Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Directus Vulnerable to User Enumeration via Password Reset Timing Attack CVE-2026-26185, GHSA-jr94-gj3h-c8rf | Medium | 0.4% | 12 Feb, 2026 | npm @directus/api npm directus |
Malicious release: Malicious code in @depro0x/despicable-me (npm) MAL-2026-873 | Malicious | Not scored | 12 Feb, 2026 | npm @depro0x/despicable-me |
Malicious release: Malicious code in stylelint-recommended (npm) GHSA-prwr-p62p-3qr2, MAL-2026-872 | Malicious | Not scored | 12 Feb, 2026 | npm stylelint-recommended |
CediPay Affected by Improper Input Validation in Payment Processing CVE-2026-26063, GHSA-wvr6-395c-5pxr | High | 0.3% | 12 Feb, 2026 | npm cedipay-core |
Malicious release: Malicious code in envoy1 (npm) GHSA-f4fg-xj6v-j6r8, MAL-2026-871 | Malicious | Not scored | 12 Feb, 2026 | npm envoy1 |
@farmfe/core is Missing Origin Validation in WebSocket CVE-2025-56647, GHSA-p773-8mf4-rjm5 | Medium | 0.2% | 12 Feb, 2026 | npm @farmfe/core |
Malicious release: Malicious code in ether-lint (npm) GHSA-9p23-x4p4-m392, MAL-2026-941 | Malicious | Not scored | 12 Feb, 2026 | npm ether-lint |
markdown-it is has a Regular Expression Denial of Service (ReDoS) CVE-2026-2327, GHSA-38c4-r59v-3vqw | Medium | 0.7% | 12 Feb, 2026 | npm markdown-it |
qs's arrayLimit bypass in comma parsing allows denial of service CVE-2026-2391, GHSA-w7fw-mjwx-w883 | Medium | 0.5% | 12 Feb, 2026 | npm qs |
next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content CVE-2026-0969, GHSA-g4xw-jxrg-5f6m | High | 0.6% | 12 Feb, 2026 | npm next-mdx-remote |
ajv has ReDoS when using `$data` option CVE-2025-69873, GHSA-2g4f-4pwh-qvx6 | Medium | 0.5% | 11 Feb, 2026 | npm ajv |
nanotar is vulnerable to path traversal in parseTar() and parseTarGzip() CVE-2025-69874, GHSA-92fh-27vv-894w | Critical | 0.9% | 11 Feb, 2026 | npm nanotar |
Malicious release: Malicious code in express-gueues (npm) GHSA-x2xw-8qjm-mcvr, MAL-2026-861 | Malicious | Not scored | 11 Feb, 2026 | npm express-gueues |
set-in Affected by Prototype Pollution CVE-2026-26021, GHSA-2c4m-g7rx-63q7 | Critical | 0.6% | 11 Feb, 2026 | npm set-in |
Malicious release: Malicious code in systemtest-network (npm) GHSA-2cmj-2pj3-9369, MAL-2026-859 | Malicious | Not scored | 11 Feb, 2026 | npm systemtest-network |
Malicious release: Malicious code in osopackage (npm) GHSA-hc86-54fq-c4mf, MAL-2026-857 | Malicious | Not scored | 11 Feb, 2026 | npm osopackage |
Malicious release: Malicious code in systemtest-information (npm) GHSA-j464-mvwq-jr58, MAL-2026-858 | Malicious | Not scored | 11 Feb, 2026 | npm systemtest-information |
@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation CVE-2026-26019, GHSA-gf3v-fwqg-4vh7 | Medium | 0.4% | 11 Feb, 2026 | npm @langchain/community |
Malicious release: Malicious code in chai-prop (npm) GHSA-4p6w-3gcj-crr5, MAL-2026-856 | Malicious | Not scored | 11 Feb, 2026 | npm chai-prop |
Malicious release: Malicious code in node-dotenv-cli (npm) GHSA-46v6-58g3-h5qh, MAL-2026-853 | Malicious | Not scored | 11 Feb, 2026 | npm node-dotenv-cli |
Malicious release: Malicious code in sinon-node (npm) GHSA-777h-658h-v2g3, MAL-2026-854 | Malicious | Not scored | 11 Feb, 2026 | npm sinon-node |
Malicious release: Malicious code in chai-await (npm) GHSA-cg22-2f58-35xj, MAL-2026-852 | Malicious | Not scored | 11 Feb, 2026 | npm chai-await |
Malicious release: Malicious code in npm_cimetadata (npm) MAL-2026-848 | Malicious | Not scored | 11 Feb, 2026 | npm npm_cimetadata |
Malicious release: Malicious code in search-newfrontier-podlet (npm) MAL-2026-839 | Malicious | Not scored | 10 Feb, 2026 | npm search-newfrontier-podlet |
Malicious release: Malicious code in notification-saved-search-settings-podlet (npm) MAL-2026-837 | Malicious | Not scored | 10 Feb, 2026 | npm notification-saved-search-settings-podlet |
