Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Backstage: Improper input validation in proxy-backend CVE-2026-106491, GHSA-9ghw-48h5-v2w5 | Medium | 0.3% | 23 days ago | npm @backstage/plugin-proxy-backend |
Backstage: Improper input validation in TechDocs static content requests CVE-2026-106490, GHSA-7mfx-xg57-53c9 | Medium | 0.4% | 23 days ago | npm @backstage/plugin-techdocs-backend |
Backstage: Improper authorization enforcement for TechDocs static content CVE-2026-106489, GHSA-rg9r-hr7g-5gc2 | Medium | 0.3% | 23 days ago | npm @backstage/plugin-techdocs-backend |
Backstage: Unsupported catalog cluster authentication mode in kubernetes backend CVE-2026-106487, GHSA-h53x-hjx6-25gr | Medium | 0.3% | 23 days ago | npm @backstage/plugin-kubernetes-backend |
Backstage has improper authorization in GitLab organizational user ingestion CVE-2026-106463, GHSA-gp6m-x9vw-5c5x | Medium | 0.2% | 23 days ago | npm @backstage/plugin-catalog-backend-module-gitlab |
Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback CVE-2026-106462, GHSA-29gx-h2m3-xw44 | Medium | 0.2% | 23 days ago | npm @backstage/plugin-scaffolder-backend npm @backstage/plugin-scaffolder-backend-module-azure npm @backstage/plugin-scaffolder-backend-module-bitbucket-cloud npm @backstage/plugin-scaffolder-backend-module-bitbucket-server +2 more |
Backstage: Incorrect authorization in scaffolder task listing CVE-2026-106461, GHSA-7hfw-grcm-cqm6 | Medium | 0.2% | 23 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization CVE-2026-106460, GHSA-xm5q-p7w3-x6cp | Medium | 0.3% | 23 days ago | npm @backstage/plugin-auth-node |
Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates CVE-2026-106458, GHSA-c36c-cf6r-ghgj | Medium | 0.3% | 23 days ago | npm @backstage/plugin-catalog-backend-module-bitbucket-server |
Backstage: Inconsistent credential enforcement for overlapping proxy routes CVE-2026-106456, GHSA-472h-9c5j-prrr | Medium | 0.2% | 23 days ago | npm @backstage/plugin-proxy-backend |
Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates CVE-2026-106444, GHSA-xw65-4hp5-5hc7 | Medium | 0.3% | 23 days ago | npm handlebars |
LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration CVE-2026-106120, GHSA-fwxr-j5w2-587m | Medium | 0.4% | 23 days ago | npm liquidjs |
LangChain: MongoDBChatMessageHistory query injection can allow cross-session access CVE-2026-106119, GHSA-m6rx-h84q-8r95 | Medium | 0.5% | 23 days ago | npm @langchain/mongodb |
Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories CVE-2026-106109, GHSA-q9mq-245r-4g93 | Medium | 0.1% | 23 days ago | npm @quasar/app-vite |
Payload: Unauthenticated account-lockout denial of service CVE-2026-105866, GHSA-v5gf-vpjc-pc7w | Medium | 0.4% | 23 days ago | npm payload |
@payloadcms/plugin-multi-tenant has a cross-tenant create issue CVE-2026-105864, GHSA-xhm9-gwgw-3q2q | Medium | 0.2% | 23 days ago | npm @payloadcms/plugin-multi-tenant |
Payload relationship-query authorization bypass CVE-2026-105852, GHSA-7c34-32v3-j575 | Medium | 0.3% | 23 days ago | npm payload |
Payload: Insufficient Access Control in Stripe REST Proxy CVE-2026-105848, GHSA-r9v2-gg2j-22q5 | Medium | 0.2% | 23 days ago | npm @payloadcms/plugin-stripe |
Payload: Untrusted redirect URL parameter exploit CVE-2026-105846, GHSA-w84c-53h3-mc2g | Medium | 0.2% | 23 days ago | npm @payloadcms/next npm payload |
Payload: Password hashes use insufficient PBKDF2 iterations CVE-2026-105804, GHSA-q6mq-ch85-c8mm | Medium | 0.1% | 23 days ago | npm payload |
Payload: Sort queries could expose protected field information CVE-2026-105805, GHSA-9g87-32v6-3c2r | Medium | 0.3% | 23 days ago | npm payload |
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes CVE-2026-109345, GHSA-6688-9rhm-gjv2 | Medium | 0.3% | 23 days ago | npm dompurify |
smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line GHSA-r4xh-jqrq-34v2 | Medium | Not scored | 23 days ago | npm smol-toml |
fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values GHSA-jggr-w7fw-pc2j | Medium | Not scored | 24 days ago | npm fast-copy |
