Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Multer vulnerable to Denial of Service via incomplete cleanup CVE-2026-3304, GHSA-xf7r-hgr6-v32p | High | 0.7% | 27 Feb, 2026 | npm multer |
Multer vulnerable to Denial of Service via resource exhaustion CVE-2026-2359, GHSA-v52c-386h-88mc | High | 0.7% | 27 Feb, 2026 | npm multer |
Malicious release: Malicious code in @skyzopedia/baileys (npm) GHSA-65cp-mv9p-hrfx, MAL-2026-1065 | Malicious | Not scored | 27 Feb, 2026 | npm @skyzopedia/baileys |
Malicious release: Malicious code in @skyzopedia/baileys-pro (npm) GHSA-9543-wpp8-34w3, MAL-2026-1067 | Malicious | Not scored | 27 Feb, 2026 | npm @skyzopedia/baileys-pro |
Malicious release: Malicious code in @skyzopedia/libsignal-node (npm) GHSA-ccmw-784p-h6x6, MAL-2026-1069 | Malicious | Not scored | 27 Feb, 2026 | npm @skyzopedia/libsignal-node |
Malicious release: Malicious code in libsignal-skyzopedia (npm) GHSA-f6mr-6f43-m4cr, MAL-2026-1071 | Malicious | Not scored | 27 Feb, 2026 | npm libsignal-skyzopedia |
Malicious release: Malicious code in @skyzopedia/baileys-mod (npm) GHSA-gg4c-g7hp-rgp8, MAL-2026-1066 | Malicious | Not scored | 27 Feb, 2026 | npm @skyzopedia/baileys-mod |
Malicious release: Malicious code in @skyzopedia/ubot (npm) GHSA-mw93-6xm9-4mxq, MAL-2026-1070 | Malicious | Not scored | 27 Feb, 2026 | npm @skyzopedia/ubot |
Malicious release: Malicious code in @skyzopedia/brat (npm) GHSA-prrf-qx8x-3283, MAL-2026-1068 | Malicious | Not scored | 27 Feb, 2026 | npm @skyzopedia/brat |
Malicious release: Malicious code in @zinley/orion (npm) MAL-2026-1060 | Malicious | Not scored | 27 Feb, 2026 | npm @zinley/orion |
Malicious release: Malicious code in newman-reporter-genuinepoc (npm) MAL-2026-1061 | Malicious | Not scored | 27 Feb, 2026 | npm newman-reporter-genuinepoc |
Malicious release: Malicious code in express-core-validator (npm) GHSA-pqqv-f6rm-588j, MAL-2026-1062 | Malicious | Not scored | 27 Feb, 2026 | npm express-core-validator |
Malicious release: Malicious code in nuget-task-common (npm) MAL-2026-1059 | Malicious | Not scored | 27 Feb, 2026 | npm nuget-task-common |
OpenClaw's tools.exec.safeBins sort long-option abbreviation bypass can skip exec approval in allowlist mode CVE-2026-28363, CVE-2026-32059, GHSA-3c6h-g97w-fg78, GHSA-7977-c43c-xpwj | Critical | 0.6% | 27 Feb, 2026 | npm openclaw |
@actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget file access in multi-user mode CVE-2026-27638, GHSA-qmjj-p7m9-wjrv | Medium | 0.3% | 26 Feb, 2026 | npm @actual-app/sync-server |
n8n has Webhook Forgery on Zendesk Trigger Node CVE-2026-56360, GHSA-38c7-23hj-2wgq | Medium | 0.3% | 26 Feb, 2026 | npm n8n |
n8n has a Guardrail Node Bypass CVE-2026-56349, GHSA-fvfv-ppw4-7h2w | Medium | 0.5% | 26 Feb, 2026 | npm n8n |
n8n has an Authentication Bypass in its Chat Trigger Node CVE-2026-56353, GHSA-jh8h-6c9q-7gmw | Medium | 0.3% | 26 Feb, 2026 | npm n8n |
n8n has an SSO Enforcement Bypass in its Self-Service Settings API CVE-2026-56350, GHSA-vjf3-2gpj-233v | Medium | 0.4% | 26 Feb, 2026 | npm n8n |
Malicious release: Malicious code in foundry-toolkit (npm) MAL-2026-1052 | Malicious | Not scored | 26 Feb, 2026 | npm foundry-toolkit |
Malicious release: Malicious code in launch-darkly-js (npm) GHSA-g8jj-44f9-c9rv, MAL-2026-1050 | Malicious | Not scored | 26 Feb, 2026 | npm launch-darkly-js |
Malicious release: Malicious code in windowston (npm) GHSA-5xm7-fvcm-hr3f, MAL-2026-1057 | Malicious | Not scored | 26 Feb, 2026 | npm windowston |
n8n: Webhook Forgery on Github Webhook Trigger CVE-2026-56357, GHSA-mqpr-49jj-32rc | Medium | 0.3% | 26 Feb, 2026 | npm n8n |
n8n: SQL Injection in MySQL, PostgreSQL, and Microsoft SQL nodes CVE-2026-56351, GHSA-f3f2-mcxc-pwjx | Medium | 0.4% | 26 Feb, 2026 | npm n8n |
