Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in transform-modules-systemjs (npm) GHSA-wc64-r4v7-rjwr, MAL-2026-1571 | Malicious | Not scored | 16 Mar, 2026 | npm transform-modules-systemjs |
Malicious release: Malicious code in transform-es2015-duplicate-keys (npm) GHSA-wgjr-2vhj-qwv7, MAL-2026-1561 | Malicious | Not scored | 16 Mar, 2026 | npm transform-es2015-duplicate-keys |
Malicious release: Malicious code in syntax-export-extensions (npm) GHSA-whjj-mhxg-67rv, MAL-2026-1550 | Malicious | Not scored | 16 Mar, 2026 | npm syntax-export-extensions |
Malicious release: Malicious code in typescript-vue-apollo-smart-ops (npm) GHSA-x3pj-5gcc-j9rh, MAL-2026-1555 | Malicious | Not scored | 16 Mar, 2026 | npm typescript-vue-apollo-smart-ops |
Malicious release: Malicious code in syntax-async-generators (npm) GHSA-x49c-wrwr-8p2q, MAL-2026-1558 | Malicious | Not scored | 16 Mar, 2026 | npm syntax-async-generators |
Malicious release: Malicious code in typescript-type-graphql (npm) GHSA-x56x-pjgc-r3cm, MAL-2026-1540 | Malicious | Not scored | 16 Mar, 2026 | npm typescript-type-graphql |
Malicious release: Malicious code in transform-regexp-constructors (npm) MAL-2026-3125 | Malicious | Not scored | 16 Mar, 2026 | npm transform-regexp-constructors |
Malicious release: Malicious code in @3stripes/common (npm) MAL-2026-1426 | Malicious | Not scored | 15 Mar, 2026 | npm @3stripes/common |
Malicious release: Malicious code in @3stripes/auth (npm) MAL-2026-1425 | Malicious | Not scored | 15 Mar, 2026 | npm @3stripes/auth |
Malicious release: Malicious code in @3stripes/helpers (npm) MAL-2026-1427 | Malicious | Not scored | 15 Mar, 2026 | npm @3stripes/helpers |
Malicious release: Malicious code in @3stripes/api-client (npm) MAL-2026-1424 | Malicious | Not scored | 15 Mar, 2026 | npm @3stripes/api-client |
Malicious release: Malicious code in @3stripes/utils (npm) MAL-2026-1430 | Malicious | Not scored | 15 Mar, 2026 | npm @3stripes/utils |
Malicious release: Malicious code in @3stripes/lib (npm) MAL-2026-1428 | Malicious | Not scored | 15 Mar, 2026 | npm @3stripes/lib |
Malicious release: Malicious code in @3stripes/ui (npm) MAL-2026-1429 | Malicious | Not scored | 15 Mar, 2026 | npm @3stripes/ui |
Malicious release: Malicious code in n8n-nodes-text-helpers (npm) GHSA-r2w7-4rv7-p8wj, MAL-2026-1454 | Malicious | Not scored | 15 Mar, 2026 | npm n8n-nodes-text-helpers |
Malicious release: Malicious code in tracking-service-config (npm) MAL-2026-1457 | Malicious | Not scored | 14 Mar, 2026 | npm tracking-service-config |
Malicious release: Malicious code in test_pkg_forppe (npm) GHSA-xvw4-g263-g3r2, MAL-2026-1423 | Malicious | Not scored | 14 Mar, 2026 | npm test_pkg_forppe |
Malicious release: Malicious code in native_dep (npm) GHSA-j72j-g5w7-jj7f, MAL-2026-1455 | Malicious | Not scored | 14 Mar, 2026 | npm native_dep |
Angular vulnerable to XSS in i18n attribute bindings CVE-2026-32635, GHSA-g93w-mfhg-p222 | High | 0.5% | 13 Mar, 2026 | npm @angular/compiler npm @angular/core |
file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry CVE-2026-32630, GHSA-j47w-4g3g-c36v | Medium | 0.3% | 13 Mar, 2026 | npm file-type |
OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation CVE-2026-34505, GHSA-5m9r-p9g7-679c | Medium | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured CVE-2026-32974, GHSA-g353-mgv3-8pcj | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Gateway `agent` calls could override the workspace boundary CVE-2026-33573, GHSA-2rqg-gjgv-84jm | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes CVE-2026-22172, GHSA-rqpp-rjj8-7wv8 | Critical | 0.6% | 13 Mar, 2026 | npm openclaw |
