Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
@bytebase/dbhub's read-only mode does not prevent database writes CVE-2026-61788, GHSA-mwwr-p57h-56pf | High | 0.4% | 24 Sep, 2026 | npm @bytebase/dbhub |
@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata CVE-2026-61782, GHSA-jmg2-rcxh-w8q3 | High | 0.4% | 24 Sep, 2026 | npm @rsdoctor/rspack-plugin |
`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction CVE-2026-56744, GHSA-36f9-7rg5-cpf8 | High | 0.4% | 24 Sep, 2026 | npm @bsv/wallet-toolbox npm @bsv/wallet-toolbox-client npm @bsv/wallet-toolbox-mobile |
OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget CVE-2026-77394, GHSA-gvf2-2rh5-mpgf | High | 0.4% | 23 Sep, 2026 | npm @openc3/vue-common |
ReactPress has SQL injection via dynamic column names in TypeORM query builders CVE-2026-61685, GHSA-wmw4-mw6x-6vfm | High | 0.5% | 22 Sep, 2026 | npm @fecommunity/reactpress |
Unleash: Missing await on permission check + cross-project IDOR in admin API CVE-2026-77426, GHSA-72h8-wp98-7hch | High | 0.5% | 22 Sep, 2026 | npm unleash-server |
request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process CVE-2026-62985, GHSA-r3r9-wp5j-pq5g | High | 0.6% | 22 Sep, 2026 | npm request-filtering-agent |
9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header CVE-2026-56681, GHSA-5mj8-gf6m-fhw8 | High | 1.1% | 22 Sep, 2026 | npm 9router |
@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory CVE-2026-61647, GHSA-jjhp-8crj-mppq | High | 0.4% | 21 Sep, 2026 | npm @roomi-fields/notebooklm-mcp |
Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token` CVE-2026-58269, GHSA-92cr-jxw4-5wjg | High | 0.3% | 21 Sep, 2026 | npm @sync-in/server |
deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes CVE-2026-63116, GHSA-89vx-jh4q-vg3w | High | 0.5% | 21 Sep, 2026 | npm @deepstream/server |
devalue: `stringify`/`uneval` serialize shared memory CVE-2026-92708, GHSA-j22f-vq7h-c4qm | High | 0.7% | 18 Sep, 2026 | npm devalue |
deepmerge mergeObject() allows prototype poisoning of returned objects CVE-2026-93753, GHSA-gcqx-w48m-w2h4 | High | 0.5% | 18 Sep, 2026 | npm deepmerge |
source-map-js allows event-loop denial of service through indexed source-map section offsets CVE-2026-93749, GHSA-68fv-2mgg-jv7q | High | 0.5% | 18 Sep, 2026 | npm source-map-js |
Withdrawn Advisory: http-cache-semantics max-stale handling can disclose cross-user cached responses CVE-2026-93748, GHSA-ch52-4w7c-c8xp | High | 0.6% | 18 Sep, 2026 | npm http-cache-semantics |
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer CVE-2026-91127, GHSA-3753-m2x2-q623 | High | 0.4% | 18 Sep, 2026 | npm @file-viewer/doc npm msdoc-viewer |
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS) CVE-2026-77301, GHSA-7q85-xj36-vmfc | High | 0.6% | 18 Sep, 2026 | npm adm-zip |
Withdrawn Advisory: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns CVE-2026-93687, GHSA-vfj7-8cjw-p6xm | High | 0.8% | 18 Sep, 2026 | npm braces |
Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text CVE-2026-77615, GHSA-m6c8-jcw2-5r25 | High | 0.6% | 17 Sep, 2026 | Maven org.opencastproject:opencast-engage-paella-player-7 npm paella-core |
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses CVE-2026-86039, GHSA-vrf4-mx87-p53w | High | 0.3% | 17 Sep, 2026 | npm @libp2p/peer-store |
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID CVE-2026-86038, GHSA-c3gv-825q-fvmp | High | 0.2% | 17 Sep, 2026 | npm @libp2p/gossipsub |
ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion CVE-2026-85715, GHSA-pj96-35fp-cfcc | High | 0.6% | 17 Sep, 2026 | npm exifreader |
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows CVE-2026-71538, GHSA-q69g-4hcv-6jg4 | High | 0.2% | 17 Sep, 2026 | npm @cyclonedx/cyclonedx-npm |
Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends CVE-2026-63460, GHSA-jgm3-qmp2-c4p7 | High | 0.6% | 17 Sep, 2026 | npm @vendure/core |
Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions CVE-2026-63459, GHSA-xhq9-whgq-49j5 | High | 0.4% | 17 Sep, 2026 | npm @vendure/dashboard |
vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM CVE-2026-92959, GHSA-f8gf-w286-fmq2 | High | 0.4% | 17 Sep, 2026 | npm vm2 |
vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes CVE-2026-92958, GHSA-6rh5-qq4q-97xh | High | 0.4% | 17 Sep, 2026 | npm vm2 |
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks CVE-2026-92952, GHSA-jf8q-945g-9q4c | High | 0.5% | 17 Sep, 2026 | npm vm2 |
vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block) CVE-2026-92942, GHSA-r4fx-v8hh-22mv | High | 0.5% | 17 Sep, 2026 | npm vm2 |
joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()` CVE-2026-92599, GHSA-6h2x-m376-mqjq | High | 0.6% | 16 Sep, 2026 | npm joi |
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site CVE-2026-63506, GHSA-g74q-6g2f-874x | High | 0.5% | 16 Sep, 2026 | npm @tinacms/auth npm next-tinacms-azure |
node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion CVE-2026-68904, GHSA-r2pf-9cw4-5j65 | High | 0.4% | 16 Sep, 2026 | npm node-opcua npm node-opcua-client npm node-opcua-transport |
@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration CVE-2026-63671, GHSA-mxm6-v9r6-r94c | High | 0.5% | 16 Sep, 2026 | npm @nuxtjs/mdc |
adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0 CVE-2026-92000, GHSA-rcw4-f5rp-g42v | High | 0.7% | 15 Sep, 2026 | npm adm-zip |
@zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS GHSA-5648-rgj9-v224 | High | Not scored | 15 Sep, 2026 | npm @zereight/mcp-gitlab |
Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser) CVE-2026-90776, GHSA-prgh-xp8r-p3m5 | High | 0.7% | 13 Sep, 2026 | npm nodemailer |
FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix CVE-2026-59973, GHSA-65h7-9wrw-629c | High | 0.4% | 11 Sep, 2026 | npm @frontmcp/adapters npm frontmcp npm mcp-from-openapi |
compression vulnerable to Denial of Service via memory leak on premature response close CVE-2026-87776, GHSA-vc2v-76pw-4v95 | High | 0.5% | 11 Sep, 2026 | npm compression |
@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission CVE-2026-59965, GHSA-4qpv-39hg-f7fx | High | 0.4% | 10 Sep, 2026 | npm @jhb.software/payload-alt-text-plugin |
@argos-ci/core: CI Branch Name OS Command Injection CVE-2026-59960, GHSA-4x45-gxvp-6283 | High | 0.6% | 10 Sep, 2026 | npm @argos-ci/core |
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVE-2026-88060, GHSA-v3p8-whq6-r5jg | High | 0.4% | 10 Sep, 2026 | npm @angular/platform-server |
Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVE-2026-88058, GHSA-j3r3-mxqp-r2p4 | High | 0.3% | 10 Sep, 2026 | npm @angular/platform-server |
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVE-2026-88056, GHSA-f6mr-pjwc-34m4 | High | 0.5% | 10 Sep, 2026 | npm @angular/platform-server |
@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name GHSA-x7m8-jrm8-hpvx | High | Not scored | 10 Sep, 2026 | npm @eigenpal/docx-editor-core npm @eigenpal/docx-editor-react |
@openhop/server: Path Traversal in Flow ID File Operations CVE-2026-59179, GHSA-g72f-jw3w-mgh7 | High | 0.4% | 09 Sep, 2026 | npm @openhop/server |
functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import CVE-2026-59176, GHSA-wcjj-9m6g-2fr2 | High | 0.2% | 09 Sep, 2026 | npm functype-mcp-server |
@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run CVE-2026-59160, GHSA-2r5q-h53f-9rp3 | High | 0.5% | 09 Sep, 2026 | npm @yeger/turbo-graph |
Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients CVE-2026-59158, GHSA-fxg7-897c-57mp | High | 0.5% | 09 Sep, 2026 | npm nuxt-ollama |
n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution CVE-2026-86083, GHSA-6xcw-7xm6-48c6 | High | 0.7% | 08 Sep, 2026 | npm n8n |
n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node CVE-2026-86082, GHSA-34ff-336r-5q23 | High | 0.4% | 08 Sep, 2026 | npm n8n |