Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
mppx has Stripe charge credential replay via missing idempotency check CVE-2026-34210, GHSA-8mhj-rffc-rcvw | Medium | 0.5% | 29 Mar, 2026 | npm mppx |
mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality CVE-2026-34209, GHSA-mv9j-8jvg-j8mr | High | 0.4% | 29 Mar, 2026 | npm mppx |
Malicious release: Malicious code in f0-state-manager (npm) MAL-2026-2287 | Malicious | Not scored | 29 Mar, 2026 | npm f0-state-manager |
Malicious release: Malicious code in merchservicingnodeserv (npm) MAL-2026-2288 | Malicious | Not scored | 29 Mar, 2026 | npm merchservicingnodeserv |
Malicious release: Malicious code in dial-app-version (npm) MAL-2026-2285 | Malicious | Not scored | 29 Mar, 2026 | npm dial-app-version |
Malicious release: Malicious code in bizsignupnodeweb (npm) MAL-2026-2284 | Malicious | Not scored | 29 Mar, 2026 | npm bizsignupnodeweb |
Malicious release: Malicious code in sn3akysnak3-test (npm) MAL-2026-2286 | Malicious | Not scored | 29 Mar, 2026 | npm sn3akysnak3-test |
Malicious release: Malicious code in @adac-fahrzeugplattform/ui (npm) GHSA-96gm-xh35-6xfw, MAL-2026-2282 | Malicious | Not scored | 29 Mar, 2026 | npm @adac-fahrzeugplattform/ui |
Malicious release: Malicious code in payerpath-customer-lib (npm) MAL-2026-2276 | Malicious | Not scored | 28 Mar, 2026 | npm payerpath-customer-lib |
Malicious release: Malicious code in autoshipment-public-front (npm) GHSA-qrhg-p488-7f87, MAL-2026-2274 | Malicious | Not scored | 28 Mar, 2026 | npm autoshipment-public-front |
Malicious release: Malicious code in npmamzs (npm) MAL-2026-2275 | Malicious | Not scored | 28 Mar, 2026 | npm npmamzs |
OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret CVE-2026-35628, GHSA-vcx4-4qxg-mfp4 | Medium | 0.3% | 27 Mar, 2026 | npm openclaw |
OpenClaw: BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System Events CVE-2026-35642, GHSA-mw7w-g3mg-xqm7 | Medium | 0.2% | 27 Mar, 2026 | npm openclaw |
OpenClaw: Matrix Verification Notices Bypass Matrix DM Policy and Reply to Unpaired DM Peers CVE-2026-35647, GHSA-9wqx-g2cw-vc7r | Medium | 0.3% | 27 Mar, 2026 | npm openclaw |
OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing CVE-2026-35623, GHSA-xq8g-hgh6-87hv | Medium | 0.4% | 27 Mar, 2026 | npm openclaw |
OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers CVE-2026-35669, GHSA-qm2m-28pf-hgjw | High | 0.3% | 27 Mar, 2026 | npm openclaw |
OpenClaw: Silent privilege escalation via gateway shared-auth reconnect CVE-2026-35625, GHSA-fqw4-mph7-2vr8 | Critical | 0.2% | 27 Mar, 2026 | npm openclaw |
OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin CVE-2026-35663, GHSA-9hjh-fr4f-gxc4 | Critical | 0.3% | 27 Mar, 2026 | npm openclaw |
OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding CVE-2026-34512, GHSA-9p93-7j67-5pc2 | High | 0.4% | 27 Mar, 2026 | npm openclaw |
Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies CVE-2026-34226, GHSA-w4gp-fjgq-3q4g | High | 0.5% | 27 Mar, 2026 | npm happy-dom |
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization CVE-2026-65914, GHSA-h8r8-wccr-v5f2 | Medium | 0.3% | 27 Mar, 2026 | npm dompurify |
Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host CVE-2026-34076, GHSA-gjxx-92w9-8v8f | High | 0.3% | 27 Mar, 2026 | npm @clerk/backend npm @clerk/express npm @clerk/fastify npm @clerk/hono |
@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools CVE-2026-33989, GHSA-3p2m-h2v6-g9mx | High | 0.5% | 27 Mar, 2026 | npm @mobilenext/mobile-mcp |
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options CVE-2026-33941, GHSA-xjpj-3mr7-gcpf | High | 0.3% | 27 Mar, 2026 | npm handlebars |
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial CVE-2026-33940, GHSA-xhpv-hc6g-r9c6 | High | 0.7% | 27 Mar, 2026 | npm handlebars |
