Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm) GHSA-gj3c-r86r-hr43, MAL-2026-16415 | Malicious | Not scored | 22 Sep, 2026 | npm @tvg-mar/tvg-promos-atomic-ui |
Unleash: Missing await on permission check + cross-project IDOR in admin API CVE-2026-77426, GHSA-72h8-wp98-7hch | High | 0.5% | 22 Sep, 2026 | npm unleash-server |
Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log CVE-2026-77425, GHSA-5ffh-6f9q-5hhr | Medium | 0.3% | 22 Sep, 2026 | npm unleash-server |
Unleash: Clone-feature lets a user copy a feature from a project they cannot read CVE-2026-76910, GHSA-8xcj-9hfr-fh9j | Medium | 0.4% | 22 Sep, 2026 | npm unleash-server |
Unleash: CR-approval email renders user-controlled raw HTML CVE-2026-76909, GHSA-7hvx-28gp-mf6j | Low | 0.5% | 22 Sep, 2026 | npm unleash-server |
mppx: Gas Draining with access list CVE-2026-63628, GHSA-vc9j-9wph-qghj | Medium | 0.5% | 22 Sep, 2026 | npm mppx |
mppx: Gas Draining with padding CVE-2026-63627, GHSA-727h-3vm5-qwq6 | Medium | 0.5% | 22 Sep, 2026 | npm mppx |
request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process CVE-2026-62985, GHSA-r3r9-wp5j-pq5g | High | 0.6% | 22 Sep, 2026 | npm request-filtering-agent |
Malicious release: Malicious code in ubiquiti-agents-link-mcp (npm) GHSA-rqpx-hw2h-g3hc, MAL-2026-16409 | Malicious | Not scored | 22 Sep, 2026 | npm ubiquiti-agents-link-mcp |
Malicious release: Malicious code in tailwind-form-styles (npm) GHSA-h48r-xx59-h44r, MAL-2026-16405 | Malicious | Not scored | 22 Sep, 2026 | npm tailwind-form-styles |
Malicious release: Malicious code in node-env-buffer (npm) GHSA-2g29-f3qp-c7gf, MAL-2026-16403 | Malicious | Not scored | 22 Sep, 2026 | npm node-env-buffer |
Malicious release: Malicious code in envforge3 (npm) GHSA-7chm-5cxc-2wx2, MAL-2026-16393 | Malicious | Not scored | 22 Sep, 2026 | npm envforge3 |
Malicious release: Malicious code in envforge2 (npm) GHSA-h8xg-3hfp-rx6q, MAL-2026-16392 | Malicious | Not scored | 22 Sep, 2026 | npm envforge2 |
Malicious release: Malicious code in envparse2 (npm) GHSA-q747-c2cv-gfhj, MAL-2026-16394 | Malicious | Not scored | 22 Sep, 2026 | npm envparse2 |
Malicious release: Malicious code in envparse3 (npm) GHSA-vq77-3r62-c2cx, MAL-2026-16395 | Malicious | Not scored | 22 Sep, 2026 | npm envparse3 |
Malicious release: Malicious code in sysverify (npm) GHSA-jpfv-9923-q8rq, MAL-2026-16404 | Malicious | Not scored | 22 Sep, 2026 | npm sysverify |
Malicious release: Malicious code in cloudndmcedu (npm) GHSA-3r7g-wjh4-5228, MAL-2026-16391 | Malicious | Not scored | 22 Sep, 2026 | npm cloudndmcedu |
Malicious release: Malicious code in ndmcjcxiebysfdb (npm) GHSA-8344-w2r2-rxp2, MAL-2026-16400 | Malicious | Not scored | 22 Sep, 2026 | npm ndmcjcxiebysfdb |
Malicious release: Malicious code in ndmcmsujey (npm) GHSA-fjp4-jprr-4jp6, MAL-2026-16402 | Malicious | Not scored | 22 Sep, 2026 | npm ndmcmsujey |
Malicious release: Malicious code in ndmckauxuoincv (npm) GHSA-q5vm-6mhj-qq8c, MAL-2026-16401 | Malicious | Not scored | 22 Sep, 2026 | npm ndmckauxuoincv |
Malicious release: Malicious code in fdhcxvnwhjiofv (npm) GHSA-299v-cwvm-ffx4, MAL-2026-16396 | Malicious | Not scored | 22 Sep, 2026 | npm fdhcxvnwhjiofv |
Malicious release: Malicious code in luftmvfiwgxydes (npm) GHSA-j2f6-x53f-2qqf, MAL-2026-16398 | Malicious | Not scored | 22 Sep, 2026 | npm luftmvfiwgxydes |
Malicious release: Malicious code in kambxjowhdsgyw (npm) GHSA-pmhv-gqr9-wrgr, MAL-2026-16397 | Malicious | Not scored | 22 Sep, 2026 | npm kambxjowhdsgyw |
Malicious release: Malicious code in lufxchwmxwyps (npm) GHSA-xvmw-wchq-f7p8, MAL-2026-16399 | Malicious | Not scored | 22 Sep, 2026 | npm lufxchwmxwyps |
Malicious release: Malicious code in oracle-redis (npm) MAL-2026-16390 | Malicious | Not scored | 22 Sep, 2026 | npm oracle-redis |
