Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters CVE-2026-25544, GHSA-xx6w-jxg9-2wh8 | Critical | 0.8% | 05 Feb, 2026 | npm @payloadcms/drizzle |
@nyariv/sandboxjs has a Sandbox Escape issue CVE-2026-25520, GHSA-58jh-xv4v-pcx4 | Critical | 0.9% | 05 Feb, 2026 | npm @nyariv/sandboxjs |
Malicious release: Malicious code in test-npm-style (npm) GHSA-23p3-w862-22mh, MAL-2026-771 | Malicious | Not scored | 05 Feb, 2026 | npm test-npm-style |
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior CVE-2025-68458, GHSA-8fgc-7cc6-rx7x | Low | 0.2% | 05 Feb, 2026 | npm webpack |
Malicious release: Malicious code in xpack-per-user (npm) GHSA-p3cq-rj28-5hq5, MAL-2026-770 | Malicious | Not scored | 05 Feb, 2026 | npm xpack-per-user |
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence CVE-2025-68157, GHSA-38r7-794h-5758 | Low | 0.2% | 05 Feb, 2026 | npm webpack |
Sandbox escape via infinite recursion and error objects CVE-2026-25533, GHSA-x39w-8vm5-5m3p | Medium | 0.3% | 05 Feb, 2026 | npm @enclave-vm/core npm enclave-vm |
Malicious release: Malicious code in debug-logger-utils (npm) GHSA-v56v-w5mx-f7pj, MAL-2026-768 | Malicious | Not scored | 05 Feb, 2026 | npm debug-logger-utils |
Malicious release: Malicious code in 0xhash-utils (npm) GHSA-jp2g-vjp5-7pjh, MAL-2026-767 | Malicious | Not scored | 05 Feb, 2026 | npm 0xhash-utils |
Malicious release: Malicious code in https-servers (npm) GHSA-fr3g-46g8-q3gv, MAL-2026-769 | Malicious | Not scored | 05 Feb, 2026 | npm https-servers |
Malicious release: Malicious code in optimizer-cpu (npm) GHSA-x66r-5jww-pf82, MAL-2026-765 | Malicious | Not scored | 05 Feb, 2026 | npm optimizer-cpu |
Malicious release: Malicious code in chai-as-advanced (npm) GHSA-hw5g-4gvf-c7vh, MAL-2026-764 | Malicious | Not scored | 05 Feb, 2026 | npm chai-as-advanced |
Malicious release: Malicious code in digital-checkout (npm) MAL-2026-761 | Malicious | Not scored | 05 Feb, 2026 | npm digital-checkout |
Malicious release: Malicious code in @helloflex/widget-next-sdk (npm) GHSA-h3g9-hf4q-p76h, MAL-2026-760 | Malicious | Not scored | 05 Feb, 2026 | npm @helloflex/widget-next-sdk |
Malicious release: Malicious code in conp-dats-editor (npm) MAL-2026-772 | Malicious | Not scored | 05 Feb, 2026 | npm conp-dats-editor |
Malicious release: Malicious code in internallib_v157 (npm) GHSA-h23p-rf86-54wq, MAL-2026-757 | Malicious | Not scored | 05 Feb, 2026 | npm internallib_v157 |
Malicious release: Malicious code in tailwindcss-forms-starter (npm) GHSA-2rc6-vjw6-pg8x, MAL-2026-758 | Malicious | Not scored | 05 Feb, 2026 | npm tailwindcss-forms-starter |
Malicious release: Malicious code in cat-retail-app (npm) GHSA-c8q4-36x7-q9xp, MAL-2026-756 | Malicious | Not scored | 05 Feb, 2026 | npm cat-retail-app |
Malicious release: Malicious code in @jes4l/react-pkg (npm) GHSA-g32q-5m39-h362, MAL-2026-755 | Malicious | Not scored | 05 Feb, 2026 | npm @jes4l/react-pkg |
Malicious release: Malicious code in express_update (npm) GHSA-w2xr-35pg-j36q, MAL-2026-751 | Malicious | Not scored | 05 Feb, 2026 | npm express_update |
Malicious release: Malicious code in locate-path_updated (npm) GHSA-5h6m-mvmj-68rj, MAL-2026-752 | Malicious | Not scored | 05 Feb, 2026 | npm locate-path_updated |
Malicious release: Malicious code in log-symbols_updated (npm) GHSA-gm92-8pqf-v32m, MAL-2026-753 | Malicious | Not scored | 05 Feb, 2026 | npm log-symbols_updated |
Malicious release: Malicious code in @purecore/rabbitmq (npm) GHSA-5v54-wrvc-9wq7, MAL-2026-749 | Malicious | Not scored | 05 Feb, 2026 | npm @purecore/rabbitmq |
Malicious release: Malicious code in dspmobile (npm) GHSA-x9fp-x6pr-v3wx, MAL-2026-750 | Malicious | Not scored | 05 Feb, 2026 | npm dspmobile |
