Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key CVE-2026-34950, GHSA-mvf2-f6gm-w987 | Critical | 0.2% | 02 Apr, 2026 | npm fast-jwt |
Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions GHSA-3hfp-gqgh-xc5g | Critical | Not scored | 02 Apr, 2026 | npm @lightdash/cli |
Axios npm Supply Chain Incident Impacting @usebruno/cli CVE-2026-34841, GHSA-658g-p7jg-wx5g | Critical | 0.2% | 02 Apr, 2026 | npm @usebruno/cli |
Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity CVE-2026-33950, GHSA-x8hc-fqv3-7gwf | Critical | 0.4% | 02 Apr, 2026 | npm signalk-server |
Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery CVE-2026-34751, GHSA-hp5w-3hxx-vmwf | Critical | 0.3% | 01 Apr, 2026 | npm @payloadcms/graphql npm payload |
OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover CVE-2026-41294, GHSA-8rh7-6779-cjqq | Critical | 0.1% | 01 Apr, 2026 | npm openclaw |
lodash vulnerable to Code Injection via `_.template` imports key names CVE-2026-4800, GHSA-r5fr-rjxr-66jc | Critical | 2.8% | 31 Mar, 2026 | npm lodash npm lodash-amd npm lodash-es npm lodash.template |
parse-server has cloud function validator bypass via prototype chain traversal BIT-parse-2026-34532, CVE-2026-34532, GHSA-vpj2-qq7w-5qq6 | Critical | 0.3% | 31 Mar, 2026 | npm parse-server |
OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation CVE-2026-33579, GHSA-hc5h-pmr3-3497 | Critical | 0.8% | 31 Mar, 2026 | npm openclaw |
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node CVE-2026-34156, GHSA-px3p-vgh9-m57c | Critical | 35.0% | 30 Mar, 2026 | npm @nocobase/plugin-workflow-javascript |
MikroORM is vulnerable to SQL Injection via specially crafted object CVE-2026-34220, GHSA-gwhv-j974-6fxm | Critical | 0.4% | 29 Mar, 2026 | npm @mikro-orm/core |
mppx has multiple payment bypass and griefing vulnerabilities GHSA-8x4m-qw58-3pcx | Critical | Not scored | 29 Mar, 2026 | npm mppx |
OpenClaw: Silent privilege escalation via gateway shared-auth reconnect CVE-2026-35625, GHSA-fqw4-mph7-2vr8 | Critical | 0.2% | 27 Mar, 2026 | npm openclaw |
OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin CVE-2026-35663, GHSA-9hjh-fr4f-gxc4 | Critical | 0.3% | 27 Mar, 2026 | npm openclaw |
Handlebars.js has JavaScript Injection via AST Type Confusion CVE-2026-33937, GHSA-2w6w-674q-4c4q | Critical | 1.9% | 27 Mar, 2026 | npm handlebars |
Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter CVE-2026-82854, GHSA-c7w3-x93f-qmm8 | Critical | 2.0% | 26 Mar, 2026 | npm nodemailer |
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code CVE-2026-33943, GHSA-6q6h-j7hj-3r64 | Critical | 0.6% | 26 Mar, 2026 | npm happy-dom |
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) CVE-2026-33896, GHSA-2328-f5f3-gj25 | Critical | 0.4% | 26 Mar, 2026 | npm node-forge |
OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve CVE-2026-35639, GHSA-hf68-49fm-59cq | Critical | 0.5% | 26 Mar, 2026 | npm openclaw |
Convict has Prototype Pollution via startsWith() function CVE-2026-33864, GHSA-44fc-8fm5-q62h | Critical | Not scored | 26 Mar, 2026 | npm convict |
Convict has prototype pollution via load(), loadFile(), and schema initialization CVE-2026-33863, GHSA-hf2r-9gf9-rwch | Critical | Not scored | 26 Mar, 2026 | npm convict |
n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE CVE-2026-33696, GHSA-mxrg-77hm-89hv | Critical | 0.8% | 25 Mar, 2026 | npm n8n |
n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode CVE-2026-33660, GHSA-58qr-rcgv-642v | Critical | 1.0% | 25 Mar, 2026 | npm n8n |
thumbler allows OS Command Injection CVE-2026-26833, GHSA-mvhf-547c-h55r | Critical | 2.4% | 25 Mar, 2026 | npm thumbler |
node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter CVE-2026-26832, GHSA-8j44-735h-w4w2 | Critical | 1.7% | 25 Mar, 2026 | npm node-tesseract-ocr |
