Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in create-react-app-ui (npm) GHSA-qvrq-vg6m-5cr8, MAL-2026-14325 | Malicious | Not scored | 20 Aug, 2026 | npm create-react-app-ui |
Malicious release: Malicious code in create-react-app-ux (npm) GHSA-rxpg-3mx3-fwqm, MAL-2026-14326 | Malicious | Not scored | 20 Aug, 2026 | npm create-react-app-ux |
Malicious release: Malicious code in cig-data-patcher (npm) GHSA-wvvc-v5v3-7mcx, MAL-2026-14323 | Malicious | Not scored | 20 Aug, 2026 | npm cig-data-patcher |
Malicious release: Malicious code in debug-fnt (npm) GHSA-qpp9-fwpx-39f8, MAL-2026-14322 | Malicious | Not scored | 20 Aug, 2026 | npm debug-fnt |
Malicious release: Malicious code in test-flow-entire6 (npm) GHSA-34c9-jfcv-757f, MAL-2026-14320 | Malicious | Not scored | 20 Aug, 2026 | npm test-flow-entire6 |
Malicious release: Malicious code in test-flow-1 (npm) GHSA-4cwc-wpx2-j752, MAL-2026-14319 | Malicious | Not scored | 20 Aug, 2026 | npm test-flow-1 |
Malicious release: Malicious code in test-flow-entire7 (npm) GHSA-c7wg-wr5p-3pw9, MAL-2026-14321 | Malicious | Not scored | 20 Aug, 2026 | npm test-flow-entire7 |
Malicious release: Malicious code in frenchworldcupwin (npm) GHSA-hp4f-wg89-v3fg, MAL-2026-14318 | Malicious | Not scored | 20 Aug, 2026 | npm frenchworldcupwin |
Malicious release: Malicious code in fetch-webjs-script (npm) GHSA-qpx8-cvmq-8jh7, MAL-2026-14317 | Malicious | Not scored | 20 Aug, 2026 | npm fetch-webjs-script |
Malicious release: Malicious code in @httttt/mcp-demo (npm) GHSA-phcp-xhhf-xcvq, MAL-2026-14315 | Malicious | Not scored | 20 Aug, 2026 | npm @httttt/mcp-demo |
Malicious release: Malicious code in expect-dotenv (npm) GHSA-h7q6-7chv-cgh2, MAL-2026-14316 | Malicious | Not scored | 20 Aug, 2026 | npm expect-dotenv |
Malicious release: Malicious code in express-route-engine (npm) MAL-2026-14307 | Malicious | Not scored | 19 Aug, 2026 | npm express-route-engine |
Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root CVE-2026-63123, GHSA-rgr9-r7mj-mf6x | Medium | 0.3% | 19 Aug, 2026 | npm @tinacms/cli |
Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters) CVE-2026-59992, GHSA-8mq9-5fw2-5rm4 | Medium | 0.4% | 19 Aug, 2026 | npm next-tinacms-azure npm next-tinacms-cloudinary npm next-tinacms-dos npm next-tinacms-s3 |
LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process CVE-2026-69222, GHSA-4r6h-5v86-94p3 | High | 0.6% | 19 Aug, 2026 | npm liquidjs |
LiquidJS has an infinite loop vulnerability in its `strip_html` filter CVE-2026-61556, GHSA-m7fp-h3p4-hr49 | High | 0.5% | 19 Aug, 2026 | npm liquidjs |
logto-tunnel serves files outside --experience-path via path traversal CVE-2026-63188, GHSA-rxjr-6c9q-h67x | High | 0.5% | 19 Aug, 2026 | npm @logto/tunnel |
SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses GHSA-hjwh-xvfw-qrwj | Medium | Not scored | 19 Aug, 2026 | npm mcp-searxng |
SearXNG MCP Server: Additional hardened-mode SSRF bypasses CVE-2026-54689, GHSA-wppf-h75h-6pm6 | Medium | 0.2% | 19 Aug, 2026 | npm mcp-searxng |
SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off) CVE-2026-54688, GHSA-q87f-qc2r-2gw4 | Medium | 0.5% | 19 Aug, 2026 | npm mcp-searxng |
Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint CVE-2026-53957, GHSA-2xhg-73j7-rrgx | High | 0.4% | 19 Aug, 2026 | npm @contentful/mcp-server npm @contentful/mcp-tools |
claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools GHSA-rr55-jp92-8wp2 | High | Not scored | 19 Aug, 2026 | npm claude-faf-mcp |
faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools GHSA-j4r7-8ph4-43g3 | High | Not scored | 19 Aug, 2026 | npm faf-mcp |
grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools GHSA-cc2g-gq8c-r332 | High | Not scored | 19 Aug, 2026 | npm grok-faf-mcp |
Malicious release: Malicious code in mc-provider (npm) GHSA-8r2v-hr8v-g7hw, MAL-2026-14305 | Malicious | Not scored | 19 Aug, 2026 | npm mc-provider |
