Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets CVE-2026-86472, GHSA-hrr3-gc8f-f4qj | Medium | 0.3% | 15 Sep, 2026 | npm fast-uri |
moment vulnerable to Path Traversal via crafted non-string locale name CVE-2026-17495, GHSA-4p3w-j4w9-5jqw | Medium | 0.5% | 15 Sep, 2026 | npm moment |
multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads CVE-2026-88932, GHSA-3pph-fpjx-jg34 | Medium | 0.5% | 14 Sep, 2026 | npm multer |
joi messages compilation allows prototype replacement through __proto__ error codes CVE-2026-90771, GHSA-wr44-6hxh-3jwq | Medium | 0.4% | 13 Sep, 2026 | npm joi |
morgan vulnerable to Log Injection via unescaped double quote in quoted log fields CVE-2026-87859, GHSA-9f6g-j8ch-79g4 | Medium | 0.4% | 11 Sep, 2026 | npm morgan |
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent` CVE-2026-88059, GHSA-p297-fm68-3q8c | Medium | 0.3% | 10 Sep, 2026 | npm @angular/common |
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler CVE-2026-88057, GHSA-hh8m-fm6v-7cvg | Medium | 0.4% | 10 Sep, 2026 | npm @angular/compiler npm @angular/core |
n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read CVE-2026-86995, GHSA-qgpw-8g46-w95v | Medium | 0.4% | 08 Sep, 2026 | npm n8n |
n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter CVE-2026-86994, GHSA-65xw-2v52-jhxc | Medium | 0.3% | 08 Sep, 2026 | npm n8n |
n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check CVE-2026-86993, GHSA-pq6c-vh67-xpm3 | Medium | 0.5% | 08 Sep, 2026 | npm n8n |
n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints CVE-2026-86085, GHSA-cqr2-h44g-v75v | Medium | 0.4% | 08 Sep, 2026 | npm n8n |
n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions CVE-2026-86084, GHSA-pf83-w3f9-8m37 | Medium | 0.5% | 08 Sep, 2026 | npm n8n |
n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open CVE-2026-86080, GHSA-5m98-cgcr-xx3q | Medium | 0.3% | 08 Sep, 2026 | npm n8n |
n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers CVE-2026-86079, GHSA-f2cp-m7mv-8jpv | Medium | 0.5% | 08 Sep, 2026 | npm n8n |
n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service CVE-2026-86078, GHSA-679f-58pq-4v2c | Medium | 0.6% | 08 Sep, 2026 | npm n8n |
n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket CVE-2026-86077, GHSA-35jj-42hp-8gmq | Medium | 0.4% | 08 Sep, 2026 | npm n8n |
n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy CVE-2026-86996, GHSA-7hgx-277f-7vmg | Medium | 0.3% | 08 Sep, 2026 | npm n8n |
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature CVE-2026-92595, GHSA-8m3c-c648-2xjj | Medium | 0.3% | 08 Sep, 2026 | npm nodemailer |
n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content CVE-2026-86074, GHSA-q5wm-mgqx-fv2f | Medium | 0.4% | 08 Sep, 2026 | npm n8n |
n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution CVE-2026-86073, GHSA-cw9w-vv67-hf73 | Medium | 0.4% | 08 Sep, 2026 | npm n8n |
Snowflake drivers writes sensitive information to logs CVE-2026-86597, GHSA-qqj6-54q6-cxv6, GO-2026-6665, PYSEC-2026-4301 | Medium | 0.1% | 08 Sep, 2026 | Go github.com/snowflakedb/gosnowflake Go github.com/snowflakedb/gosnowflake/v2 Maven net.snowflake:snowflake-jdbc Maven net.snowflake:snowflake-jdbc-fips +3 more |
undici vulnerable to Denial of Service via unbounded decompression of compressed responses CVE-2026-84890, GHSA-3xpg-4rpp-hhhm | Medium | 0.4% | 04 Sep, 2026 | npm undici |
undici vulnerable to Denial of Service via orphaned RetryHandler response body CVE-2026-18149, GHSA-pmjh-fq2x-6v4x | Medium | 0.5% | 04 Sep, 2026 | npm undici |
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression CVE-2026-85024, GHSA-3wwx-pv8p-q78v | Medium | 0.4% | 04 Sep, 2026 | npm undici |
undici vulnerable to caching and replay of unsafe HTTP method responses CVE-2026-85008, GHSA-8436-99hf-9mmv | Medium | 0.1% | 04 Sep, 2026 | npm undici |
