Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body CVE-2026-111181, GHSA-27r3-jxmh-p828 | High | 0.4% | 7 days ago | npm body-parser |
Malicious release: Malicious code in net-codec-testmetest (npm) MAL-2026-18186 | Malicious | Not scored | 8 days ago | npm net-codec-testmetest |
Malicious release: Malicious code in log-rotate-testmetest (npm) MAL-2026-18185 | Malicious | Not scored | 8 days ago | npm log-rotate-testmetest |
Malicious release: Malicious code in formatting-subtitles (npm) MAL-2026-18184 | Malicious | Not scored | 8 days ago | npm formatting-subtitles |
Malicious release: Malicious code in @conduitops/logview-archive (npm) MAL-2026-18183 | Malicious | Not scored | 8 days ago | npm @conduitops/logview-archive |
Malicious release: Malicious code in simplewave (npm) MAL-2026-18187 | Malicious | Not scored | 8 days ago | npm simplewave |
Malicious release: Malicious code in @sudobility/testomniac_client (npm) GHSA-g7cj-274j-rxqw, MAL-2026-18129 | Malicious | Not scored | 8 days ago | npm @sudobility/testomniac_client |
Malicious release: Malicious code in @sudobility/indexer_client (npm) GHSA-xfvr-39v2-q24q, MAL-2026-18127 | Malicious | Not scored | 8 days ago | npm @sudobility/indexer_client |
Malicious release: Malicious code in @sudobility/wildduck_client (npm) GHSA-5ff7-5w72-hm63, MAL-2026-18130 | Malicious | Not scored | 8 days ago | npm @sudobility/wildduck_client |
Malicious release: Malicious code in @sudobility/shaperouter_client (npm) GHSA-x7g4-jh5c-33xr, MAL-2026-18128 | Malicious | Not scored | 8 days ago | npm @sudobility/shaperouter_client |
Malicious release: Malicious code in @worrisome/aaaa (npm) GHSA-fxf3-w84v-3v6g, MAL-2026-18125 | Malicious | Not scored | 8 days ago | npm @worrisome/aaaa |
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse() CVE-2026-114144, GHSA-9qmh-m7c6-f92p | High | 0.4% | 8 days ago | npm toml |
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse() CVE-2026-114143, GHSA-9j65-hcg3-gc64 | High | 0.5% | 8 days ago | npm toml |
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype CVE-2026-114142, GHSA-h895-cgqg-jf52 | High | 0.4% | 8 days ago | npm tome npm toml |
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse() CVE-2026-114141, GHSA-4qx8-w7c3-pj3p | High | 0.4% | 8 days ago | npm toml |
Sentry-Javascript: Middleware Bypass when using Tunnel route CVE-2026-114139, GHSA-mchm-gjx6-7h55 | Critical | 0.5% | 8 days ago | npm @sentry/nextjs |
Nuxt server islands render `useHeadSafe` input without sanitisation CVE-2026-114133, GHSA-xfq5-w38q-pc2x | Medium | 0.2% | 8 days ago | npm nuxt |
Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive CVE-2026-114132, GHSA-vjh5-4x84-xrqp | Medium | 0.4% | 8 days ago | npm @nuxt/nitro-server npm nuxt |
Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes CVE-2026-114131, GHSA-6gq8-jgmh-3ffp | Medium | 0.4% | 8 days ago | npm nuxt |
Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled CVE-2026-114130, GHSA-jjm6-p2m9-9w4x | Low | 0.4% | 8 days ago | npm nuxt |
stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service CVE-2026-114129, GHSA-jj87-hc4r-jwfw | Medium | 0.3% | 8 days ago | npm stream-json |
Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering CVE-2026-114128, GHSA-98hj-9722-w3j8 | Medium | 0.3% | 8 days ago | npm astro |
Astro: Arbitrary CSS injection in Astro View Transitions CVE-2026-114127, GHSA-mpr7-6m5w-76rw | Low | 0.4% | 8 days ago | npm astro |
Storybook dev server vulnerable to code injection from the local network CVE-2026-114126, GHSA-px85-f4q5-jh77 | High | 0.5% | 8 days ago | npm @storybook/addon-mcp npm @storybook/addon-vitest npm @storybook/core npm @storybook/core-server +2 more |
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry CVE-2026-114124, GHSA-h3v5-h239-pg29 | Low | 0.2% | 8 days ago | npm electron |
Malicious release: Malicious code in pixel-map-testmetest (npm) MAL-2026-18180 | Malicious | Not scored | 8 days ago | npm pixel-map-testmetest |
