Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
n8n Has Expression Escape Vulnerability Leading to RCE CVE-2026-25049, GHSA-6cqr-8cfr-67f8 | Critical | 1.6% | 04 Feb, 2026 | npm n8n |
n8n's Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner CVE-2025-61917, GHSA-49mx-fj45-q3p6 | High | 0.4% | 04 Feb, 2026 | npm n8n |
Malicious release: Malicious code in internationalized (npm) GHSA-2f47-cw56-c2fv, MAL-2026-743 | Malicious | Not scored | 04 Feb, 2026 | npm internationalized |
Malicious release: Malicious code in confluence-analytics-support (npm) GHSA-4j65-m9j3-4wrc, MAL-2026-741 | Malicious | Not scored | 04 Feb, 2026 | npm confluence-analytics-support |
Malicious release: Malicious code in mdp-client-web (npm) GHSA-crrc-9hrh-2pgh, MAL-2026-744 | Malicious | Not scored | 04 Feb, 2026 | npm mdp-client-web |
Malicious release: Malicious code in ggajsvjsg (npm) GHSA-jv7m-6p34-m7xf, MAL-2026-736 | Malicious | Not scored | 04 Feb, 2026 | npm ggajsvjsg |
Malicious release: Malicious code in docusaurus-plugin-launchdarkly (npm) GHSA-q8cq-3xjx-954v, MAL-2026-735 | Malicious | Not scored | 04 Feb, 2026 | npm docusaurus-plugin-launchdarkly |
Malicious release: Malicious code in remark-gfm-v4 (npm) GHSA-xpfh-2xjg-cgvr, MAL-2026-737 | Malicious | Not scored | 04 Feb, 2026 | npm remark-gfm-v4 |
Malicious release: Malicious code in xpack-subscription-test (npm) GHSA-cjg3-62x9-48px, MAL-2026-734 | Malicious | Not scored | 04 Feb, 2026 | npm xpack-subscription-test |
Malicious release: Malicious code in deuro-landing-page (npm) MAL-2026-733 | Malicious | Not scored | 04 Feb, 2026 | npm deuro-landing-page |
Malicious release: Malicious code in partnerss (npm) MAL-2026-717 | Malicious | Not scored | 04 Feb, 2026 | npm partnerss |
Malicious release: Malicious code in json-mapping-source (npm) GHSA-mh9w-jmxc-c3wj, MAL-2026-725 | Malicious | Not scored | 04 Feb, 2026 | npm json-mapping-source |
Malicious release: Malicious code in chai-grab (npm) GHSA-j4cp-89ch-6hv7, MAL-2026-720 | Malicious | Not scored | 04 Feb, 2026 | npm chai-grab |
Malicious release: Malicious code in zappr (npm) GHSA-6cp7-hh84-q43w, MAL-2026-730 | Malicious | Not scored | 04 Feb, 2026 | npm zappr |
Malicious release: Malicious code in z-shop-js-env (npm) GHSA-6hph-mcq5-c6c3, MAL-2026-727 | Malicious | Not scored | 04 Feb, 2026 | npm z-shop-js-env |
Malicious release: Malicious code in z-shop-ui (npm) GHSA-hrr6-55jh-6cvv, MAL-2026-728 | Malicious | Not scored | 04 Feb, 2026 | npm z-shop-ui |
Malicious release: Malicious code in zalando-consent-api (npm) GHSA-r6c3-cmw7-p4qr, MAL-2026-729 | Malicious | Not scored | 04 Feb, 2026 | npm zalando-consent-api |
Malicious release: Malicious code in z-shop-event-bus (npm) GHSA-xfv7-mr73-872w, MAL-2026-726 | Malicious | Not scored | 04 Feb, 2026 | npm z-shop-event-bus |
Malicious release: Malicious code in chai-async-promised (npm) GHSA-37qg-vpf9-mc8h, MAL-2026-719 | Malicious | Not scored | 04 Feb, 2026 | npm chai-async-promised |
Malicious release: Malicious code in dotenv-embedded (npm) GHSA-v736-fhq8-mxhm, MAL-2026-721 | Malicious | Not scored | 04 Feb, 2026 | npm dotenv-embedded |
Malicious release: Malicious code in https-emailjs (npm) GHSA-3gjc-g7m2-vjf4, MAL-2026-724 | Malicious | Not scored | 04 Feb, 2026 | npm https-emailjs |
Malicious release: Malicious code in http-emailjs (npm) GHSA-8g4f-5rq7-4g8h, MAL-2026-723 | Malicious | Not scored | 04 Feb, 2026 | npm http-emailjs |
Malicious release: Malicious code in @fxinternal/netdiagnostics (npm) GHSA-83x6-432q-hpcf, MAL-2026-718 | Malicious | Not scored | 04 Feb, 2026 | npm @fxinternal/netdiagnostics |
Malicious release: Malicious code in express-groups-routes (npm) GHSA-v866-jcq6-8pmv, MAL-2026-722 | Malicious | Not scored | 04 Feb, 2026 | npm express-groups-routes |
Malicious release: Malicious code in ongose (npm) GHSA-3r27-rv87-43w9, MAL-2026-712 | Malicious | Not scored | 04 Feb, 2026 | npm ongose |
