Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor CVE-2026-23830, GHSA-wxhw-j4hc-fmq6 | Critical | 1.2% | 27 Jan, 2026 | npm @nyariv/sandboxjs |
Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) CVE-2026-24473, GHSA-w332-q679-j88p | Medium | 0.5% | 27 Jan, 2026 | npm hono |
Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception CVE-2026-24472, GHSA-6wqw-2p9w-4vw4 | Medium | 0.5% | 27 Jan, 2026 | npm hono |
Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing CVE-2026-24398, GHSA-r354-f388-2fhh | Medium | 0.3% | 27 Jan, 2026 | npm hono |
n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution CVE-2026-1470, GHSA-5xrp-6693-jjx9 | Critical | 20.4% | 27 Jan, 2026 | npm n8n |
Malicious release: Malicious code in @santandergroup-uk/edgehome-components (npm) GHSA-7w89-3478-9838, MAL-2026-527 | Malicious | Not scored | 27 Jan, 2026 | npm @santandergroup-uk/edgehome-components |
Malicious release: Malicious code in internallib_v828 (npm) GHSA-4r5c-58jj-47rr, MAL-2026-534 | Malicious | Not scored | 27 Jan, 2026 | npm internallib_v828 |
Malicious release: Malicious code in stylus.js (npm) GHSA-7hw4-xjm9-2fr7, MAL-2026-542 | Malicious | Not scored | 27 Jan, 2026 | npm stylus.js |
Malicious release: Malicious code in morgan.js (npm) GHSA-8j6f-2j2w-q8hc, MAL-2026-536 | Malicious | Not scored | 27 Jan, 2026 | npm morgan.js |
Malicious release: Malicious code in mysql2.js (npm) GHSA-mv7j-pqp4-p8p3, MAL-2026-537 | Malicious | Not scored | 27 Jan, 2026 | npm mysql2.js |
Malicious release: Malicious code in knex.js (npm) GHSA-v532-mx4j-wq5x, MAL-2026-535 | Malicious | Not scored | 27 Jan, 2026 | npm knex.js |
Malicious release: Malicious code in pump.js (npm) GHSA-vg7v-pm3q-r4f5, MAL-2026-541 | Malicious | Not scored | 27 Jan, 2026 | npm pump.js |
Malicious release: Malicious code in grepleaks (npm) GHSA-576v-xg3m-rpj7, MAL-2026-530 | Malicious | Not scored | 27 Jan, 2026 | npm grepleaks |
Malicious release: Malicious code in hackerxhj (npm) GHSA-893h-38p9-2g7m, MAL-2026-531 | Malicious | Not scored | 27 Jan, 2026 | npm hackerxhj |
Malicious release: Malicious code in testxhjhka (npm) GHSA-pqc3-frfj-85cg, MAL-2026-545 | Malicious | Not scored | 27 Jan, 2026 | npm testxhjhka |
Malicious release: Malicious code in xhjxhjhiagent (npm) GHSA-rx7h-wg9p-mhmq, MAL-2026-546 | Malicious | Not scored | 27 Jan, 2026 | npm xhjxhjhiagent |
Malicious release: Malicious code in testxhjhk (npm) GHSA-v3hr-6cj2-6w2v, MAL-2026-544 | Malicious | Not scored | 27 Jan, 2026 | npm testxhjhk |
Malicious release: Malicious code in hiagentxhjrceme (npm) GHSA-7rwj-7qq6-w6vx, MAL-2026-533 | Malicious | Not scored | 27 Jan, 2026 | npm hiagentxhjrceme |
Malicious release: Malicious code in hiagentxhjrce (npm) GHSA-rq46-v367-269c, MAL-2026-532 | Malicious | Not scored | 27 Jan, 2026 | npm hiagentxhjrce |
Malicious release: Malicious code in @row-components/pricing-embedded-sui (npm) GHSA-22mf-gpfv-j3x3, MAL-2026-526 | Malicious | Not scored | 27 Jan, 2026 | npm @row-components/pricing-embedded-sui |
Malicious release: Malicious code in tailwind-components-cli (npm) GHSA-r7r7-fg7f-727f, MAL-2026-543 | Malicious | Not scored | 27 Jan, 2026 | npm tailwind-components-cli |
Malicious release: Malicious code in n8n-nodes-xkwqpzrt-jmflhvbn-dsyocgxwmkelpt (npm) GHSA-4h38-mjmr-prfx, MAL-2026-540 | Malicious | Not scored | 27 Jan, 2026 | npm n8n-nodes-xkwqpzrt-jmflhvbn-dsyocgxwmkelpt |
Malicious release: Malicious code in n8n-nodes-gasdhgfuy-rejerw-ytjsadx (npm) GHSA-7jcc-gjp4-f9w4, MAL-2026-538 | Malicious | Not scored | 27 Jan, 2026 | npm n8n-nodes-gasdhgfuy-rejerw-ytjsadx |
Malicious release: Malicious code in n8n-nodes-gg-udhasudsh-hgjkhg-official (npm) GHSA-9gwp-x3p2-fchf, MAL-2026-539 | Malicious | Not scored | 27 Jan, 2026 | npm n8n-nodes-gg-udhasudsh-hgjkhg-official |
Malicious release: Malicious code in fileupload-core (npm) GHSA-jmrw-v7rp-6m4v, MAL-2026-529 | Malicious | Not scored | 27 Jan, 2026 | npm fileupload-core |
