Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in json-merge-tool (npm) GHSA-cpf2-rx79-x333, MAL-2026-1297 | Malicious | Not scored | 09 Mar, 2026 | npm json-merge-tool |
OpenClaw: Sandboxed /acp spawn requests could initialize host ACP sessions CVE-2026-27646, GHSA-9q36-67vc-rrwg | Medium | 0.1% | 09 Mar, 2026 | npm openclaw |
OpenClaw: system.run allow-always persistence included shell-commented payload tails GHSA-9q2p-vc84-2rwm | Medium | Not scored | 09 Mar, 2026 | npm openclaw |
OpenClaw: `operator.write` chat.send could reach admin-only config writes GHSA-hfpr-jhpq-x4rm | Medium | Not scored | 09 Mar, 2026 | npm openclaw |
OpenClaw: system.run wrapper-depth boundary could skip shell approval gating CVE-2026-27183, GHSA-r6qf-8968-wj9q | Low | 0.1% | 09 Mar, 2026 | npm openclaw |
OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects CVE-2026-32913, GHSA-6mgf-v5j7-45cr | High | 0.3% | 09 Mar, 2026 | npm openclaw |
OpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping GHSA-pjvx-rx66-r3fg | Medium | Not scored | 09 Mar, 2026 | npm openclaw |
OpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers GHSA-3h2q-j2v4-6w5r | Medium | Not scored | 09 Mar, 2026 | npm openclaw |
OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots GHSA-j425-whc4-4jgc | Medium | Not scored | 09 Mar, 2026 | npm openclaw |
OpenClaw's hooks count non-POST requests toward auth lockout GHSA-6rmx-gvvg-vh6j | Medium | Not scored | 09 Mar, 2026 | npm openclaw |
OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage GHSA-rchv-x836-w7xp | High | Not scored | 09 Mar, 2026 | npm openclaw |
OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding CVE-2026-30920, GHSA-656w-6f6c-m9r6 | High | 0.2% | 09 Mar, 2026 | npm @oneuptime/common |
@budibase/server: Command Injection in PostgreSQL Dump Command CVE-2026-25041, GHSA-726g-59wr-cj4c | High | 0.5% | 09 Mar, 2026 | npm @budibase/server |
Malicious release: Malicious code in odds-analyzer (npm) GHSA-89vf-5w9c-qf87, MAL-2026-1292 | Malicious | Not scored | 09 Mar, 2026 | npm odds-analyzer |
Malicious release: Malicious code in tw-modern-ui (npm) GHSA-m4gf-v2v4-3qh2, MAL-2026-1293 | Malicious | Not scored | 09 Mar, 2026 | npm tw-modern-ui |
Actual Sync Server has an Authenticated Path Traversal CVE-2026-3089, GHSA-27vg-33gh-4hwg | Medium | 0.4% | 09 Mar, 2026 | npm @actual-app/sync-server |
Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters BIT-parse-2026-30863, CVE-2026-30863, GHSA-x6fw-778m-wr9v | Critical | 0.6% | 07 Mar, 2026 | npm parse-server |
Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled BIT-parse-2026-30854, CVE-2026-30854, GHSA-q5q9-2rhp-33qw | Medium | 0.3% | 07 Mar, 2026 | npm parse-server |
Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization BIT-parse-2026-30850, CVE-2026-30850, GHSA-hwx8-q9cg-mqmc | Medium | 0.3% | 07 Mar, 2026 | npm parse-server |
Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory BIT-parse-2026-30848, CVE-2026-30848, GHSA-hm3f-q6rw-m6wh | Medium | 0.3% | 07 Mar, 2026 | npm parse-server |
OneUptime: Synthetic Monitor RCE via exposed Playwright browser object CVE-2026-30921, GHSA-4j36-39gm-8vq8 | Critical | 0.5% | 07 Mar, 2026 | npm @oneuptime/common |
x402 SDK Security Advisory GHSA-qr2g-p6q7-w82m, GO-2026-4647 | High | Not scored | 07 Mar, 2026 | Go github.com/coinbase/x402/go PyPI x402 npm @x402/svm |
OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE CVE-2026-30887, GHSA-h343-gg57-2q67 | Critical | 0.4% | 07 Mar, 2026 | npm @oneuptime/common |
PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3` CVE-2026-30870, GHSA-q6wc-xx4m-92fj | Medium | 0.2% | 07 Mar, 2026 | npm @powersync/service-core npm @powersync/service-sync-rules |
Flowise Missing Authentication on NVIDIA NIM Endpoints CVE-2026-30824, GHSA-5f53-522j-j454 | High | 37.3% | 06 Mar, 2026 | npm flowise |
Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration CVE-2026-30823, GHSA-cwc3-p92j-g7qm | High | 0.5% | 06 Mar, 2026 | npm flowise |
Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint CVE-2026-30822, GHSA-mq4r-h2gh-qv7x | High | 15.0% | 06 Mar, 2026 | npm flowise |
parse-server: Malformed `$regex` query leaks database error details in API response BIT-parse-2026-30835, CVE-2026-30835, GHSA-9cp7-3q5w-j92g | Medium | 0.4% | 06 Mar, 2026 | npm parse-server |
Flowise has Arbitrary File Upload via MIME Spoofing CVE-2026-30821, GHSA-j8g8-j7fc-43v6 | High | 16.7% | 06 Mar, 2026 | npm flowise |
Flowise has Authorization Bypass via Spoofed x-request-from Header CVE-2026-30820, GHSA-wvhq-wp8g-c7vq | High | 0.5% | 06 Mar, 2026 | npm flowise |
Mercurius's queryDepth limit bypassed for WebSocket subscriptions CVE-2026-30241, GHSA-m4h2-mjfm-mp55 | Low | 0.4% | 06 Mar, 2026 | npm mercurius |
parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user BIT-parse-2026-30229, CVE-2026-30229, GHSA-79wj-8rqv-jvp5 | High | 0.4% | 06 Mar, 2026 | npm parse-server |
parse-server's file creation and deletion bypasses `readOnlyMasterKey` write restriction BIT-parse-2026-30228, CVE-2026-30228, GHSA-xfh7-phr7-gr2x | Medium | 0.4% | 06 Mar, 2026 | npm parse-server |
Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens GHSA-9r75-g2cr-3h76 | Medium | Not scored | 06 Mar, 2026 | npm @workflow/core npm workflow |
defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag CVE-2026-30830, GHSA-5mq8-78gm-pjmq | Low | 0.3% | 06 Mar, 2026 | npm defuddle |
express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network CVE-2026-30827, GHSA-46wh-pxpv-q5gq | High | 0.5% | 06 Mar, 2026 | npm express-rate-limit |
GitHub Copilot CLI Dangerous Shell Expansion Patterns Enable Arbitrary Code Execution CVE-2026-29783, GHSA-g8r9-g2v8-jv6f | High | 0.5% | 06 Mar, 2026 | npm @github/copilot |
Malicious release: Malicious code in qq-console (npm) GHSA-whff-563x-2xmr, MAL-2026-1271 | Malicious | Not scored | 06 Mar, 2026 | npm qq-console |
Malicious release: Malicious code in @wgu-edu/wgu-core (npm) GHSA-9pc5-g685-53f7, MAL-2026-1269 | Malicious | Not scored | 06 Mar, 2026 | npm @wgu-edu/wgu-core |
Malicious release: Malicious code in @wgu-edu/wgu-icons (npm) GHSA-r3w8-f4f4-mvvw, MAL-2026-1270 | Malicious | Not scored | 06 Mar, 2026 | npm @wgu-edu/wgu-icons |
Malicious release: Malicious code in @shenira/baileysx (npm) GHSA-24xg-rj5c-2r2c, MAL-2026-1267 | Malicious | Not scored | 06 Mar, 2026 | npm @shenira/baileysx |
Malicious release: Malicious code in @shenira/baileys (npm) GHSA-gwh9-jq72-g4mw, MAL-2026-1266 | Malicious | Not scored | 06 Mar, 2026 | npm @shenira/baileys |
Malicious release: Malicious code in @shenira/libsignal-node (npm) GHSA-vr9m-wh7r-4xfx, MAL-2026-1268 | Malicious | Not scored | 06 Mar, 2026 | npm @shenira/libsignal-node |
Malicious release: Malicious code in test-mal-npm-pkg-not-local (npm) GHSA-5q4h-v7c2-v9r2, MAL-2026-1274 | Malicious | Not scored | 06 Mar, 2026 | npm test-mal-npm-pkg-not-local |
Malicious release: Malicious code in test-mal-npm-pkg-local (npm) GHSA-6258-pr46-j4rc, MAL-2026-1273 | Malicious | Not scored | 06 Mar, 2026 | npm test-mal-npm-pkg-local |
Malicious release: Malicious code in test-mal-npm-pkg-2 (npm) GHSA-855h-6c4m-f9m7, MAL-2026-1272 | Malicious | Not scored | 06 Mar, 2026 | npm test-mal-npm-pkg-2 |
Malicious release: Malicious code in aaaaaxxxxx (npm) GHSA-w24m-g68p-7wmq, MAL-2026-1265 | Malicious | Not scored | 06 Mar, 2026 | npm aaaaaxxxxx |
Malicious release: Malicious code in webmd-url (npm) GHSA-853v-5vhr-jmpc, MAL-2026-1260 | Malicious | Not scored | 06 Mar, 2026 | npm webmd-url |
Malicious release: Malicious code in pino-sdk-v2 (npm) GHSA-h6xh-3v8c-jhjf, MAL-2026-1259 | Malicious | Not scored | 06 Mar, 2026 | npm pino-sdk-v2 |
Malicious release: Malicious code in tether-dev-docs (npm) GHSA-6c8j-272h-r6h7, MAL-2026-1258 | Malicious | Not scored | 06 Mar, 2026 | npm tether-dev-docs |