Malicious release: Malicious code in noverojava (npm) MAL-2026-16389 | Malicious | Not scored | 22 Sep, 2026 | npm noverojava |
Malicious release: Malicious code in nodetokyo (npm) MAL-2026-16388 | Malicious | Not scored | 22 Sep, 2026 | npm nodetokyo |
Malicious release: Malicious code in zeal-utils (npm) MAL-2026-16542 | Malicious | Not scored | 22 Sep, 2026 | npm zeal-utils |
Malicious release: Malicious code in zeal-util-hooks (npm) MAL-2026-16541 | Malicious | Not scored | 22 Sep, 2026 | npm zeal-util-hooks |
Malicious release: Malicious code in style-class-utils (npm) MAL-2026-16540 | Malicious | Not scored | 22 Sep, 2026 | npm style-class-utils |
Malicious release: Malicious code in spark-rpc (npm) MAL-2026-16538 | Malicious | Not scored | 22 Sep, 2026 | npm spark-rpc |
Malicious release: Malicious code in speaker_tagging_media_player (npm) MAL-2026-16539 | Malicious | Not scored | 22 Sep, 2026 | npm speaker_tagging_media_player |
Malicious release: Malicious code in spark-common (npm) MAL-2026-16537 | Malicious | Not scored | 22 Sep, 2026 | npm spark-common |
Malicious release: Malicious code in mx-www-locales-common (npm) MAL-2026-16536 | Malicious | Not scored | 22 Sep, 2026 | npm mx-www-locales-common |
Malicious release: Malicious code in mercuriusdream-oidc-replay-probe (npm) MAL-2026-16535 | Malicious | Not scored | 22 Sep, 2026 | npm mercuriusdream-oidc-replay-probe |
Malicious release: Malicious code in eslint-config-compact-utils (npm) MAL-2026-16417 | Malicious | Not scored | 22 Sep, 2026 | npm eslint-config-compact-utils |
Malicious release: Malicious code in halali-sample (npm) MAL-2026-16534 | Malicious | Not scored | 22 Sep, 2026 | npm halali-sample |
Malicious release: Malicious code in exodus-firestore-synchronize (npm) MAL-2026-16533 | Malicious | Not scored | 22 Sep, 2026 | npm exodus-firestore-synchronize |
Malicious release: Malicious code in @yuva2210/okx-poc-preinstall (npm) MAL-2026-16531 | Malicious | Not scored | 22 Sep, 2026 | npm @yuva2210/okx-poc-preinstall |
Malicious release: Malicious code in @yuva2210/poc-depconf (npm) MAL-2026-16532 | Malicious | Not scored | 22 Sep, 2026 | npm @yuva2210/poc-depconf |
Malicious release: Malicious code in @ssgw/background-transition (npm) MAL-2026-16530 | Malicious | Not scored | 22 Sep, 2026 | npm @ssgw/background-transition |
Malicious release: Malicious code in @larocas-bbresearch/tp-probe-e29834ce (npm) MAL-2026-16529 | Malicious | Not scored | 22 Sep, 2026 | npm @larocas-bbresearch/tp-probe-e29834ce |
Malicious release: Malicious code in @larocas-bbresearch/tombstone-probe-odvz5y (npm) MAL-2026-16527 | Malicious | Not scored | 22 Sep, 2026 | npm @larocas-bbresearch/tombstone-probe-odvz5y |
Malicious release: Malicious code in @larocas-bbresearch/tp-probe-dc7a3670 (npm) MAL-2026-16528 | Malicious | Not scored | 22 Sep, 2026 | npm @larocas-bbresearch/tp-probe-dc7a3670 |
Malicious release: Malicious code in @larocas-bbresearch/tombstone-probe-live-z6xz56 (npm) MAL-2026-16526 | Malicious | Not scored | 22 Sep, 2026 | npm @larocas-bbresearch/tombstone-probe-live-z6xz56 |
Malicious release: Malicious code in @larocas-bbresearch/tombstone-probe-8ejnsa (npm) MAL-2026-16525 | Malicious | Not scored | 22 Sep, 2026 | npm @larocas-bbresearch/tombstone-probe-8ejnsa |
Malicious release: Malicious code in @ks-cqc/fingerprint-generator (npm) MAL-2026-16523 | Malicious | Not scored | 22 Sep, 2026 | npm @ks-cqc/fingerprint-generator |
Malicious release: Malicious code in @ks-cqc/h5-sig4 (npm) MAL-2026-16524 | Malicious | Not scored | 22 Sep, 2026 | npm @ks-cqc/h5-sig4 |
Malicious release: Malicious code in @egencia/uitk-react-text (npm) MAL-2026-16522 | Malicious | Not scored | 22 Sep, 2026 | npm @egencia/uitk-react-text |
Malicious release: Malicious code in @egencia/uitk-react-spacing (npm) MAL-2026-16521 | Malicious | Not scored | 22 Sep, 2026 | npm @egencia/uitk-react-spacing |