Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path CVE-2026-86081, GHSA-j535-v25q-vx3q | High | 0.6% | 08 Sep, 2026 | npm n8n |
n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution CVE-2026-86076, GHSA-hw8v-xxg5-vvvx | High | 0.8% | 08 Sep, 2026 | npm n8n |
n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint CVE-2026-86075, GHSA-hh89-3r9w-qj3j | High | 0.6% | 08 Sep, 2026 | npm n8n |
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain CVE-2026-92598, GHSA-wmmp-3585-3rmp | High | 0.4% | 08 Sep, 2026 | npm nodemailer |
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list CVE-2026-92596, GHSA-2x7j-588g-ccc2 | High | 0.8% | 08 Sep, 2026 | npm nodemailer |
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain CVE-2026-92597, GHSA-cc9r-2j5m-2m83 | High | 0.4% | 08 Sep, 2026 | npm nodemailer |
OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree GHSA-2q42-4q24-7rgv | High | Not scored | 08 Sep, 2026 | npm @typespec/compiler npm @typespec/openapi3 |
sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 CVE-2026-114112, GHSA-rgj7-g3m4-5g8c | High | 0.2% | 08 Sep, 2026 | npm sharp |
Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing GHSA-j95f-988m-3j2f | High | Not scored | 08 Sep, 2026 | npm @tiptap/core |
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json CVE-2026-86540, GHSA-mc52-mwq4-vfx3 | High | 0.2% | 07 Sep, 2026 | npm knowns |
Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools CVE-2026-86439, GHSA-9gfj-28hw-jchp | High | 1.1% | 07 Sep, 2026 | npm knowns |
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop GHSA-7q9c-hpx7-9cwm | High | Not scored | 04 Sep, 2026 | npm @typespec/spector |
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol CVE-2026-19534, GHSA-rfgv-xxqx-mfg5 | High | 0.4% | 04 Sep, 2026 | npm undici |
undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors CVE-2026-85152, GHSA-vp8m-p9jh-q5pm | High | 0.2% | 04 Sep, 2026 | npm undici |
undici vulnerable to Denial of Service via WebSocketStream unclean close CVE-2026-85014, GHSA-rx4f-c7p8-82vq | High | 0.4% | 04 Sep, 2026 | npm undici |
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches CVE-2026-84933, GHSA-2jfj-6hjv-fm6j | High | 0.3% | 04 Sep, 2026 | npm undici |
smol-toml: Denial of Service via malformed TOML documents CVE-2026-85730, GHSA-7w5x-hrqm-74c2 | High | 0.5% | 04 Sep, 2026 | npm smol-toml |
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write) CVE-2026-85651, GHSA-qxpp-qjg8-x4jv | High | 0.5% | 04 Sep, 2026 | npm trigger.dev |
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL CVE-2026-85650, GHSA-xxv7-2vv3-h682 | High | 0.3% | 04 Sep, 2026 | npm trigger.dev |
fastify vulnerable to header validation bypass via incomplete schema case normalization CVE-2026-84428, GHSA-9q9j-q6p8-xq58 | High | 0.5% | 04 Sep, 2026 | npm fastify |
fastify vulnerable to request body replacement via an async validation result collision CVE-2026-84504, GHSA-667r-xxjv-c9mm | High | 0.4% | 04 Sep, 2026 | npm fastify |
fastify vulnerable to request validation bypass via skipped boolean false schemas CVE-2026-84469, GHSA-hwr6-493r-vm6h | High | 0.5% | 04 Sep, 2026 | npm fastify |
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers CVE-2026-76169, GHSA-p68q-wchp-6fh7 | High | 0.5% | 04 Sep, 2026 | npm fastify |
toml-node: Uncontrolled Recursion CVE-2026-77465, GHSA-82x6-q7mm-w9cf | High | 0.6% | 03 Sep, 2026 | npm toml |
toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization CVE-2026-63376, GHSA-v5mp-jgw5-2x6j | High | 0.7% | 03 Sep, 2026 | npm toml |
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority CVE-2026-84394, GHSA-58mr-gqgx-xq4g | High | 0.4% | 03 Sep, 2026 | npm fast-uri |
fast-uri vulnerable to authority injection via an unvalidated port in serialize CVE-2026-84292, GHSA-qw65-cvwx-89v3 | High | 0.2% | 02 Sep, 2026 | npm fast-uri |
TOON: Prototype pollution when decoding untrusted TOON input CVE-2026-82404, GHSA-p95v-992w-h6c3 | High | 0.7% | 02 Sep, 2026 | npm @toon-format/toon |
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources CVE-2026-84375, GHSA-2883-xcg3-v3hh | High | 0.5% | 01 Sep, 2026 | npm js-yaml |
SVGO: removeScripts allows executable links through namespace and control-character bypasses CVE-2026-84370, GHSA-w27v-7q3p-w38r | High | 0.5% | 01 Sep, 2026 | npm svgo |
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml CVE-2026-101043, GHSA-vx52-2968-3vc6 | High | 0.3% | 01 Sep, 2026 | npm pnpm |
pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project GHSA-2rx9-3g3h-c2jv | High | Not scored | 01 Sep, 2026 | npm pnpm |
MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials GHSA-3f6p-5ww8-9rcr | High | Not scored | 01 Sep, 2026 | npm mysql2 |
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser CVE-2026-83619, GHSA-x4fp-j954-r2f4 | High | 0.5% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator CVE-2026-83618, GHSA-vr34-hp96-76pp | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator CVE-2026-83617, GHSA-jxjr-3g7g-3944 | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed CVE-2026-83616, GHSA-c7q8-3ch8-vqpv | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: Quadratic-memory consumption CVE-2026-83615, GHSA-965w-775f-mr7g | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge CVE-2026-83614, GHSA-93r5-fhx6-vmg9 | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: Quadratic-time attribute deduplication CVE-2026-83613, GHSA-8344-3jmq-59r6 | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: HTML raw-text closing-tag case mismatch causes output amplification CVE-2026-83612, GHSA-6mj3-qw4j-hgrw | High | 0.5% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path CVE-2026-83609, GHSA-3px3-54cx-rmw9 | High | 0.5% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: DocType `name` Injection Bypasses requireWellFormed CVE-2026-83608, GHSA-27p8-2357-5qqv | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: Element name injection via createElement() bypasses requireWellFormed CVE-2026-83607, GHSA-w2rr-34g9-rvrj | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions CVE-2026-83606, GHSA-g53g-w8rj-fmg7 | High | 0.5% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed CVE-2026-83605, GHSA-4w3w-2rp5-g8jm | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install CVE-2026-82393, GHSA-vq4v-j7r6-jq4m | High | 0.6% | 31 Aug, 2026 | npm pnpm |
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph CVE-2026-82392, GHSA-c59q-g84q-2gj5 | High | 0.6% | 31 Aug, 2026 | npm pnpm |
multer vulnerable to Denial of Service via oversized array index in field names CVE-2026-82333, GHSA-535w-7cp7-47q4 | High | 0.4% | 28 Aug, 2026 | npm multer |
multer vulnerable to Denial of Service via crafted multipart field names CVE-2026-77078, GHSA-wc9g-mqfw-jrwm | High | 0.5% | 28 Aug, 2026 | npm multer |