Malicious release: Malicious code in tailwindcss-animation-modern (npm) GHSA-w9j5-g394-3q5c, MAL-2026-754 | Malicious | Not scored | 05 Feb, 2026 | npm tailwindcss-animation-modern |
FUXA Unauthenticated Remote Arbitrary Device Tag Write CVE-2026-25752, GHSA-ggxw-g3cp-mgf8 | Critical | 0.5% | 05 Feb, 2026 | npm fuxa-server |
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API CVE-2026-25895, GHSA-88qh-cphv-996c | Critical | 12.8% | 05 Feb, 2026 | npm fuxa-server |
FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration CVE-2026-25894, GHSA-32cc-x95p-fxcg | Critical | 0.8% | 05 Feb, 2026 | npm fuxa-server |
FUXA Unauthenticated Exposure of Plaintext Database Credentials CVE-2026-25751, GHSA-c5gq-4h56-4mmx | Critical | 0.3% | 05 Feb, 2026 | npm fuxa-server |
FUXA Unauthenticated Remote Code Execution via Admin JWT Minting CVE-2026-25893, GHSA-vwcg-c828-9822 | Critical | 0.8% | 05 Feb, 2026 | npm fuxa-server |
Malicious release: Malicious code in react-vite-sync (npm) GHSA-6c8f-x4v8-69pr, MAL-2026-747 | Malicious | Not scored | 04 Feb, 2026 | npm react-vite-sync |
Malicious release: Malicious code in react-count-sync (npm) GHSA-g8h5-29pj-64xq, MAL-2026-746 | Malicious | Not scored | 04 Feb, 2026 | npm react-count-sync |
Malicious release: Malicious code in web3-chain-sync (npm) GHSA-p3xm-qpjg-2gg8, MAL-2026-748 | Malicious | Not scored | 04 Feb, 2026 | npm web3-chain-sync |
n8n's domain allowlist bypass enables credential exfiltration CVE-2026-25631, GHSA-2xcx-75h9-vr9h | Medium | 0.3% | 04 Feb, 2026 | npm n8n |
survey-pdf Upgraded jsPDF Version Due to Security Vulnerability CVE-2026-25630, GHSA-h3q6-jfrg-3x6q | Critical | Not scored | 04 Feb, 2026 | npm survey-pdf |
OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.apply CVE-2026-25593, GHSA-g55j-c2v4-pjcg | High | 0.7% | 04 Feb, 2026 | npm openclaw |
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse CVE-2026-25536, GHSA-345p-7cg4-v4c7 | High | 0.3% | 04 Feb, 2026 | npm @modelcontextprotocol/sdk |
godot-mcp has Command Injection via unsanitized projectPath CVE-2026-25546, GHSA-8jx2-rhfh-q928 | High | 1.0% | 04 Feb, 2026 | npm @coding-solo/godot-mcp |
OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction CVE-2026-25475, GHSA-r8g4-86fx-92mq | Medium | 0.8% | 04 Feb, 2026 | npm openclaw |
Apollo Serve vulnerable to Denial of Service with `startStandaloneServer` CVE-2026-23897, GHSA-mp6q-xf9x-fwf7 | High | 0.7% | 04 Feb, 2026 | npm @apollo/server npm apollo-server |
n8n Vulnerable to Command Injection in Community Package Installation CVE-2026-21893, GHSA-7c4h-vh2m-743m | Critical | 1.5% | 04 Feb, 2026 | npm n8n |
Malicious release: Malicious code in dcf-commons (npm) GHSA-qc9j-cjcm-p53g, MAL-2026-742 | Malicious | Not scored | 04 Feb, 2026 | npm dcf-commons |
Malicious release: Malicious code in @msecscc/gaia (npm) GHSA-9m24-6v7q-pffv, MAL-2026-740 | Malicious | Not scored | 04 Feb, 2026 | npm @msecscc/gaia |
n8n has a Python sandbox escape CVE-2026-25115, GHSA-8398-gmmx-564h | Critical | 0.6% | 04 Feb, 2026 | npm n8n |
n8n Merge Node has Arbitrary File Write leading to RCE CVE-2026-25056, GHSA-hv53-3329-vmrm | Critical | 0.7% | 04 Feb, 2026 | npm n8n |
n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH Node CVE-2026-25055, GHSA-m82q-59gv-mcr9 | High | 1.9% | 04 Feb, 2026 | npm n8n |
n8n Has Stored Cross-site Scripting via Markdown Rendering in Workflow UI CVE-2026-25054, GHSA-qpq4-pw7f-pp8w | High | 0.2% | 04 Feb, 2026 | npm n8n |
n8n has OS Command Injection in Git Node CVE-2026-25053, GHSA-9g95-qf3f-ggrw | Critical | 0.6% | 04 Feb, 2026 | npm n8n |
n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users CVE-2026-25052, GHSA-gfvg-qv54-r4pc | Critical | 0.3% | 04 Feb, 2026 | npm n8n |
n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS CVE-2026-25051, GHSA-825q-w924-xhgx | High | 0.3% | 04 Feb, 2026 | npm n8n |