Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes CVE-2026-32916, GHSA-xw77-45gv-p728 | Critical | 0.5% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Sandbox `writeFile` commit could race outside the validated path CVE-2026-32977, GHSA-xvx8-77m6-gwg6 | Medium | 0.1% | 13 Mar, 2026 | npm openclaw |
Malicious release: Malicious code in cw-isdk (npm) GHSA-4gjw-qxx7-crc6, MAL-2026-1420 | Malicious | Not scored | 13 Mar, 2026 | npm cw-isdk |
Dagu: SSE Authentication Bypass in Basic Auth Mode CVE-2026-31882, GHSA-9wmw-9wph-2vwp | High | 0.8% | 13 Mar, 2026 | npm dagu |
Malicious release: Malicious code in tailwind-mainanimation (npm) GHSA-r38v-v7pv-rgrj, MAL-2026-1418 | Malicious | Not scored | 13 Mar, 2026 | npm tailwind-mainanimation |
Malicious release: Malicious code in tailwindcss-style-modify (npm) GHSA-m7rv-f9h8-5r7w, MAL-2026-1419 | Malicious | Not scored | 13 Mar, 2026 | npm tailwindcss-style-modify |
SandboxJS affected by a Sandbox Escape CVE-2026-26954, GHSA-6r9f-759j-hjgv | Critical | 0.6% | 13 Mar, 2026 | npm @nyariv/sandboxjs |
Malicious release: Malicious code in hardhat2-config (npm) GHSA-3cgj-gvv2-qrm4, MAL-2026-1414 | Malicious | Not scored | 13 Mar, 2026 | npm hardhat2-config |
Malicious release: Malicious code in twitch.dashboard-v2.core (npm) GHSA-89fh-43jx-c785, MAL-2026-1417 | Malicious | Not scored | 13 Mar, 2026 | npm twitch.dashboard-v2.core |
Malicious release: Malicious code in pulsard-utils (npm) GHSA-93p8-6ccp-ww68, MAL-2026-1415 | Malicious | Not scored | 13 Mar, 2026 | npm pulsard-utils |
Malicious release: Malicious code in twitch-security (npm) GHSA-gp4w-hqqj-mj8j, MAL-2026-1416 | Malicious | Not scored | 13 Mar, 2026 | npm twitch-security |
Malicious release: Malicious code in brlc-base (npm) GHSA-fj4h-6xw5-7w6c, MAL-2026-1413 | Malicious | Not scored | 13 Mar, 2026 | npm brlc-base |
Malicious release: Malicious code in rrweb-v1 (npm) MAL-2026-1456 | Malicious | Not scored | 13 Mar, 2026 | npm rrweb-v1 |
Malicious release: Malicious code in solana-pumpfun-sdk (npm) GHSA-jcj7-prw7-7g8m, MAL-2026-1400 | Malicious | Not scored | 13 Mar, 2026 | npm solana-pumpfun-sdk |
Malicious release: Malicious code in pino-sdk (npm) GHSA-w65h-pr62-r9x7, MAL-2026-1399 | Malicious | Not scored | 13 Mar, 2026 | npm pino-sdk |
Malicious release: Malicious code in @dinzid04/libsignal-node (npm) GHSA-cv92-97xv-5m97, MAL-2026-1392 | Malicious | Not scored | 13 Mar, 2026 | npm @dinzid04/libsignal-node |
Malicious release: Malicious code in @dinzid04/baileys (npm) GHSA-x75j-rf36-jhfm, MAL-2026-1391 | Malicious | Not scored | 13 Mar, 2026 | npm @dinzid04/baileys |
Malicious release: Malicious code in tailwindcss-animation-advanced (npm) GHSA-6955-77hw-g832, MAL-2026-1401 | Malicious | Not scored | 13 Mar, 2026 | npm tailwindcss-animation-advanced |
Malicious release: Malicious code in cortana-md-bot (npm) GHSA-337h-4j9r-8w2f, MAL-2026-1393 | Malicious | Not scored | 13 Mar, 2026 | npm cortana-md-bot |
Malicious release: Malicious code in @depro-tech/cortana-md (npm) GHSA-6wv6-cjh5-792c, MAL-2026-1390 | Malicious | Not scored | 13 Mar, 2026 | npm @depro-tech/cortana-md |
Malicious release: Malicious code in meta-internal-logger-drzak (npm) GHSA-5m63-g4p4-w233, MAL-2026-1398 | Malicious | Not scored | 13 Mar, 2026 | npm meta-internal-logger-drzak |
Malicious release: Malicious code in whatsapp-core-auth-drzak (npm) GHSA-h5f2-r2ph-vpwg, MAL-2026-1404 | Malicious | Not scored | 13 Mar, 2026 | npm whatsapp-core-auth-drzak |
Malicious release: Malicious code in dell-internal-auth-drzak (npm) GHSA-27p2-jj24-ph4c, MAL-2026-1396 | Malicious | Not scored | 13 Mar, 2026 | npm dell-internal-auth-drzak |
Malicious release: Malicious code in tradepmr-fusion-core-drzak (npm) GHSA-6v8m-pxj8-gvhq, MAL-2026-1403 | Malicious | Not scored | 13 Mar, 2026 | npm tradepmr-fusion-core-drzak |
Malicious release: Malicious code in fusion-internal-common-drzak (npm) GHSA-84r2-9pxx-jpj2, MAL-2026-1397 | Malicious | Not scored | 13 Mar, 2026 | npm fusion-internal-common-drzak |
