Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in pdfjs-dist-fourth (npm) MAL-2026-1257 | Malicious | Not scored | 05 Mar, 2026 | npm pdfjs-dist-fourth |
Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint CVE-2026-56267, GHSA-jc5m-wrp2-qq38 | Medium | 0.5% | 05 Mar, 2026 | npm flowise |
Flowise has Insufficient Password Salt Rounds CVE-2026-56272, GHSA-x2g5-fvc2-gqvp | Medium | 0.1% | 05 Mar, 2026 | npm flowise |
Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation CVE-2026-3419, GHSA-573f-x89g-hqp9 | Medium | 0.4% | 05 Mar, 2026 | npm fastify |
@perfood/couch-auth has an Observable Timing Discrepancy CVE-2025-70949, GHSA-mjqr-5c55-g77h | High | 0.4% | 05 Mar, 2026 | npm @perfood/couch-auth |
@perfood/couch-auth has a host header injection vulnerability CVE-2025-70948, GHSA-qw8v-34ww-6q9p | Critical | 0.4% | 05 Mar, 2026 | npm @perfood/couch-auth |
Fonoster is vulnerable to directory traversal CVE-2024-43035, GHSA-9fv2-c7v6-p45w | Medium | 2.4% | 05 Mar, 2026 | npm @fonoster/voice |
Malicious release: Malicious code in @imhuman/corp-build-utils-poc (npm) GHSA-53gc-6rwm-8qvx, MAL-2026-1247 | Malicious | Not scored | 05 Mar, 2026 | npm @imhuman/corp-build-utils-poc |
Malicious release: Malicious code in @imhuman/fw-logger (npm) GHSA-6qpc-26c3-fqx4, MAL-2026-1248 | Malicious | Not scored | 05 Mar, 2026 | npm @imhuman/fw-logger |
Malicious release: Malicious code in imhuman-fw-logger (npm) GHSA-v8g3-qq8j-v4hp, MAL-2026-1249 | Malicious | Not scored | 05 Mar, 2026 | npm imhuman-fw-logger |
Malicious release: Malicious code in pear-apps-lib-ui-react-hooks (npm) GHSA-8332-hw5x-q6rx, MAL-2026-1251 | Malicious | Not scored | 05 Mar, 2026 | npm pear-apps-lib-ui-react-hooks |
Mercurius: Incorrect Content-Type parsing can lead to CSRF attack CVE-2025-64166, GHSA-v66j-6wwf-jc57 | Medium | 0.2% | 05 Mar, 2026 | npm mercurius |
Malicious release: Malicious code in pear-apps-utils-avatar-initials (npm) GHSA-g582-vfxj-j9qp, MAL-2026-1252 | Malicious | Not scored | 05 Mar, 2026 | npm pear-apps-utils-avatar-initials |
Malicious release: Malicious code in pear-apps-utils-date (npm) GHSA-j8cc-p8rq-xhvh, MAL-2026-1253 | Malicious | Not scored | 05 Mar, 2026 | npm pear-apps-utils-date |
Malicious release: Malicious code in pear-apps-utils-qr (npm) GHSA-jxj8-p2mm-gjr9, MAL-2026-1254 | Malicious | Not scored | 05 Mar, 2026 | npm pear-apps-utils-qr |
Malicious release: Malicious code in pearpass-lib-data-export (npm) GHSA-h3vq-4m22-hrmf, MAL-2026-1255 | Malicious | Not scored | 05 Mar, 2026 | npm pearpass-lib-data-export |
Malicious release: Malicious code in pear-apps-lib-feedback (npm) GHSA-64j5-x9g6-59pm, MAL-2026-1250 | Malicious | Not scored | 05 Mar, 2026 | npm pear-apps-lib-feedback |
Malicious release: Malicious code in pearpass-lib-data-import (npm) GHSA-xrpx-878r-jfmq, MAL-2026-1256 | Malicious | Not scored | 05 Mar, 2026 | npm pearpass-lib-data-import |
Malicious release: Malicious code in pearpass-utils-password-check (npm) GHSA-pjg5-rffv-3xj5, MAL-2026-1246 | Malicious | Not scored | 05 Mar, 2026 | npm pearpass-utils-password-check |
Malicious release: Malicious code in nf-referral-backend-placeholder (npm) GHSA-g4g8-rr9p-7rcm, MAL-2026-1245 | Malicious | Not scored | 05 Mar, 2026 | npm nf-referral-backend-placeholder |
Malicious release: Malicious code in spectral-corsair-navigator (npm) GHSA-g844-gph2-p427, MAL-2026-1244 | Malicious | Not scored | 05 Mar, 2026 | npm spectral-corsair-navigator |
Malicious release: Malicious code in nf-referral-backend (npm) GHSA-7fwh-38h4-x929, MAL-2026-1243 | Malicious | Not scored | 05 Mar, 2026 | npm nf-referral-backend |
tar has Hardlink Path Traversal via Drive-Relative Linkpath CVE-2026-29786, GHSA-qffp-2rhf-9h96 | High | 0.5% | 05 Mar, 2026 | npm tar |
Ghost has incomplete CSRF protections around OTC use BIT-ghost-2026-29784, CVE-2026-29784, GHSA-9m84-wc28-w895 | High | 0.2% | 05 Mar, 2026 | npm ghost |
Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction BIT-parse-2026-29182, CVE-2026-29182, GHSA-vc89-5g3r-cmhh | High | 0.4% | 05 Mar, 2026 | npm parse-server |
@backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration via Log Redaction Bypass CVE-2026-29184, GHSA-8qp7-fhr9-fw53 | Medium | 0.3% | 05 Mar, 2026 | npm @backstage/plugin-scaffolder-backend |
Backstage vulnerable to potential reading of SCM URLs using built in token CVE-2026-29185, GHSA-95v5-prp4-5gv5 | Low | 0.4% | 05 Mar, 2026 | npm @backstage/integration |
TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution CVE-2026-29186, GHSA-928r-fm4v-mvrw | Critical | 0.9% | 05 Mar, 2026 | npm @backstage/plugin-techdocs-node |
SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) CVE-2026-29074, GHSA-xpqw-6gx7-v673 | High | 0.7% | 04 Mar, 2026 | npm svgo |
Immutable is vulnerable to Prototype Pollution CVE-2026-29063, GHSA-wf6x-7x77-mvgw | High | 1.0% | 04 Mar, 2026 | npm immutable |
locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection CVE-2026-29091, GHSA-fp25-p6mj-qqg6 | High | 0.9% | 04 Mar, 2026 | npm locutus |
@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware CVE-2026-29087, GHSA-wc8c-qw6v-h7f6 | High | 0.4% | 04 Mar, 2026 | npm @hono/node-server |
Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie() CVE-2026-29086, GHSA-5pq2-9x2x-5p6w | Medium | 0.3% | 04 Mar, 2026 | npm hono |
Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE() CVE-2026-29085, GHSA-p6xx-57qc-3wxr | Medium | 0.3% | 04 Mar, 2026 | npm hono |
Hono vulnerable to arbitrary file access via serveStatic vulnerability CVE-2026-29045, GHSA-q5qw-h33p-qvwr | Critical | 0.6% | 04 Mar, 2026 | npm hono |
OpenClaw: BlueBubbles (optional plugin) pairing/allowlist mismatch when allowFrom is empty CVE-2026-22170, GHSA-jwf4-8wf4-jf2m | Medium | 0.3% | 04 Mar, 2026 | npm openclaw |
OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection GHSA-jjgj-cpp9-cvpv | Medium | Not scored | 04 Mar, 2026 | npm openclaw |
OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations GHSA-3jx4-q2m7-r496 | High | Not scored | 04 Mar, 2026 | npm openclaw |
OpenClaw Canvas Authentication Bypass Vulnerability CVE-2026-3690, GHSA-vvjh-f6p9-5vcf | High | 0.7% | 04 Mar, 2026 | npm openclaw |
OpenClaw's image tool bypasses tools.fs.workspaceOnly on sandbox mount paths and exfiltrates out-of-workspace images CVE-2026-32002, GHSA-q6qf-4p5j-r25g | Medium | 0.3% | 04 Mar, 2026 | npm openclaw |
OpenClaw has incomplete IPv4 special-use SSRF blocking in web fetch guard CVE-2026-32019, GHSA-4rqq-w8v4-7p47 | Medium | 0.2% | 04 Mar, 2026 | npm openclaw |
OpenClaw has agent avatar symlink traversal in gateway session metadata GHSA-9mph-4f7v-fmvh | Medium | Not scored | 04 Mar, 2026 | npm openclaw |
OpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization GHSA-f6h3-846h-2r8w | Medium | Not scored | 04 Mar, 2026 | npm openclaw |
OpenClaw has cross-account DM pairing authorization bypass via unscoped pairing store access CVE-2026-32067, GHSA-vjp8-wprm-2jw9 | Low | 0.2% | 04 Mar, 2026 | npm openclaw |
OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP GHSA-8cp7-rp8r-mg77 | Medium | Not scored | 04 Mar, 2026 | npm openclaw |
OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows CVE-2026-32005, GHSA-x2ff-j5c2-ggpr | High | 0.3% | 04 Mar, 2026 | npm openclaw |
CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package CVE-2026-28343, GHSA-jrqm-vmqc-gm93 | Medium | 0.3% | 04 Mar, 2026 | npm @ckeditor/ckeditor5-html-support npm ckeditor5 |
Malicious release: Malicious code in yaml-manifest-utils-mynarratorai (npm) MAL-2026-1242 | Malicious | Not scored | 04 Mar, 2026 | npm yaml-manifest-utils-mynarratorai |
Dark Reader gives users the ability to request style sheets from local web servers CVE-2025-68467, GHSA-x369-mcw8-8rvj | Low | 0.1% | 04 Mar, 2026 | npm darkreader |
Multer Vulnerable to Denial of Service via Uncontrolled Recursion CVE-2026-3520, GHSA-5528-5vmv-3xc2 | High | 0.8% | 04 Mar, 2026 | npm multer |