Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
n8n has a Sandbox Escape in its JavaScript Task Runner CVE-2026-27495, GHSA-jjpj-p2wh-qf23 | Critical | 0.8% | 25 Feb, 2026 | npm n8n |
n8n has Arbitrary File Read via Python Code Node Sandbox Escape CVE-2026-27494, GHSA-mmgg-m5j7-f83h | High | 0.4% | 25 Feb, 2026 | npm n8n |
n8n has Unauthenticated Expression Evaluation via Form Node CVE-2026-27493, GHSA-75g8-rv7v-32f7 | Critical | 1.4% | 25 Feb, 2026 | npm n8n |
LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader CVE-2026-27795, GHSA-mphv-75cg-56wg | High | 0.2% | 25 Feb, 2026 | npm @langchain/community |
Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline CVE-2026-27739, GHSA-x288-3778-4hhx | Critical | 0.6% | 25 Feb, 2026 | npm @angular/ssr npm @nguniversal/common npm @nguniversal/express-engine |
Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize CVE-2026-27829, GHSA-cj9f-h6r6-4cx2 | High | 0.3% | 25 Feb, 2026 | npm @astrojs/node |
Malicious release: Malicious code in chai-lite-lib (npm) GHSA-c692-r7hw-33w6, MAL-2026-1034 | Malicious | Not scored | 25 Feb, 2026 | npm chai-lite-lib |
Angular SSR has an Open Redirect via X-Forwarded-Prefix CVE-2026-27738, GHSA-xh43-g2fq-wjrj | Medium | 0.4% | 25 Feb, 2026 | npm @angular/ssr |
OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() CVE-2026-27728, GHSA-jmhp-5558-qxh5 | Critical | 2.0% | 25 Feb, 2026 | npm @oneuptime/common |
Malicious release: Malicious code in duer-js (npm) GHSA-8cqh-92f8-vrg4, MAL-2026-1033 | Malicious | Not scored | 25 Feb, 2026 | npm duer-js |
Malicious release: Malicious code in react-svg-helper-fast (npm) GHSA-vcw9-rvcg-7922, MAL-2026-1031 | Malicious | Not scored | 25 Feb, 2026 | npm react-svg-helper-fast |
Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud) CVE-2026-27702, GHSA-rvhr-26g4-p2r8 | Critical | 0.4% | 25 Feb, 2026 | npm budibase |
Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo CVE-2026-27700, GHSA-xh87-mx6m-69f3 | High | 0.3% | 25 Feb, 2026 | npm hono |
ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation CVE-2026-22866, GHSA-c6rr-7pmc-73wc | Low | 0.2% | 25 Feb, 2026 | npm @ensdomains/ens-contracts |
Malicious release: Malicious code in chai-as-utils (npm) GHSA-x93r-8pwh-v64c, MAL-2026-1030 | Malicious | Not scored | 25 Feb, 2026 | npm chai-as-utils |
Malicious release: Malicious code in sample-custom-component (npm) GHSA-p3mp-3xxq-692w, MAL-2026-1032 | Malicious | Not scored | 25 Feb, 2026 | npm sample-custom-component |
Basic FTP has Path Traversal Vulnerability in its downloadToDir() method CVE-2026-27699, GHSA-5rq4-664w-9x2c | Critical | 0.9% | 25 Feb, 2026 | npm basic-ftp |
Malicious release: Malicious code in @schedaero/react-core (npm) MAL-2026-1230 | Malicious | Not scored | 25 Feb, 2026 | npm @schedaero/react-core |
Malicious release: Malicious code in @schedaero/yukon (npm) MAL-2026-1232 | Malicious | Not scored | 25 Feb, 2026 | npm @schedaero/yukon |
Malicious release: Malicious code in @schedaero/bacon (npm) MAL-2026-1228 | Malicious | Not scored | 25 Feb, 2026 | npm @schedaero/bacon |
Malicious release: Malicious code in @schedaero/net-common (npm) MAL-2026-1229 | Malicious | Not scored | 25 Feb, 2026 | npm @schedaero/net-common |
Malicious release: Malicious code in uxproject11 (npm) GHSA-vvjv-x5r6-jrrr, MAL-2026-1234 | Malicious | Not scored | 25 Feb, 2026 | npm uxproject11 |
Malicious release: Malicious code in projectrtert (npm) GHSA-m97j-c9c8-qv27, MAL-2026-1233 | Malicious | Not scored | 25 Feb, 2026 | npm projectrtert |
Malicious release: Malicious code in @schedaero/shared (npm) MAL-2026-1231 | Malicious | Not scored | 25 Feb, 2026 | npm @schedaero/shared |
Malicious release: Malicious code in react-devtools-raycast (npm) MAL-2026-1039 | Malicious | Not scored | 25 Feb, 2026 | npm react-devtools-raycast |