Malicious release: Malicious code in tradepmr-api-utils-drzak (npm) GHSA-c69r-v442-p36q, MAL-2026-1402 | Malicious | Not scored | 13 Mar, 2026 | npm tradepmr-api-utils-drzak |
Malicious release: Malicious code in dell-fusion-core-drzak (npm) GHSA-h25q-p78j-7v25, MAL-2026-1395 | Malicious | Not scored | 13 Mar, 2026 | npm dell-fusion-core-drzak |
Malicious release: Malicious code in dell-emc-internal-api-drzak (npm) GHSA-h9w4-crm5-qp2f, MAL-2026-1394 | Malicious | Not scored | 13 Mar, 2026 | npm dell-emc-internal-api-drzak |
Malicious release: Malicious code in whatsapp-fastdesk-utils-drzak (npm) GHSA-m63f-89px-gqhq, MAL-2026-1405 | Malicious | Not scored | 13 Mar, 2026 | npm whatsapp-fastdesk-utils-drzak |
Malicious release: Malicious code in @immuta/flag-providers-web (npm) MAL-2026-1382 | Malicious | Not scored | 13 Mar, 2026 | npm @immuta/flag-providers-web |
Malicious release: Malicious code in tachyon-spade-reporter (npm) GHSA-5w2f-897r-j622, MAL-2026-1386 | Malicious | Not scored | 13 Mar, 2026 | npm tachyon-spade-reporter |
Malicious release: Malicious code in tahoe-tap (npm) GHSA-777p-fm5x-p7rg, MAL-2026-1387 | Malicious | Not scored | 13 Mar, 2026 | npm tahoe-tap |
Malicious release: Malicious code in tourney-sdk-react (npm) GHSA-7wp6-2652-ppmj, MAL-2026-1388 | Malicious | Not scored | 13 Mar, 2026 | npm tourney-sdk-react |
Malicious release: Malicious code in twitch-twilight-intl (npm) GHSA-rch7-r7gr-cp84, MAL-2026-1389 | Malicious | Not scored | 13 Mar, 2026 | npm twitch-twilight-intl |
Malicious release: Malicious code in conductor-managed-airflow-environment (npm) GHSA-9hh2-8w9q-4w9j, MAL-2026-1385 | Malicious | Not scored | 13 Mar, 2026 | npm conductor-managed-airflow-environment |
Malicious release: Malicious code in @lux2/ssr-catalogue-sfcc (npm) MAL-2026-1384 | Malicious | Not scored | 13 Mar, 2026 | npm @lux2/ssr-catalogue-sfcc |
Malicious release: Malicious code in @immuta/feature-flags-core (npm) MAL-2026-1381 | Malicious | Not scored | 13 Mar, 2026 | npm @immuta/feature-flags-core |
Malicious release: Malicious code in @immuta/pxl-components (npm) MAL-2026-1383 | Malicious | Not scored | 13 Mar, 2026 | npm @immuta/pxl-components |
Malicious release: Malicious code in 8x8-developer-docs (npm) GHSA-89hj-xp64-rgvm, MAL-2026-1379 | Malicious | Not scored | 13 Mar, 2026 | npm 8x8-developer-docs |
Malicious release: Malicious code in f0-service-address-doctor (npm) GHSA-cqxq-2582-f357, MAL-2026-1378 | Malicious | Not scored | 13 Mar, 2026 | npm f0-service-address-doctor |
Malicious release: Malicious code in adroit-websdk-server (npm) MAL-2026-1377 | Malicious | Not scored | 13 Mar, 2026 | npm adroit-websdk-server |
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS CVE-2026-2581, GHSA-phc3-fgpg-7m6h | Medium | 0.6% | 12 Mar, 2026 | npm undici |
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation CVE-2026-2229, GHSA-v9p9-hfj2-hcw8 | High | 1.0% | 12 Mar, 2026 | npm undici |
Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client CVE-2026-1528, GHSA-f269-vfmq-vjvj | High | 0.6% | 12 Mar, 2026 | npm undici |
Undici has CRLF Injection in undici via `upgrade` option CVE-2026-1527, GHSA-4992-7rv2-5pvq | Medium | 0.3% | 12 Mar, 2026 | npm undici |
Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression CVE-2026-1526, GHSA-vrm6-8vpv-qv8q | High | 1.3% | 12 Mar, 2026 | npm undici |
OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode CVE-2026-32302, GHSA-5wcw-8jjv-m286 | High | 0.2% | 12 Mar, 2026 | npm openclaw |
Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint BIT-parse-2026-32269, CVE-2026-32269, GHSA-69xg-f649-w5g2 | Medium | 0.3% | 12 Mar, 2026 | npm parse-server |
Undici has an HTTP Request/Response Smuggling issue CVE-2026-1525, GHSA-2mjp-6q6p-2qxm | Critical | 0.6% | 12 Mar, 2026 | npm undici |
flatted vulnerable to unbounded recursion DoS in parse() revive phase CVE-2026-32141, GHSA-25h7-pfq9-p65f | High | 0.9% | 12 Mar, 2026 | npm flatted |