Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in cat-sis2go-utils (npm) MAL-2026-16071 | Malicious | Not scored | 09 Sep, 2026 | npm cat-sis2go-utils |
Malicious release: Malicious code in easypanel-deploy (npm) MAL-2026-16074 | Malicious | Not scored | 09 Sep, 2026 | npm easypanel-deploy |
Malicious release: Malicious code in easypanel-api-client (npm) MAL-2026-16073 | Malicious | Not scored | 09 Sep, 2026 | npm easypanel-api-client |
Malicious release: Malicious code in easypanel-hosting (npm) MAL-2026-16075 | Malicious | Not scored | 09 Sep, 2026 | npm easypanel-hosting |
Malicious release: Malicious code in @fyxzpediaa/baileys (npm) MAL-2026-16070 | Malicious | Not scored | 09 Sep, 2026 | npm @fyxzpediaa/baileys |
Malicious release: Malicious code in reactlogo-load (npm) MAL-2026-16069 | Malicious | Not scored | 09 Sep, 2026 | npm reactlogo-load |
Malicious release: Malicious code in @versacode/baileys (npm) GHSA-fw7g-gr3j-7wf7, MAL-2026-16068 | Malicious | Not scored | 09 Sep, 2026 | npm @versacode/baileys |
Malicious release: Malicious code in @vallensofficial/baileys (npm) GHSA-gg93-mm5f-23v8, MAL-2026-16067 | Malicious | Not scored | 09 Sep, 2026 | npm @vallensofficial/baileys |
Malicious release: Malicious code in @haimiya/baileys (npm) GHSA-q246-72rh-fp8w, MAL-2026-16066 | Malicious | Not scored | 09 Sep, 2026 | npm @haimiya/baileys |
Malicious release: Malicious code in @yongot/canary-mcp-isolation (npm) MAL-2026-16061 | Malicious | Not scored | 09 Sep, 2026 | npm @yongot/canary-mcp-isolation |
Malicious release: Malicious code in express-session-timer (npm) MAL-2026-16065 | Malicious | Not scored | 09 Sep, 2026 | npm express-session-timer |
Malicious release: Malicious code in bx-ui-view (npm) MAL-2026-16064 | Malicious | Not scored | 09 Sep, 2026 | npm bx-ui-view |
Malicious release: Malicious code in @yongot/canary-mcp-test (npm) MAL-2026-16062 | Malicious | Not scored | 09 Sep, 2026 | npm @yongot/canary-mcp-test |
Malicious release: Malicious code in alloy-graphql (npm) MAL-2026-16063 | Malicious | Not scored | 09 Sep, 2026 | npm alloy-graphql |
Malicious release: Malicious code in selfcerts (npm) MAL-2026-16060 | Malicious | Not scored | 09 Sep, 2026 | npm selfcerts |
Malicious release: Malicious code in rojo-rbx (npm) MAL-2026-16059 | Malicious | Not scored | 09 Sep, 2026 | npm rojo-rbx |
Malicious release: Malicious code in file-type-detector (npm) MAL-2026-16053 | Malicious | Not scored | 09 Sep, 2026 | npm file-type-detector |
Malicious release: Malicious code in gloggo (npm) MAL-2026-16054 | Malicious | Not scored | 09 Sep, 2026 | npm gloggo |
Malicious release: Malicious code in sonmors (npm) MAL-2026-16055 | Malicious | Not scored | 09 Sep, 2026 | npm sonmors |
Malicious release: Malicious code in vinzz-wcli (npm) MAL-2026-16058 | Malicious | Not scored | 08 Sep, 2026 | npm vinzz-wcli |
Malicious release: Malicious code in toru-ultimate (npm) MAL-2026-16057 | Malicious | Not scored | 08 Sep, 2026 | npm toru-ultimate |
Malicious release: Malicious code in tailwind-aspect-styles (npm) MAL-2026-16056 | Malicious | Not scored | 08 Sep, 2026 | npm tailwind-aspect-styles |
n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read CVE-2026-86995, GHSA-qgpw-8g46-w95v | Medium | 0.4% | 08 Sep, 2026 | npm n8n |
n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter CVE-2026-86994, GHSA-65xw-2v52-jhxc | Medium | 0.3% | 08 Sep, 2026 | npm n8n |
n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check CVE-2026-86993, GHSA-pq6c-vh67-xpm3 | Medium | 0.5% | 08 Sep, 2026 | npm n8n |
