Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in typescriptt-cli (npm) MAL-2026-14151 | Malicious | Not scored | 18 Aug, 2026 | npm typescriptt-cli |
Malicious release: Malicious code in tyepescript-core (npm) MAL-2026-14144 | Malicious | Not scored | 18 Aug, 2026 | npm tyepescript-core |
Malicious release: Malicious code in typecript-cli (npm) MAL-2026-14145 | Malicious | Not scored | 18 Aug, 2026 | npm typecript-cli |
Malicious release: Malicious code in typescipt-core (npm) MAL-2026-14147 | Malicious | Not scored | 18 Aug, 2026 | npm typescipt-core |
Malicious release: Malicious code in typescipt-cli (npm) MAL-2026-14146 | Malicious | Not scored | 18 Aug, 2026 | npm typescipt-cli |
Malicious release: Malicious code in tyepescript-cli (npm) MAL-2026-14143 | Malicious | Not scored | 18 Aug, 2026 | npm tyepescript-cli |
Malicious release: Malicious code in @mohamed_nowisar/token3-check (npm) MAL-2026-14135 | Malicious | Not scored | 18 Aug, 2026 | npm @mohamed_nowisar/token3-check |
Malicious release: Malicious code in @mohamed_nowisar/depconf-canary-test (npm) MAL-2026-14134 | Malicious | Not scored | 18 Aug, 2026 | npm @mohamed_nowisar/depconf-canary-test |
Malicious release: Malicious code in agora402-payment-utils (npm) GHSA-pvr5-m9hx-xxfr, MAL-2026-14136 | Malicious | Not scored | 18 Aug, 2026 | npm agora402-payment-utils |
Malicious release: Malicious code in mtslink-depconf-probe-profileusername (npm) MAL-2026-14137 | Malicious | Not scored | 18 Aug, 2026 | npm mtslink-depconf-probe-profileusername |
Malicious release: Malicious code in optimizely-starter-kit-for-fastly-compute (npm) GHSA-8pfr-f8q3-mr5x, MAL-2026-14138 | Malicious | Not scored | 18 Aug, 2026 | npm optimizely-starter-kit-for-fastly-compute |
Malicious release: Malicious code in prism-registry (npm) GHSA-gvgw-fqw6-f4rw, MAL-2026-14139 | Malicious | Not scored | 18 Aug, 2026 | npm prism-registry |
Malicious release: Malicious code in vite-svg-config (npm) MAL-2026-14140 | Malicious | Not scored | 18 Aug, 2026 | npm vite-svg-config |
fastify vulnerable to schema validation bypass via root primitive coercion mismatch CVE-2026-18504, GHSA-w2qp-rph6-63g4 | Medium | 0.3% | 18 Aug, 2026 | npm fastify |
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count CVE-2026-16732, GHSA-3m5p-2c4r-xxw2 | Medium | 0.2% | 18 Aug, 2026 | npm fastify |
MeshCentral has unsanitized data fields GHSA-c7hr-448w-65px | High | Not scored | 18 Aug, 2026 | npm meshcentral |
MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables CVE-2026-63640, GHSA-q4gh-4ffp-5cg8 | Medium | 0.3% | 18 Aug, 2026 | npm magicmirror |
GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data CVE-2026-55178, GHSA-p23g-mvhj-jh3j, PYSEC-2026-3662, PYSEC-2026-3663 | High | 0.6% | 18 Aug, 2026 | PyPI geolens PyPI geolens-cli npm @geolens/sdk |
Malicious release: Malicious code in plugin-react-vite (npm) GHSA-xjmp-gcmw-2xxm, MAL-2026-14129 | Malicious | Not scored | 18 Aug, 2026 | npm plugin-react-vite |
MagicMirror: ssrf calendar .js CVE-2026-63643, GHSA-w6x9-28jw-hq7j | Medium | 0.7% | 18 Aug, 2026 | npm magicmirror |
MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery CVE-2026-63642, GHSA-998g-7v5w-cr7g | Medium | 0.5% | 18 Aug, 2026 | npm magicmirror |
MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions CVE-2026-63641, GHSA-w26r-fwg8-rcp3 | Low | 0.4% | 18 Aug, 2026 | npm magicmirror |
@rhinostone/swig: arbitrary local file read via include/extends path traversal GHSA-2mf3-mr2r-r4vf | High | Not scored | 18 Aug, 2026 | npm @rhinostone/swig npm @rhinostone/swig-core npm @rhinostone/swig-django npm @rhinostone/swig-jinja2 +1 more |
Malicious release: Malicious code in @reducers/projects (npm) GHSA-3jm4-64fg-x3gh, MAL-2026-14127 | Malicious | Not scored | 18 Aug, 2026 | npm @reducers/projects |
Malicious release: Malicious code in @guildai-services/guildai (npm) GHSA-7322-f886-qg4p, MAL-2026-14125 | Malicious | Not scored | 18 Aug, 2026 | npm @guildai-services/guildai |
CodeWhale: js_execution leaks parent environment to model context via missing env scrub CVE-2026-75915, GHSA-h539-c7r8-3xq4 | High | 0.7% | 18 Aug, 2026 | crates.io codewhale-tui crates.io deepseek-tui npm codewhale npm deepseek-tui |
CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes CVE-2026-75914, GHSA-w7wx-5q49-r59w | High | 0.5% | 18 Aug, 2026 | crates.io codewhale-tui crates.io deepseek-tui npm codewhale npm deepseek-tui |
CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval CVE-2026-75913, GHSA-7j5w-7r7x-9v27 | High | 0.5% | 18 Aug, 2026 | crates.io codewhale-tui crates.io deepseek-tui npm codewhale npm deepseek-tui |
CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval CVE-2026-75912, GHSA-c6mw-8xh8-gpq6 | High | 0.4% | 18 Aug, 2026 | crates.io codewhale-tui crates.io deepseek-tui npm codewhale npm deepseek-tui |
CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository CVE-2026-75911, GHSA-gx45-xrj5-g6c4 | High | 0.2% | 18 Aug, 2026 | crates.io codewhale-tui crates.io deepseek-tui npm codewhale npm deepseek-tui |
CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository CVE-2026-75859, GHSA-62f5-cp2p-vq95 | High | 0.5% | 18 Aug, 2026 | crates.io codewhale-tui crates.io deepseek-tui npm codewhale npm deepseek-tui |
CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE) CVE-2026-75858, GHSA-wrj3-vj8c-784f | High | 0.4% | 18 Aug, 2026 | crates.io codewhale-tui crates.io deepseek-tui npm codewhale npm deepseek-tui |
CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation) CVE-2026-75857, GHSA-g29h-pfmp-qp9r | High | 0.2% | 18 Aug, 2026 | crates.io codewhale-tui crates.io deepseek-tui npm codewhale npm deepseek-tui |
CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning CVE-2026-75856, GHSA-6v2g-fpxh-pmmh | Critical | 0.5% | 18 Aug, 2026 | crates.io codewhale-tui crates.io deepseek-tui npm codewhale npm deepseek-tui |
Malicious release: Malicious code in @milleree/date-display (npm) GHSA-p7f6-r5h9-5w5w, MAL-2026-14126 | Malicious | Not scored | 18 Aug, 2026 | npm @milleree/date-display |
Malicious release: Malicious code in motionspring (npm) GHSA-f96p-92vv-5j49, MAL-2026-14128 | Malicious | Not scored | 18 Aug, 2026 | npm motionspring |
Malicious release: Malicious code in alphazone (npm) GHSA-58r2-5x99-cjrp, MAL-2026-14124 | Malicious | Not scored | 18 Aug, 2026 | npm alphazone |
Malicious release: Malicious code in @oyo_tech/oyochat_user (npm) MAL-2026-14123 | Malicious | Not scored | 18 Aug, 2026 | npm @oyo_tech/oyochat_user |
Malicious release: Malicious code in bcc-design-icons (npm) GHSA-73q2-99qx-v576, MAL-2026-14119, SNYK-JS-BCCDESIGNICONS-19003147 | Malicious | Not scored | 18 Aug, 2026 | npm bcc-design-icons |
Malicious release: Malicious code in bcc-design (npm) GHSA-v36x-48h2-hc4f, MAL-2026-14117, SNYK-JS-BCCDESIGN-19003146 | Malicious | Not scored | 18 Aug, 2026 | npm bcc-design |
Malicious release: Malicious code in core-tailwindcss-utility (npm) MAL-2026-14118 | Malicious | Not scored | 18 Aug, 2026 | npm core-tailwindcss-utility |
Malicious release: Malicious code in blastradar (npm) GHSA-pp9x-4g56-7322, MAL-2026-14120 | Malicious | Not scored | 18 Aug, 2026 | npm blastradar |
Malicious release: Malicious code in ulebkit (npm) GHSA-w4vj-4cxr-299x, MAL-2026-14122 | Malicious | Not scored | 18 Aug, 2026 | npm ulebkit |
Malicious release: Malicious code in sui-move-graphql (npm) GHSA-xgmm-vq93-f5vx, MAL-2026-14121 | Malicious | Not scored | 18 Aug, 2026 | npm sui-move-graphql |
MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id BIT-mlflow-2026-69148, CVE-2026-69148, GHSA-gqch-g4w5-7qcw | High | 0.4% | 17 Aug, 2026 | npm mlflow |
MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth BIT-mlflow-2026-69146, CVE-2026-69146, GHSA-3p64-6gvh-82v5 | Medium | 0.4% | 17 Aug, 2026 | npm mlflow |
9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint CVE-2026-56677, GHSA-8g4w-4ffg-8vgx | High | 0.4% | 17 Aug, 2026 | npm 9router |
Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url` CVE-2026-54356, GHSA-6x9p-4r67-5gjx | High | 0.4% | 17 Aug, 2026 | npm @budibase/server |
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS CVE-2026-71553, GHSA-vmg4-6gfg-83qx | High | 0.4% | 17 Aug, 2026 | npm apostrophe |
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close CVE-2026-63670, GHSA-jxwj-j7wr-gfrw | Medium | 0.3% | 17 Aug, 2026 | npm sanitize-html |