Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Ghost: Remote Code Execution via Bookmark Card Images BIT-ghost-2026-105642, CVE-2026-105642, GHSA-788w-68h3-cvxp | High | 0.3% | 25 days ago | npm ghost |
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control CVE-2026-104891, GHSA-jg6q-3qfh-r9f8 | High | 0.3% | 25 days ago | npm @insumermodel/mppx-condition-gate npm @insumermodel/mppx-token-gate |
Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name CVE-2026-114081, GHSA-9q4r-4842-93vw | High | 0.4% | 28 days ago | npm trigger.dev |
Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR) GHSA-pp95-gc86-jq6q | High | Not scored | 28 days ago | npm trigger.dev |
probe-image-size: Quadratic-time Denial of Service in the SVG Parser CVE-2026-104861, GHSA-gjj5-9665-rwrc | High | 0.4% | 28 days ago | npm probe-image-size |
@nx/docker: OS command injection in the @nx/docker release pipeline CVE-2026-104859, GHSA-6vc5-vf29-ffr2 | High | 0.1% | 28 days ago | npm @nx/docker |
Nx daemon and plugin worker sockets are accessible to other local users CVE-2026-104854, GHSA-w3vv-58gj-gw77 | High | 0.1% | 28 days ago | npm nx |
Next.js has Server-Side Request Forgery in Image Optimization CVE-2026-94483, GHSA-cjq9-62q9-8jv4 | High | 0.3% | 28 days ago | npm next |
ProseMirror has a XSS vulnerability in prosemirror-view's paste handling CVE-2026-104847, GHSA-c8x8-7fp4-3x9w | High | 0.3% | 28 days ago | npm prosemirror-view |
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization CVE-2026-104845, GHSA-jp82-f5mq-hwhp | High | 0.4% | 28 days ago | npm seroval |
figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width CVE-2026-96780, GHSA-62ch-8vmq-8xm7 | High | 0.5% | 29 days ago | npm figlet |
Zod can exhaust memory while validating oversized constrained collections CVE-2023-54404, GHSA-mrhx-c7xc-m3w5 | High | 0.3% | 29 days ago | npm zod |
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor CVE-2026-103921, GHSA-6fw5-9hq8-w87g | High | 0.3% | 29 days ago | npm @graphql-tools/executor-legacy-ws |
devalue: Repeated primitive strings cause quadratic expansion in uneval GHSA-mcm9-63f2-9j32 | High | Not scored | 29 days ago | npm devalue |
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation GHSA-r9w8-h9r3-54w4 | High | Not scored | 29 days ago | npm devalue |
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise GHSA-x5rw-q4pp-hg5g | High | Not scored | 29 days ago | npm devalue |
Ghost: Authorization Bypass in Comment Like Feature BIT-ghost-2026-103288, CVE-2026-103288, GHSA-qrh6-cwg3-343x | High | 0.2% | 29 days ago | npm ghost |
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) CVE-2026-102990, GHSA-c475-qrg2-pj4r | High | 0.4% | 30 Sep, 2026 | npm basic-ftp |
Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters CVE-2026-101896, GHSA-ff3f-86qr-9cv3 | High | 0.8% | 30 Sep, 2026 | npm @angular/router |
Astro: Malformed port in the Host header can crash the Node adapter CVE-2026-102984, GHSA-qh8j-hqjv-7m4x | High | 0.4% | 30 Sep, 2026 | npm @astrojs/node |
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets GHSA-9c5c-9qcx-q35q | High | Not scored | 30 Sep, 2026 | npm @nestjs/platform-fastify |
Socket.IO: Engine.IO Protocol Revision Mismatch DoS CVE-2026-102599, GHSA-2gc4-cqfq-p2gv | High | 0.6% | 29 Sep, 2026 | npm engine.io |
adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content CVE-2026-114104, GHSA-p634-w6r4-rjp2 | High | 0.3% | 29 Sep, 2026 | npm adm-zip |
adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS) CVE-2026-114102, GHSA-8238-w5pm-2374 | High | 0.5% | 29 Sep, 2026 | npm adm-zip |
simple-git allows command execution through unblocked Git configuration includes CVE-2026-102826, GHSA-g4wm-2vf7-vfgr | High | 0.5% | 29 Sep, 2026 | npm simple-git |
