Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in eslint-verify-plugin (npm) GHSA-g7rg-j32w-9f9m, MAL-2026-1173 | Malicious | Not scored | 03 Mar, 2026 | npm eslint-verify-plugin |
mailparser vulnerable to Cross-site Scripting CVE-2026-3455, GHSA-7gmj-h9xc-mcxc | Low | 0.4% | 03 Mar, 2026 | npm mailparser |
@tootallnate/once vulnerable to Incorrect Control Flow Scoping CVE-2026-3449, GHSA-vpq2-c234-7xj6 | Low | 0.1% | 03 Mar, 2026 | npm @tootallnate/once |
Malicious release: Malicious code in gabby-types (npm) GHSA-pwrj-8gmq-f574, MAL-2026-1176 | Malicious | Not scored | 03 Mar, 2026 | npm gabby-types |
Malicious release: Malicious code in @global-dax-ad-platform/dax-utils (npm) GHSA-33x7-m654-2w4g, MAL-2026-1170 | Malicious | Not scored | 03 Mar, 2026 | npm @global-dax-ad-platform/dax-utils |
Malicious release: Malicious code in @global-dax-ad-platform/dax-components (npm) GHSA-5rpp-4wg3-q4ww, MAL-2026-1165 | Malicious | Not scored | 03 Mar, 2026 | npm @global-dax-ad-platform/dax-components |
Malicious release: Malicious code in @global-dax-ad-platform/dax-modules (npm) GHSA-rqrg-p585-r9f4, MAL-2026-1167 | Malicious | Not scored | 03 Mar, 2026 | npm @global-dax-ad-platform/dax-modules |
Malicious release: Malicious code in @global-dax-ad-platform/dax-hooks (npm) GHSA-vp7m-93c4-5992, MAL-2026-1166 | Malicious | Not scored | 03 Mar, 2026 | npm @global-dax-ad-platform/dax-hooks |
Malicious release: Malicious code in @global-dax-ad-platform/dax-types (npm) GHSA-w8f2-jmmq-3g88, MAL-2026-1169 | Malicious | Not scored | 03 Mar, 2026 | npm @global-dax-ad-platform/dax-types |
Malicious release: Malicious code in @global-dax-ad-platform/dax-styles (npm) GHSA-x3c2-xw79-63qf, MAL-2026-1168 | Malicious | Not scored | 03 Mar, 2026 | npm @global-dax-ad-platform/dax-styles |
Malicious release: Malicious code in hiagentevilmcp (npm) GHSA-9264-q4hp-q57g, MAL-2026-1178 | Malicious | Not scored | 03 Mar, 2026 | npm hiagentevilmcp |
Malicious release: Malicious code in @zakhaevv/envai (npm) GHSA-33h9-mg87-vq25, MAL-2026-1172 | Malicious | Not scored | 03 Mar, 2026 | npm @zakhaevv/envai |
Malicious release: Malicious code in @snazaah/davey (npm) GHSA-q84c-f2pg-2gh7, MAL-2026-1171 | Malicious | Not scored | 03 Mar, 2026 | npm @snazaah/davey |
Malicious release: Malicious code in graph-dynamic (npm) GHSA-6q72-5cph-5xxf, MAL-2026-1177 | Malicious | Not scored | 03 Mar, 2026 | npm graph-dynamic |
Malicious release: Malicious code in magala (npm) GHSA-vcvv-6hch-f873, MAL-2026-1179 | Malicious | Not scored | 03 Mar, 2026 | npm magala |
Malicious release: Malicious code in openclaw-droid (npm) GHSA-q7p3-59wr-r6f3, MAL-2026-1151 | Malicious | Not scored | 03 Mar, 2026 | npm openclaw-droid |
Malicious release: Malicious code in token-discord-encryptation (npm) GHSA-q5w4-82wp-c3hp, MAL-2026-1157 | Malicious | Not scored | 03 Mar, 2026 | npm token-discord-encryptation |
Malicious release: Malicious code in solongnerds (npm) GHSA-rvxr-rg3g-gqfr, MAL-2026-1156 | Malicious | Not scored | 03 Mar, 2026 | npm solongnerds |
Malicious release: Malicious code in yazxzpedia-libsignal (npm) GHSA-2wr8-68wx-vgr7, MAL-2026-1164 | Malicious | Not scored | 03 Mar, 2026 | npm yazxzpedia-libsignal |
Malicious release: Malicious code in primexuu-libsignal (npm) GHSA-6w7r-jw92-pfjf, MAL-2026-1153 | Malicious | Not scored | 03 Mar, 2026 | npm primexuu-libsignal |
Malicious release: Malicious code in libsignal-yazxz (npm) GHSA-75f2-3rh8-f2rr, MAL-2026-1150 | Malicious | Not scored | 03 Mar, 2026 | npm libsignal-yazxz |
Malicious release: Malicious code in rullzdigital-libsignal (npm) GHSA-jgfp-q988-vx26, MAL-2026-1155 | Malicious | Not scored | 03 Mar, 2026 | npm rullzdigital-libsignal |
Malicious release: Malicious code in danzxoffc74-libsignal (npm) GHSA-p3mp-4w28-j2fj, MAL-2026-1147 | Malicious | Not scored | 03 Mar, 2026 | npm danzxoffc74-libsignal |
Malicious release: Malicious code in @yazxzpedia/baileys (npm) GHSA-q2g5-7g7x-28xp, MAL-2026-1145 | Malicious | Not scored | 03 Mar, 2026 | npm @yazxzpedia/baileys |
