Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @solana-launchpads/sdk (npm) GHSA-mrwh-gr28-36wv, MAL-2026-1939 | Malicious | Not scored | 20 Mar, 2026 | npm @solana-launchpads/sdk |
Malicious release: Malicious code in polymarket-onchain (npm) GHSA-qw8c-w97q-7p7p, MAL-2026-1963 | Malicious | Not scored | 20 Mar, 2026 | npm polymarket-onchain |
Malicious release: Malicious code in @dotprompt/promptly-darwin-arm64 (npm) GHSA-52w3-g4x3-xw3h, MAL-2026-1937 | Malicious | Not scored | 20 Mar, 2026 | npm @dotprompt/promptly-darwin-arm64 |
Malicious release: Malicious code in pretty-ts-logger (npm) GHSA-7qv7-jx74-qhx9, MAL-2026-1965 | Malicious | Not scored | 20 Mar, 2026 | npm pretty-ts-logger |
Malicious release: Malicious code in client-hash-sdk (npm) GHSA-7w6q-gfxv-393v, MAL-2026-1941 | Malicious | Not scored | 20 Mar, 2026 | npm client-hash-sdk |
Malicious release: Malicious code in clob-utils-sdks (npm) GHSA-vrqq-pxvj-f2mg, MAL-2026-1943 | Malicious | Not scored | 20 Mar, 2026 | npm clob-utils-sdks |
Malicious release: Malicious code in wildhunter (npm) GHSA-mqvj-42pf-qv58, MAL-2026-1972 | Malicious | Not scored | 20 Mar, 2026 | npm wildhunter |
Malicious release: Malicious code in supportgameapp (npm) GHSA-87mp-vrm9-h8r5, MAL-2026-1970 | Malicious | Not scored | 20 Mar, 2026 | npm supportgameapp |
Malicious release: Malicious code in restaking-apy-module (npm) GHSA-4gc2-gg24-6qf6, MAL-2026-1966 | Malicious | Not scored | 20 Mar, 2026 | npm restaking-apy-module |
Malicious release: Malicious code in json-parse-genie (npm) GHSA-mwq7-2fm8-vc4q, MAL-2026-1952 | Malicious | Not scored | 20 Mar, 2026 | npm json-parse-genie |
Malicious release: Malicious code in interface-builder-kit (npm) GHSA-82f5-93r9-hhwq, MAL-2026-1951 | Malicious | Not scored | 20 Mar, 2026 | npm interface-builder-kit |
Malicious release: Malicious code in jsonify-bundler (npm) GHSA-wv5m-jqq3-c22x, MAL-2026-1935 | Malicious | Not scored | 20 Mar, 2026 | npm jsonify-bundler |
Malicious release: Malicious code in lint-builder (npm) GHSA-5p7c-2c97-fjpm, MAL-2026-1936 | Malicious | Not scored | 20 Mar, 2026 | npm lint-builder |
Malicious release: Malicious code in big-nunber (npm) GHSA-jq28-7779-5hp9, MAL-2026-1934 | Malicious | Not scored | 20 Mar, 2026 | npm big-nunber |
Parse Server has an auth provider validation bypass on login via partial authData BIT-parse-2026-33409, CVE-2026-33409, GHSA-pfj7-wv7c-22pr | High | 0.5% | 19 Mar, 2026 | npm parse-server |
Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR CVE-2026-33397, GHSA-vfx2-hv2g-xj5f | Medium | 0.3% | 19 Mar, 2026 | npm @angular/ssr |
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser CVE-2026-33349, GHSA-jp2q-39xq-3w4g | Medium | 0.5% | 19 Mar, 2026 | npm fast-xml-parser |
@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix) CVE-2026-33326, GHSA-cgcg-q9jh-5pr2 | Medium | 0.3% | 19 Mar, 2026 | npm @keystone-6/core |
Parse Server email verification resend page leaks user existence BIT-parse-2026-33323, CVE-2026-33323, GHSA-h29g-q5c2-9h4f | Medium | 0.3% | 19 Mar, 2026 | npm parse-server |
SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials CVE-2026-33311, GHSA-mr9r-mww3-v6gv | Medium | 0.2% | 19 Mar, 2026 | npm @dicebear/core npm @dicebear/initials |
Prototype Pollution via parse() in NodeJS flatted CVE-2026-33228, GHSA-rf6f-7fwh-wjgh | High | 0.9% | 19 Mar, 2026 | npm flatted |
Malicious release: Malicious code in react-native-country-select (npm) GHSA-vf6p-p33f-3cjv, MAL-2026-1931 | Malicious | Not scored | 19 Mar, 2026 | npm react-native-country-select |
Malicious release: Malicious code in react-native-international-phone-number (npm) GHSA-69cx-hr8r-mc9j, MAL-2026-1932 | Malicious | Not scored | 19 Mar, 2026 | npm react-native-international-phone-number |
Malicious release: Malicious code in @iflow-mcp/watercrawl-watercrawl-mcp (npm) GHSA-rg84-r52h-2rgw, MAL-2026-1930 | Malicious | Not scored | 19 Mar, 2026 | npm @iflow-mcp/watercrawl-watercrawl-mcp |