Malicious release: Malicious code in reactt-sdkk (npm) GHSA-4hx3-gphj-r9hr, MAL-2026-714 | Malicious | Not scored | 04 Feb, 2026 | npm reactt-sdkk |
Malicious release: Malicious code in mongooose_update (npm) GHSA-626w-9prr-rwc6, MAL-2026-709 | Malicious | Not scored | 04 Feb, 2026 | npm mongooose_update |
Malicious release: Malicious code in mongoose_update (npm) GHSA-g9f3-5423-w9c8, MAL-2026-711 | Malicious | Not scored | 04 Feb, 2026 | npm mongoose_update |
Malicious release: Malicious code in react-sdkk (npm) GHSA-gvm7-w8rj-q842, MAL-2026-713 | Malicious | Not scored | 04 Feb, 2026 | npm react-sdkk |
Malicious release: Malicious code in si-wsl (npm) GHSA-qc6m-55v7-26x2, MAL-2026-716 | Malicious | Not scored | 04 Feb, 2026 | npm si-wsl |
Malicious release: Malicious code in rreact-sdk (npm) GHSA-v42r-whqq-4prv, MAL-2026-715 | Malicious | Not scored | 04 Feb, 2026 | npm rreact-sdk |
Malicious release: Malicious code in mongooose_updated (npm) GHSA-x2r8-ggc3-9654, MAL-2026-710 | Malicious | Not scored | 04 Feb, 2026 | npm mongooose_updated |
Malicious release: Malicious code in incode-kyc-backend (npm) GHSA-3gwm-923q-5fmw, MAL-2026-708 | Malicious | Not scored | 03 Feb, 2026 | npm incode-kyc-backend |
Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data) CVE-2026-25155, GHSA-vm6g-8r4h-22x8 | High | 0.1% | 03 Feb, 2026 | npm @builder.io/qwik-city |
Qwik City Open Redirect via fixTrailingSlash CVE-2026-25149, GHSA-92j7-wgmg-f32m | Low | 0.3% | 03 Feb, 2026 | npm @builder.io/qwik-city |
Qwik City has a CSRF Protection Bypass via Content-Type Header Validation CVE-2026-25151, GHSA-r666-8gjf-4v5f | Medium | 0.2% | 03 Feb, 2026 | npm @builder.io/qwik-city |
Prototype Pollution via FormData Processing in Qwik City CVE-2026-25150, GHSA-xqg6-98cw-gxhq | Critical | 0.7% | 03 Feb, 2026 | npm @builder.io/qwik-city |
Qwik SSR XSS via Unsafe Virtual Node Serialization CVE-2026-25148, GHSA-m6jq-g7gq-5w3c | Medium | 0.3% | 03 Feb, 2026 | npm @builder.io/qwik-city |
@isaacs/brace-expansion has Uncontrolled Resource Consumption CVE-2026-25547, GHSA-7h2j-956f-4vf2 | Critical | 0.5% | 03 Feb, 2026 | npm @isaacs/brace-expansion |
Claude Code has a Command Injection in find Command Bypasses User Approval Prompt CVE-2026-24887, GHSA-qgqw-h4xq-7w8w | High | 0.6% | 03 Feb, 2026 | npm @anthropic-ai/claude-code |
Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes CVE-2026-24053, GHSA-q728-gf8j-w49r | High | 0.5% | 03 Feb, 2026 | npm @anthropic-ai/claude-code |
Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains CVE-2026-24052, GHSA-vhw5-3g5m-8ggf | High | 0.4% | 03 Feb, 2026 | npm @anthropic-ai/claude-code |
FUXA allows Remote Code Execution (RCE) via the project import functionality. CVE-2025-69983, GHSA-5r63-q8hg-p8qx | Critical | 0.5% | 03 Feb, 2026 | npm fuxa-server |
FUXA contains an Unrestricted File Upload vulnerability CVE-2025-69981, GHSA-7g56-fwxj-cm23 | Critical | 0.8% | 03 Feb, 2026 | npm fuxa-server |
FUXA has a hardcoded fallback JWT signing secret CVE-2025-69971, GHSA-c8m8-3jcr-6rj5 | Critical | 2.2% | 03 Feb, 2026 | npm @frangoteam/fuxa |
FUXA contains an insecure default configuration vulnerability CVE-2025-69970, GHSA-r5m2-fqcf-qrf7 | Critical | 0.5% | 03 Feb, 2026 | npm fuxa-server |
Compressing Vulnerable to Arbitrary File Write via Symlink Extraction CVE-2026-24884, GHSA-cc8f-xg8v-72m3 | High | 0.3% | 03 Feb, 2026 | npm compressing |
Malicious release: Malicious code in js-unpack (npm) GHSA-6444-v9wg-78rr, MAL-2026-707 | Malicious | Not scored | 03 Feb, 2026 | npm js-unpack |
Malicious release: Malicious code in @devgandhi/healthpulse (npm) GHSA-m56w-m3fj-frgc, MAL-2026-706 | Malicious | Not scored | 03 Feb, 2026 | npm @devgandhi/healthpulse |
Malicious release: Malicious code in @devgandhi/cpp (npm) GHSA-qc7c-jwxx-8xm4, MAL-2026-705 | Malicious | Not scored | 03 Feb, 2026 | npm @devgandhi/cpp |