Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree CVE-2026-63669, GHSA-wr5r-wqp2-x4fh | Medium | 0.3% | 17 Aug, 2026 | npm apostrophe |
ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal CVE-2026-63667, GHSA-79qf-vqgc-7xx3 | Medium | 0.5% | 17 Aug, 2026 | npm @apostrophecms/import-export |
Etherpad has stored XSS in HTML export via unescaped attribute-pool values CVE-2026-55090, GHSA-2jp7-wwpg-3p9w | High | 0.5% | 17 Aug, 2026 | npm ep_etherpad-lite |
Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling GHSA-92hr-gmr6-h8cp | Medium | Not scored | 17 Aug, 2026 | npm ep_etherpad-lite |
vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass CVE-2026-92961, GHSA-v836-6xw4-9cx3 | High | 0.5% | 17 Aug, 2026 | npm vm2 |
vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f) CVE-2026-92960, GHSA-m5w8-4gq2-6f8x | Critical | 0.5% | 17 Aug, 2026 | npm vm2 |
vm2: Sandbox Breakout Using Dangerous Host Proto Mutators CVE-2026-47698, GHSA-cfcw-xp6x-25gj | Critical | 1.0% | 17 Aug, 2026 | npm vm2 |
VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE CVE-2026-47686, GHSA-m283-3h24-438v | Critical | 0.6% | 17 Aug, 2026 | npm vm2 |
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike CVE-2026-47683, GHSA-gmc2-2x9w-cgh9 | High | 0.5% | 17 Aug, 2026 | npm vm2 |
Malicious release: Malicious code in sui-move-rpc (npm) GHSA-342c-493g-f389, MAL-2026-14113 | Malicious | Not scored | 17 Aug, 2026 | npm sui-move-rpc |
Malicious release: Malicious code in bcs-core (npm) GHSA-5w7j-92p9-p5h4, MAL-2026-14105 | Malicious | Not scored | 17 Aug, 2026 | npm bcs-core |
Malicious release: Malicious code in leb128x (npm) GHSA-p98p-7p39-8v79, MAL-2026-14109 | Malicious | Not scored | 17 Aug, 2026 | npm leb128x |
Malicious release: Malicious code in sui-gql-core (npm) GHSA-rg66-wjvq-h8xm, MAL-2026-14112 | Malicious | Not scored | 17 Aug, 2026 | npm sui-gql-core |
Malicious release: Malicious code in reseller-app (npm) GHSA-x3qj-pjpv-x4c6, MAL-2026-14110 | Malicious | Not scored | 17 Aug, 2026 | npm reseller-app |
Malicious release: Malicious code in club-sauce (npm) GHSA-vm8j-8r82-992m, MAL-2026-14107 | Malicious | Not scored | 17 Aug, 2026 | npm club-sauce |
extract-zip allows arbitrary file writes through symlink archive entries CVE-2026-19693, GHSA-7pqw-9j4j-h8q3 | High | 0.5% | 17 Aug, 2026 | npm extract-zip |
Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage CVE-2026-53728, GHSA-m44r-7c5h-m6mj | High | 0.2% | 17 Aug, 2026 | npm @medplum/core |
DeepmergeTS has stack exhaustion when merging recursive object graphs CVE-2026-40345, GHSA-ggr8-5vv4-36mx | High | 0.5% | 17 Aug, 2026 | npm deepmerge-ts |
Malicious release: Malicious code in sugarball-cli (npm) GHSA-5v79-352p-4p25, MAL-2026-14111 | Malicious | Not scored | 17 Aug, 2026 | npm sugarball-cli |
Malicious release: Malicious code in cloud-agen-bot (npm) GHSA-q7j9-fgrw-6553, MAL-2026-14106 | Malicious | Not scored | 17 Aug, 2026 | npm cloud-agen-bot |
Malicious release: Malicious code in junofficial-userbot (npm) GHSA-5x9q-34mv-j8p3, MAL-2026-14108 | Malicious | Not scored | 17 Aug, 2026 | npm junofficial-userbot |
Malicious release: Malicious code in @junofficial/baileys (npm) GHSA-6mr4-v6qj-924j, MAL-2026-14101 | Malicious | Not scored | 17 Aug, 2026 | npm @junofficial/baileys |
Malicious release: Malicious code in autoai (npm) GHSA-8prp-jj56-c277, MAL-2026-14104 | Malicious | Not scored | 17 Aug, 2026 | npm autoai |