Malicious release: Malicious code in @aifabrix/miso-client (npm) GHSA-5w47-93jc-5w3g, MAL-2026-1929 | Malicious | Not scored | 19 Mar, 2026 | npm @aifabrix/miso-client |
Malicious release: Malicious code in changelog-logger-wrap (npm) GHSA-59ff-98r4-m9mp, MAL-2026-1928 | Malicious | Not scored | 19 Mar, 2026 | npm changelog-logger-wrap |
Malicious release: Malicious code in changelog-logger-utils (npm) GHSA-7fr9-gw6v-q3mw, MAL-2026-1927 | Malicious | Not scored | 19 Mar, 2026 | npm changelog-logger-utils |
Malicious release: Malicious code in tokenshower (npm) GHSA-jcwx-28x8-jf6f, MAL-2026-1926 | Malicious | Not scored | 19 Mar, 2026 | npm tokenshower |
Malicious release: Malicious code in jsonify-parser (npm) GHSA-hqf3-9jfp-qgh9, MAL-2026-1925 | Malicious | Not scored | 19 Mar, 2026 | npm jsonify-parser |
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint GHSA-wvr4-3wq4-gpc5 | Critical | Not scored | 19 Mar, 2026 | npm mcp-bridge |
Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File CVE-2026-33068, GHSA-mmgp-wc2j-qcv7 | High | 0.4% | 19 Mar, 2026 | npm @anthropic-ai/claude-code |
Malicious release: Malicious code in nflx-release (npm) MAL-2026-1580 | Malicious | Not scored | 19 Mar, 2026 | npm nflx-release |
Malicious release: Malicious code in wn-idv-persona-client (npm) MAL-2026-1584 | Malicious | Not scored | 19 Mar, 2026 | npm wn-idv-persona-client |
Malicious release: Malicious code in whatnot-web (npm) MAL-2026-1583 | Malicious | Not scored | 19 Mar, 2026 | npm whatnot-web |
Malicious release: Malicious code in whatnot-events (npm) MAL-2026-1581 | Malicious | Not scored | 19 Mar, 2026 | npm whatnot-events |
Malicious release: Malicious code in whatnot-manifests (npm) MAL-2026-1582 | Malicious | Not scored | 19 Mar, 2026 | npm whatnot-manifests |
Malicious release: Malicious code in browser-gaming-client (npm) MAL-2026-1578 | Malicious | Not scored | 19 Mar, 2026 | npm browser-gaming-client |
Malicious release: Malicious code in nf-cl-ls (npm) MAL-2026-1579 | Malicious | Not scored | 19 Mar, 2026 | npm nf-cl-ls |
Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview CVE-2026-33226, GHSA-4647-wpjq-hh7f | High | 0.4% | 18 Mar, 2026 | npm budibase |
Parse Server leaks protected fields via LiveQuery afterEvent trigger BIT-parse-2026-33163, CVE-2026-33163, GHSA-5hmj-jcgp-6hff | High | 0.4% | 18 Mar, 2026 | npm parse-server |
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction CVE-2026-32731, GHSA-mwxc-m426-3f78 | Critical | 0.5% | 18 Mar, 2026 | npm @apostrophecms/import-export |
ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware CVE-2026-32730, GHSA-v9xm-ffx2-7h35 | High | 0.4% | 18 Mar, 2026 | npm apostrophe |
NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability CVE-2026-30048, GHSA-w3vx-52j6-9fjp | Medium | 0.3% | 18 Mar, 2026 | npm @developer.notchatbot/webchat |
socket.io allows an unbounded number of binary attachments CVE-2026-33151, GHSA-677m-j7p3-52f9 | High | 0.5% | 18 Mar, 2026 | npm socket.io-parser |
OneUptime WhatsApp Webhook Missing Signature Verification CVE-2026-33143, GHSA-g5ph-f57v-mwjc | High | 0.2% | 18 Mar, 2026 | npm oneuptime |
Malicious release: Malicious code in chai-as-constrained (npm) GHSA-mwp5-h2j4-x4f3, MAL-2026-1576 | Malicious | Not scored | 18 Mar, 2026 | npm chai-as-constrained |
OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters CVE-2026-33142, GHSA-gcg3-c5p2-cqgg | High | 0.3% | 18 Mar, 2026 | npm oneuptime |
h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read CVE-2026-86253, GHSA-wr4h-v87w-p3r7 | High | 0.6% | 18 Mar, 2026 | npm h3 |
h3 has a middleware bypass with one gadget CVE-2026-33131, GHSA-3vj8-jmxq-cgj5 | Critical | 0.4% | 18 Mar, 2026 | npm h3 |
h3 has an observable timing discrepancy in basic auth utils CVE-2026-33129, GHSA-26f5-8h2x-34xh | Medium | 0.3% | 18 Mar, 2026 | npm h3 |