Malicious release: Malicious code in test-brotli-testmetest (npm) MAL-2026-18181 | Malicious | Not scored | 8 days ago | npm test-brotli-testmetest |
Malicious release: Malicious code in test-brotli2-testmetest (npm) MAL-2026-18182 | Malicious | Not scored | 8 days ago | npm test-brotli2-testmetest |
Malicious release: Malicious code in log-sink-testmetest (npm) MAL-2026-18179 | Malicious | Not scored | 8 days ago | npm log-sink-testmetest |
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites CVE-2026-114125, GHSA-f2ph-cmg5-wxc8 | Critical | 0.4% | 8 days ago | npm @storybook/addon-mcp npm @storybook/addon-vitest npm @storybook/core npm @storybook/core-server +2 more |
Electron: Frame subscription trusts GPU-supplied frame geometry CVE-2026-114122, GHSA-3qxv-5xgr-q7w9 | Low | 0.2% | 8 days ago | npm electron |
Electron: openExternal permission requests can be attributed to the wrong origin CVE-2026-114121, GHSA-997q-gvvc-jwmx | Medium | 0.2% | 8 days ago | npm electron |
Electron: HID and USB permission checks can be attributed to the wrong origin CVE-2026-113800, GHSA-fw47-9c62-h3vw | Medium | 0.2% | 8 days ago | npm electron |
Electron: Pointer lock permission requests can be attributed to the wrong frame CVE-2026-113798, GHSA-x562-297c-g43g | Medium | 0.2% | 8 days ago | npm electron |
Electron: Extension tabs.query returns tab URLs and titles without the tabs permission CVE-2026-113797, GHSA-98mx-cjp9-gchm | Low | 0.6% | 8 days ago | npm electron |
Electron: SameSite cookie restrictions are not applied to windows opened from links CVE-2026-113796, GHSA-2p8c-gr87-2676 | Medium | 0.2% | 8 days ago | npm electron |
Malicious release: Malicious code in data-pipeline-testmetest (npm) MAL-2026-18177 | Malicious | Not scored | 8 days ago | npm data-pipeline-testmetest |
Malicious release: Malicious code in event-emitter-testmetest (npm) MAL-2026-18178 | Malicious | Not scored | 8 days ago | npm event-emitter-testmetest |
Malicious release: Malicious code in peptide-modify (npm) GHSA-h643-5mcg-c726, MAL-2026-18123 | Malicious | Not scored | 8 days ago | npm peptide-modify |
Malicious release: Malicious code in my-auto-follow-eltio (npm) GHSA-xw7m-xxch-j3hp, MAL-2026-18121 | Malicious | Not scored | 9 days ago | npm my-auto-follow-eltio |
Malicious release: Malicious code in @alannxd/baileys (npm) GHSA-7345-fjw8-x55w, MAL-2026-18120 | Malicious | Not scored | 9 days ago | npm @alannxd/baileys |
SvelteKit : XSS via untrusted cache-control header in prerendered page CVE-2026-114061, GHSA-27mw-82g8-phjj | Low | 0.2% | 9 days ago | npm @sveltejs/kit |
SvelteKit: URL redirection to untrusted site via enhanced form submission CVE-2026-114060, GHSA-pfhg-q3qv-9q6r | Low | 0.2% | 9 days ago | npm @sveltejs/kit |
Malicious release: Malicious code in tellyo-colours (npm) GHSA-4q6x-w65x-677r, MAL-2026-18115 | Malicious | Not scored | 9 days ago | npm tellyo-colours |
@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035) CVE-2026-111753, GHSA-jfgx-762w-99vr | Medium | Not scored | 9 days ago | npm @angular/common |
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) CVE-2026-111758, GHSA-gfr2-rv44-r23c | High | 0.5% | 9 days ago | npm markdown-it |
MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another CVE-2026-111770, GHSA-jm63-cq47-j5jp | High | Not scored | 9 days ago | npm @modelcontextprotocol/server |
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation CVE-2026-111768, GHSA-46jr-4wx8-v453 | High | Not scored | 9 days ago | npm @modelcontextprotocol/sdk npm @modelcontextprotocol/server |
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service CVE-2026-111771, GHSA-rvq5-wwqv-78pq | Medium | Not scored | 9 days ago | npm @modelcontextprotocol/express npm @modelcontextprotocol/sdk npm @modelcontextprotocol/server npm @modelcontextprotocol/server-legacy |
Malicious release: Malicious code in @securihackbot/depconf-stage-1792484738 (npm) MAL-2026-18105 | Malicious | Not scored | 9 days ago | npm @securihackbot/depconf-stage-1792484738 |