Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Parse Server missing audience validation in Keycloak authentication adapter BIT-parse-2026-30949, CVE-2026-30949, GHSA-48mh-j4p5-7j9v | High | 0.5% | 10 Mar, 2026 | npm parse-server |
Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload BIT-parse-2026-30948, CVE-2026-30948, GHSA-hcj7-6gxh-24ww | High | 0.2% | 10 Mar, 2026 | npm parse-server |
Parse Server has a bypass of class-level permissions in LiveQuery BIT-parse-2026-30947, CVE-2026-30947, GHSA-7ch5-98q2-7289 | High | 0.5% | 10 Mar, 2026 | npm parse-server |
Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API BIT-parse-2026-30946, CVE-2026-30946, GHSA-cmj3-wx7h-ffvg | High | 0.6% | 10 Mar, 2026 | npm parse-server |
Elysia has a string URL format ReDoS CVE-2026-30837, GHSA-f45g-68q3-5w8x | High | 0.5% | 10 Mar, 2026 | npm elysia |
Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter CVE-2026-29793, GHSA-p9xr-7p9p-gpqx | Critical | 0.5% | 10 Mar, 2026 | npm @feathersjs/mongodb |
Feathers has an OAuth Callback Account Takeover issue CVE-2026-29792, GHSA-wg9x-qfgw-pxhj | Critical | 0.6% | 10 Mar, 2026 | npm @feathersjs/authentication-oauth |
pdfmake is vulnerable to server-side request forgery (SSRF) CVE-2026-26801, GHSA-wp52-r2fp-4vmr | High | 0.5% | 10 Mar, 2026 | npm pdfmake |
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE CVE-2026-28292, GHSA-r275-fr43-pm7q | Critical | 1.4% | 10 Mar, 2026 | npm simple-git |
Parse Server: SQL injection via dot-notation field name in PostgreSQL BIT-parse-2026-31840, CVE-2026-31840, GHSA-qpr4-jrj4-6f27 | Critical | 0.5% | 10 Mar, 2026 | npm parse-server |
@appium/support has a Zip Slip arbitrary file write in its ZIP extraction CVE-2026-30973, GHSA-rfx7-4xw3-gh4m | Medium | 0.5% | 10 Mar, 2026 | npm @appium/support |
StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service CVE-2026-30945, GHSA-8rgj-vrfr-6hqr | High | 0.5% | 10 Mar, 2026 | npm studiocms |
Parse Server has a NoSQL injection via token type in password reset and email verification endpoints BIT-parse-2026-30941, CVE-2026-30941, GHSA-vgjh-hmwf-c588 | High | 0.5% | 10 Mar, 2026 | npm parse-server |
Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network CVE-2026-26118, GHSA-hhfx-wfvq-7g9c, PYSEC-2026-2669 | High | 1.1% | 10 Mar, 2026 | NuGet Azure.Mcp PyPI msmcp-azure npm @azure/mcp |
StudioCMS has Privilege Escalation via Insecure API Token Generation CVE-2026-30944, GHSA-667w-mmh7-mrr4 | High | 0.6% | 10 Mar, 2026 | npm studiocms |
Malicious release: Malicious code in test-logsmodule-v-zisko (npm) GHSA-5c6q-wp3q-gcch, MAL-2026-1324 | Malicious | Not scored | 10 Mar, 2026 | npm test-logsmodule-v-zisko |
Malicious release: Malicious code in bluelite-bot-manager (npm) GHSA-6939-264r-mcp4, MAL-2026-1323 | Malicious | Not scored | 10 Mar, 2026 | npm bluelite-bot-manager |
Malicious release: Malicious code in rtxnode-sass22 (npm) GHSA-gr9m-wqvq-35x3, MAL-2026-1322 | Malicious | Not scored | 10 Mar, 2026 | npm rtxnode-sass22 |
Malicious release: Malicious code in @openclaw-ai/openclawai (npm) GHSA-73px-wj4g-wgwp, MAL-2026-1321 | Malicious | Not scored | 10 Mar, 2026 | npm @openclaw-ai/openclawai |
Malicious release: Malicious code in @web-monorepo/fetchers (npm) MAL-2026-1318 | Malicious | Not scored | 10 Mar, 2026 | npm @web-monorepo/fetchers |
Malicious release: Malicious code in @augmentor/experiences (npm) GHSA-mpxg-x386-qhgr, MAL-2026-1317 | Malicious | Not scored | 10 Mar, 2026 | npm @augmentor/experiences |
Malicious release: Malicious code in alinet-w (npm) GHSA-394g-wvjv-j6mg, MAL-2026-1319 | Malicious | Not scored | 10 Mar, 2026 | npm alinet-w |
Malicious release: Malicious code in chain-promised-await (npm) GHSA-x7f9-fr3r-64w3, MAL-2026-1320 | Malicious | Not scored | 10 Mar, 2026 | npm chain-promised-await |
node-tar Symlink Path Traversal via Drive-Relative Linkpath CVE-2026-31802, GHSA-9ppj-qmqm-q256 | High | 0.3% | 10 Mar, 2026 | npm tar |
OneUptime has WhatsApp Resend Verification Authorization Bypass CVE-2026-30959, GHSA-cw6x-mw64-q6pv | Medium | 0.4% | 10 Mar, 2026 | npm @oneuptime/common |