textract is vulnerable to OS Command Injection CVE-2026-26831, GHSA-9pcj-m5rr-p28g | Critical | 2.5% | 25 Mar, 2026 | npm textract |
pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter CVE-2026-26830, GHSA-q5mh-72xg-628w | Critical | 2.5% | 25 Mar, 2026 | npm pdf-image |
Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` CVE-2026-33768, GHSA-mr6q-rp88-fx84 | Critical | 0.3% | 24 Mar, 2026 | npm @astrojs/vercel |
jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation CVE-2026-4599, GHSA-5jx8-q4cp-rhh6 | Critical | 0.5% | 23 Mar, 2026 | npm jsrsasign |
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint GHSA-wvr4-3wq4-gpc5 | Critical | Not scored | 19 Mar, 2026 | npm mcp-bridge |
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction CVE-2026-32731, GHSA-mwxc-m426-3f78 | Critical | 0.5% | 18 Mar, 2026 | npm @apostrophecms/import-export |
h3 has a middleware bypass with one gadget CVE-2026-33131, GHSA-3vj8-jmxq-cgj5 | Critical | 0.4% | 18 Mar, 2026 | npm h3 |
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields CVE-2026-33128, GHSA-22cc-p3c6-wpvm | Critical | 0.6% | 18 Mar, 2026 | npm h3 |
jsPDF has HTML Injection in New Window paths CVE-2026-31938, GHSA-wfv2-pwc8-crg5 | Critical | 0.3% | 17 Mar, 2026 | npm jspdf |
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection CVE-2026-32917, GHSA-g2f6-pwvx-r275 | Critical | 2.0% | 16 Mar, 2026 | npm openclaw |
OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval CVE-2026-32987, GHSA-63f5-hhc7-cx6p | Critical | 0.4% | 16 Mar, 2026 | npm openclaw |
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes CVE-2026-22172, GHSA-rqpp-rjj8-7wv8 | Critical | 0.6% | 13 Mar, 2026 | npm openclaw |
`OpenClaw: session_status` let sandboxed subagents access parent or sibling session state CVE-2026-32918, GHSA-wcxr-59v9-rxr8 | Critical | 0.1% | 13 Mar, 2026 | npm openclaw |
Apollo Federation vulnerable to prototype pollution via incomplete key sanitization CVE-2026-32621, GHSA-pfjj-6f4p-rvmh | Critical | 0.5% | 13 Mar, 2026 | npm @apollo/federation-internals npm @apollo/gateway npm @apollo/query-planner |
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters CVE-2026-32306, GHSA-p5g2-jm85-8g35 | Critical | 0.7% | 13 Mar, 2026 | npm oneuptime |
Locutus vulnerable to RCE via unsanitized input in create_function() CVE-2026-32304, GHSA-vh9h-29pq-r5m8 | Critical | 0.6% | 13 Mar, 2026 | npm locutus |
OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity CVE-2026-32978, GHSA-qc36-x95h-7j53 | Critical | 0.2% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries CVE-2026-32915, GHSA-4w7m-58cg-cmff | Critical | 0.1% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE CVE-2026-32922, GHSA-4jpw-hj22-2xmc | Critical | 0.7% | 13 Mar, 2026 | npm openclaw |
OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes CVE-2026-32916, GHSA-xw77-45gv-p728 | Critical | 0.5% | 13 Mar, 2026 | npm openclaw |
SandboxJS affected by a Sandbox Escape CVE-2026-26954, GHSA-6r9f-759j-hjgv | Critical | 0.6% | 13 Mar, 2026 | npm @nyariv/sandboxjs |
Undici has an HTTP Request/Response Smuggling issue CVE-2026-1525, GHSA-2mjp-6q6p-2qxm | Critical | 0.5% | 12 Mar, 2026 | npm undici |
Parse Server: Account takeover via operator injection in authentication data identifier BIT-parse-2026-32248, CVE-2026-32248, GHSA-5fw2-8jcv-xh87 | Critical | 0.6% | 12 Mar, 2026 | npm parse-server |
Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance BIT-parse-2026-32242, CVE-2026-32242, GHSA-2cjm-2gwv-m892 | Critical | 0.3% | 12 Mar, 2026 | npm parse-server |
TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS CVE-2026-28792, GHSA-8pw3-9m7f-q734 | Critical | 0.6% | 12 Mar, 2026 | npm @tinacms/cli |