`OpenClaw: session_status` let sandboxed subagents access parent or sibling session state CVE-2026-32918, GHSA-wcxr-59v9-rxr8 | Critical | 0.1% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories CVE-2026-32920, GHSA-99qw-6mr3-36qr | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces CVE-2026-32914, GHSA-r7vr-gr74-94p8 | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths CVE-2026-32973, GHSA-f8r2-vg7x-gh8m | High | 0.4% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Feishu reaction events could bypass group authorization and mention gating CVE-2026-32924, GHSA-m69h-jm2f-2pv8 | Medium | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes CVE-2026-32972, GHSA-vmhq-cqm9-6p7q | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens CVE-2026-33575, GHSA-7h7g-x2px-94hj | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw's Zalouser allowlist authorization matched mutable group names by default CVE-2026-32975, GHSA-f5mf-3r52-r83w | Medium | 0.3% | 13 Mar, 2026 | npm openclaw |
Apollo Federation vulnerable to prototype pollution via incomplete key sanitization CVE-2026-32621, GHSA-pfjj-6f4p-rvmh | Critical | 0.5% | 13 Mar, 2026 | npm @apollo/federation-internals npm @apollo/gateway npm @apollo/query-planner |
Malicious release: Malicious code in devlino (npm) GHSA-jx86-pq3j-fp99, MAL-2026-1421 | Malicious | Not scored | 13 Mar, 2026 | npm devlino |
Parse Server's GraphQL WebSocket endpoint bypasses security middleware BIT-parse-2026-32594, CVE-2026-32594, GHSA-p2x3-8689-cwpg | Medium | 0.4% | 13 Mar, 2026 | npm parse-server |
@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script CVE-2026-4092, GHSA-hqjg-pww4-pcgq | High | 0.5% | 13 Mar, 2026 | npm @google/clasp |
OneUptime: Password Reset Token Logged at INFO Level CVE-2026-32598, GHSA-4524-cj9j-g4fj | Medium | 0.3% | 13 Mar, 2026 | npm oneuptime |
OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") CVE-2026-32308, GHSA-wvh5-6vjm-23qh | High | 0.3% | 13 Mar, 2026 | npm oneuptime |
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters CVE-2026-32306, GHSA-p5g2-jm85-8g35 | Critical | 0.7% | 13 Mar, 2026 | npm oneuptime |
OpenClaw: Discord guild reaction ingress could bypass users and roles allowlists CVE-2026-32923, GHSA-9vvh-2768-c8vp | Medium | 0.2% | 13 Mar, 2026 | npm openclaw |
Locutus vulnerable to RCE via unsanitized input in create_function() CVE-2026-32304, GHSA-vh9h-29pq-r5m8 | Critical | 0.6% | 13 Mar, 2026 | npm locutus |
OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode CVE-2026-32970, GHSA-qvr7-g57c-mrc7 | Low | 0.1% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Sandbox staged writes could escape the verified parent directory before commit CVE-2026-32988, GHSA-mj4p-rc52-m843 | High | 0.1% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Write-scoped callers could reach admin-only session reset logic through `agent` CVE-2026-32919, GHSA-jf6w-m8jw-jfxc | Medium | 0.1% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity CVE-2026-32978, GHSA-qc36-x95h-7j53 | Critical | 0.2% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Channel commands could bypass account-scoped `configWrites` restrictions CVE-2026-32976, GHSA-8jhh-jcqg-mj5p | High | 0.2% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv CVE-2026-32971, GHSA-rw39-5899-8mxp | High | 0.3% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity CVE-2026-32979, GHSA-xf99-j42q-5w5p | High | 0.1% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries CVE-2026-32915, GHSA-4w7m-58cg-cmff | Critical | 0.1% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE CVE-2026-32922, GHSA-4jpw-hj22-2xmc | Critical | 0.7% | 13 Mar, 2026 | npm openclaw |