Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in rimarf (npm) GHSA-2r7f-gcp3-m5jq, MAL-2026-968 | Malicious | Not scored | 20 Feb, 2026 | npm rimarf |
Malicious release: Malicious code in hardhta (npm) GHSA-c597-v633-vcm6, MAL-2026-960 | Malicious | Not scored | 20 Feb, 2026 | npm hardhta |
Malicious release: Malicious code in format-defaults (npm) GHSA-chmw-4pgg-56w6, MAL-2026-959 | Malicious | Not scored | 20 Feb, 2026 | npm format-defaults |
Malicious release: Malicious code in crypto-reader-info (npm) GHSA-mxvw-w9w3-rqc7, MAL-2026-956 | Malicious | Not scored | 20 Feb, 2026 | npm crypto-reader-info |
Malicious release: Malicious code in secp256 (npm) GHSA-p683-99hw-p2fq, MAL-2026-970 | Malicious | Not scored | 20 Feb, 2026 | npm secp256 |
Malicious release: Malicious code in node-native-bridge (npm) GHSA-qgwv-9xxh-fmph, MAL-2026-965 | Malicious | Not scored | 20 Feb, 2026 | npm node-native-bridge |
Malicious release: Malicious code in suport-color (npm) GHSA-5qvc-hmwr-ghj5, MAL-2026-971 | Malicious | Not scored | 20 Feb, 2026 | npm suport-color |
Malicious release: Malicious code in opencraw (npm) GHSA-6v8f-7cjm-f7f8, MAL-2026-966 | Malicious | Not scored | 20 Feb, 2026 | npm opencraw |
Malicious release: Malicious code in cloude-code (npm) GHSA-8vcq-w335-fh83, MAL-2026-954 | Malicious | Not scored | 20 Feb, 2026 | npm cloude-code |
Malicious release: Malicious code in iru-caches (npm) GHSA-9w7p-hqx2-pjjx, MAL-2026-961 | Malicious | Not scored | 20 Feb, 2026 | npm iru-caches |
Malicious release: Malicious code in cloude (npm) GHSA-fw89-7q74-q5p8, MAL-2026-953 | Malicious | Not scored | 20 Feb, 2026 | npm cloude |
Malicious release: Malicious code in iruchache (npm) GHSA-m47j-9qfx-6jh4, MAL-2026-962 | Malicious | Not scored | 20 Feb, 2026 | npm iruchache |
Malicious release: Malicious code in claud-code (npm) GHSA-p2wm-2x3h-8gq6, MAL-2026-952 | Malicious | Not scored | 20 Feb, 2026 | npm claud-code |
Sync-in Server has a stored cross-site scripting (XSS) vulnerability CVE-2025-67438, GHSA-9jmq-xgjm-p8c2 | Medium | 0.3% | 20 Feb, 2026 | npm @sync-in/server |
bn.js affected by an infinite loop CVE-2026-2739, GHSA-378v-28hj-76wf | Medium | 0.5% | 20 Feb, 2026 | npm bn.js |
OpenClaw safeBins file-existence oracle information disclosure CVE-2026-4040, GHSA-6c9j-x93c-rw6j | Medium | 0.2% | 19 Feb, 2026 | npm openclaw |
OpenClaw safeBins stdin-only bypass via sort output and recursive grep flags CVE-2026-31996, GHSA-4685-c5cp-vp95 | Low | 0.1% | 19 Feb, 2026 | npm openclaw |
OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace CVE-2026-32060, GHSA-r5fq-947m-xm57 | High | 0.8% | 19 Feb, 2026 | npm openclaw |
Pannellum has a XSS vulnerability in hot spot attributes CVE-2026-27210, GHSA-8423-w5wx-h2r6 | Medium | 0.4% | 19 Feb, 2026 | npm pannellum |
Feathers exposes internal headers via unencrypted session cookie CVE-2026-27193, GHSA-9m9c-vpv5-9g85 | High | 0.4% | 19 Feb, 2026 | npm @feathersjs/authentication-oauth |
Feathers has an origin validation bypass via prefix matching CVE-2026-27192, GHSA-mp4x-c34x-wv3x | High | 0.3% | 19 Feb, 2026 | npm @feathersjs/authentication-oauth |
Feathers has an open redirect in OAuth callback enables account takeover CVE-2026-27191, GHSA-ppf9-4ffw-hh4p | High | 0.3% | 19 Feb, 2026 | npm @feathersjs/authentication-oauth |
CPU exhaustion in SvelteKit remote form deserialization (experimental only) CVE-2026-82261, GHSA-88qp-p4qg-rqm6 | High | 0.5% | 19 Feb, 2026 | npm @sveltejs/kit |
Memory exhaustion in SvelteKit remote form deserialization (experimental only) CVE-2026-82260, GHSA-vrhm-gvg7-fpcf | High | 0.5% | 19 Feb, 2026 | npm @sveltejs/kit |
devalue affected by CPU and memory amplification from sparse arrays CVE-2026-123569, GHSA-33hq-fvwr-56pm | Low | Not scored | 19 Feb, 2026 | npm devalue |
devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed CVE-2026-123568, GHSA-8qm3-746x-r74r | Low | Not scored | 19 Feb, 2026 | npm devalue |
Svelte SSR attribute spreading includes inherited properties from prototype chain CVE-2026-27125, GHSA-crpf-4hrx-3jrp | Medium | 0.4% | 19 Feb, 2026 | npm svelte |
Prototype pollution in swiper CVE-2026-27212, GHSA-hmx5-qpq5-p643 | Critical | 0.5% | 19 Feb, 2026 | npm swiper |
eBay API MCP Server Affected by Environment Variable Injection CVE-2026-27203, GHSA-97rm-xj73-33jh | High | 0.4% | 19 Feb, 2026 | npm ebay-mcp |
Hono added timing comparison hardening in basicAuth and bearerAuth CVE-2026-56764, GHSA-gq3j-xvxp-8hrf | Medium | 0.3% | 19 Feb, 2026 | npm hono |
OpenClaw replaced a deprecated sandbox hash algorithm CVE-2026-28479, GHSA-fh3f-q9qw-93j9 | High | 0.2% | 19 Feb, 2026 | npm openclaw |
OpenClaw has a Web Fetch DoS via unbounded response parsing CVE-2026-28394, GHSA-p536-vvpp-9mc8 | Medium | 0.5% | 19 Feb, 2026 | npm openclaw |
jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property) CVE-2026-25940, GHSA-p5xg-68wr-hm3m | High | 0.5% | 19 Feb, 2026 | npm jspdf |
Svelte SSR does not validate dynamic element tag names in `<svelte:element>` CVE-2026-27122, GHSA-m56q-vw4c-c2cp | Medium | 0.2% | 19 Feb, 2026 | npm svelte |
Svelte affected by cross-site scripting via spread attributes in Svelte SSR CVE-2026-27121, GHSA-f7gr-6p89-r883 | Medium | 0.2% | 19 Feb, 2026 | npm svelte |
Svelte affected by XSS in SSR `<option>` element CVE-2026-27119, GHSA-h7h7-mm68-gmrc | Medium | 0.2% | 19 Feb, 2026 | npm svelte |
Cache poisoning in @sveltejs/adapter-vercel CVE-2026-27118, GHSA-9pq4-5hcf-288c | Medium | 0.3% | 19 Feb, 2026 | npm @sveltejs/adapter-vercel |
Malicious release: Unauthorized npm publish of cline@2.3.0 with modified postinstall script GHSA-9ppg-jx86-fqw7, MAL-2026-1380 | MaliciousLow | Not scored | 19 Feb, 2026 | npm cline |
jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method CVE-2026-25755, GHSA-9vjf-qc39-jprp | High | 1.0% | 19 Feb, 2026 | npm jspdf |
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions CVE-2026-25535, GHSA-67pg-wm7f-q7fj | High | 0.8% | 19 Feb, 2026 | npm jspdf |
Malicious release: Malicious code in ably-forks (npm) GHSA-px78-22pw-hx3r, MAL-2026-939 | Malicious | Not scored | 19 Feb, 2026 | npm ably-forks |
Fabric.js Affected by Stored XSS via SVG Export CVE-2026-27013, GHSA-hfvx-25r5-qc3w | High | 0.3% | 18 Feb, 2026 | npm fabric |
OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection CVE-2026-27009, GHSA-37gc-85xm-2ww6 | Medium | 0.3% | 18 Feb, 2026 | npm openclaw |
OpenClaw hardened the skill download target directory validation CVE-2026-27008, GHSA-h7f7-89mm-pqh6 | Medium | 0.2% | 18 Feb, 2026 | npm openclaw |
OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation CVE-2026-27007, GHSA-xxvh-5hwj-42pp | Medium | 0.2% | 18 Feb, 2026 | npm openclaw |
OpenClaw session tool visibility hardening and Telegram webhook secret fallback CVE-2026-27004, GHSA-6hf3-mhgc-cm65 | Medium | 0.1% | 18 Feb, 2026 | npm openclaw |
OpenClaw: Telegram bot token exposure via logs CVE-2026-27003, GHSA-chf7-jq6g-qrwv | Medium | 0.2% | 18 Feb, 2026 | npm openclaw |
OpenClaw: Docker container escape via unvalidated bind mount config injection CVE-2026-27002, GHSA-w235-x559-36mg | High | 0.5% | 18 Feb, 2026 | npm openclaw |
OpenClaw: Unsanitized CWD path injection into LLM prompts CVE-2026-27001, GHSA-2qj5-gwg2-xwc4 | High | 0.2% | 18 Feb, 2026 | npm openclaw |
RediSearch Query Injection in @langchain/langgraph-checkpoint-redis CVE-2026-27022, GHSA-5mx2-w598-339m | Medium | 4.0% | 18 Feb, 2026 | npm @langchain/langgraph-checkpoint-redis |