Malicious release: Malicious code in jslint-config (npm) GHSA-39pg-5x8j-wg53, MAL-2026-1055 | Malicious | Not scored | 26 Feb, 2026 | npm jslint-config |
Malicious release: Malicious code in hardhat-node (npm) MAL-2026-1053 | Malicious | Not scored | 26 Feb, 2026 | npm hardhat-node |
Malicious release: Malicious code in zoddle (npm) GHSA-rrcm-fmc5-5m45, MAL-2026-1058 | Malicious | Not scored | 26 Feb, 2026 | npm zoddle |
Malicious release: Malicious code in jest-param-validator (npm) GHSA-48qg-xrrh-4cv3, MAL-2026-1046 | Malicious | Not scored | 26 Feb, 2026 | npm jest-param-validator |
Malicious release: Malicious code in jest-node-paramset (npm) GHSA-jwcf-6pvx-4cwr, MAL-2026-1045 | Malicious | Not scored | 26 Feb, 2026 | npm jest-node-paramset |
Malicious release: Malicious code in ts-packer (npm) GHSA-rqxr-2phg-q2jr, MAL-2026-1047 | Malicious | Not scored | 26 Feb, 2026 | npm ts-packer |
Malicious release: Malicious code in corstoken (npm) GHSA-4857-6w35-8677, MAL-2026-1051 | Malicious | Not scored | 26 Feb, 2026 | npm corstoken |
Malicious release: Malicious code in iosysredis (npm) GHSA-jqx9-7jq8-cq9x, MAL-2026-1054 | Malicious | Not scored | 26 Feb, 2026 | npm iosysredis |
Malicious release: Malicious code in undicy-lint (npm) GHSA-g752-q3r2-xhrj, MAL-2026-1056 | Malicious | Not scored | 26 Feb, 2026 | npm undicy-lint |
Angular i18n vulnerable to Cross-Site Scripting CVE-2026-27970, GHSA-prjf-86w9-mfqv | High | 0.5% | 26 Feb, 2026 | npm @angular/core |
Koa has Host Header Injection via ctx.hostname CVE-2026-27959, GHSA-7gcc-r8m5-44qm | High | 0.4% | 26 Feb, 2026 | npm koa |
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder CVE-2026-27942, GHSA-fj3w-jwp8-x2g3 | Low | 0.5% | 26 Feb, 2026 | npm fast-xml-parser |
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions CVE-2026-27904, GHSA-23c5-xmqv-rm74 | High | 0.5% | 26 Feb, 2026 | npm minimatch |
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments CVE-2026-27903, GHSA-7r86-cg39-jmmj | High | 0.6% | 26 Feb, 2026 | npm minimatch |
Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers CVE-2026-27902, GHSA-qgvg-pr8v-6rr3 | Medium | 0.3% | 26 Feb, 2026 | npm svelte |
Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent` CVE-2026-27901, GHSA-phwv-c562-gvmh | Medium | 0.3% | 26 Feb, 2026 | npm svelte |
dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform() CVE-2026-27837, GHSA-r5mx-6wc6-7h9w | Critical | 0.4% | 26 Feb, 2026 | npm dottie |
TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist CVE-2026-27818, GHSA-w789-49fc-v8hr | High | 0.3% | 26 Feb, 2026 | npm terriajs-server |
Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter BIT-parse-2026-27804, CVE-2026-27804, GHSA-4q3h-vp4r-prv2 | Critical | 0.2% | 25 Feb, 2026 | npm parse-server |
Malicious release: Malicious code in promanage (npm) GHSA-mcg5-r97j-83h6, MAL-2026-1038 | Malicious | Not scored | 25 Feb, 2026 | npm promanage |
n8n Vulnerable to Stored XSS via Various Nodes CVE-2026-27578, GHSA-2p9h-rqjw-gm92 | High | 0.2% | 25 Feb, 2026 | npm n8n |
Storybook Dev Server is Vulnerable to WebSocket Hijacking CVE-2026-27148, GHSA-mjf5-7g4m-gx5w | High | 0.6% | 25 Feb, 2026 | npm storybook |
n8n: Expression Sandbox Escape Leads to RCE CVE-2026-27577, GHSA-vpcf-gvg4-6qwr | Critical | 10.7% | 25 Feb, 2026 | npm n8n |
n8n has Arbitrary Command Execution via File Write and Git Operations CVE-2026-27498, GHSA-x2mw-7j39-93xq | Critical | 0.8% | 25 Feb, 2026 | npm n8n |
Malicious release: Malicious code in uuindex (npm) GHSA-8h8j-w8xj-5g4c, MAL-2026-1043 | Malicious | Not scored | 25 Feb, 2026 | npm uuindex |
n8n has Potential Remote Code Execution via Merge Node CVE-2026-27497, GHSA-wxx7-mcgf-j869 | Critical | 0.9% | 25 Feb, 2026 | npm n8n |