Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements CVE-2026-84369, GHSA-4vpr-x523-8j87 | Medium | 0.4% | 01 Sep, 2026 | npm svgo |
joi: Prototype pollution via a `__proto__` language key in custom messages CVE-2026-84368, GHSA-6w3j-5fw6-r9vr | Low | 0.4% | 01 Sep, 2026 | npm @hapi/joi npm joi |
joi: object().rename() with a template target can set the validated object's prototype CVE-2026-84367, GHSA-gg4h-3hg2-grpc | Low | 0.4% | 01 Sep, 2026 | npm joi |
Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory CVE-2026-84365, GHSA-gqvv-2mrq-wpjv | Medium | 0.4% | 01 Sep, 2026 | npm hono |
Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion CVE-2026-84364, GHSA-g6gw-c38x-mqfc | Medium | 0.5% | 01 Sep, 2026 | npm hono |
Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials CVE-2026-84363, GHSA-crvj-82cr-hjcx | Medium | 0.4% | 01 Sep, 2026 | npm hono |
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml CVE-2026-101043, GHSA-vx52-2968-3vc6 | High | 0.3% | 01 Sep, 2026 | npm pnpm |
pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project GHSA-2rx9-3g3h-c2jv | High | Not scored | 01 Sep, 2026 | npm pnpm |
Malicious release: Malicious code in order-package-saas (npm) MAL-2026-15816 | Malicious | Not scored | 01 Sep, 2026 | npm order-package-saas |
Malicious release: Malicious code in bt2-api-gateway-node-js (npm) MAL-2026-15813 | Malicious | Not scored | 01 Sep, 2026 | npm bt2-api-gateway-node-js |
MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials GHSA-3f6p-5ww8-9rcr | High | Not scored | 01 Sep, 2026 | npm mysql2 |
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser CVE-2026-83619, GHSA-x4fp-j954-r2f4 | High | 0.5% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator CVE-2026-83618, GHSA-vr34-hp96-76pp | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator CVE-2026-83617, GHSA-jxjr-3g7g-3944 | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed CVE-2026-83616, GHSA-c7q8-3ch8-vqpv | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: Quadratic-memory consumption CVE-2026-83615, GHSA-965w-775f-mr7g | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge CVE-2026-83614, GHSA-93r5-fhx6-vmg9 | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: Quadratic-time attribute deduplication CVE-2026-83613, GHSA-8344-3jmq-59r6 | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: HTML raw-text closing-tag case mismatch causes output amplification CVE-2026-83612, GHSA-6mj3-qw4j-hgrw | High | 0.5% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content CVE-2026-83611, GHSA-6h8r-xr42-gp59 | Medium | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization CVE-2026-83610, GHSA-6gmq-8vp8-gcm6 | Medium | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path CVE-2026-83609, GHSA-3px3-54cx-rmw9 | High | 0.5% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: DocType `name` Injection Bypasses requireWellFormed CVE-2026-83608, GHSA-27p8-2357-5qqv | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: Element name injection via createElement() bypasses requireWellFormed CVE-2026-83607, GHSA-w2rr-34g9-rvrj | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions CVE-2026-83606, GHSA-g53g-w8rj-fmg7 | High | 0.5% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed CVE-2026-83605, GHSA-4w3w-2rp5-g8jm | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
Malicious release: Malicious code in react-mongoose (npm) GHSA-wvgj-m2p9-jf3c, MAL-2026-15845 | Malicious | Not scored | 01 Sep, 2026 | npm react-mongoose |
Malicious release: Malicious code in @yane88/ripgrep-win (npm) GHSA-274r-44qv-6xwc, MAL-2026-15660 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/ripgrep-win |
Malicious release: Malicious code in @yane88/workbuddy-01 (npm) GHSA-2w3r-v82c-4rvg, MAL-2026-15665 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/workbuddy-01 |
Malicious release: Malicious code in @yane88/listary-01 (npm) GHSA-46j3-wfp2-66m2, MAL-2026-15658 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/listary-01 |
Malicious release: Malicious code in @yane88/workbuddy-02 (npm) GHSA-677c-x838-7qj5, MAL-2026-15666 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/workbuddy-02 |
Malicious release: Malicious code in @yane88/listary (npm) GHSA-6qjf-3c98-5gr7, MAL-2026-15657 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/listary |
Malicious release: Malicious code in @yane88/hexhub-client (npm) GHSA-75h3-gh74-47p2, MAL-2026-15649 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/hexhub-client |
Malicious release: Malicious code in @yane88/term-reqable-01 (npm) GHSA-m76v-4h4c-w693, MAL-2026-15662 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/term-reqable-01 |
Malicious release: Malicious code in @yane88/workbuddy-03 (npm) GHSA-qpjf-29xc-g688, MAL-2026-15667 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/workbuddy-03 |
Malicious release: Malicious code in @yane88/listary-02 (npm) GHSA-rg2v-g672-8773, MAL-2026-15659 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/listary-02 |
Malicious release: Malicious code in @yane88/workbuddy (npm) GHSA-v22h-4j6c-58cm, MAL-2026-15664 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/workbuddy |
Malicious release: Malicious code in @yane88/term-reqable-02 (npm) GHSA-vq2v-vw6h-9g9f, MAL-2026-15663 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/term-reqable-02 |
Malicious release: Malicious code in @yane88/term-reqable (npm) GHSA-xx48-j637-66x2, MAL-2026-15661 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/term-reqable |
Malicious release: Malicious code in @yane88/idea-2026.2-01 (npm) GHSA-2fmg-86jf-r56c, MAL-2026-15651 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/idea-2026.2-01 |
Malicious release: Malicious code in @yane88/idea-2026.2 (npm) GHSA-5qw7-3hqh-q33m, MAL-2026-15650 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/idea-2026.2 |
Malicious release: Malicious code in @yane88/idea-2026.2-02 (npm) GHSA-fgwh-qm8c-9mv8, MAL-2026-15652 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/idea-2026.2-02 |
Malicious release: Malicious code in @yane88/idea-2026.2-03 (npm) GHSA-fw5q-2vvv-w862, MAL-2026-15653 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/idea-2026.2-03 |
Malicious release: Malicious code in @yane88/idea-2026.2-06 (npm) GHSA-j62v-qq84-cr9v, MAL-2026-15656 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/idea-2026.2-06 |
Malicious release: Malicious code in @yane88/idea-2026.2-05 (npm) GHSA-mv54-8cx5-2fc9, MAL-2026-15655 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/idea-2026.2-05 |
Malicious release: Malicious code in @yane88/idea-2026.2-04 (npm) GHSA-xpjx-pwwq-qg46, MAL-2026-15654 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/idea-2026.2-04 |
Malicious release: Malicious code in matrix-by-lmx (npm) GHSA-jhgv-vh9h-q3r9, MAL-2026-15670 | Malicious | Not scored | 01 Sep, 2026 | npm matrix-by-lmx |
Malicious release: Malicious code in randomunblockedwebsite (npm) GHSA-5x4x-f7h5-6p47, MAL-2026-15672 | Malicious | Not scored | 01 Sep, 2026 | npm randomunblockedwebsite |
Malicious release: Malicious code in @fdr-mar/promos-types (npm) GHSA-gj3w-q938-w6m6, MAL-2026-15648 | Malicious | Not scored | 01 Sep, 2026 | npm @fdr-mar/promos-types |
Malicious release: Malicious code in kendo-angular-window (npm) GHSA-jjx4-p3qc-rhrq, MAL-2026-15669 | Malicious | Not scored | 01 Sep, 2026 | npm kendo-angular-window |