Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob CVE-2026-107303, GHSA-9ffp-22j7-56r2 | High | 0.3% | 22 days ago | npm generator-jhipster npm react-jhipster |
msgpack5: Truncated map32 headers throw an unexpected error CVE-2026-107302, GHSA-8f34-f56x-9xph | High | 0.5% | 22 days ago | npm msgpack5 |
msgpack5: Many buffered values can exhaust the streaming decoder stack CVE-2026-107300, GHSA-5x5g-h9x8-2fh9 | High | 0.4% | 22 days ago | npm msgpack5 |
Payload: SQL injection in SQLite/Postgres CVE-2026-105856, CVE-2026-63316, GHSA-pj7x-6wpf-pgvp | High | 0.3% | 23 days ago | npm @payloadcms/db-d1-sqlite npm @payloadcms/db-postgres npm @payloadcms/db-sqlite npm @payloadcms/db-vercel-postgres |
Backstage has improper input validation in TechDocs Markdown extension configuration CVE-2026-106557, GHSA-f7v3-xhm6-w245 | High | 0.3% | 23 days ago | npm @backstage/plugin-techdocs-node |
Backstage: Improper repository path validation in a Scaffolder backend module CVE-2026-106560, GHSA-2cmg-v53w-8xfp | High | 0.3% | 23 days ago | npm @backstage/plugin-scaffolder-backend-module-confluence-to-markdown |
Backstage: Improper validation of TechDocs MkDocs configuration CVE-2026-106558, GHSA-qmw3-745m-w99g | High | 0.5% | 23 days ago | npm @backstage/plugin-techdocs-node |
Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml CVE-2026-106510, GHSA-4488-j8vj-vqqv | High | 0.5% | 23 days ago | npm @backstage/plugin-techdocs-node |
Backstage: Improper validation of MkDocs theme configuration in TechDocs CVE-2026-106509, GHSA-8w7q-29mw-gf5c | High | 0.5% | 24 days ago | npm @backstage/plugin-techdocs-node |
Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend CVE-2026-106505, GHSA-p75x-jh7p-ppcx | High | 0.3% | 24 days ago | npm @backstage/plugin-techdocs-node |
Backstage: Scaffolder action input authorization bypass CVE-2026-106503, GHSA-hmp2-4m7g-22cv | High | 0.5% | 24 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage: Improper task state validation in Scaffolder backend CVE-2026-106500, GHSA-xvgh-hmx8-9xxf | High | 0.3% | 24 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage: Improper URL validation in catalog entity placeholder resolution CVE-2026-106498, GHSA-qgvj-qcf8-xq73 | High | 0.3% | 24 days ago | npm @backstage/plugin-catalog-backend |
Backstage: Improper preservation of access restrictions during service credential delegation CVE-2026-106492, GHSA-cq7v-rfgc-5c7v | High | 0.2% | 24 days ago | npm @backstage/backend-defaults |
Backstage: Improper authentication in the OIDC provider CVE-2026-106488, GHSA-826h-28h9-65hg | High | 0.3% | 24 days ago | npm @backstage/plugin-auth-backend-module-oidc-provider |
Backstage: Improper input validation in Sentry scaffolder actions CVE-2026-106459, GHSA-g734-fhp4-7mfp | High | 0.2% | 24 days ago | npm @backstage/plugin-scaffolder-backend-module-sentry |
Backstage: Insufficient audience validation in the Cloudflare Access auth provider CVE-2026-106457, GHSA-q333-f498-w2x7 | High | 0.3% | 24 days ago | npm @backstage/plugin-auth-backend-module-cloudflare-access-provider |
Backstage: Improper validation of MkDocs plugin configuration in TechDocs CVE-2026-106455, GHSA-q38j-6vcm-2f5m | High | 0.3% | 24 days ago | npm @backstage/plugin-techdocs-node |
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained CVE-2026-106107, GHSA-5m6h-8g35-p3m7 | High | 0.3% | 24 days ago | npm @quasar/app-vite |
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable CVE-2026-106106, GHSA-r5mf-4r5x-q78f | High | 0.3% | 24 days ago | npm @quasar/app-vite npm @quasar/render-ssr-error |
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions CVE-2026-106105, GHSA-fh39-c73x-5pjv | High | 0.1% | 24 days ago | npm @quasar/app-vite npm @quasar/cli npm @quasar/ssl-certificate |
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server CVE-2026-106104, GHSA-68jq-fhch-4xq4 | High | 0.4% | 24 days ago | npm quasar |
Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile CVE-2026-106103, GHSA-wmpw-j6qv-mw88 | High | 0.3% | 24 days ago | npm @quasar/icongenie |
Payload: Field-level write access bypass in Payload on MongoDB CVE-2026-106100, GHSA-4ww4-68q3-h7g5 | High | 0.2% | 24 days ago | npm @payloadcms/db-mongodb |
