Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector CVE-2026-92944, GHSA-27g9-p43v-cw3v | Critical | 0.8% | 17 Sep, 2026 | npm vm2 |
vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block) CVE-2026-92942, GHSA-r4fx-v8hh-22mv | High | 0.5% | 17 Sep, 2026 | npm vm2 |
vm2 NodeVM can replace the host process TLS trust store CVE-2026-92941, GHSA-98xx-8mx4-x7cm | Critical | 0.3% | 17 Sep, 2026 | npm vm2 |
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent CVE-2026-92940, GHSA-h85j-hv3c-qfgq | Critical | 0.4% | 17 Sep, 2026 | npm vm2 |
vm2 crypto builtin loads attacker native code through setEngine CVE-2026-92939, GHSA-46pr-c5wc-xffx | Critical | 0.6% | 17 Sep, 2026 | npm vm2 |
vm2 allows a sandboxed plugin to execute native code through `node:sqlite` CVE-2026-92938, GHSA-6w8r-xxw2-g3hx | Critical | 0.6% | 17 Sep, 2026 | npm vm2 |
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection CVE-2026-92937, GHSA-647f-g98j-qq25 | Critical | 1.0% | 17 Sep, 2026 | npm vm2 |
vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting CVE-2026-92936, GHSA-x6m4-chr9-cg97 | Medium | 0.5% | 17 Sep, 2026 | npm vm2 |
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE CVE-2026-92935, GHSA-8hr7-r645-pc6w | Critical | 0.6% | 17 Sep, 2026 | npm vm2 |
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit CVE-2026-92934, GHSA-x965-fc75-jpqh | Critical | 0.8% | 17 Sep, 2026 | npm vm2 |
vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack CVE-2026-92933, GHSA-r273-hxvj-fxhp | Medium | 0.4% | 17 Sep, 2026 | npm vm2 |
Malicious release: Malicious code in tailwindcss-contact-form (npm) MAL-2026-16251 | Malicious | Not scored | 17 Sep, 2026 | npm tailwindcss-contact-form |
Malicious release: Malicious code in kartykgithub-takedown-b (npm) GHSA-f8wr-9w83-7gmw, MAL-2026-16249 | Malicious | Not scored | 17 Sep, 2026 | npm kartykgithub-takedown-b |
Malicious release: Malicious code in kartykgithub-takedown-a (npm) GHSA-5r64-rpvg-q9rr, MAL-2026-16248 | Malicious | Not scored | 17 Sep, 2026 | npm kartykgithub-takedown-a |
Malicious release: Malicious code in laycot (npm) MAL-2026-16253 | Malicious | Not scored | 16 Sep, 2026 | npm laycot |
Malicious release: Malicious code in kartyk-github-token-pkg (npm) GHSA-4rmp-vchm-9gvg, MAL-2026-16246 | Malicious | Not scored | 16 Sep, 2026 | npm kartyk-github-token-pkg |
Malicious release: Malicious code in kartyk-github-single-ver-pkg (npm) GHSA-4vpr-3r9p-p9fh, MAL-2026-16245 | Malicious | Not scored | 16 Sep, 2026 | npm kartyk-github-single-ver-pkg |
Malicious release: Malicious code in pkg-rollback-dreed-viced-sonic-ponds (npm) GHSA-63f3-rmrf-6m9q, MAL-2026-16247 | Malicious | Not scored | 16 Sep, 2026 | npm pkg-rollback-dreed-viced-sonic-ponds |
Malicious release: Malicious code in kartyk-github-oidc-test-pkg (npm) GHSA-4vxh-7998-9h4g, MAL-2026-16244 | Malicious | Not scored | 16 Sep, 2026 | npm kartyk-github-oidc-test-pkg |
joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()` CVE-2026-92599, GHSA-6h2x-m376-mqjq | High | 0.6% | 16 Sep, 2026 | npm joi |
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site CVE-2026-63506, GHSA-g74q-6g2f-874x | High | 0.5% | 16 Sep, 2026 | npm @tinacms/auth npm next-tinacms-azure |
Svelte devalue: DoS via malformed input CVE-2026-81176, GHSA-9rgm-9g3h-6x36 | Medium | 0.5% | 16 Sep, 2026 | npm devalue |
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass CVE-2026-77360, GHSA-j9v4-rhgr-4m5f | Medium | 0.5% | 16 Sep, 2026 | npm @orpc/server |
Redocly CLI: Path traversal when using `split` command CVE-2026-63225, GHSA-657c-g7qc-r9j2 | Medium | 0.2% | 16 Sep, 2026 | npm @redocly/cli |
node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion CVE-2026-68904, GHSA-r2pf-9cw4-5j65 | High | 0.4% | 16 Sep, 2026 | npm node-opcua npm node-opcua-client npm node-opcua-transport |
