Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) CVE-2026-111752, GHSA-62vg-58rm-qff7 | High | Not scored | 9 days ago | npm @angular/router |
@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR) CVE-2026-111754, GHSA-w739-gvwx-grc3 | Medium | Not scored | 9 days ago | npm @angular/platform-server |
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references CVE-2026-110725, GHSA-333x-w4r6-6crp | Low | 0.3% | 10 days ago | npm fast-uri |
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding CVE-2026-110306, GHSA-w74x-v6f9-j3xg | Medium | 0.3% | 10 days ago | npm fast-uri |
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization CVE-2026-110180, GHSA-wjr9-j795-jxcr | Medium | 0.3% | 10 days ago | npm fast-uri |
fast-uri vulnerable to improper path equivalence in relative reference normalization CVE-2026-110095, GHSA-xhq7-xmqj-769h | Low | 0.3% | 10 days ago | npm fast-uri |
Malicious release: Malicious code in @platform-services/hrm-mfe-core (npm) MAL-2026-18091 | Malicious | Not scored | 10 days ago | npm @platform-services/hrm-mfe-core |
Malicious release: Malicious code in sc-announcer (npm) GHSA-fxw2-4j5q-6hwg, MAL-2026-18064 | Malicious | Not scored | 10 days ago | npm sc-announcer |
Malicious release: Malicious code in fanarena-common (npm) MAL-2026-18063 | Malicious | Not scored | 10 days ago | npm fanarena-common |
Malicious release: Malicious code in ccl-global-shopping (npm) GHSA-hh3m-f424-g8v5, MAL-2026-18061 | Malicious | Not scored | 10 days ago | npm ccl-global-shopping |
Malicious release: Malicious code in sc-wizard (npm) MAL-2026-18062 | Malicious | Not scored | 10 days ago | npm sc-wizard |
Malicious release: Malicious code in @an1mshnpmb9c84920/pipe-dns-m19t2 (npm) GHSA-3xpj-mfqg-v52m, MAL-2026-18049 | Malicious | Not scored | 10 days ago | npm @an1mshnpmb9c84920/pipe-dns-m19t2 |
Malicious release: Malicious code in @an1mshnpmb9c84920/stage-repo-m19g7 (npm) GHSA-42h4-pvwr-r87v, MAL-2026-18052 | Malicious | Not scored | 10 days ago | npm @an1mshnpmb9c84920/stage-repo-m19g7 |
Malicious release: Malicious code in @an1mshnpmb9c84920/stage-outer-m19s5 (npm) GHSA-6grm-8w52-497r, MAL-2026-18051 | Malicious | Not scored | 10 days ago | npm @an1mshnpmb9c84920/stage-outer-m19s5 |
Malicious release: Malicious code in @an1mshnpmb9c84920/gat-scope-target-125ec19a (npm) GHSA-87gv-mmww-whrr, MAL-2026-18046 | Malicious | Not scored | 10 days ago | npm @an1mshnpmb9c84920/gat-scope-target-125ec19a |
Malicious release: Malicious code in @an1mshnpmb9c84920/stage-fn-m19p2 (npm) GHSA-h79g-mv9q-7p44, MAL-2026-18050 | Malicious | Not scored | 10 days ago | npm @an1mshnpmb9c84920/stage-fn-m19p2 |
Malicious release: Malicious code in @an1mshnpmb9c84920/pipe-compat-m19r8 (npm) GHSA-hxmq-p768-mjhf, MAL-2026-18048 | Malicious | Not scored | 10 days ago | npm @an1mshnpmb9c84920/pipe-compat-m19r8 |
Malicious release: Malicious code in @an1mshnpmb9c84920/oidc-cross-cafb9d929e (npm) GHSA-mmr7-9m67-9qh5, MAL-2026-18047 | Malicious | Not scored | 10 days ago | npm @an1mshnpmb9c84920/oidc-cross-cafb9d929e |
Malicious release: Malicious code in @decoopus/chatgpt-setup (npm) GHSA-4632-2g34-4r9w, MAL-2026-18053 | Malicious | Not scored | 10 days ago | npm @decoopus/chatgpt-setup |
Malicious release: Malicious code in api-anthropic (npm) GHSA-cj9w-7h22-q93g, MAL-2026-18055 | Malicious | Not scored | 10 days ago | npm api-anthropic |
Malicious release: Malicious code in claude-desktop-setup (npm) GHSA-f4mf-vhm8-xxqc, MAL-2026-18059 | Malicious | Not scored | 10 days ago | npm claude-desktop-setup |
Malicious release: Malicious code in codex-setup (npm) GHSA-h8cg-xwfv-9x77, MAL-2026-18060 | Malicious | Not scored | 10 days ago | npm codex-setup |
Malicious release: Malicious code in @decoopus/claude-setup (npm) GHSA-p7p5-jrq5-q47x, MAL-2026-18054 | Malicious | Not scored | 10 days ago | npm @decoopus/claude-setup |