Payload: Uploaded XML files could execute same-origin JavaScript CVE-2026-105868, GHSA-9qpg-3cf8-w33x | High | 0.2% | 24 days ago | npm payload |
Payload: Client uploads could overwrite S3 objects CVE-2026-105867, GHSA-7vg8-29qx-jgj8 | High | 0.2% | 24 days ago | npm @payloadcms/storage-s3 |
Payload: Incomplete validation during the upload file lifecycle CVE-2026-105865, GHSA-p223-2wr2-j562 | High | 0.4% | 24 days ago | npm payload |
Payload: Bypassed sanitization of user uploaded SVGs CVE-2026-105862, GHSA-2pwp-2369-8fg3 | High | 0.3% | 24 days ago | npm payload |
Payload external upload trust validation issue CVE-2026-105861, GHSA-pj5h-5q6c-3pfx | High | 0.1% | 24 days ago | npm payload |
Payload has a tenant authorization bypass in Multi-Tenant Plugin CVE-2026-105860, GHSA-p96c-xwx8-3cqj | High | 0.2% | 24 days ago | npm @payloadcms/plugin-multi-tenant |
Payload: Remote Code Execution through first-register CVE-2026-105858, GHSA-97rh-rhh2-7vjv | High | 0.5% | 24 days ago | npm payload |
Payload didn't enforce field-level password update restrictions CVE-2026-105855, GHSA-fx49-4h83-wjv9 | High | 0.2% | 24 days ago | npm payload |
Payload: ReDoS in Multipart Content-Type Validation CVE-2026-105854, GHSA-2g7p-5934-q4w7 | High | 0.4% | 24 days ago | npm payload |
Payload vulnerable to API key disclosure through ordinary document reads CVE-2026-105849, GHSA-238x-w2j9-gwwr | High | 0.3% | 24 days ago | npm payload |
Payload Ecommerce has an order confirmation validation issue CVE-2026-105850, GHSA-8r29-2mp2-pmrw | High | 0.3% | 24 days ago | npm @payloadcms/plugin-ecommerce |
Payload: Token refresh and password reset responses may expose restricted user fields CVE-2026-105853, GHSA-xgv3-crq2-6f69 | High | 0.3% | 24 days ago | npm payload |
Payload: Improper access control for MCP API keys CVE-2026-105806, GHSA-2q76-m6w6-qgc6 | High | 0.3% | 24 days ago | npm @payloadcms/plugin-mcp |
Payload: Polymorphic join queries could disclose hidden fields CVE-2026-105847, GHSA-fpww-c55p-cjv6 | High | 0.2% | 24 days ago | npm payload |
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server CVE-2026-104850, GHSA-6qxp-vccf-f47h | High | 0.2% | 24 days ago | npm @modelcontextprotocol/client npm @modelcontextprotocol/sdk |
sharp : Vulnerability in librsvg dependency CVE-2026-96889 CVE-2026-114111, GHSA-wq5f-xc86-pv6w | High | 0.1% | 24 days ago | npm sharp |
Nx: OS command injection via git revisions and remote refs GHSA-w2vw-w76x-qr89 | High | Not scored | 25 days ago | npm nx |
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep` CVE-2026-104852, GHSA-7mx3-vvmw-hjmv | High | 0.4% | 25 days ago | npm @graphql-tools/utils |
@vue/server-renderer: XSS via missing CR in attribute-name blacklist GHSA-g2v6-rqmx-r4w6 | High | Not scored | 25 days ago | npm @vue/server-renderer |
Ghost: Stored XSS via File Uploads on Local Storage BIT-ghost-2026-104411, BIT-ghost-2026-105679, CVE-2026-104411, CVE-2026-105679, GHSA-gfjp-2p8f-94qv | High | 0.3% | 25 days ago | npm ghost |
Ghost: Remote Code Execution via Theme Translation Files BIT-ghost-2026-104418, BIT-ghost-2026-105677, CVE-2026-104418, CVE-2026-105677, GHSA-jj74-hc2q-xrvm | High | 0.7% | 25 days ago | npm ghost |
Ghost: Invite Token Disclosure in Ghost Admin API BIT-ghost-2026-104416, BIT-ghost-2026-105675, CVE-2026-104416, CVE-2026-105675, GHSA-v6q3-xqxm-6f5v | High | 0.4% | 25 days ago | npm ghost |
Ghost: Stored XSS via Bookmark Card Images BIT-ghost-2026-104413, BIT-ghost-2026-105651, CVE-2026-104413, CVE-2026-105651, GHSA-347q-26qq-h2p6 | High | 0.3% | 25 days ago | npm ghost |
Ghost: Stored XSS via oEmbed Photo Responses BIT-ghost-2026-104414, BIT-ghost-2026-105650, CVE-2026-104414, CVE-2026-105650, GHSA-v3xr-g6p2-fvgv | High | 0.3% | 25 days ago | npm ghost |
Ghost: Stored XSS via SVG Uploads Bypassing Sanitization BIT-ghost-2026-105649, CVE-2026-105649, GHSA-8575-cr6v-7jh4 | High | 0.3% | 25 days ago | npm ghost |
Ghost: Stored XSS via Embed Card Previews BIT-ghost-2026-105643, CVE-2026-105643, GHSA-69qc-f5m6-889c | High | 0.3% | 25 days ago | npm ghost |