Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @validator-lut-sdk/v3 (npm) GHSA-5g7h-cvvx-x96c, MAL-2026-2221 | Malicious | Not scored | 26 Mar, 2026 | npm @validator-lut-sdk/v3 |
Malicious release: Malicious code in @solmasterv3/solana-metadata-sdk (npm) GHSA-4wgw-h2cc-rpv6, MAL-2026-2219 | Malicious | Not scored | 26 Mar, 2026 | npm @solmasterv3/solana-metadata-sdk |
Malicious release: Malicious code in validator-lut-sdk (npm) GHSA-6m48-c744-9q65, MAL-2026-2227 | Malicious | Not scored | 26 Mar, 2026 | npm validator-lut-sdk |
Malicious release: Malicious code in @solana-ipfs/sdk (npm) GHSA-8f57-hh49-gmqf, MAL-2026-2218 | Malicious | Not scored | 26 Mar, 2026 | npm @solana-ipfs/sdk |
Malicious release: Malicious code in neanderthal-validator (npm) GHSA-f8qc-h6gw-x2vm, MAL-2026-2225 | Malicious | Not scored | 26 Mar, 2026 | npm neanderthal-validator |
Malicious release: Malicious code in jito-validator-sdk (npm) GHSA-r6f4-p397-5xrj, MAL-2026-2224 | Malicious | Not scored | 26 Mar, 2026 | npm jito-validator-sdk |
Malicious release: Malicious code in @pumpfun-ipfs/sdk (npm) GHSA-wwjg-c6fp-6648, MAL-2026-2216 | Malicious | Not scored | 26 Mar, 2026 | npm @pumpfun-ipfs/sdk |
Malicious release: Malicious code in node-coremesh (npm) GHSA-c5x7-f6qj-gc77, MAL-2026-2226 | Malicious | Not scored | 26 Mar, 2026 | npm node-coremesh |
Malicious release: Malicious code in chain-coremesh (npm) GHSA-mgm3-4q53-38p5, MAL-2026-2222 | Malicious | Not scored | 26 Mar, 2026 | npm chain-coremesh |
Malicious release: Malicious code in @opengov/form-renderer (npm) GHSA-j3x7-94xp-wf43, MAL-2026-2211 | Malicious | Not scored | 26 Mar, 2026 | npm @opengov/form-renderer |
Malicious release: Malicious code in @emilgroup/commission-sdk (npm) MAL-2026-2202 | Malicious | Not scored | 26 Mar, 2026 | npm @emilgroup/commission-sdk |
Malicious release: Malicious code in @emilgroup/discount-sdk-node (npm) MAL-2026-2203 | Malicious | Not scored | 26 Mar, 2026 | npm @emilgroup/discount-sdk-node |
Malicious release: Malicious code in @emilgroup/numbergenerator-sdk-node (npm) MAL-2026-2204 | Malicious | Not scored | 26 Mar, 2026 | npm @emilgroup/numbergenerator-sdk-node |
Malicious release: Malicious code in @emilgroup/partner-sdk (npm) MAL-2026-2205 | Malicious | Not scored | 26 Mar, 2026 | npm @emilgroup/partner-sdk |
Malicious release: Malicious code in @emilgroup/process-manager-sdk (npm) MAL-2026-2206 | Malicious | Not scored | 26 Mar, 2026 | npm @emilgroup/process-manager-sdk |
Malicious release: Malicious code in @emilgroup/process-manager-sdk-node (npm) MAL-2026-2207 | Malicious | Not scored | 26 Mar, 2026 | npm @emilgroup/process-manager-sdk-node |
Malicious release: Malicious code in @emilgroup/setting-sdk (npm) MAL-2026-2208 | Malicious | Not scored | 26 Mar, 2026 | npm @emilgroup/setting-sdk |
Malicious release: Malicious code in @emilgroup/translation-sdk-node (npm) MAL-2026-2209 | Malicious | Not scored | 26 Mar, 2026 | npm @emilgroup/translation-sdk-node |
Malicious release: Malicious code in @opengov/form-builder (npm) MAL-2026-2210 | Malicious | Not scored | 26 Mar, 2026 | npm @opengov/form-builder |
Malicious release: Malicious code in @opengov/qa-record-types-api (npm) MAL-2026-2212 | Malicious | Not scored | 26 Mar, 2026 | npm @opengov/qa-record-types-api |
Malicious release: Malicious code in @virtahealth/substrate-root (npm) MAL-2026-2213 | Malicious | Not scored | 26 Mar, 2026 | npm @virtahealth/substrate-root |
Malicious release: Malicious code in react-autolink-text (npm) MAL-2026-2214 | Malicious | Not scored | 26 Mar, 2026 | npm react-autolink-text |
Malicious release: Malicious code in react-leaflet-marker-layer (npm) MAL-2026-2215 | Malicious | Not scored | 26 Mar, 2026 | npm react-leaflet-marker-layer |