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation CVE-2026-102282, GHSA-j5f4-cc29-5x44 | High | 0.2% | 29 Sep, 2026 | npm adm-zip |
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer CVE-2026-102677, GHSA-qmv3-fv6v-rmhq | High | 0.1% | 29 Sep, 2026 | npm electron |
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled CVE-2026-102675, GHSA-j84w-jfhq-vhvj | High | 0.2% | 29 Sep, 2026 | npm electron |
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions CVE-2026-102674, GHSA-gr2m-v5gq-v685 | High | 0.2% | 29 Sep, 2026 | npm electron |
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab CVE-2026-102673, GHSA-hq2x-r82h-9wj4 | High | 0.1% | 29 Sep, 2026 | npm electron |
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup CVE-2026-102600, GHSA-wfpm-5gcm-94cg | High | 0.4% | 29 Sep, 2026 | npm @socket.io/cluster-engine |
Nest: Remote process termination via a deeply nested microservice message pattern CVE-2026-102281, GHSA-m8vh-jmq9-5rjg | High | 0.6% | 28 Sep, 2026 | npm @nestjs/microservices |
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE CVE-2026-101895, GHSA-f67j-2jqw-jpq7 | High | 0.9% | 28 Sep, 2026 | npm @angular/platform-server |
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion CVE-2026-102278, GHSA-qhr7-859c-m2p7 | High | 0.5% | 28 Sep, 2026 | npm brace-expansion |
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion CVE-2026-102276, GHSA-6j4f-fj2g-mc7p | High | 0.5% | 28 Sep, 2026 | npm brace-expansion |
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized CVE-2026-101916, GHSA-m9gg-hp2v-232j | High | 0.2% | 28 Sep, 2026 | npm @grpc/grpc-js |
Axios: Prototype Pollution Gadget in axios toFormData Options CVE-2026-101909, GHSA-x97p-jq2g-jp4f | High | 0.5% | 28 Sep, 2026 | npm axios |
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF CVE-2026-101907, GHSA-r4gj-5m52-g5wh | High | 0.5% | 28 Sep, 2026 | npm axios |
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location CVE-2026-101906, GHSA-mghh-pgcx-3jjj | High | 0.5% | 28 Sep, 2026 | npm axios |
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection CVE-2026-101905, GHSA-m8m8-qj5v-23w3 | High | 0.4% | 28 Sep, 2026 | npm axios |
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) CVE-2026-101903, GHSA-c29m-xwm3-cm6r | High | 0.4% | 28 Sep, 2026 | npm axios |
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization CVE-2026-101901, GHSA-542g-h47m-68v8 | High | 0.5% | 28 Sep, 2026 | npm axios |
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls CVE-2026-101898, GHSA-3pq3-5fj3-cg6v | High | 0.5% | 28 Sep, 2026 | npm axios |
code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78) GHSA-456v-xq2p-r4cj | High | Not scored | 28 Sep, 2026 | npm code-ollama |
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process CVE-2026-100722, GHSA-2v2p-6j97-cjg9 | High | 0.3% | 27 Sep, 2026 | npm vm2 |
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS CVE-2026-100702, GHSA-8vvx-rff5-p5rq | High | 0.3% | 26 Sep, 2026 | npm nodemailer |
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service CVE-2026-100700, GHSA-v53p-9fqp-m79j | High | 0.3% | 26 Sep, 2026 | npm nodemailer |
OpenClaw: Channel read actions could skip target allowlists CVE-2026-100582, GHSA-g7fw-3gjp-g5hf | High | 0.2% | 26 Sep, 2026 | npm @openclaw/feishu npm @openclaw/googlechat npm @openclaw/matrix npm @openclaw/msteams |
Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token CVE-2026-57449, GHSA-m62c-5q34-f3cf | High | 0.3% | 25 Sep, 2026 | npm @actual-app/sync-server |
OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet GHSA-29h2-jr22-frmh | High | Not scored | 25 Sep, 2026 | npm @openzeppelin/confidential-contracts |