Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them CVE-2026-73419, GHSA-x445-f3h2-j279 | Medium | 0.2% | 23 Jul, 2026 | npm @auth/core npm next-auth |
@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths CVE-2026-7120, GHSA-8pvw-jcv7-9cmj | Medium | 0.4% | 23 Jul, 2026 | npm @fastify/static |
n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation CVE-2026-72750, GHSA-652q-gvq3-74qv | Medium | 0.5% | 22 Jul, 2026 | npm n8n |
n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances CVE-2026-72775, GHSA-jqwr-vx3p-r266 | Medium | 0.5% | 22 Jul, 2026 | npm n8n |
n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner CVE-2026-72764, GHSA-9cmh-xcqm-5hqr | Medium | 0.8% | 22 Jul, 2026 | npm n8n |
Next.js: Cache confusion of response bodies for requests with bodies CVE-2026-64648, GHSA-68g3-v927-f742 | Medium | 0.3% | 22 Jul, 2026 | npm next |
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences CVE-2026-64647, GHSA-4633-3j49-mh5q | Medium | 0.3% | 22 Jul, 2026 | npm next |
Next.js: Unbounded Server Action payload in Edge runtime CVE-2026-64646, GHSA-4c39-4ccg-62r3 | Medium | 0.5% | 22 Jul, 2026 | npm next |
Next.js: Denial of Service in the Image Optimization API using SVGs CVE-2026-64644, GHSA-q8wf-6r8g-63ch | Medium | 0.7% | 22 Jul, 2026 | npm next |
Next.js: Unauthenticated disclosure of internal Server Function endpoints CVE-2026-64643, GHSA-955p-x3mx-jcvp | Medium | 0.5% | 22 Jul, 2026 | npm next |
danger allows local OS command injection through crafted file paths CVE-2026-16629, GHSA-3x93-p86w-5jvh | Medium | 1.1% | 22 Jul, 2026 | npm danger |
n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory CVE-2026-72773, GHSA-pf2q-pxhf-hgmw | Medium | 0.6% | 22 Jul, 2026 | npm n8n |
n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service CVE-2026-72769, GHSA-hx4h-vr3m-45vh | Medium | 0.5% | 22 Jul, 2026 | npm n8n |
n8n: SSRF Protection Bypass via MCP Client Node CVE-2026-72768, GHSA-vhf8-cg2h-cg3p | Medium | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: Google Service Account Private Key Exposed in JWT Header CVE-2026-65599, GHSA-9r8p-h6cc-6qhm | Medium | 0.2% | 22 Jul, 2026 | npm n8n |
n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction CVE-2026-65596, GHSA-gq66-9cw5-j5jm | Medium | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check CVE-2026-65594, GHSA-q5xf-xhwf-cwqf | Medium | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access CVE-2026-65593, GHSA-9w78-79q7-r4fp | Medium | 0.2% | 22 Jul, 2026 | npm n8n |
n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows CVE-2026-65590, GHSA-fpg6-x68q-5793 | Medium | 0.6% | 22 Jul, 2026 | npm n8n |
n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data CVE-2026-65589, GHSA-89gh-3pgc-v5h2 | Medium | 0.5% | 22 Jul, 2026 | npm n8n |
n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook CVE-2026-65014, GHSA-33q9-f52j-gc75 | Medium | 0.6% | 22 Jul, 2026 | npm n8n |
fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives CVE-2026-45820, GHSA-px8p-9vwx-vf98 | Medium | 0.3% | 22 Jul, 2026 | npm fflate |
Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake CVE-2026-73565, GHSA-9mqv-5hh9-4cgg | Medium | 0.5% | 21 Jul, 2026 | npm @hono/node-server |
TypeORM: migration:generate template-literal code injection CVE-2026-73651, GHSA-2rp8-mm9q-fp49 | Medium | 0.4% | 21 Jul, 2026 | npm typeorm |
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. CVE-2026-66010, GHSA-c2j3-45gr-mqc4 | Medium | 0.2% | 21 Jul, 2026 | npm dompurify |
Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) GHSA-frvp-7c67-39w9 | Medium | Not scored | 21 Jul, 2026 | npm @hono/node-server |
