Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in sinful (npm) GHSA-2xjj-r8mc-xpf6, MAL-2026-16284 | Malicious | Not scored | 18 Sep, 2026 | npm sinful |
Malicious release: Malicious code in tailwindcss-form (npm) GHSA-c8m9-qwg6-5cv9, MAL-2026-16282 | Malicious | Not scored | 18 Sep, 2026 | npm tailwindcss-form |
Malicious release: Malicious code in @sanzoffc/baileys (npm) GHSA-w5cc-9p38-q2wq, MAL-2026-16281 | Malicious | Not scored | 18 Sep, 2026 | npm @sanzoffc/baileys |
Malicious release: Malicious code in xzvbailsx (npm) MAL-2026-16279 | Malicious | Not scored | 18 Sep, 2026 | npm xzvbailsx |
Malicious release: Malicious code in xzvbailey (npm) MAL-2026-16278 | Malicious | Not scored | 18 Sep, 2026 | npm xzvbailey |
Malicious release: Malicious code in xa424234657567 (npm) MAL-2026-16277 | Malicious | Not scored | 18 Sep, 2026 | npm xa424234657567 |
Malicious release: Malicious code in zero-baileys (npm) GHSA-v486-jrrq-rhwx, MAL-2026-16280 | Malicious | Not scored | 18 Sep, 2026 | npm zero-baileys |
Malicious release: Malicious code in @lekzo/baileys (npm) GHSA-jv7g-wqqq-m6gm, MAL-2026-16276 | Malicious | Not scored | 18 Sep, 2026 | npm @lekzo/baileys |
Malicious release: Malicious code in blue-string-formatter-utils (npm) MAL-2026-16273 | Malicious | Not scored | 17 Sep, 2026 | npm blue-string-formatter-utils |
Malicious release: Malicious code in @tink/tink-link-core (npm) MAL-2026-16270 | Malicious | Not scored | 17 Sep, 2026 | npm @tink/tink-link-core |
Malicious release: Malicious code in test89078-auth (npm) MAL-2026-16271 | Malicious | Not scored | 17 Sep, 2026 | npm test89078-auth |
Malicious release: Malicious code in kartykgithub-multiversion-a (npm) GHSA-p957-4pc7-x6hp, MAL-2026-16272 | Malicious | Not scored | 17 Sep, 2026 | npm kartykgithub-multiversion-a |
Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text CVE-2026-77615, GHSA-m6c8-jcw2-5r25 | High | 0.6% | 17 Sep, 2026 | Maven org.opencastproject:opencast-engage-paella-player-7 npm paella-core |
Malicious release: Malicious code in @kartyk-github-org/takedown-b (npm) GHSA-q83w-3hvr-fgg7, MAL-2026-16266 | Malicious | Not scored | 17 Sep, 2026 | npm @kartyk-github-org/takedown-b |
Malicious release: Malicious code in @kartyk-github-org/takedown-a (npm) GHSA-rx76-mcg9-gqc5, MAL-2026-16265 | Malicious | Not scored | 17 Sep, 2026 | npm @kartyk-github-org/takedown-a |
Malicious release: Malicious code in tailwindcss-form-ui (npm) MAL-2026-16262 | Malicious | Not scored | 17 Sep, 2026 | npm tailwindcss-form-ui |
Malicious release: Malicious code in tailwindcss-form-utils (npm) MAL-2026-16263 | Malicious | Not scored | 17 Sep, 2026 | npm tailwindcss-form-utils |
Malicious release: Malicious code in @railone/image-utils (npm) MAL-2026-16261 | Malicious | Not scored | 17 Sep, 2026 | npm @railone/image-utils |
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses CVE-2026-86039, GHSA-vrf4-mx87-p53w | High | 0.3% | 17 Sep, 2026 | npm @libp2p/peer-store |
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID CVE-2026-86038, GHSA-c3gv-825q-fvmp | High | 0.2% | 17 Sep, 2026 | npm @libp2p/gossipsub |
ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion CVE-2026-85715, GHSA-pj96-35fp-cfcc | High | 0.6% | 17 Sep, 2026 | npm exifreader |
Malicious release: Malicious code in confx1789550882 (npm) MAL-2026-16260 | Malicious | Not scored | 17 Sep, 2026 | npm confx1789550882 |
Malicious release: Malicious code in randompkga (npm) GHSA-532p-c872-3926, MAL-2026-16255 | Malicious | Not scored | 17 Sep, 2026 | npm randompkga |
Malicious release: Malicious code in randompkgd (npm) GHSA-cqc9-f5fp-r45q, MAL-2026-16258 | Malicious | Not scored | 17 Sep, 2026 | npm randompkgd |
