Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes CVE-2026-24053, GHSA-q728-gf8j-w49r | High | 0.5% | 03 Feb, 2026 | npm @anthropic-ai/claude-code |
Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains CVE-2026-24052, GHSA-vhw5-3g5m-8ggf | High | 0.4% | 03 Feb, 2026 | npm @anthropic-ai/claude-code |
Compressing Vulnerable to Arbitrary File Write via Symlink Extraction CVE-2026-24884, GHSA-cc8f-xg8v-72m3 | High | 0.3% | 03 Feb, 2026 | npm compressing |
OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand CVE-2026-25157, GHSA-q284-4pvr-m585 | High | 1.1% | 02 Feb, 2026 | npm clawdbot |
OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable CVE-2026-24763, GHSA-mc68-q9jw-2h3v | High | 5.2% | 02 Feb, 2026 | npm clawdbot |
Fastify's Content-Type header tab character allows body validation bypass CVE-2026-25223, GHSA-jx2c-rxcm-jvmq | High | 0.9% | 02 Feb, 2026 | npm fastify |
jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution CVE-2026-24737, GHSA-pqxr-3g65-p328 | High | 0.6% | 02 Feb, 2026 | npm jspdf |
jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder CVE-2026-24133, GHSA-95fx-jjr5-f39c | High | 0.6% | 02 Feb, 2026 | npm jspdf |
OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl CVE-2026-25253, GHSA-g8p2-7wf7-98mq | High | 32.4% | 01 Feb, 2026 | npm clawdbot |
@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks CVE-2026-25153, GHSA-6jr7-99pf-8vgf | High | 0.6% | 30 Jan, 2026 | npm @backstage/plugin-techdocs-node |
fast-xml-parser has RangeError DoS Numeric Entities Bug CVE-2026-25128, GHSA-37qj-frw5-hhjh | High | 0.6% | 30 Jan, 2026 | npm fast-xml-parser |
NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload CVE-2026-24769, GHSA-q5c6-h22r-qpwr | High | 0.4% | 28 Jan, 2026 | npm nocodb |
BrowserStack Local vulnerable to Command Injection through logfile variable CVE-2025-57283, GHSA-g4w6-c99w-4wh7 | High | 0.8% | 28 Jan, 2026 | npm browserstack-local |
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components GHSA-h25m-26qc-wcjf | High | Not scored | 28 Jan, 2026 | npm next |
billboard.js is vulnerable to XSS during chart option binding CVE-2026-1513, GHSA-rpc5-pm7q-hjmp | High | 0.2% | 28 Jan, 2026 | npm billboard.js |
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal CVE-2026-24842, GHSA-34x7-hfp2-rc4v | High | 0.6% | 28 Jan, 2026 | npm tar |
Ghost vulnerable to XSS via malicious Portal preview links BIT-ghost-2026-24778, CVE-2026-24778, GHSA-gv6q-2m97-882h | High | 0.3% | 27 Jan, 2026 | npm @tryghost/portal npm ghost |
Next.js has Unbounded Memory Consumption via PPR Resume Endpoint CVE-2025-59472, GHSA-5f7q-jpqc-wp7h | High | 0.4% | 26 Jan, 2026 | npm next |
Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration CVE-2025-59471, GHSA-9g9p-9gw9-jx7f | High | 0.5% | 26 Jan, 2026 | npm next |
React Server Components have multiple Denial of Service Vulnerabilities CVE-2026-23864, GHSA-83fc-fqcc-2hmg | High | 2.6% | 26 Jan, 2026 | npm react-server-dom-parcel npm react-server-dom-turbopack npm react-server-dom-webpack |
Duplicate Advisory: npm cli Uncontrolled Search Path Element Local Privilege Escalation Vulnerability CVE-2026-0775, GHSA-3966-f6p6-2qr9 | High | 0.3% | 23 Jan, 2026 | npm npm |
Orval Mock Generation Code Injection via const CVE-2026-24132, GHSA-f456-rf33-4626 | High | 0.7% | 22 Jan, 2026 | npm @orval/mock |
Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization Bypass CVE-2025-65098, GHSA-4xc5-wfwc-jw47 | High | 0.3% | 22 Jan, 2026 | npm @typebot.io/js |
Seroval affected by Denial of Service via Deeply Nested Objects CVE-2026-24006, GHSA-3j22-8qj3-26mx | High | 0.4% | 22 Jan, 2026 | npm seroval |