n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints CVE-2026-86085, GHSA-cqr2-h44g-v75v | Medium | 0.4% | 08 Sep, 2026 | npm n8n |
n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions CVE-2026-86084, GHSA-pf83-w3f9-8m37 | Medium | 0.5% | 08 Sep, 2026 | npm n8n |
n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution CVE-2026-86083, GHSA-6xcw-7xm6-48c6 | High | 0.7% | 08 Sep, 2026 | npm n8n |
n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node CVE-2026-86082, GHSA-34ff-336r-5q23 | High | 0.4% | 08 Sep, 2026 | npm n8n |
n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path CVE-2026-86081, GHSA-j535-v25q-vx3q | High | 0.6% | 08 Sep, 2026 | npm n8n |
n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open CVE-2026-86080, GHSA-5m98-cgcr-xx3q | Medium | 0.3% | 08 Sep, 2026 | npm n8n |
n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers CVE-2026-86079, GHSA-f2cp-m7mv-8jpv | Medium | 0.5% | 08 Sep, 2026 | npm n8n |
n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service CVE-2026-86078, GHSA-679f-58pq-4v2c | Medium | 0.6% | 08 Sep, 2026 | npm n8n |
n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket CVE-2026-86077, GHSA-35jj-42hp-8gmq | Medium | 0.4% | 08 Sep, 2026 | npm n8n |
n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution CVE-2026-86076, GHSA-hw8v-xxg5-vvvx | High | 0.8% | 08 Sep, 2026 | npm n8n |
n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint CVE-2026-86075, GHSA-hh89-3r9w-qj3j | High | 0.6% | 08 Sep, 2026 | npm n8n |
Malicious release: Malicious code in open-item-validator (npm) GHSA-55qh-42r8-hcgq, MAL-2026-16052 | Malicious | Not scored | 08 Sep, 2026 | npm open-item-validator |
n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy CVE-2026-86996, GHSA-7hgx-277f-7vmg | Medium | 0.3% | 08 Sep, 2026 | npm n8n |
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain CVE-2026-92598, GHSA-wmmp-3585-3rmp | High | 0.4% | 08 Sep, 2026 | npm nodemailer |
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list CVE-2026-92596, GHSA-2x7j-588g-ccc2 | High | 0.8% | 08 Sep, 2026 | npm nodemailer |
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain CVE-2026-92597, GHSA-cc9r-2j5m-2m83 | High | 0.4% | 08 Sep, 2026 | npm nodemailer |
OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree GHSA-2q42-4q24-7rgv | High | Not scored | 08 Sep, 2026 | npm @typespec/compiler npm @typespec/openapi3 |
Astro: Remote code execution through AVIF image optimization GHSA-26w7-cxv4-gfx2 | Critical | Not scored | 08 Sep, 2026 | npm astro |
sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 CVE-2026-114112, GHSA-rgj7-g3m4-5g8c | High | 0.2% | 08 Sep, 2026 | npm sharp |
Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing GHSA-j95f-988m-3j2f | High | Not scored | 08 Sep, 2026 | npm @tiptap/core |
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used GHSA-2xp9-vwfh-vxw4 | Critical | Not scored | 08 Sep, 2026 | npm next |
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature CVE-2026-92595, GHSA-8m3c-c648-2xjj | Medium | 0.3% | 08 Sep, 2026 | npm nodemailer |
Malicious release: Malicious code in @aspect-adv-ui/consent-manager (npm) MAL-2026-16050 | Malicious | Not scored | 08 Sep, 2026 | npm @aspect-adv-ui/consent-manager |
Malicious release: Malicious code in @umschool/analytics (npm) MAL-2026-16051 | Malicious | Not scored | 08 Sep, 2026 | npm @umschool/analytics |
Malicious release: Malicious code in tailwindcss-aspectratio-styles (npm) MAL-2026-16049 | Malicious | Not scored | 08 Sep, 2026 | npm tailwindcss-aspectratio-styles |