Malicious release: Malicious code in randompkgc (npm) GHSA-p8m5-fmxm-99f6, MAL-2026-16257 | Malicious | Not scored | 17 Sep, 2026 | npm randompkgc |
Malicious release: Malicious code in randompkge (npm) GHSA-rc4q-v4pf-8j7x, MAL-2026-16259 | Malicious | Not scored | 17 Sep, 2026 | npm randompkge |
Malicious release: Malicious code in randompkgb (npm) GHSA-vxvv-gh3g-35pj, MAL-2026-16256 | Malicious | Not scored | 17 Sep, 2026 | npm randompkgb |
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows CVE-2026-71538, GHSA-q69g-4hcv-6jg4 | High | 0.2% | 17 Sep, 2026 | npm @cyclonedx/cyclonedx-npm |
Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification CVE-2026-63472, GHSA-6j36-r6pr-59x4 | Critical | 0.6% | 17 Sep, 2026 | npm @vendure/core |
Vendure: Shop API list queries can return non-public entities when filterOperator is OR CVE-2026-63461, GHSA-xf65-r35x-wmmv | Medium | 0.4% | 17 Sep, 2026 | npm @vendure/core |
Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends CVE-2026-63460, GHSA-jgm3-qmp2-c4p7 | High | 0.6% | 17 Sep, 2026 | npm @vendure/core |
Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions CVE-2026-63459, GHSA-xhq9-whgq-49j5 | High | 0.4% | 17 Sep, 2026 | npm @vendure/dashboard |
Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter CVE-2026-61793, GHSA-q8hw-4fvp-9rwv | Medium | 0.5% | 17 Sep, 2026 | npm nuxt-og-image |
Malicious release: Malicious code in pulse-pwn-9f3a2 (npm) GHSA-fwr5-cj49-cq4h, MAL-2026-16254 | Malicious | Not scored | 17 Sep, 2026 | npm pulse-pwn-9f3a2 |
Malicious release: Malicious code in ragacateslikodi (npm) GHSA-mjhw-5x2v-v3wg, MAL-2026-16252 | Malicious | Not scored | 17 Sep, 2026 | npm ragacateslikodi |
vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM CVE-2026-92959, GHSA-f8gf-w286-fmq2 | High | 0.4% | 17 Sep, 2026 | npm vm2 |
vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes CVE-2026-92958, GHSA-6rh5-qq4q-97xh | High | 0.4% | 17 Sep, 2026 | npm vm2 |
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process CVE-2026-92957, GHSA-8686-vhfx-7r3j | Critical | 0.5% | 17 Sep, 2026 | npm vm2 |
vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass CVE-2026-92956, GHSA-wjwh-qqvp-g4p4 | Critical | 0.5% | 17 Sep, 2026 | npm vm2 |
vm2: Sandbox Escape (NodeVM) CVE-2026-92955, GHSA-88hf-g992-jg85 | Critical | 0.7% | 17 Sep, 2026 | npm vm2 |
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process CVE-2026-92954, GHSA-gjq8-xm47-88rc | Critical | 0.5% | 17 Sep, 2026 | npm vm2 |
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix CVE-2026-92953, GHSA-3vgf-8m4q-q4qr | Critical | 0.5% | 17 Sep, 2026 | npm vm2 |
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks CVE-2026-92952, GHSA-jf8q-945g-9q4c | High | 0.5% | 17 Sep, 2026 | npm vm2 |
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package CVE-2026-92951, GHSA-c48m-32m9-vx93 | Critical | 0.5% | 17 Sep, 2026 | npm vm2 |
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts CVE-2026-92950, GHSA-jxxv-8r27-vm4p | Critical | 0.2% | 17 Sep, 2026 | npm vm2 |
vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor CVE-2026-92949, GHSA-633r-hq9m-c4ff | Medium | 0.3% | 17 Sep, 2026 | npm vm2 |
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape CVE-2026-92948, GHSA-qhwx-74w5-xhxq | Critical | 0.7% | 17 Sep, 2026 | npm vm2 |
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool CVE-2026-92947, GHSA-fcqc-726x-5wfc | Critical | 0.5% | 17 Sep, 2026 | npm vm2 |
vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE CVE-2026-92946, GHSA-j3hm-6rg5-mchv | Critical | 0.8% | 17 Sep, 2026 | npm vm2 |
vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted CVE-2026-92945, GHSA-7q3f-wx44-378m | Medium | 0.3% | 17 Sep, 2026 | npm vm2 |