Malicious release: Malicious code in chatgpt-desktop-setup (npm) GHSA-pgq5-xq28-533m, MAL-2026-18056 | Malicious | Not scored | 10 days ago | npm chatgpt-desktop-setup |
Malicious release: Malicious code in chatgpt-pro-activator (npm) GHSA-qp43-mgx6-56x2, MAL-2026-18057 | Malicious | Not scored | 10 days ago | npm chatgpt-pro-activator |
Malicious release: Malicious code in chatgpt-pro-setup-tool (npm) GHSA-xwx3-5h3q-2v8r, MAL-2026-18058 | Malicious | Not scored | 10 days ago | npm chatgpt-pro-setup-tool |
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled CVE-2026-111766, GHSA-vfgh-jcmw-g37q | Low | 0.4% | 10 days ago | npm markdown-it |
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes CVE-2026-111759, GHSA-r7fv-28h4-cvq7 | High | 0.6% | 10 days ago | npm markdown-it |
Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths CVE-2026-109955, CVE-2026-111757, GHSA-5r4p-p66f-jhc7 | Medium | 0.3% | 10 days ago | npm hono |
follow-redirects sensitiveHeaders regex escaping can expose credential headers CVE-2026-111755, GHSA-8r9p-f939-6h3c | High | 0.5% | 10 days ago | npm follow-redirects |
Malicious release: Malicious code in esgbz5 (npm) GHSA-25f9-m2r5-6fcq, MAL-2026-18009 | Malicious | Not scored | 10 days ago | npm esgbz5 |
Malicious release: Malicious code in tkacg3 (npm) GHSA-27jv-jmw5-c2v5, MAL-2026-18037 | Malicious | Not scored | 10 days ago | npm tkacg3 |
Malicious release: Malicious code in v49yzy (npm) GHSA-299j-xhj5-p4mq, MAL-2026-18038 | Malicious | Not scored | 10 days ago | npm v49yzy |
Malicious release: Malicious code in 3gr841 (npm) GHSA-3268-6cgx-qmp3, MAL-2026-17946 | Malicious | Not scored | 10 days ago | npm 3gr841 |
Malicious release: Malicious code in 4p9kgm (npm) GHSA-37g4-578m-87mr, MAL-2026-17948 | Malicious | Not scored | 10 days ago | npm 4p9kgm |
Malicious release: Malicious code in j019qc (npm) GHSA-3c65-77q8-3cv8, MAL-2026-18018 | Malicious | Not scored | 10 days ago | npm j019qc |
Malicious release: Malicious code in noe77e (npm) GHSA-3f7v-wqcp-rcj5, MAL-2026-18033 | Malicious | Not scored | 10 days ago | npm noe77e |
Malicious release: Malicious code in 8h66ok (npm) GHSA-4755-8q82-c3cq, MAL-2026-17951 | Malicious | Not scored | 10 days ago | npm 8h66ok |
Malicious release: Malicious code in ju0oud (npm) GHSA-4vwp-4cgf-q7hm, MAL-2026-18020 | Malicious | Not scored | 10 days ago | npm ju0oud |
Malicious release: Malicious code in zubn7b (npm) GHSA-56wf-ffww-7w6r, MAL-2026-18044 | Malicious | Not scored | 10 days ago | npm zubn7b |
Malicious release: Malicious code in lstsyw (npm) GHSA-6f5h-29pq-736p, MAL-2026-18022 | Malicious | Not scored | 10 days ago | npm lstsyw |
Malicious release: Malicious code in g23p4g (npm) GHSA-6jj8-jfq4-rh25, MAL-2026-18013 | Malicious | Not scored | 10 days ago | npm g23p4g |
Malicious release: Malicious code in ysqp68 (npm) GHSA-6mmf-g5rj-3qxv, MAL-2026-18041 | Malicious | Not scored | 10 days ago | npm ysqp68 |
Malicious release: Malicious code in g8ez1y (npm) GHSA-6rc2-wmvg-58vj, MAL-2026-18014 | Malicious | Not scored | 10 days ago | npm g8ez1y |
Malicious release: Malicious code in f4iomt (npm) GHSA-75h5-8c3h-fgfg, MAL-2026-18011 | Malicious | Not scored | 10 days ago | npm f4iomt |
Malicious release: Malicious code in 3gr2dj (npm) GHSA-7w9w-mcrx-mq63, MAL-2026-17945 | Malicious | Not scored | 10 days ago | npm 3gr2dj |
Malicious release: Malicious code in rhlozh (npm) GHSA-8h9g-w7hc-m2vg, MAL-2026-18035 | Malicious | Not scored | 10 days ago | npm rhlozh |
Malicious release: Malicious code in x294tn (npm) GHSA-946x-h6wx-r4jh, MAL-2026-18040 | Malicious | Not scored | 10 days ago | npm x294tn |
Malicious release: Malicious code in 8i7pp4 (npm) GHSA-97qj-xxch-gv59, MAL-2026-17952 | Malicious | Not scored | 10 days ago | npm 8i7pp4 |
Malicious release: Malicious code in aqj3w7 (npm) GHSA-c92v-wc47-vg7h, MAL-2026-17971 | Malicious | Not scored | 10 days ago | npm aqj3w7 |