Malicious release: Malicious code in idx_form_script (npm) MAL-2026-16243 | Malicious | Not scored | 16 Sep, 2026 | npm idx_form_script |
@platejs/core HTML deserialization can trigger browser behavior during parsing CVE-2026-88976, GHSA-qrfj-mgw8-j9c6 | Medium | 0.3% | 16 Sep, 2026 | npm @platejs/core |
@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration CVE-2026-63671, GHSA-mxm6-v9r6-r94c | High | 0.5% | 16 Sep, 2026 | npm @nuxtjs/mdc |
Malicious release: Malicious code in @traktis/core (npm) MAL-2026-16222 | Malicious | Not scored | 16 Sep, 2026 | npm @traktis/core |
Malicious release: Malicious code in @traktis/environment (npm) MAL-2026-16223 | Malicious | Not scored | 16 Sep, 2026 | npm @traktis/environment |
Malicious release: Malicious code in strapi-plugin-os-rec (npm) MAL-2026-16234 | Malicious | Not scored | 16 Sep, 2026 | npm strapi-plugin-os-rec |
Malicious release: Malicious code in strapi-plugin-ccrev-meeb (npm) MAL-2026-16228 | Malicious | Not scored | 16 Sep, 2026 | npm strapi-plugin-ccrev-meeb |
Malicious release: Malicious code in strapi-plugin-osag (npm) MAL-2026-16235 | Malicious | Not scored | 16 Sep, 2026 | npm strapi-plugin-osag |
Malicious release: Malicious code in strapi-plugin-ccrec-meeb (npm) MAL-2026-16227 | Malicious | Not scored | 16 Sep, 2026 | npm strapi-plugin-ccrec-meeb |
Malicious release: Malicious code in strapi-plugin-cccon-meeb (npm) MAL-2026-16225 | Malicious | Not scored | 16 Sep, 2026 | npm strapi-plugin-cccon-meeb |
Malicious release: Malicious code in strapi-plugin-persh-meeb (npm) MAL-2026-16237 | Malicious | Not scored | 16 Sep, 2026 | npm strapi-plugin-persh-meeb |
Malicious release: Malicious code in strapi-plugin-pysh-meeb (npm) MAL-2026-16239 | Malicious | Not scored | 16 Sep, 2026 | npm strapi-plugin-pysh-meeb |
Malicious release: Malicious code in strapi-plugin-perev-meeb (npm) MAL-2026-16236 | Malicious | Not scored | 16 Sep, 2026 | npm strapi-plugin-perev-meeb |
Malicious release: Malicious code in strapi-plugin-ccip-meeb (npm) MAL-2026-16226 | Malicious | Not scored | 16 Sep, 2026 | npm strapi-plugin-ccip-meeb |
Malicious release: Malicious code in strapi-plugin-honey-meeb (npm) MAL-2026-16231 | Malicious | Not scored | 16 Sep, 2026 | npm strapi-plugin-honey-meeb |
Malicious release: Malicious code in strapi-plugin-conresh-meeb (npm) MAL-2026-16229 | Malicious | Not scored | 16 Sep, 2026 | npm strapi-plugin-conresh-meeb |
Malicious release: Malicious code in strapi-plugin-feedmeeb (npm) MAL-2026-16230 | Malicious | Not scored | 16 Sep, 2026 | npm strapi-plugin-feedmeeb |
Malicious release: Malicious code in strapi-plugin-portcc-meeb (npm) MAL-2026-16238 | Malicious | Not scored | 16 Sep, 2026 | npm strapi-plugin-portcc-meeb |
Malicious release: Malicious code in strapi-plugin-maylog-meeb (npm) MAL-2026-16233 | Malicious | Not scored | 16 Sep, 2026 | npm strapi-plugin-maylog-meeb |
Malicious release: Malicious code in strapi-plugin-listcc-meeb (npm) MAL-2026-16232 | Malicious | Not scored | 16 Sep, 2026 | npm strapi-plugin-listcc-meeb |
fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses CVE-2026-92081, GHSA-4mh8-r7rc-xpvc | Medium | 0.4% | 16 Sep, 2026 | npm fastify |
Malicious release: Malicious code in process-mite (npm) MAL-2026-16224 | Malicious | Not scored | 16 Sep, 2026 | npm process-mite |
Malicious release: Malicious code in discord-resolvers (npm) GHSA-whmq-ffxc-4jpc, MAL-2026-16214 | Malicious | Not scored | 16 Sep, 2026 | npm discord-resolvers |
Malicious release: Malicious code in discord-players (npm) GHSA-mvg6-qj9g-3j3j, MAL-2026-16213 | Malicious | Not scored | 16 Sep, 2026 | npm discord-players |
Malicious release: Malicious code in tetomood (npm) MAL-2026-16216 | Malicious | Not scored | 16 Sep, 2026 | npm tetomood |