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered CVE-2026-73423, GHSA-8mv7-9c27-98vc | Medium | 0.3% | 20 Jul, 2026 | npm astro |
Astro: Unauthenticated path override in the @astrojs/vercel ISR function CVE-2026-73424, GHSA-x27w-589x-frm2 | Medium | 0.4% | 20 Jul, 2026 | npm @astrojs/vercel |
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) CVE-2026-59729, GHSA-f48w-9m4c-m7f5 | Medium | 0.5% | 20 Jul, 2026 | npm astro |
@astrojs/rss: XML Injection via Unescaped RSS Feed Fields CVE-2026-59728, GHSA-8j5q-mfj2-5q9q | Medium | 0.3% | 20 Jul, 2026 | npm @astrojs/rss |
Axios form serializer maxDepth bypass via {} metatoken CVE-2026-67321, GHSA-hcpx-6fm6-wx23 | Medium | 0.5% | 20 Jul, 2026 | npm axios |
Axios: Nested axios option objects can consume polluted prototype values CVE-2026-67319, GHSA-7q8q-rj6j-mhjq | Medium | 0.3% | 20 Jul, 2026 | npm axios |
Axios: HTTP/2 streamed uploads bypass `maxBodyLength` CVE-2026-67318, GHSA-mwf2-3pr3-8698 | Medium | 0.6% | 20 Jul, 2026 | npm axios |
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` CVE-2026-67317, GHSA-jqh4-m9w3-8hp9 | Medium | 0.6% | 20 Jul, 2026 | npm axios |
Axios: Prototype pollution gadgets can alter axios request construction CVE-2026-67316, GHSA-mmx7-hfxf-jppx | Medium | 0.4% | 20 Jul, 2026 | npm axios |
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios CVE-2026-67315, GHSA-f4gw-2p7v-4548 | Medium | 0.5% | 20 Jul, 2026 | npm axios |
Astro: Reflected XSS via unescaped View Transition animation properties CVE-2026-73422, GHSA-4g3v-8h47-v7g6 | Medium | 0.5% | 20 Jul, 2026 | npm astro |
Axios: Excessive recursion in formDataToJSON can cause denial of service CVE-2026-67313, GHSA-42h9-826w-cgv3 | Medium | 0.5% | 20 Jul, 2026 | npm axios |
Axios: Prototype pollution auth subfields can inject Basic auth CVE-2026-67314, GHSA-xj6q-8x83-jv6g | Medium | 0.4% | 20 Jul, 2026 | npm axios |
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service CVE-2026-67312, GHSA-pmv8-rq9r-6j72 | Medium | 0.5% | 20 Jul, 2026 | npm axios |
ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes CVE-2026-53496, GHSA-g77h-45rf-hcx4 | Medium | 0.5% | 17 Jul, 2026 | npm exifreader |
mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath CVE-2026-54561, GHSA-f7wf-v2vw-mpcx | Medium | 0.2% | 17 Jul, 2026 | npm mcp-memory-keeper |
TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard CVE-2026-54546, GHSA-vqrw-qphh-p34v | Medium | 0.4% | 17 Jul, 2026 | npm @tak-ps/cloudtak |
websocket-driver: Resource limit bypass via message compression CVE-2026-54490, GHSA-mp7j-qc5w-4988 | Medium | 0.4% | 15 Jul, 2026 | npm websocket-driver |
9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding CVE-2026-56678, GHSA-6mwv-4mrm-5p3m | Medium | 0.2% | 15 Jul, 2026 | npm 9router |
NocoBase backup restore schema name allows command injection CVE-2026-55410, GHSA-p853-83gj-wjj3 | Medium | 0.7% | 15 Jul, 2026 | npm @nocobase/plugin-backups |
NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass CVE-2026-52888, GHSA-v8vm-cqh8-q87q | Medium | 0.5% | 15 Jul, 2026 | npm @nocobase/plugin-collection-sql |
n8n: External Secrets Permission Bypass via Expression Parser Mismatch CVE-2026-59259, GHSA-jp7m-xcgx-57qm | Medium | 0.4% | 15 Jul, 2026 | npm n8n |
n8n: External Secrets Accessible via Workflow Expressions Outside Credentials CVE-2026-59254, GHSA-2434-3x6q-8r99 | Medium | 0.4% | 15 Jul, 2026 | npm n8n |
n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode CVE-2026-55608, GHSA-2cf7-hpwf-47h9 | Medium | 0.3% | 14 Jul, 2026 | npm n8n-mcp |