Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
yauzl contains an off-by-one error CVE-2026-31988, GHSA-gmq8-994r-jv83 | Medium | 0.6% | 11 Mar, 2026 | npm yauzl |
StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts CVE-2026-32106, GHSA-wj56-g96r-673q | High | 0.3% | 11 Mar, 2026 | npm studiocms |
StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings CVE-2026-32104, GHSA-9v82-xrm4-mp52 | Medium | 0.3% | 11 Mar, 2026 | npm studiocms |
StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation CVE-2026-32103, GHSA-h7vr-cg25-jf8c | High | 0.4% | 11 Mar, 2026 | npm studiocms |
StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check CVE-2026-32101, GHSA-mm78-fgq8-6pgr | High | 0.2% | 11 Mar, 2026 | npm @studiocms/s3-storage |
Malicious release: Malicious code in f0-abstraction-resolver (npm) MAL-2026-1347 | Malicious | Not scored | 11 Mar, 2026 | npm f0-abstraction-resolver |
Malicious release: Malicious code in locale-clamp-middleware (npm) MAL-2026-1348 | Malicious | Not scored | 11 Mar, 2026 | npm locale-clamp-middleware |
Malicious release: Malicious code in mabibilabub (npm) MAL-2026-1349 | Malicious | Not scored | 11 Mar, 2026 | npm mabibilabub |
Parse Server has a SQL injection via query field name when using PostgreSQL BIT-parse-2026-32234, CVE-2026-32234, GHSA-c442-97qw-j6c6 | Medium | 0.2% | 11 Mar, 2026 | npm parse-server |
Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause BIT-parse-2026-32098, CVE-2026-32098, GHSA-j7mm-f4rv-6q6q | Medium | 0.3% | 11 Mar, 2026 | npm parse-server |
Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash CVE-2026-32094, GHSA-9jfh-9xrq-4vwm | Medium | 0.3% | 11 Mar, 2026 | npm shescape |
devalue has prototype pollution in devalue.parse and devalue.unflatten CVE-2026-30226, GHSA-cfw5-2vxh-hr84 | Medium | 0.5% | 11 Mar, 2026 | npm devalue |
Malicious release: Malicious code in bignum-ts (npm) GHSA-3xc3-xrqv-fjx6, MAL-2026-1344 | Malicious | Not scored | 11 Mar, 2026 | npm bignum-ts |
Malicious release: Malicious code in npm-builders (npm) GHSA-fjr5-82h6-f8gr, MAL-2026-1345 | Malicious | Not scored | 11 Mar, 2026 | npm npm-builders |
Malicious release: Malicious code in ts-lint-builder (npm) GHSA-mxvj-m5xp-m9xg, MAL-2026-1346 | Malicious | Not scored | 11 Mar, 2026 | npm ts-lint-builder |
Striae has a hash validation utility vulnerability CVE-2026-31839, GHSA-mmf8-487q-p45m | High | 0.1% | 11 Mar, 2026 | npm @striae-org/striae |
Malicious release: Malicious code in chai-as-flex (npm) GHSA-p3rj-3q6f-wvp8, MAL-2026-1343 | Malicious | Not scored | 11 Mar, 2026 | npm chai-as-flex |
Malicious release: Malicious code in polygon-gamma-api (npm) GHSA-39j3-68gf-vh7w, MAL-2026-1333 | Malicious | Not scored | 11 Mar, 2026 | npm polygon-gamma-api |
Malicious release: Malicious code in tailwindcss-animate-framer (npm) GHSA-6wp3-j2v8-4jg5, MAL-2026-1335 | Malicious | Not scored | 11 Mar, 2026 | npm tailwindcss-animate-framer |
Malicious release: Malicious code in vite-chunker (npm) GHSA-f786-3r3g-h442, MAL-2026-1338 | Malicious | Not scored | 11 Mar, 2026 | npm vite-chunker |
Malicious release: Malicious code in tailwindcss-forms-bundler (npm) GHSA-gm2h-wf73-fxx5, MAL-2026-1336 | Malicious | Not scored | 11 Mar, 2026 | npm tailwindcss-forms-bundler |
Malicious release: Malicious code in gamma-api-provider (npm) GHSA-rp22-7cw9-ph5g, MAL-2026-1328 | Malicious | Not scored | 11 Mar, 2026 | npm gamma-api-provider |
Malicious release: Malicious code in mui-path-imports (npm) GHSA-5gp8-24cq-8q2v, MAL-2026-1332 | Malicious | Not scored | 11 Mar, 2026 | npm mui-path-imports |
Malicious release: Malicious code in typescript-urql (npm) GHSA-g7m7-vfxq-49jh, MAL-2026-1337 | Malicious | Not scored | 11 Mar, 2026 | npm typescript-urql |
Malicious release: Malicious code in clean-order (npm) GHSA-rv53-q5vv-mx3f, MAL-2026-1326 | Malicious | Not scored | 11 Mar, 2026 | npm clean-order |
Malicious release: Malicious code in google-camelcase (npm) GHSA-5w4r-j5gv-rm4x, MAL-2026-1329 | Malicious | Not scored | 11 Mar, 2026 | npm google-camelcase |