undici vulnerable to response truncation via oversized chunked responses in the dump interceptor CVE-2026-84947, GHSA-2gqq-gqf2-x968 | Medium | 0.2% | 04 Sep, 2026 | npm undici |
node-csv: Prototype replacement still reachable via columns path CVE-2026-85063, GHSA-8cw4-87c7-c6xx | Medium | 0.6% | 03 Sep, 2026 | npm csv-parse |
Colord: Slow rejection of oversized malformed color strings CVE-2026-85062, GHSA-2wm5-q62r-hmrv | Medium | 0.5% | 03 Sep, 2026 | npm colord |
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS) CVE-2026-71429, GHSA-528h-pc64-c93x | Medium | 0.2% | 03 Sep, 2026 | npm stream-json |
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base CVE-2026-84376, GHSA-376h-93r7-7g6f | Medium | 0.7% | 02 Sep, 2026 | npm astro |
Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes GHSA-cp6q-959q-f8rh | Medium | Not scored | 02 Sep, 2026 | npm @tiptap/core |
humanfs: Recursive copy follows symlinked files and copies data from outside the source tree GHSA-p498-v437-472g | Medium | Not scored | 02 Sep, 2026 | npm @humanfs/node |
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock CVE-2026-84373, GHSA-82fw-gwwq-j7x9 | Medium | 0.5% | 01 Sep, 2026 | npm @vitest/mocker npm vitest |
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass CVE-2026-84371, GHSA-g8qq-57p8-ggw5 | Medium | 0.3% | 01 Sep, 2026 | npm sanitize-html |
SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements CVE-2026-84369, GHSA-4vpr-x523-8j87 | Medium | 0.4% | 01 Sep, 2026 | npm svgo |
Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory CVE-2026-84365, GHSA-gqvv-2mrq-wpjv | Medium | 0.4% | 01 Sep, 2026 | npm hono |
Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion CVE-2026-84364, GHSA-g6gw-c38x-mqfc | Medium | 0.5% | 01 Sep, 2026 | npm hono |
Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials CVE-2026-84363, GHSA-crvj-82cr-hjcx | Medium | 0.4% | 01 Sep, 2026 | npm hono |
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content CVE-2026-83611, GHSA-6h8r-xr42-gp59 | Medium | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization CVE-2026-83610, GHSA-6gmq-8vp8-gcm6 | Medium | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS GHSA-rgwj-5xj2-c3m3 | Medium | Not scored | 31 Aug, 2026 | npm mysql2 |
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking CVE-2026-81888, GHSA-fm3f-ch8h-qw8q | Medium | 0.2% | 31 Aug, 2026 | npm @hono/oauth-providers |
qs array-limit bypass via bracket-key comma parsing CVE-2026-82562, GHSA-x5fp-wj9c-mxmx | Medium | 0.5% | 30 Aug, 2026 | npm qs |
qs: Denial of Service via Attacker Controlled isBuffer CVE-2026-82417, GHSA-4mjr-xmp4-gh2g | Medium | 0.4% | 30 Aug, 2026 | npm qs |
MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets BIT-mariadb-2026-55855, BIT-mariadb-min-2026-55855, BIT-mysql-client-2026-55855, CVE-2026-55855, GHSA-g5xc-5w98-jfvm | Medium | 0.7% | 28 Aug, 2026 | npm mariadb |
MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials BIT-mariadb-2026-55854, BIT-mariadb-min-2026-55854, BIT-mysql-client-2026-55854, CVE-2026-55854, GHSA-42r5-vhpq-m858 | Medium | 0.4% | 28 Aug, 2026 | npm mariadb |
morgan vulnerable to Log Forging via unescaped Unicode line separators CVE-2026-15603, GHSA-jxfw-x594-9x9m | Medium | 0.4% | 28 Aug, 2026 | npm morgan |
libreoffice-convert vulnerable to path traversal / arbitrary file write CVE-2026-54732, GHSA-gmxc-r82q-347r | Medium | 0.4% | 27 Aug, 2026 | npm libreoffice-convert |
n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter) CVE-2026-54687, GHSA-q7m3-rhxg-7vxr | Medium | 0.8% | 27 Aug, 2026 | npm n8n-nodes-sqlite3 |
mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation) CVE-2026-55663, GHSA-p7x2-g5cq-fhmq | Medium | 0.2% | 25 Aug, 2026 | crates.io mediasoup npm mediasoup |