Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Electron: shell.openPath path validation bypass via embedded null byte CVE-2026-70603, GHSA-5c9j-mhmv-5xgx | Medium | 0.1% | 05 Aug, 2026 | npm electron |
Electron: Cross-origin iframe can position native autofill popup CVE-2026-70600, GHSA-x8rc-wpg4-grpf | Medium | 0.2% | 05 Aug, 2026 | npm electron |
Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin CVE-2026-70599, GHSA-9pf5-hg6p-4pwp | Medium | 0.2% | 05 Aug, 2026 | npm electron |
Electron: Parent process code-sign check is spoofable CVE-2026-70597, GHSA-jm7p-cc5g-qwxx | Medium | 0.1% | 05 Aug, 2026 | npm electron |
Ghost: Cross-Site Scripting in Feature Image Captions BIT-ghost-2026-70596, CVE-2026-70596, GHSA-pr22-p9rp-2cqv | Medium | 0.3% | 05 Aug, 2026 | npm ghost |
Ghost: Server-Side Request Forgery Mitigation Issue BIT-ghost-2026-70595, CVE-2026-70595, GHSA-x5mm-wm4g-j5xv | Medium | 0.3% | 05 Aug, 2026 | npm ghost |
Ghost: Session Fixation in Ghost Admin BIT-ghost-2026-70594, CVE-2026-70594, GHSA-7mpp-r37j-x5wh | Medium | 0.2% | 04 Aug, 2026 | npm ghost |
Ghost: Theme Upload Path Traversal BIT-ghost-2026-70593, CVE-2026-70593, GHSA-cjc9-q5gf-327p | Medium | 0.4% | 04 Aug, 2026 | npm ghost |
Ghost: Database Backup Path Traversal BIT-ghost-2026-70592, CVE-2026-70592, GHSA-cj62-hvv2-2q5h | Medium | 0.4% | 04 Aug, 2026 | npm ghost |
Ghost: Server-Side Request Forgery in Image Fetching BIT-ghost-2026-70591, CVE-2026-70591, GHSA-gcvv-72q8-9v76 | Medium | 0.4% | 04 Aug, 2026 | npm ghost |
Ghost: Blind Password Hash Disclosure in Ghost Admin API BIT-ghost-2026-70590, CVE-2026-70590, GHSA-jm22-3w23-5q7w | Medium | 0.3% | 04 Aug, 2026 | npm ghost |
Ghost: Archived Offers can be Redeemed BIT-ghost-2026-70589, CVE-2026-70589, GHSA-4wx2-7gvj-qfq3 | Medium | 0.3% | 04 Aug, 2026 | npm ghost |
Ghost: Cross-Site Scripting in Universal Import BIT-ghost-2026-70588, CVE-2026-70588, GHSA-2gx6-7gx2-wwcf | Medium | 0.4% | 04 Aug, 2026 | npm ghost |
Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials CVE-2026-73603, GHSA-8gj2-2cvc-6xx7 | Medium | 0.3% | 04 Aug, 2026 | npm flowise |
Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint CVE-2026-73488, GHSA-2364-jh4q-m9vm | Medium | 0.4% | 04 Aug, 2026 | npm flowise |
Hono: ReDoS in CORS middleware via Access-Control-Request-Headers CVE-2026-69207, GHSA-8j4g-w8fx-2239 | Medium | 0.6% | 03 Aug, 2026 | npm hono |
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks CVE-2026-69198, GHSA-4xrf-jv44-h6hh | Medium | 0.5% | 03 Aug, 2026 | npm ip-address |
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset CVE-2026-69153, GHSA-fxqj-rqcc-2cmp | Medium | 0.5% | 03 Aug, 2026 | npm postcss |
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization CVE-2026-65841, GHSA-45qg-252v-3f7p | Medium | 0.5% | 31 Jul, 2026 | npm jodit |
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS CVE-2026-62324, GHSA-j839-gqq4-gf9j | Medium | 0.3% | 31 Jul, 2026 | npm jodit |
@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification GHSA-xrmj-5g4g-8987 | Medium | Not scored | 31 Jul, 2026 | npm @dynatrace-oss/dynatrace-mcp-server |
@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL GHSA-pqh8-p93p-2rx7 | Medium | Not scored | 31 Jul, 2026 | npm @dynatrace-oss/dynatrace-mcp-server |
re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS) CVE-2026-68499, GHSA-6hxr-mr5r-9836 | Medium | 0.2% | 30 Jul, 2026 | npm re2 |
re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS) CVE-2026-67550, GHSA-ff84-5f28-78qj | Medium | 0.2% | 30 Jul, 2026 | npm re2 |
undici vulnerable to CRLF Injection via blob-like body 'type' property CVE-2026-15157, GHSA-m8rv-5g2x-5cg5 | Medium | 0.3% | 29 Jul, 2026 | npm undici |