Malicious release: Malicious code in base99-85x (npm) MAL-2026-14304 | Malicious | Not scored | 19 Aug, 2026 | npm base99-85x |
Orval: Import-time RCE via schema default -> zod module-level template literal CVE-2026-72717, GHSA-w727-8j6c-2rj4 | Critical | 0.7% | 19 Aug, 2026 | npm orval |
Orval: Import-time RCE via query-parameter default -> zod module-level template literal CVE-2026-72716, GHSA-p4cg-3328-rvfg | Critical | 0.7% | 19 Aug, 2026 | npm orval |
Orval: Import-time RCE via header-parameter default -> zod module-level template literal CVE-2026-71871, GHSA-8j6p-r8jg-mxqh | Critical | 0.7% | 19 Aug, 2026 | npm orval |
Orval: Import-time RCE via array-items default -> zod module-level template literal CVE-2026-71869, GHSA-2h9g-j24r-h63g | Critical | 0.7% | 19 Aug, 2026 | npm orval |
Orval: Import-time RCE via enum-typed default -> zod module-level template literal CVE-2026-71868, GHSA-3575-w9fc-c2j6 | Critical | 0.7% | 19 Aug, 2026 | npm orval |
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator CVE-2026-71867, GHSA-2w86-xfrc-g85r | Critical | 0.7% | 19 Aug, 2026 | npm orval |
Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client CVE-2026-71866, GHSA-6mr6-jvcr-2f25 | Critical | 0.7% | 19 Aug, 2026 | npm orval |
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli CVE-2026-71865, GHSA-653q-5476-x79g | Critical | 0.7% | 19 Aug, 2026 | npm orval |
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client CVE-2026-71864, GHSA-6437-gxhq-pqv8 | Critical | 0.7% | 19 Aug, 2026 | npm orval |
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification) CVE-2026-62682, GHSA-88f2-fpv8-89q2 | Critical | 0.7% | 19 Aug, 2026 | npm orval |
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout) CVE-2026-62681, GHSA-fg9p-mrxr-hvq7 | Critical | 0.7% | 19 Aug, 2026 | npm orval |
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref CVE-2026-62680, GHSA-cxq5-97v7-87j8 | High | 0.4% | 19 Aug, 2026 | npm orval |
Malicious release: Malicious code in x6842179305 (npm) MAL-2026-14303 | Malicious | Not scored | 19 Aug, 2026 | npm x6842179305 |
Malicious release: Malicious code in ai-texts-utils (npm) GHSA-3p3q-38q9-rr37, MAL-2026-14302 | Malicious | Not scored | 19 Aug, 2026 | npm ai-texts-utils |
Malicious release: Malicious code in node-runtime-utils (npm) GHSA-c436-rrhg-m984, MAL-2026-14313 | Malicious | Not scored | 19 Aug, 2026 | npm node-runtime-utils |
Malicious release: Malicious code in webpack-cdn-fetcher (npm) GHSA-gjvp-mjhq-rfwc, MAL-2026-14314 | Malicious | Not scored | 19 Aug, 2026 | npm webpack-cdn-fetcher |
Malicious release: Malicious code in eslint-config-consumerweb (npm) GHSA-2pxg-969f-jc3q, MAL-2026-14311 | Malicious | Not scored | 19 Aug, 2026 | npm eslint-config-consumerweb |
Malicious release: Malicious code in griffin-transliterator (npm) GHSA-4hcm-p7x4-q9h9, MAL-2026-14312 | Malicious | Not scored | 19 Aug, 2026 | npm griffin-transliterator |
Malicious release: Malicious code in bunnyhijack-test-0x00 (npm) GHSA-8x5v-wf85-xhj5, MAL-2026-14310 | Malicious | Not scored | 19 Aug, 2026 | npm bunnyhijack-test-0x00 |
Malicious release: Malicious code in @idanefraim/my-ui-kit (npm) GHSA-hwmr-jv5f-67q9, MAL-2026-14309 | Malicious | Not scored | 19 Aug, 2026 | npm @idanefraim/my-ui-kit |
Malicious release: Malicious code in evm-validation (npm) GHSA-gvxq-2rq2-f7x6, MAL-2026-14301 | Malicious | Not scored | 19 Aug, 2026 | npm evm-validation |
Malicious release: Malicious code in eth-react-provider (npm) GHSA-rr86-r66c-qc54, MAL-2026-14300 | Malicious | Not scored | 19 Aug, 2026 | npm eth-react-provider |
Malicious release: Malicious code in emoji-prints-fancy (npm) GHSA-m523-mggx-3fgr, MAL-2026-14298 | Malicious | Not scored | 19 Aug, 2026 | npm emoji-prints-fancy |
Malicious release: Malicious code in gear-composer (npm) MAL-2026-14299 | Malicious | Not scored | 19 Aug, 2026 | npm gear-composer |