Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in spectral-corsair-my-backdoor (npm) GHSA-j5w6-gpq8-mpf4, MAL-2026-1374 | Malicious | Not scored | 12 Mar, 2026 | npm spectral-corsair-my-backdoor |
Parse Server: Account takeover via operator injection in authentication data identifier BIT-parse-2026-32248, CVE-2026-32248, GHSA-5fw2-8jcv-xh87 | Critical | 0.7% | 12 Mar, 2026 | npm parse-server |
Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance BIT-parse-2026-32242, CVE-2026-32242, GHSA-2cjm-2gwv-m892 | Critical | 0.3% | 12 Mar, 2026 | npm parse-server |
Trix has a Stored XSS vulnerability through serialized attributes CVE-2026-73426, GHSA-qmpg-8xg6-ph5q | Medium | 0.3% | 12 Mar, 2026 | RubyGems action_text-trix npm trix |
Hyperterse: Raw exposure of database statements in MCP search tool CVE-2026-31841, GHSA-92gp-jfgx-9qpv | Medium | 0.2% | 12 Mar, 2026 | npm hyperterse |
TinaCMS CLI has Arbitrary File Read via Disabled Vite Filesystem Restriction CVE-2026-29066, GHSA-m48g-4wr2-j2h6 | Medium | 1.1% | 12 Mar, 2026 | npm @tinacms/cli |
TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete CVE-2026-28793, GHSA-2f24-mg4x-534q | High | 0.2% | 12 Mar, 2026 | npm @tinacms/cli |
TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS CVE-2026-28792, GHSA-8pw3-9m7f-q734 | Critical | 0.6% | 12 Mar, 2026 | npm @tinacms/cli |
Tina: Path Traversal in Media Upload Handle CVE-2026-28791, GHSA-5hxf-c7j4-279c | High | 0.4% | 12 Mar, 2026 | npm tinacms |
@tinacms/graphql has a Path Traversal issue CVE-2026-24125, GHSA-2238-xc5r-v9hj | Medium | 0.5% | 12 Mar, 2026 | npm @tinacms/graphql |
Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties GHSA-mwv9-gp5h-frr4 | Low | Not scored | 12 Mar, 2026 | npm devalue |
Malicious release: Malicious code in @sky-it-livedata-libraries/livedata-commons-client (npm) GHSA-qm4f-gcp7-4h8m, MAL-2026-1373 | Malicious | Not scored | 12 Mar, 2026 | npm @sky-it-livedata-libraries/livedata-commons-client |
Malicious release: Malicious code in @sky-it-livedata-libraries/livedata-commons (npm) GHSA-crjc-v3g6-rw28, MAL-2026-1372 | Malicious | Not scored | 12 Mar, 2026 | npm @sky-it-livedata-libraries/livedata-commons |
@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint CVE-2026-32237, GHSA-8wq8-6859-qx77 | Medium | 0.3% | 12 Mar, 2026 | npm @backstage/plugin-scaffolder-backend |
@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch CVE-2026-32236, GHSA-qp4c-xg64-7c6x | Low | 0.3% | 12 Mar, 2026 | npm @backstage/plugin-auth-backend |
@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass CVE-2026-32235, GHSA-wqvh-63mv-9w92 | Medium | 0.2% | 12 Mar, 2026 | npm @backstage/plugin-auth-backend |
Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page CVE-2026-32230, GHSA-c7hf-c5p5-5g6h | Medium | 1.0% | 12 Mar, 2026 | npm uptime-kuma |
OpenClaw: /api/channels gateway-auth boundary bypass via path canonicalization mismatch CVE-2026-32031, GHSA-8j2w-6fmm-m587 | Medium | 0.2% | 12 Mar, 2026 | npm openclaw |
OpenClaw: Slack system events bypass sender authorization in member and message subtype handlers CVE-2026-32895, GHSA-v8cg-4474-49v8 | Medium | 0.2% | 12 Mar, 2026 | npm openclaw |
OpenClaw: Sandbox dangling-symlink alias handling could bypass workspace-only write boundary GHSA-qcc4-p59m-p54m | High | Not scored | 12 Mar, 2026 | npm openclaw |
OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leaf CVE-2026-32055, GHSA-mgrq-9f93-wpp5 | High | 0.3% | 12 Mar, 2026 | npm openclaw |
OpenClaw: LINE group allowlist scope mismatch with DM pairing-store entries GHSA-gp3q-wpq4-5c5h | High | Not scored | 12 Mar, 2026 | npm openclaw |
OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty CVE-2026-34506, GHSA-g7cr-9h7q-4qxq | Medium | 0.3% | 12 Mar, 2026 | npm openclaw |
OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base path CVE-2026-33574, GHSA-vhwf-4x96-vqx2 | Medium | 0.1% | 12 Mar, 2026 | npm openclaw |
OpenClaw's system.run approvals did not bind mutable script operands across approval and execution CVE-2026-32921, GHSA-8g75-q649-6pv6 | Medium | 0.2% | 12 Mar, 2026 | npm openclaw |
Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity CVE-2026-31873, GHSA-5339-hvwr-7582 | Medium | 0.3% | 12 Mar, 2026 | npm unhead |
Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check CVE-2026-31860, GHSA-g5xx-pwrp-g3fv | Medium | 0.3% | 12 Mar, 2026 | npm unhead |
Malicious release: Malicious code in @adamallana0909/apple-research-test (npm) MAL-2026-1375 | Malicious | Not scored | 12 Mar, 2026 | npm @adamallana0909/apple-research-test |
Malicious release: Malicious code in @appleseed-apple/ac-sasskit (npm) MAL-2026-1376 | Malicious | Not scored | 12 Mar, 2026 | npm @appleseed-apple/ac-sasskit |
Keycloak vulnerable to authorization bypass via the Admin API BIT-keycloak-2026-2366, CVE-2026-2366, GHSA-r8jr-wg88-fq5c | Low | 0.3% | 12 Mar, 2026 | Maven org.keycloak:keycloak-js-admin-client npm @keycloak/keycloak-admin-client |
Malicious release: Malicious code in json-specparse (npm) GHSA-w3m6-xffr-576m, MAL-2026-1368 | Malicious | Not scored | 12 Mar, 2026 | npm json-specparse |
Malicious release: Malicious code in mezukabil (npm) GHSA-gx7x-gm3r-rcxv, MAL-2026-1370 | Malicious | Not scored | 12 Mar, 2026 | npm mezukabil |
Malicious release: Malicious code in @kinggupong/baileys (npm) GHSA-786q-6xgv-455x, MAL-2026-1366 | Malicious | Not scored | 12 Mar, 2026 | npm @kinggupong/baileys |
Malicious release: Malicious code in kinggupong (npm) GHSA-953p-rf5p-cp9c, MAL-2026-1369 | Malicious | Not scored | 12 Mar, 2026 | npm kinggupong |
Malicious release: Malicious code in @kinggupong/libsignal-node (npm) GHSA-qjv5-rg93-2qhv, MAL-2026-1367 | Malicious | Not scored | 12 Mar, 2026 | npm @kinggupong/libsignal-node |
Malicious release: Malicious code in praxis-scripts (npm) GHSA-37c2-jh79-3hh6, MAL-2026-1362 | Malicious | Not scored | 12 Mar, 2026 | npm praxis-scripts |
Malicious release: Malicious code in pcl-build-docroot (npm) GHSA-9fgh-86m3-xx7g, MAL-2026-1361 | Malicious | Not scored | 12 Mar, 2026 | npm pcl-build-docroot |
Malicious release: Malicious code in unibody (npm) GHSA-v8gw-679q-2rc3, MAL-2026-1365 | Malicious | Not scored | 12 Mar, 2026 | npm unibody |
Malicious release: Malicious code in libsignal-mod (npm) GHSA-2wrw-p8q7-2vff, MAL-2026-1359 | Malicious | Not scored | 12 Mar, 2026 | npm libsignal-mod |
Malicious release: Malicious code in dappa-libsignal (npm) GHSA-vpw8-364r-vpp5, MAL-2026-1358 | Malicious | Not scored | 12 Mar, 2026 | npm dappa-libsignal |
Malicious release: Malicious code in @dappaoffc/baileys-mod (npm) GHSA-8xvm-wjf7-r5wq, MAL-2026-1355 | Malicious | Not scored | 12 Mar, 2026 | npm @dappaoffc/baileys-mod |
Malicious release: Malicious code in @dappaoffc/baileys (npm) GHSA-x7j8-crq4-jwgr, MAL-2026-1354 | Malicious | Not scored | 12 Mar, 2026 | npm @dappaoffc/baileys |
Malicious release: Malicious code in react-svg-anchor (npm) GHSA-rqq3-hgxg-3j76, MAL-2026-1363 | Malicious | Not scored | 12 Mar, 2026 | npm react-svg-anchor |
Malicious release: Malicious code in bign.ts (npm) GHSA-75ch-f3xh-qrc4, MAL-2026-1357 | Malicious | Not scored | 12 Mar, 2026 | npm bign.ts |
Malicious release: Malicious code in npm-doc-build (npm) GHSA-r89p-9949-2qj7, MAL-2026-1360 | Malicious | Not scored | 12 Mar, 2026 | npm npm-doc-build |
Malicious release: Malicious code in b2b-common-cb-lib (npm) GHSA-3g6j-9975-jm52, MAL-2026-1356 | Malicious | Not scored | 12 Mar, 2026 | npm b2b-common-cb-lib |
Malicious release: Malicious code in svg-safety-tool (npm) GHSA-5wq3-6mmg-x8x9, MAL-2026-1364 | Malicious | Not scored | 12 Mar, 2026 | npm svg-safety-tool |
Malicious release: Malicious code in jinja-template (npm) GHSA-42gx-7w4g-27q2, MAL-2026-1352 | Malicious | Not scored | 12 Mar, 2026 | npm jinja-template |
Malicious release: Malicious code in restrict-imports (npm) GHSA-w874-2fc5-93fx, MAL-2026-1353 | Malicious | Not scored | 12 Mar, 2026 | npm restrict-imports |
@whyour/qinglong: manipulation of the argument command leads to protection mechanism failure CVE-2026-3965, GHSA-xj37-qjg2-xwv2 | Low | 0.5% | 12 Mar, 2026 | npm @whyour/qinglong |