Backstage has a Possible Symlink Path Traversal in Scaffolder Actions CVE-2026-24046, GHSA-rq6q-wr2q-7pgp | High | 0.5% | 21 Jan, 2026 | npm @backstage/backend-defaults npm @backstage/plugin-scaffolder-backend npm @backstage/plugin-scaffolder-node |
Seroval affected by Denial of Service via Array serialization CVE-2026-23957, GHSA-66fc-rw6m-c2q6 | High | 0.4% | 21 Jan, 2026 | npm seroval |
seroval affected by Denial of Service via RegExp serialization CVE-2026-23956, GHSA-hx9m-jf43-8ffr | High | 0.5% | 21 Jan, 2026 | npm seroval |
@envelop/graphql-modules has a Race Condition vulnerability GHSA-h3hw-29fv-2x75 | High | Not scored | 21 Jan, 2026 | npm @envelop/graphql-modules |
sm-crypto Affected by Signature Forgery in SM2-DSA CVE-2026-23965, GHSA-hpwg-xg7m-3p6m | High | 0.2% | 21 Jan, 2026 | npm sm-crypto |
sm-crypto Affected by Signature Malleability in SM2-DSA CVE-2026-23967, GHSA-qv7w-v773-3xqm | High | 0.2% | 21 Jan, 2026 | npm sm-crypto |
seroval Affected by Remote Code Execution via JSON Deserialization CVE-2026-23737, GHSA-3rxj-6cgf-8cfw | High | 0.6% | 21 Jan, 2026 | npm seroval |
Wrangler affected by OS Command Injection in `wrangler pages deploy` CVE-2026-0933, GHSA-36p8-mvp6-cv38 | High | 1.5% | 20 Jan, 2026 | npm wrangler |
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS CVE-2026-23950, GHSA-r6q2-hw4h-h46w | High | 0.3% | 20 Jan, 2026 | npm tar |
@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding) CVE-2026-22037, GHSA-g6q3-96cp-5r5m | High | 0.3% | 19 Jan, 2026 | npm @fastify/express |
Fastify Middie Middleware Path Bypass CVE-2026-22031, GHSA-cxrg-g7r8-w69p | High | 0.5% | 19 Jan, 2026 | npm @fastify/middie |
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization CVE-2026-23745, GHSA-8qq5-rm4j-mr97 | High | 0.4% | 16 Jan, 2026 | npm tar |
svelte is vulnerable to XSS with textarea bind:value GHSA-gw32-9rmw-qwww | High | Not scored | 16 Jan, 2026 | npm svelte |
GraphQL Modules has a Race Condition issue CVE-2026-23735, GHSA-53wg-r69p-v3r7 | High | 0.6% | 16 Jan, 2026 | npm graphql-modules |
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse CVE-2026-22775, GHSA-g2pg-6438-jwpf | High | 0.6% | 15 Jan, 2026 | npm devalue |
@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata) CVE-2026-22803, GHSA-j2f3-wq62-6q46 | High | 0.6% | 15 Jan, 2026 | npm @sveltejs/kit |
Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse CVE-2026-22774, GHSA-vw5p-8cq8-m7mv | High | 0.6% | 15 Jan, 2026 | npm devalue |
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering CVE-2025-67647, GHSA-j62c-4x62-9r35 | High | 0.5% | 15 Jan, 2026 | npm @sveltejs/adapter-node npm @sveltejs/kit |
Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion CVE-2026-22036, GHSA-g9mf-h72j-4rw9 | High | 0.5% | 14 Jan, 2026 | npm undici |
html2pdf.js contains a cross-site scripting vulnerability CVE-2026-22787, GHSA-w8x4-x68c-m6fc | High | 0.4% | 14 Jan, 2026 | npm html2pdf.js |
Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml file CVE-2026-76232, GHSA-3f44-xw83-3pmg | High | 1.0% | 13 Jan, 2026 | npm renovate |
Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml file CVE-2026-76233, GHSA-xjr7-3c3g-m763 | High | 1.0% | 13 Jan, 2026 | npm renovate |
Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies CVE-2026-76231, GHSA-36j9-mx87-2cff | High | 1.0% | 13 Jan, 2026 | npm renovate |
Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration CVE-2026-76230, GHSA-fr4j-65pv-gjjj | High | 1.0% | 13 Jan, 2026 | npm renovate |
Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback) CVE-2026-22818, GHSA-3vhc-576x-3qv4 | High | 0.1% | 13 Jan, 2026 | npm hono |
Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass CVE-2026-22817, GHSA-f67f-6cw9-8mq4 | High | 0.2% | 13 Jan, 2026 | npm hono |