undici vulnerable to downstream response desynchronization via retry interceptor CVE-2026-16728, GHSA-8xcm-r25x-g524 | Medium | 0.3% | 29 Jul, 2026 | npm undici |
mathlive's Lack of Escaping of HTML allows for XSS CVE-2026-54705, GHSA-fm7p-gw32-828p | Medium | 0.3% | 29 Jul, 2026 | npm mathlive |
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields CVE-2026-16729, GHSA-v3r7-h72x-cjcm | Medium | 0.3% | 29 Jul, 2026 | npm undici |
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref` CVE-2026-54663, GHSA-x36r-4347-pm5x | Medium | 0.2% | 29 Jul, 2026 | npm swagger-typescript-api |
@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition GHSA-vg6v-j97m-h5xq | Medium | Not scored | 28 Jul, 2026 | npm @novu/application-generic |
ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks CVE-2026-54272, GHSA-22jq-vg5j-6vgg | Medium | 0.4% | 27 Jul, 2026 | npm ip-address |
FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller GHSA-8q49-2h5h-434x | Medium | Not scored | 24 Jul, 2026 | npm @frontmcp/adapters |
Quasar: Prototype pollution in the extend() utility CVE-2026-73647, GHSA-3r53-75j5-3g7j | Medium | 0.4% | 24 Jul, 2026 | npm quasar |
Shescape: Home-directory disclosure in assignment context on Unix with Dash CVE-2026-73411, GHSA-q53c-4prm-w95q | Medium | 0.6% | 24 Jul, 2026 | npm shescape |
Shescape: Path disclosure on Unix with Zsh CVE-2026-73412, GHSA-6v4m-fw66-8r4x | Medium | 0.6% | 24 Jul, 2026 | npm shescape |
Budibase: SSRF via bare fetch() in uploadUrl during AI table generation CVE-2026-73307, GHSA-hfhx-w8p8-4hc7 | Medium | 0.4% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Account Enumeration via Login Lockout Response Differential CVE-2026-73306, GHSA-cr7p-cr3q-h5cm | Medium | 0.4% | 24 Jul, 2026 | npm @budibase/server |
Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders CVE-2026-73308, GHSA-gh4h-34gr-87r7 | Medium | 0.4% | 24 Jul, 2026 | npm @budibase/server |
Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users CVE-2026-73304, GHSA-fcrw-f7gg-6g9f | Medium | 0.5% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings CVE-2026-73301, GHSA-4qcj-m5wp-jmf4 | Medium | 0.3% | 24 Jul, 2026 | npm @budibase/server |
Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter) BIT-mongoose-2026-73562, CVE-2026-73562, GHSA-664h-wqgq-64gw | Medium | 0.5% | 24 Jul, 2026 | npm mongoose |
@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass CVE-2026-73563, GHSA-38hq-7x33-php4 | Medium | 0.2% | 24 Jul, 2026 | npm @backstage/plugin-auth-backend |
Trix: Stored XSS via HTMLParser attribute injection on paste CVE-2026-73428, GHSA-53g2-mvcc-q9x3 | Medium | 0.4% | 24 Jul, 2026 | RubyGems action_text-trix npm trix |
Valibot: record() issue paths can make flatten() throw for inherited Object property names CVE-2026-59952, GHSA-5qjj-4xww-7phc | Medium | 0.4% | 24 Jul, 2026 | npm valibot |
SvelteKit: Prototype pollution in file input deletion path in remote-function forms CVE-2026-82257, GHSA-866w-xmhq-wj7x | Medium | 0.4% | 24 Jul, 2026 | npm @sveltejs/kit |
SvelteKit: Big remote form function payloads can cause Node process to crash CVE-2026-82256, GHSA-wqjv-9729-c5q2 | Medium | 0.4% | 24 Jul, 2026 | npm @sveltejs/kit |
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) CVE-2026-53669, GHSA-wrjc-x8rr-h8h6 | Medium | 0.3% | 23 Jul, 2026 | npm react-router |
React Router: Open redirect leading to XSS CVE-2026-53668, GHSA-jjmj-jmhj-qwj2 | Medium | 0.3% | 23 Jul, 2026 | npm react-router npm react-router-dom |
React Router: RSCErrorHandler Missing Protocol Validation (XSS) CVE-2026-53667, GHSA-h8fp-f39c-q6mh | Medium | 0.4% | 23 Jul, 2026 | npm react-router |
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration CVE-2026-53666, GHSA-337j-9hxr-rhxg | Medium | 0.4% | 23 Jul, 2026 | npm react-router |