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation CVE-2026-33939, GHSA-9cx6-37pm-9jff | High | 0.6% | 27 Mar, 2026 | npm handlebars |
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block CVE-2026-33938, GHSA-3mfm-83xf-c92r | High | 0.7% | 27 Mar, 2026 | npm handlebars |
Handlebars.js has JavaScript Injection via AST Type Confusion CVE-2026-33937, GHSA-2w6w-674q-4c4q | Critical | 1.9% | 27 Mar, 2026 | npm handlebars |
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects CVE-2026-34043, GHSA-qj8w-gfj5-8c6v | High | 0.5% | 27 Mar, 2026 | npm serialize-javascript |
n8n has XSS in its Credential Management Flow CVE-2026-56359, GHSA-364x-8g5j-x2pr | Medium | 0.2% | 27 Mar, 2026 | npm n8n |
n8n has XSS in Chat Trigger Node through Custom CSS CVE-2026-56356, GHSA-3c7f-5hgj-h279 | Medium | 0.3% | 27 Mar, 2026 | npm n8n |
n8n: Authenticated XSS and Open Redirect via Form Node CVE-2026-56354, GHSA-w673-8fjw-457c | Medium | 0.2% | 27 Mar, 2026 | npm n8n |
n8n has a Stored XSS Vulnerability in its Form Trigger CVE-2026-56358, GHSA-q4fm-pjq6-m63g | Medium | 0.2% | 27 Mar, 2026 | npm n8n |
Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521 CVE-2026-33994, GHSA-vc8f-x9pp-wf5p | Medium | 0.6% | 27 Mar, 2026 | npm locutus |
Locutus has Prototype Pollution via __proto__ Key Injection in unserialize() CVE-2026-33993, GHSA-4mph-v827-f877 | Medium | 0.6% | 27 Mar, 2026 | npm locutus |
Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk) CVE-2026-33979, GHSA-3843-rr4g-m8jq | High | 0.4% | 27 Mar, 2026 | npm express-xss-sanitizer |
Postiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader GHSA-89v5-38xr-9m4j | High | Not scored | 27 Mar, 2026 | npm postiz |
Postiz App has a High-Severity SSRF Vulnerability via Next.js GHSA-vj2p-7pgw-g2wf | High | Not scored | 27 Mar, 2026 | npm postiz |
Malicious release: Malicious code in current-context-urn (npm) MAL-2026-2258 | Malicious | Not scored | 27 Mar, 2026 | npm current-context-urn |
Malicious release: Malicious code in xpna-context (npm) MAL-2026-2257 | Malicious | Not scored | 27 Mar, 2026 | npm xpna-context |
Malicious release: Malicious code in shenxun162938 (npm) GHSA-c8v3-pvm5-9xx2, MAL-2026-2256 | Malicious | Not scored | 27 Mar, 2026 | npm shenxun162938 |
Malicious release: Malicious code in dgxeon-soket-buttonx (npm) GHSA-7xvw-wvqm-q57f, MAL-2026-2253 | Malicious | Not scored | 27 Mar, 2026 | npm dgxeon-soket-buttonx |
Malicious release: Malicious code in dgxeon-baileys (npm) GHSA-fjqf-7gvm-9qrq, MAL-2026-2252 | Malicious | Not scored | 27 Mar, 2026 | npm dgxeon-baileys |
Malicious release: Malicious code in chai-as-added (npm) GHSA-6r6x-95fj-pw48, MAL-2026-2249 | Malicious | Not scored | 27 Mar, 2026 | npm chai-as-added |
Malicious release: Malicious code in testtestsharp (npm) GHSA-7g34-jxp7-g7r3, MAL-2026-2251 | Malicious | Not scored | 27 Mar, 2026 | npm testtestsharp |
Malicious release: Malicious code in test1sharp (npm) GHSA-89p7-jcpx-6x86, MAL-2026-2250 | Malicious | Not scored | 27 Mar, 2026 | npm test1sharp |
Malicious release: Malicious code in @ev-tech/eva-container-api (npm) GHSA-gphq-fq72-qxwr, MAL-2026-2246 | Malicious | Not scored | 27 Mar, 2026 | npm @ev-tech/eva-container-api |
Malicious release: Malicious code in cua-primitives-server (npm) GHSA-jmx7-4g26-qp86, MAL-2026-2247 | Malicious | Not scored | 27 Mar, 2026 | npm cua-primitives-server |
Malicious release: Malicious code in shop-republik-ch (npm) GHSA-pjmv-p8w4-fjq5, MAL-2026-2248 | Malicious | Not scored | 27 Mar, 2026 | npm shop-republik-ch |
Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter CVE-2026-82854, GHSA-c7w3-x93f-qmm8 | Critical | 2.0% | 26 Mar, 2026 | npm nodemailer |