Malicious release: Malicious code in search-savedsearch-podlet (npm) MAL-2026-840 | Malicious | Not scored | 10 Feb, 2026 | npm search-savedsearch-podlet |
Malicious release: Malicious code in myads-layout (npm) MAL-2026-836 | Malicious | Not scored | 10 Feb, 2026 | npm myads-layout |
Malicious release: Malicious code in realestate-atlas (npm) MAL-2026-838 | Malicious | Not scored | 10 Feb, 2026 | npm realestate-atlas |
Malicious release: Malicious code in @reimorg/config (npm) GHSA-3x6g-grxh-c84v, MAL-2026-828 | Malicious | Not scored | 10 Feb, 2026 | npm @reimorg/config |
Malicious release: Malicious code in @uniconvex/dotenv (npm) GHSA-5hc6-4g5j-c3q2, MAL-2026-829 | Malicious | Not scored | 10 Feb, 2026 | npm @uniconvex/dotenv |
CASL Ability is Vulnerable to Prototype Pollution CVE-2026-1774, GHSA-x9vf-53q3-cvx6 | Critical | 0.7% | 10 Feb, 2026 | npm @casl/ability |
Malicious release: Malicious code in express-configer (npm) GHSA-69cq-35c9-qwg9, MAL-2026-833 | Malicious | Not scored | 10 Feb, 2026 | npm express-configer |
Malicious release: Malicious code in aligners (npm) GHSA-fmr8-mpjc-h8rg, MAL-2026-830 | Malicious | Not scored | 10 Feb, 2026 | npm aligners |
Malicious release: Malicious code in sap-code-style-guides (npm) GHSA-6pjr-w5hp-m7pj, MAL-2026-835 | Malicious | Not scored | 10 Feb, 2026 | npm sap-code-style-guides |
Malicious release: Malicious code in chai-as-approved (npm) GHSA-8j3c-w8c2-jpfr, MAL-2026-832 | Malicious | Not scored | 10 Feb, 2026 | npm chai-as-approved |
Malicious release: Malicious code in bigmathix (npm) GHSA-fvcx-rrjg-gr82, MAL-2026-831 | Malicious | Not scored | 10 Feb, 2026 | npm bigmathix |
Malicious release: Malicious code in graphflowx (npm) GHSA-8jpg-855v-mh37, MAL-2026-834 | Malicious | Not scored | 10 Feb, 2026 | npm graphflowx |
cap-go/capacitor-native-biometric Authentication Bypass CVE-2026-56294, GHSA-vx5f-vmr6-32wf | Medium | 0.2% | 10 Feb, 2026 | npm @capgo/capacitor-native-biometric |
Malicious release: Malicious code in narrow-array (npm) GHSA-6cq7-pjjx-42h3, MAL-2026-827 | Malicious | Not scored | 10 Feb, 2026 | npm narrow-array |
Cube Core is vulnerable to privilege escalation via a specially crafted request CVE-2026-25958, GHSA-v226-32c7-x2v7 | High | 0.4% | 09 Feb, 2026 | npm @cubejs-backend/server-core |
Cube Core is vulnerable to Denial of Service (DoS) via crafted request CVE-2026-25957, GHSA-9vph-2hvm-x66g | Medium | 0.4% | 09 Feb, 2026 | npm @cubejs-backend/server-core |
FUXA Affected by a Path Traversal Sanitization Bypass CVE-2026-25951, GHSA-68m5-5w2h-h837 | High | 1.4% | 09 Feb, 2026 | npm fuxa-server |
FUXA Unauthenticated Remote Arbitrary Scheduler Write CVE-2026-25939, GHSA-c869-jx4c-q5fc | Critical | 12.5% | 09 Feb, 2026 | npm fuxa-server |
FUXA Unauthenticated Remote Code Execution in Node-RED Integration CVE-2026-25938, GHSA-v4p5-w6r3-2x4f | Critical | 1.1% | 09 Feb, 2026 | npm fuxa-server |
unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command) CVE-2026-25918, GHSA-4255-c27h-62m5 | Medium | 0.2% | 09 Feb, 2026 | npm @rage-against-the-pixel/unity-cli |
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape) CVE-2026-25881, GHSA-ww7g-4gwx-m7wj | Critical | 0.6% | 09 Feb, 2026 | npm @nyariv/sandboxjs |
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection CVE-2026-25528, GHSA-v34v-rq6j-cj6p, PYSEC-2026-2584 | Medium | 0.3% | 09 Feb, 2026 | PyPI langsmith npm langsmith |
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig CVE-2026-25639, GHSA-43fc-jf86-j433 | High | 2.8% | 09 Feb, 2026 | npm axios |
Malicious release: Malicious code in jwtdotenv (npm) GHSA-8mjx-w3ff-mv8m, MAL-2026-821 | Malicious | Not scored | 09 Feb, 2026 | npm jwtdotenv |
Malicious release: Malicious code in json-web-sources (npm) GHSA-7r6g-f9q3-q5fg, MAL-2026-820 | Malicious | Not scored | 09 Feb, 2026 | npm json-web-sources |