Malicious release: Malicious code in @universeorg/dotenv (npm) GHSA-vvwp-x2vx-wxpf, MAL-2026-2220 | Malicious | Not scored | 26 Mar, 2026 | npm @universeorg/dotenv |
Malicious release: Malicious code in @rexorg/config (npm) GHSA-xpmv-42gw-w7wc, MAL-2026-2217 | Malicious | Not scored | 26 Mar, 2026 | npm @rexorg/config |
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching CVE-2026-33672, GHSA-3v7f-55p6-f55p | Medium | 0.4% | 25 Mar, 2026 | npm picomatch |
Picomatch has a ReDoS vulnerability via extglob quantifiers CVE-2026-33671, GHSA-c2c7-rcm5-vvqj | High | 0.4% | 25 Mar, 2026 | npm picomatch |
smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines GHSA-v3rj-xjv7-4jmq | Medium | Not scored | 25 Mar, 2026 | npm smol-toml |
yaml is vulnerable to Stack Overflow via deeply nested YAML collections CVE-2026-33532, GHSA-48c2-rrv3-qjmp | Medium | 0.5% | 25 Mar, 2026 | npm yaml |
n8n Vulnerable to LDAP Filter Injection in LDAP Node CVE-2026-33751, GHSA-w83q-mcmx-mh42 | Medium | 0.2% | 25 Mar, 2026 | npm n8n |
n8n Vulnerable to XSS via Binary Data Inline HTML Rendering CVE-2026-33749, GHSA-qfc3-hm4j-7q77 | Medium | 0.3% | 25 Mar, 2026 | npm n8n |
n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no CVE-2026-33724, GHSA-43v7-fp2v-68f6 | Medium | 0.3% | 25 Mar, 2026 | npm n8n |
n8n Has External Secrets Authorization Bypass in Credential Saving CVE-2026-33722, GHSA-fxcw-h3qj-8m8p | High | 0.3% | 25 Mar, 2026 | npm n8n |
n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK CVE-2026-33720, GHSA-vpgc-2f6g-7w7x | Medium | 0.2% | 25 Mar, 2026 | npm n8n |
n8n has SQL Injection in Data Table Node via orderByColumn Expression CVE-2026-33713, GHSA-98c2-4cr3-4jc3 | High | 0.4% | 25 Mar, 2026 | npm n8n |
n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE CVE-2026-33696, GHSA-mxrg-77hm-89hv | Critical | 0.8% | 25 Mar, 2026 | npm n8n |
n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover CVE-2026-33665, GHSA-c545-x2rh-82fc | High | 0.3% | 25 Mar, 2026 | npm n8n |
n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition CVE-2026-33663, GHSA-m63j-689w-3j35 | High | 0.4% | 25 Mar, 2026 | npm n8n |
n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode CVE-2026-33660, GHSA-58qr-rcgv-642v | Critical | 1.0% | 25 Mar, 2026 | npm n8n |
Seafile Server has multiple stored XSS vulnerabilities CVE-2026-30587, GHSA-rqj3-x344-qvxc | High | 0.3% | 25 Mar, 2026 | npm @seafile/sdoc-editor |
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern CVE-2026-33287, GHSA-6q5m-63h6-5x4v | High | 0.5% | 25 Mar, 2026 | npm liquidjs |
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash CVE-2026-33285, GHSA-9r5m-9576-7f6x | High | 0.4% | 25 Mar, 2026 | npm liquidjs |
@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling GHSA-8g29-8xwr-qmhr | Low | Not scored | 25 Mar, 2026 | npm @grackle-ai/server |
@grackle-ai/server has a Missing Secure Flag on Session Cookie GHSA-5j35-xr4g-vwf4 | Low | Not scored | 25 Mar, 2026 | npm @grackle-ai/server |
@grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers GHSA-3mjm-x6gw-2x42 | Medium | Not scored | 25 Mar, 2026 | npm @grackle-ai/server |
@grackle-ai/powerline Runs Without Authentication by Default GHSA-xq7h-vwjp-5vrh | Medium | Not scored | 25 Mar, 2026 | npm @grackle-ai/powerline |
@grackle-ai/server has Missing WebSocket Origin Header Validation GHSA-w3hv-x4fp-6h6j | High | Not scored | 25 Mar, 2026 | npm @grackle-ai/server |
@grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP tool GHSA-647h-p824-99w7 | High | Not scored | 25 Mar, 2026 | npm @grackle-ai/mcp |
@grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template GHSA-7q9x-8g6p-3x75 | Low | Not scored | 25 Mar, 2026 | npm @grackle-ai/server |
n8n has In-Process Memory Disclosure in its Task Runner CVE-2026-27496, GHSA-xvh5-5qg4-x9qp | High | 0.3% | 25 Mar, 2026 | npm n8n |