Malicious release: Malicious code in @shije/new-qs (npm) GHSA-mp8v-x9wp-v423, MAL-2026-528 | Malicious | Not scored | 27 Jan, 2026 | npm @shije/new-qs |
Malicious release: Malicious code in ftm-noderpc (npm) GHSA-m2jq-q4v9-276f, MAL-2026-520 | Malicious | Not scored | 27 Jan, 2026 | npm ftm-noderpc |
Malicious release: Malicious code in sandbox-hooks (npm) GHSA-58gm-9gr2-v55v, MAL-2026-525 | Malicious | Not scored | 27 Jan, 2026 | npm sandbox-hooks |
Malicious release: Malicious code in magento-coding-standard-eslint-plugin (npm) GHSA-673x-qfjx-j475, MAL-2026-522 | Malicious | Not scored | 27 Jan, 2026 | npm magento-coding-standard-eslint-plugin |
Malicious release: Malicious code in hammer-jquery (npm) GHSA-732r-c6r2-x55r, MAL-2026-521 | Malicious | Not scored | 27 Jan, 2026 | npm hammer-jquery |
Malicious release: Malicious code in mapkit-example-svelte (npm) GHSA-978q-52r4-529f, MAL-2026-523 | Malicious | Not scored | 27 Jan, 2026 | npm mapkit-example-svelte |
Malicious release: Malicious code in mapkit-example-vue (npm) GHSA-mvxj-fpqx-qhph, MAL-2026-524 | Malicious | Not scored | 27 Jan, 2026 | npm mapkit-example-vue |
Malicious release: Malicious code in @afg-ikea/ikea-modals (npm) GHSA-9f47-ffh4-6h4f, MAL-2026-519 | Malicious | Not scored | 27 Jan, 2026 | npm @afg-ikea/ikea-modals |
Malicious release: Malicious code in @afg-ikea/ikea-kiosk-related-components (npm) GHSA-27vw-p6h7-3c24, MAL-2026-518 | Malicious | Not scored | 27 Jan, 2026 | npm @afg-ikea/ikea-kiosk-related-components |
Malicious release: Malicious code in @afg-ikea/ikea-family-registration-module (npm) GHSA-wx5g-qvrw-cmg9, MAL-2026-517 | Malicious | Not scored | 27 Jan, 2026 | npm @afg-ikea/ikea-family-registration-module |
Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE GHSA-cr3w-cw5w-h3fj | Critical | Not scored | 26 Jan, 2026 | npm @saltcorn/server |
Next.js has Unbounded Memory Consumption via PPR Resume Endpoint CVE-2025-59472, GHSA-5f7q-jpqc-wp7h | High | 0.4% | 26 Jan, 2026 | npm next |
Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration CVE-2025-59471, GHSA-9g9p-9gw9-jx7f | High | 0.5% | 26 Jan, 2026 | npm next |
pnpm has Path Traversal via arbitrary file permission modification CVE-2026-24131, GHSA-v253-rj99-jwpq | Medium | 0.3% | 26 Jan, 2026 | npm pnpm |
pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip) CVE-2026-23888, GHSA-6pfh-p556-v868 | Medium | 0.4% | 26 Jan, 2026 | npm pnpm |
pnpm has Windows-specific tarball Path Traversal CVE-2026-23889, GHSA-6x96-7vc8-cm3p | Medium | 0.5% | 26 Jan, 2026 | npm pnpm |
pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin CVE-2026-23890, GHSA-xpqm-wm3m-f34h | Medium | 0.5% | 26 Jan, 2026 | npm pnpm |
pnpm has symlink traversal in file:/git dependencies CVE-2026-24056, GHSA-m733-5w8f-5ggw | Medium | 0.5% | 26 Jan, 2026 | npm pnpm |
React Server Components have multiple Denial of Service Vulnerabilities CVE-2026-23864, GHSA-83fc-fqcc-2hmg | High | 2.6% | 26 Jan, 2026 | npm react-server-dom-parcel npm react-server-dom-turbopack npm react-server-dom-webpack |
vm2 has a Sandbox Escape CVE-2026-22709, GHSA-99p7-6v5w-7xg8 | Critical | 1.3% | 26 Jan, 2026 | npm vm2 |
dcap-qvl has Missing Verification for QE Identity CVE-2026-22696, GHSA-796p-j2gh-9m2q, PYSEC-2026-326 | Critical | 0.2% | 26 Jan, 2026 | PyPI dcap-qvl crates.io dcap-qvl npm @phala/dcap-qvl npm @phala/dcap-qvl-node +1 more |
Malicious release: Malicious code in @sommos/create-program-template-form-data (npm) MAL-2026-509 | Malicious | Not scored | 26 Jan, 2026 | npm @sommos/create-program-template-form-data |
Malicious release: Malicious code in cartos-dds-ui (npm) MAL-2026-508 | Malicious | Not scored | 26 Jan, 2026 | npm cartos-dds-ui |
Withdrawn Advisory: eslint has a Stack Overflow when serializing objects with circular references CVE-2025-50537, GHSA-p5wg-g6qr-c7cg | Medium | 0.2% | 26 Jan, 2026 | npm eslint |
Malicious release: Malicious code in @snazah/davey (npm) GHSA-64jj-9746-r33x, MAL-2026-553 | Malicious | Not scored | 26 Jan, 2026 | npm @snazah/davey |