Malicious release: Malicious code in sort-export-all (npm) GHSA-h9cm-7hx6-2xcc, MAL-2026-1334 | Malicious | Not scored | 11 Mar, 2026 | npm sort-export-all |
Malicious release: Malicious code in filter-imports (npm) GHSA-j542-xg84-95px, MAL-2026-1327 | Malicious | Not scored | 11 Mar, 2026 | npm filter-imports |
Malicious release: Malicious code in import-zod (npm) GHSA-57v8-4prv-vf9j, MAL-2026-1330 | Malicious | Not scored | 11 Mar, 2026 | npm import-zod |
Malicious release: Malicious code in llm-oracle (npm) GHSA-84fm-x46g-jqx9, MAL-2026-1331 | Malicious | Not scored | 11 Mar, 2026 | npm llm-oracle |
@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection CVE-2026-31975, GHSA-gv8f-wpm2-m5wr | High | 3.9% | 11 Mar, 2026 | npm @siteboon/claude-code-ui |
Parse Server vulnerable to user enumeration via email verification endpoint BIT-parse-2026-31901, CVE-2026-31901, GHSA-w54v-hf9p-8856 | Medium | 0.3% | 11 Mar, 2026 | npm parse-server |
Parse Server's MFA recovery codes not consumed after use BIT-parse-2026-31875, CVE-2026-31875, GHSA-4hf6-3x24-c9m8 | High | 0.5% | 11 Mar, 2026 | npm parse-server |
Parse Server has a protected fields bypass via dot-notation in query and sort BIT-parse-2026-31872, CVE-2026-31872, GHSA-r2m8-pxm9-9c4g | High | 0.4% | 11 Mar, 2026 | npm parse-server |
Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL BIT-parse-2026-31871, CVE-2026-31871, GHSA-gqpp-xgvh-9h7h | Critical | 0.5% | 11 Mar, 2026 | npm parse-server |
Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types BIT-parse-2026-31868, CVE-2026-31868, GHSA-v5hf-f4c3-m5rv | Medium | 0.3% | 11 Mar, 2026 | npm parse-server |
Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true }) CVE-2026-56763, GHSA-v8w9-8mx6-g223 | Medium | 0.3% | 11 Mar, 2026 | npm hono |
Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL BIT-parse-2026-31856, CVE-2026-31856, GHSA-q3vj-96h2-gwvg | Critical | 0.5% | 11 Mar, 2026 | npm parse-server |
@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters CVE-2026-31862, GHSA-f2fc-vc88-6w7q | Critical | 0.5% | 11 Mar, 2026 | npm @siteboon/claude-code-ui |
@siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes CVE-2026-31861, GHSA-7fv4-fmmc-86g2 | High | 6.8% | 10 Mar, 2026 | npm @siteboon/claude-code-ui |
Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access CVE-2026-31829, GHSA-fvcw-9w9r-pxc7 | High | 2.7% | 10 Mar, 2026 | npm flowise npm flowise-components |
Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction BIT-parse-2026-31828, CVE-2026-31828, GHSA-7m6r-fhh7-r47c | Medium | 0.5% | 10 Mar, 2026 | npm parse-server |
file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header CVE-2026-31808, GHSA-5v7r-6r5c-r473 | Medium | 0.4% | 10 Mar, 2026 | npm file-type |
Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes BIT-parse-2026-31800, CVE-2026-31800, GHSA-7xg7-rqf6-pw6c | High | 0.4% | 10 Mar, 2026 | npm parse-server |
Parse Server has a rate limit bypass via batch request endpoint BIT-parse-2026-30972, CVE-2026-30972, GHSA-775h-3xrc-c228 | Medium | 0.4% | 10 Mar, 2026 | npm parse-server |
Parse Server OAuth2 authentication adapter account takeover via identity spoofing BIT-parse-2026-30967, CVE-2026-30967, GHSA-fr88-w35c-r596 | High | 0.4% | 10 Mar, 2026 | npm parse-server |
Parse Server has role escalation and CLP bypass via direct `_Join` table write BIT-parse-2026-30966, CVE-2026-30966, GHSA-5f92-jrq3-28rc | Critical | 0.4% | 10 Mar, 2026 | npm parse-server |
Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter BIT-parse-2026-30965, CVE-2026-30965, GHSA-6r2j-cxgf-495f | Critical | 1.5% | 10 Mar, 2026 | npm parse-server |
Parse Server has a protected fields bypass via logical query operators BIT-parse-2026-30962, CVE-2026-30962, GHSA-72hp-qff8-4pvv | High | 0.3% | 10 Mar, 2026 | npm parse-server |
Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type CVE-2026-30951, GHSA-6457-6jrx-69cr | High | 0.5% | 10 Mar, 2026 | npm sequelize |