Malicious release: Malicious code in rullzdigital (npm) GHSA-vv3p-5rm5-qxrc, MAL-2026-1154 | Malicious | Not scored | 03 Mar, 2026 | npm rullzdigital |
Malicious release: Malicious code in danzxoffc74 (npm) GHSA-wq3m-3fq3-4w5v, MAL-2026-1146 | Malicious | Not scored | 03 Mar, 2026 | npm danzxoffc74 |
Malicious release: Malicious code in xpack-video-submission (npm) GHSA-3mrc-3vpq-5qc6, MAL-2026-1163 | Malicious | Not scored | 03 Mar, 2026 | npm xpack-video-submission |
Malicious release: Malicious code in xpack-test-3.0 (npm) GHSA-8cfx-xvvc-pc4x, MAL-2026-1162 | Malicious | Not scored | 03 Mar, 2026 | npm xpack-test-3.0 |
Malicious release: Malicious code in xpack-arc-gateway (npm) GHSA-gh92-xxgg-6g98, MAL-2026-1158 | Malicious | Not scored | 03 Mar, 2026 | npm xpack-arc-gateway |
Malicious release: Malicious code in ethglobal-finale (npm) GHSA-x78f-q722-m5v6, MAL-2026-1148 | Malicious | Not scored | 03 Mar, 2026 | npm ethglobal-finale |
Malicious release: Malicious code in xpack-per-device (npm) GHSA-9629-h7qc-p57c, MAL-2026-1159 | Malicious | Not scored | 03 Mar, 2026 | npm xpack-per-device |
Malicious release: Malicious code in xpack-subscription (npm) GHSA-9f55-3p24-3r9c, MAL-2026-1160 | Malicious | Not scored | 03 Mar, 2026 | npm xpack-subscription |
Malicious release: Malicious code in xpack-sui (npm) GHSA-9rq2-6v86-w222, MAL-2026-1161 | Malicious | Not scored | 03 Mar, 2026 | npm xpack-sui |
Malicious release: Malicious code in pool-check (npm) GHSA-vgpx-x7hq-m4fx, MAL-2026-1152 | Malicious | Not scored | 03 Mar, 2026 | npm pool-check |
Malicious release: Malicious code in hackpreinstall (npm) GHSA-34f9-x3r7-8wjj, MAL-2026-1149 | Malicious | Not scored | 03 Mar, 2026 | npm hackpreinstall |
OpenClaw: macOS optional allowlist basename matching could bypass path-based policy CVE-2026-32016, GHSA-7f4q-9rqh-x36p | High | 0.1% | 03 Mar, 2026 | npm openclaw |
OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE) CVE-2026-32003, GHSA-2fgq-7j6h-9rm4 | High | 0.6% | 03 Mar, 2026 | npm openclaw |
OpenClaw: Node reconnect metadata spoofing could bypass platform-based node command policy CVE-2026-32014, GHSA-r65x-2hqr-j5hf | High | 0.2% | 03 Mar, 2026 | npm openclaw |
OpenClaw: macOS beta onboarding exposed PKCE verifier via OAuth state CVE-2026-3691, GHSA-6g25-pc82-vfwp | Medium | 0.5% | 03 Mar, 2026 | npm openclaw |
OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants GHSA-5847-rm3g-23mw | Medium | Not scored | 03 Mar, 2026 | npm openclaw |
OpenClaw's avatar symlink traversal can expose out-of-workspace local files CVE-2026-32024, GHSA-rx3g-mvc3-qfjf | Medium | 0.3% | 03 Mar, 2026 | npm openclaw |
OpenClaw has a sandbox network isolation bypass via docker.network=container:<id> CVE-2026-32038, GHSA-ww6v-v748-x7g9 | Critical | 0.3% | 02 Mar, 2026 | npm openclaw |
OpenClaw: Node system.run approval bypass via parent-symlink cwd rebind CVE-2026-27545, GHSA-f7ww-2725-qvw2 | High | 0.1% | 02 Mar, 2026 | npm openclaw |
OpenClaw: Message action attachment hydration bypasses local media root checks when sandboxRoot is unset CVE-2026-27522, GHSA-fqcm-97m6-w7rm | High | 0.4% | 02 Mar, 2026 | npm openclaw |
OpenClaw: system.run approval identity mismatch could execute a different binary than displayed CVE-2026-32065, GHSA-hwpq-rrpf-pgcq | Medium | 0.3% | 02 Mar, 2026 | npm openclaw |
OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval GHSA-943q-mwmv-hhvh | High | Not scored | 02 Mar, 2026 | npm openclaw |
OpenClaw Vulnerable to Remote Code Execution via Node Invoke Approval Bypass in Gateway CVE-2026-28466, GHSA-gv46-4xfq-jv58 | Critical | 0.5% | 02 Mar, 2026 | npm openclaw |
OpenClaw vulnerable to path traversal (Zip Slip) in archive extraction during explicit installation commands CVE-2026-28486, GHSA-v892-hwpg-jwqp | Medium | 0.2% | 02 Mar, 2026 | npm openclaw |
OpenClaw's sandbox skill mirroring path traversal vulnerability could write outside the sandbox workspace CVE-2026-28457, GHSA-xw4p-pw82-hqr7 | Medium | 0.2% | 02 Mar, 2026 | npm openclaw |
OpenClaw has non-constant-time token comparison in hooks authentication CVE-2026-28464, GHSA-jmm5-fvh5-gf4p | High | 0.4% | 02 Mar, 2026 | npm openclaw |