OneUptime has Synthetic Monitor RCE via exposed Playwright browser object CVE-2026-30957, GHSA-jw8q-gjvg-8w4q | Critical | 1.3% | 10 Mar, 2026 | npm @oneuptime/common |
OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover CVE-2026-30956, GHSA-r5v6-2599-9g3m | Critical | 0.5% | 10 Mar, 2026 | npm @oneuptime/common |
liquidjs has a path traversal fallback vulnerability CVE-2026-30952, GHSA-wmfp-5q7x-987x | High | 0.6% | 10 Mar, 2026 | npm liquidjs |
Malicious release: Malicious code in @mmm-otrade/transaction-adapter (npm) GHSA-2m9p-9969-wqcg, MAL-2026-1301 | Malicious | Not scored | 10 Mar, 2026 | npm @mmm-otrade/transaction-adapter |
Malicious release: Malicious code in collab-library (npm) GHSA-3gp5-v85g-m879, MAL-2026-1305 | Malicious | Not scored | 10 Mar, 2026 | npm collab-library |
Malicious release: Malicious code in @rothaus/falcologgerinternalstate (npm) GHSA-3hwm-q5v7-wc64, MAL-2026-1303 | Malicious | Not scored | 10 Mar, 2026 | npm @rothaus/falcologgerinternalstate |
Malicious release: Malicious code in iron-localstorage (npm) GHSA-5q6j-pgfc-j6hj, MAL-2026-1309 | Malicious | Not scored | 10 Mar, 2026 | npm iron-localstorage |
Malicious release: Malicious code in iron-selector (npm) GHSA-95jf-557m-8wf3, MAL-2026-1314 | Malicious | Not scored | 10 Mar, 2026 | npm iron-selector |
Malicious release: Malicious code in iron-overlay-behavior (npm) GHSA-cx53-g4g3-wmcj, MAL-2026-1312 | Malicious | Not scored | 10 Mar, 2026 | npm iron-overlay-behavior |
Malicious release: Malicious code in iron-fit-behavior (npm) GHSA-f874-c2w3-388v, MAL-2026-1307 | Malicious | Not scored | 10 Mar, 2026 | npm iron-fit-behavior |
Malicious release: Malicious code in iron-menu-behavior (npm) GHSA-h9gw-qwfq-q74c, MAL-2026-1311 | Malicious | Not scored | 10 Mar, 2026 | npm iron-menu-behavior |
Malicious release: Malicious code in iron-pages (npm) GHSA-hphv-rwc2-7gp4, MAL-2026-1313 | Malicious | Not scored | 10 Mar, 2026 | npm iron-pages |
Malicious release: Malicious code in falcologgerinternalstate (npm) GHSA-hr5p-8hqc-wcm6, MAL-2026-1306 | Malicious | Not scored | 10 Mar, 2026 | npm falcologgerinternalstate |
Malicious release: Malicious code in @platform-growth/guidance-channel-provider (npm) GHSA-m84f-rg3g-9pvw, MAL-2026-1302 | Malicious | Not scored | 10 Mar, 2026 | npm @platform-growth/guidance-channel-provider |
Malicious release: Malicious code in @mmm-otrade/transaction (npm) GHSA-m8gv-h3cq-3grx, MAL-2026-1300 | Malicious | Not scored | 10 Mar, 2026 | npm @mmm-otrade/transaction |
Malicious release: Malicious code in iron-signals (npm) GHSA-qjw5-fmpc-w42r, MAL-2026-1315 | Malicious | Not scored | 10 Mar, 2026 | npm iron-signals |
Malicious release: Malicious code in amt-package-united-icons (npm) GHSA-rjmf-gw43-xhq4, MAL-2026-1304 | Malicious | Not scored | 10 Mar, 2026 | npm amt-package-united-icons |
Malicious release: Malicious code in iron-image (npm) GHSA-2ggx-x8w4-989p, MAL-2026-1308 | Malicious | Not scored | 10 Mar, 2026 | npm iron-image |
Malicious release: Malicious code in xc-input-toggle (npm) GHSA-9mxj-qv8w-v2qx, MAL-2026-1316 | Malicious | Not scored | 10 Mar, 2026 | npm xc-input-toggle |
Malicious release: Malicious code in iron-media-query (npm) GHSA-c62p-2739-c88f, MAL-2026-1310 | Malicious | Not scored | 10 Mar, 2026 | npm iron-media-query |
Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution BIT-parse-2026-30939, CVE-2026-30939, GHSA-5j86-7r7m-p8h6 | High | 0.6% | 10 Mar, 2026 | npm parse-server |
Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement BIT-parse-2026-30938, CVE-2026-30938, GHSA-q342-9w2p-57fp | Medium | 0.5% | 10 Mar, 2026 | npm parse-server |
Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery BIT-parse-2026-30925, CVE-2026-30925, GHSA-mf3j-86qx-cq5j | High | 0.5% | 10 Mar, 2026 | npm parse-server |
Malicious release: Malicious code in monoping (npm) GHSA-mq8p-wfj2-j6cq, MAL-2026-1299 | Malicious | Not scored | 10 Mar, 2026 | npm monoping |
Malicious release: Malicious code in jsonify-core (npm) GHSA-865m-mjxh-x6h8, MAL-2026-1298 | Malicious | Not scored | 09 Mar, 2026 | npm jsonify-core |