Malicious release: Malicious code in get-fonts (npm) MAL-2026-1037 | Malicious | Not scored | 25 Feb, 2026 | npm get-fonts |
@enclave-vm/core is vulnerable to Sandbox Escape CVE-2026-27597, GHSA-f229-3862-4942 | Critical | 1.0% | 25 Feb, 2026 | npm @enclave-vm/core |
Malicious release: Malicious code in trae-browser-inspect (npm) MAL-2026-1042 | Malicious | Not scored | 25 Feb, 2026 | npm trae-browser-inspect |
repostat: Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard CVE-2026-27612, GHSA-fm8c-6m29-rp6j | Medium | 0.2% | 25 Feb, 2026 | npm repostat |
Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions CVE-2026-27610, GHSA-jhp4-jvq3-w5xr | High | 0.4% | 25 Feb, 2026 | npm parse-dashboard |
Parse Dashboard is Missing CSRF Protection for its Agent Endpoint CVE-2026-27609, GHSA-3534-xp88-25rc | High | 0.2% | 25 Feb, 2026 | npm parse-dashboard |
Parse Dashboard is Missing Authorization for its Agent Endpoint CVE-2026-27608, GHSA-cvwj-6c9h-jg6v | Critical | 0.3% | 25 Feb, 2026 | npm parse-dashboard |
Rollup 4 has Arbitrary File Write via Path Traversal CVE-2026-27606, GHSA-mw96-cpmx-2vgc | High | 1.7% | 25 Feb, 2026 | npm rollup |
Parse Dashboard has incomplete authentication on AI Agent endpoint CVE-2026-27595, GHSA-qwc3-h9mg-4582 | Critical | 0.5% | 25 Feb, 2026 | npm parse-dashboard |
Malicious release: Malicious code in examplereactnative76 (npm) MAL-2026-1028 | Malicious | Not scored | 24 Feb, 2026 | npm examplereactnative76 |
Malicious release: Malicious code in rncalendareventsexample (npm) MAL-2026-1026 | Malicious | Not scored | 24 Feb, 2026 | npm rncalendareventsexample |
Malicious release: Malicious code in rtxbbtyols (npm) GHSA-ggfg-9547-fcfq, MAL-2026-1027 | Malicious | Not scored | 24 Feb, 2026 | npm rtxbbtyols |
Malicious release: Malicious code in @protonme/routing (npm) GHSA-3mh5-3cjj-x4vw, MAL-2026-1024 | Malicious | Not scored | 24 Feb, 2026 | npm @protonme/routing |
Malicious release: Malicious code in @unitedcapitalfinancialadvisors/finlife-component-library (npm) GHSA-x5wf-632x-8qp6, MAL-2026-1025 | Malicious | Not scored | 24 Feb, 2026 | npm @unitedcapitalfinancialadvisors/finlife-component-library |
Malicious release: Malicious code in @kiukicom/sidebar (npm) GHSA-7gh6-h93x-hcxc, MAL-2026-1023 | Malicious | Not scored | 24 Feb, 2026 | npm @kiukicom/sidebar |
Malicious release: Malicious code in @atg-aml-shared/kyc-domain (npm) GHSA-h8q9-h9jg-cg4q, MAL-2026-1021 | Malicious | Not scored | 24 Feb, 2026 | npm @atg-aml-shared/kyc-domain |
Malicious release: Malicious code in @coinmetro/app (npm) GHSA-q2w3-mv8h-gpvm, MAL-2026-1022 | Malicious | Not scored | 24 Feb, 2026 | npm @coinmetro/app |
Malicious release: Malicious code in @ai-studio-web/app (npm) GHSA-q326-5gvm-75w3, MAL-2026-1020 | Malicious | Not scored | 24 Feb, 2026 | npm @ai-studio-web/app |
FUXA has JWT Authentication Bypass via HTTP Referer header spoofing CVE-2025-69985, GHSA-4r4r-4jp4-wwf9 | Critical | 6.0% | 24 Feb, 2026 | npm @frangoteam/fuxa |
ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints CVE-2026-27584, GHSA-m2cq-xjgm-f668 | Critical | 0.4% | 24 Feb, 2026 | npm @actual-app/sync-server |
Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads CVE-2026-27567, GHSA-hhfx-5x8j-f5f6 | Medium | 0.3% | 24 Feb, 2026 | npm payload |
Malicious release: Malicious code in js-multer (npm) GHSA-qr75-8mp9-xxfp, MAL-2026-1016 | Malicious | Not scored | 24 Feb, 2026 | npm js-multer |
Malicious release: Malicious code in chai-iotype (npm) GHSA-v9mr-v6fw-ggjc, MAL-2026-1014 | Malicious | Not scored | 24 Feb, 2026 | npm chai-iotype |
Malicious release: Malicious code in chai-as-pause (npm) GHSA-mg4g-8xgc-p8xw, MAL-2026-1013 | Malicious | Not scored | 24 Feb, 2026 | npm chai-as-pause |
Malicious release: Malicious code in json-mapping-srcs (npm) GHSA-rxgp-367w-gq5f, MAL-2026-1017 | Malicious | Not scored | 24 Feb, 2026 | npm json-mapping-srcs |