Ghost: Authorization Bypass in Comments Feature BIT-ghost-2026-103289, BIT-ghost-2026-105681, CVE-2026-103289, CVE-2026-105681, GHSA-6q6j-f24j-p477 | Medium | 0.3% | 24 days ago | npm ghost |
Ghost: Authorization Issue Allowed Author Role to Delete any Post BIT-ghost-2026-105680, CVE-2026-105680, GHSA-x3mg-q38v-m562 | Medium | 0.3% | 24 days ago | npm ghost |
Ghost: Editors Could Promote Staff Users to Their Own Role BIT-ghost-2026-104412, BIT-ghost-2026-105678, CVE-2026-104412, CVE-2026-105678, GHSA-4pvx-fwjj-8gpc | Medium | 0.2% | 24 days ago | npm ghost |
Ghost: Path Traversal via Locale Setting BIT-ghost-2026-104417, BIT-ghost-2026-105676, CVE-2026-104417, CVE-2026-105676, GHSA-m382-6jw4-fmp6 | Medium | 0.4% | 24 days ago | npm ghost |
Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses BIT-ghost-2026-105648, CVE-2026-105648, GHSA-r7f2-6fj8-6fg2 | Medium | 0.3% | 24 days ago | npm ghost |
Ghost: Server-Side Request Forgery in Bookmark Fetching BIT-ghost-2026-105647, CVE-2026-105647, GHSA-322m-ff4g-9vx9 | Medium | 0.2% | 24 days ago | npm ghost |
Ghost: Regular Expression Denial of Service in Content Import BIT-ghost-2026-105646, CVE-2026-105646, GHSA-fwh9-qg68-vxp4 | Medium | 0.3% | 24 days ago | npm ghost |
Ghost: Regular Expression Denial of Service in External Media Inliner BIT-ghost-2026-105645, CVE-2026-105645, GHSA-9m4w-fmjw-fvjq | Medium | 0.3% | 24 days ago | npm ghost |
Ghost : Stored XSS via SVG Files in Content Imports BIT-ghost-2026-105644, CVE-2026-105644, GHSA-hqq2-xqr2-fmx2 | Medium | 0.3% | 24 days ago | npm ghost |
Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values CVE-2026-114073, GHSA-fj2x-mqqp-3v2w | Medium | 0.2% | 27 days ago | npm trigger.dev |
Trigger.dev: Cross-environment deployment cancel CVE-2026-114079, GHSA-4672-hwv6-gq62 | Medium | 0.2% | 27 days ago | npm trigger.dev |
Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId CVE-2026-114086, GHSA-59h8-w5q6-mfmp | Medium | 0.3% | 27 days ago | npm trigger.dev |
Trigger.dev: Blind SSRF via alert-channel webhook CVE-2026-114076, GHSA-q567-cr4x-96w4 | Medium | 0.2% | 27 days ago | npm trigger.dev |
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute CVE-2026-104872, GHSA-qqmp-wf37-98f9 | Medium | 0.2% | 27 days ago | npm @opentelemetry/instrumentation-cassandra-driver npm @opentelemetry/instrumentation-knex npm @opentelemetry/instrumentation-mongoose npm @opentelemetry/instrumentation-mysql +4 more |
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows CVE-2026-104871, GHSA-7g7c-h8rr-7p6q | Medium | 0.4% | 27 days ago | npm @angular/ssr |
@orpc/zod: Prototype injection in smart coercion CVE-2026-103918, GHSA-gcgf-fh7c-8gf2 | Medium | 0.2% | 27 days ago | npm @orpc/zod |
Nx: Path traversal in nx migrate package-migrations extraction CVE-2026-104853, GHSA-hrvq-x7jp-36xv | Medium | 0.2% | 27 days ago | npm nx |
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages CVE-2026-94544, GHSA-3w37-wq28-93x7 | Medium | 0.2% | 27 days ago | npm next |
Next.js has cache poisoning of SSG and ISR pages in self-hosted applications CVE-2026-94543, GHSA-4jqv-mc3x-m676 | Medium | 0.5% | 27 days ago | npm next |
Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass CVE-2026-94485, GHSA-f87g-xv8r-7p7x | Medium | 0.2% | 27 days ago | npm next |
Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service CVE-2026-94484, GHSA-mcj8-r9mp-w47p | Medium | 0.2% | 27 days ago | npm next |
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion CVE-2026-104844, GHSA-rj75-hqrm-r3gf | Medium | 0.4% | 27 days ago | npm postcss-selector-parser |
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects CVE-2026-104183, GHSA-mjw6-4jj6-33hc | Medium | 0.2% | 28 days ago | npm stream-json |
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk CVE-2026-104182, GHSA-hqr4-qq8f-hg3x | Medium | 0.2% | 28 days ago | npm stream-json |
devalue: Residual sparse-array CPU amplification in uneval GHSA-hx4r-w6wj-j8fg | Medium | Not scored | 28 days ago | npm devalue |
next.js cache leak across root param values in nested 'use cache' functions CVE-2026-103004, GHSA-h694-7cp9-m8p3 | Medium | 0.3% | 28 days ago | npm next |