-nordica-deep (npm) GHSA-g5q8-4vqv-7j3r, MAL-2026-2474 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-nordica-deep |
Malicious release: Malicious code in strapi-plugin-nordica-vhost (npm) GHSA-fh6c-8rm8-5vrq, MAL-2026-2480 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-nordica-vhost |
Malicious release: Malicious code in strapi-plugin-nordica-stage (npm) GHSA-rm69-7489-723j, MAL-2026-2477 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-nordica-stage |
Malicious release: Malicious code in strapi-plugin-nordica-recon (npm) GHSA-r72j-h2ch-g7fj, MAL-2026-2476 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-nordica-recon |
Malicious release: Malicious code in strapi-plugin-nordica-api (npm) GHSA-9fhj-rc6p-fcqh, MAL-2026-2472 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-nordica-api |
Malicious release: Malicious code in strapi-plugin-nordica-cms (npm) GHSA-xg9c-8cmg-rqc4, MAL-2026-2473 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-nordica-cms |
Malicious release: Malicious code in strapi-plugin-nordica-sync (npm) GHSA-g52f-m5hj-mvq3, MAL-2026-2478 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-nordica-sync |
Malicious release: Malicious code in strapi-plugin-nordica-lite (npm) GHSA-rp3x-p457-89c3, MAL-2026-2475 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-nordica-lite |
Malicious release: Malicious code in strapi-plugin-nordica-tools (npm) GHSA-x5wx-4wfp-cgcr, MAL-2026-2479 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-nordica-tools |
Malicious release: Malicious code in strapi-plugin-sitemap-gen (npm) GHSA-x667-8xrq-3578, MAL-2026-2484 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-sitemap-gen |
Malicious release: Malicious code in strapi-plugin-locale (npm) GHSA-pgmf-vf3w-pvxj, MAL-2026-2468 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-locale |
Malicious release: Malicious code in strapi-plugin-api (npm) GHSA-2m6v-vrwv-92cm, MAL-2026-2451 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-api |
Malicious release: Malicious code in strapi-plugin-notify (npm) GHSA-mwh4-gjrj-9rgf, MAL-2026-2481 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-notify |
Malicious release: Malicious code in strapi-plugin-form (npm) GHSA-pf45-rpxc-m3cv, MAL-2026-2462 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-form |
Malicious release: Malicious code in strapi-plugin-seed (npm) GHSA-ghwm-gm8w-v7pg, MAL-2026-2482 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-seed |
Malicious release: Malicious code in strapi-plugin-sync (npm) GHSA-cw8q-9647-qw7j, MAL-2026-2485 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-sync |
Malicious release: Malicious code in strapi-plugin-health (npm) GHSA-8c3v-gc8j-xp6p, MAL-2026-2464 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-health |
Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step CVE-2026-35216, GHSA-fcm4-4pj2-m5hf | Critical | 10.9% | 03 Apr, 2026 | npm @budibase/server |
Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write CVE-2026-35214, GHSA-2wfh-rcwf-wh23 | High | 0.6% | 03 Apr, 2026 | npm @budibase/server |
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist CVE-2026-31818, GHSA-7r9j-r86q-7g45 | Critical | 0.4% | 03 Apr, 2026 | npm @budibase/backend-core |
Budibase: Command Injection in Bash Automation Step CVE-2026-25044, GHSA-gjw9-34gf-rp6m | High | 0.5% | 03 Apr, 2026 | npm @budibase/server |
Malicious release: Malicious code in strapi-plugin-logger (npm) GHSA-3f9q-mrvh-3g67, MAL-2026-2469 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-logger |
Malicious release: Malicious code in strapi-plugin-monitor (npm) GHSA-6rm2-h43c-2ffc, MAL-2026-2470 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-monitor |
Malicious release: Malicious code in strapi-plugin-hooks (npm) GHSA-vgx9-mqvm-pp39, MAL-2026-2467 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-hooks |
Malicious release: Malicious code in strapi-plugin-core (npm) GHSA-rhv5-72hc-mr25, MAL-2026-2456 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-core |
Malicious release: Malicious code in strapi-plugin-database (npm) GHSA-443x-5qwf-wjj8, MAL-2026-2458 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-database |
Malicious release: Malicious code in strapi-plugin-server (npm) MAL-2026-2483 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-server |
Malicious release: Malicious code in strapi-plugin-config (npm) GHSA-vwr5-7896-9xg9, MAL-2026-2454 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-config |
Malicious release: Malicious code in strapi-plugin-cron (npm) GHSA-78qv-6mwc-4mxh, MAL-2026-2457 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-cron |
Malicious release: Malicious code in strapi-plugin-events (npm) GHSA-5w8f-g8w2-jp22, MAL-2026-2460 | Malicious | Not scored | 03 Apr, 2026 | npm strapi-plugin-events |
Malicious release: Malicious code in mgc (npm) GHSA-8g9r-2x3j-gf2w, MAL-2026-2449 | Malicious | Not scored | 03 Apr, 2026 | npm mgc |
Malicious release: Malicious code in @corpweb-ui/wmkt-library (npm) GHSA-hq2v-f3x5-v66m, MAL-2026-2446 | Malicious | Not scored | 03 Apr, 2026 | npm @corpweb-ui/wmkt-library |
Malicious release: Malicious code in @toprank/partner (npm) MAL-2026-2447 | Malicious | Not scored | 03 Apr, 2026 | npm @toprank/partner |
fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup) CVE-2026-35039, GHSA-rp9m-7r4c-75qg | Critical | 0.2% | 03 Apr, 2026 | npm fast-jwt |
DOMPurify ADD_ATTR predicate skips URI validation CVE-2026-65912, GHSA-cjmm-f4jc-qw8r | Medium | 0.3% | 03 Apr, 2026 | npm dompurify |
DOMPurify USE_PROFILES prototype pollution allows event handlers CVE-2026-65913, GHSA-cj63-jhhr-wcxv | Medium | 0.3% | 03 Apr, 2026 | npm dompurify |
Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache) CVE-2026-67337, GHSA-xg6x-h9c9-2m83 | Critical | 0.5% | 03 Apr, 2026 | npm better-auth |
OpenClaw: Discord voice ingress authorization can be bypassed via channel, name, and stale-role validation gaps CVE-2026-41382, GHSA-x2m8-53h4-6hch | Low | 0.2% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message CVE-2026-41341, GHSA-6336-qqw9-v6x6 | Low | 0.1% | 03 Apr, 2026 | npm openclaw |
OpenClaw: Endpoint persists after trust decline, leaking gateway credentials CVE-2026-41300, GHSA-9f4w-67g7-mqwv | Medium | 0.3% | 03 Apr, 2026 | npm openclaw |