Malicious release: Malicious code in userbotjs (npm) GHSA-cpx6-fqq8-2xm5, MAL-2026-14114 | Malicious | Not scored | 17 Aug, 2026 | npm userbotjs |
Malicious release: Malicious code in userbotjs-jun (npm) GHSA-hvvr-852c-qpw8, MAL-2026-14115 | Malicious | Not scored | 17 Aug, 2026 | npm userbotjs-jun |
Malicious release: Malicious code in a.poltoradnev-package-a (npm) GHSA-g9p8-9jj7-5ghf, MAL-2026-14103 | Malicious | Not scored | 17 Aug, 2026 | npm a.poltoradnev-package-a |
Malicious release: Malicious code in @siwatfa/yorn (npm) GHSA-3rxm-r82c-h2f9, MAL-2026-14102 | Malicious | Not scored | 17 Aug, 2026 | npm @siwatfa/yorn |
Malicious release: Malicious code in runtime-health (npm) MAL-2026-14116 | Malicious | Not scored | 17 Aug, 2026 | npm runtime-health |
Malicious release: Malicious code in @ai-vertical/ai-agent (npm) GHSA-3248-8gvm-g9jv, MAL-2026-14070 | Malicious | Not scored | 17 Aug, 2026 | npm @ai-vertical/ai-agent |
Malicious release: Malicious code in depcruise-wrap-stream-in-html (npm) GHSA-fr93-j26p-9j5f, MAL-2026-14068 | Malicious | Not scored | 15 Aug, 2026 | npm depcruise-wrap-stream-in-html |
Malicious release: Malicious code in upload-to-gcp (npm) MAL-2026-14067 | Malicious | Not scored | 15 Aug, 2026 | npm upload-to-gcp |
Malicious release: Malicious code in akamaijs-sensorv1 (npm) GHSA-vf6f-mfc3-9548, MAL-2026-14066 | Malicious | Not scored | 15 Aug, 2026 | npm akamaijs-sensorv1 |
Malicious release: Malicious code in akamai-sensor (npm) GHSA-5rgj-m8xx-vvvj, MAL-2026-14065 | Malicious | Not scored | 15 Aug, 2026 | npm akamai-sensor |
Malicious release: Malicious code in @finaxis/common-js (npm) MAL-2026-14064 | Malicious | Not scored | 15 Aug, 2026 | npm @finaxis/common-js |
Malicious release: Malicious code in adxaa (npm) MAL-2026-14058 | Malicious | Not scored | 15 Aug, 2026 | npm adxaa |
Malicious release: Malicious code in @openrepl/shared (npm) MAL-2026-14057 | Malicious | Not scored | 15 Aug, 2026 | npm @openrepl/shared |
Malicious release: Malicious code in fastly-vcl-language-client (npm) MAL-2026-14060 | Malicious | Not scored | 15 Aug, 2026 | npm fastly-vcl-language-client |
Malicious release: Malicious code in twilio-hackerone-poc-afe6937c (npm) MAL-2026-14063 | Malicious | Not scored | 15 Aug, 2026 | npm twilio-hackerone-poc-afe6937c |
Malicious release: Malicious code in hunterone-build-probe-9210 (npm) MAL-2026-14061 | Malicious | Not scored | 15 Aug, 2026 | npm hunterone-build-probe-9210 |
Malicious release: Malicious code in tw-pkgprobe-7731 (npm) MAL-2026-14062 | Malicious | Not scored | 15 Aug, 2026 | npm tw-pkgprobe-7731 |
Malicious release: Malicious code in autbank-core (npm) MAL-2026-14059 | Malicious | Not scored | 15 Aug, 2026 | npm autbank-core |
Malicious release: Malicious code in gunzip-js (npm) GHSA-2hqf-5jxh-4wp2, MAL-2026-14056 | Malicious | Not scored | 15 Aug, 2026 | npm gunzip-js |
Malicious release: Malicious code in depcruise-fmt (npm) GHSA-gh2x-96f9-2cgf, MAL-2026-14054 | Malicious | Not scored | 15 Aug, 2026 | npm depcruise-fmt |
Malicious release: Malicious code in depcruise-baseline (npm) GHSA-rgcp-8955-2r93, MAL-2026-14053 | Malicious | Not scored | 15 Aug, 2026 | npm depcruise-baseline |
Malicious release: Malicious code in harmony-app-toolkit (npm) MAL-2026-14055 | Malicious | Not scored | 15 Aug, 2026 | npm harmony-app-toolkit |
Malicious release: Malicious code in require-i18next (npm) MAL-2026-14052 | Malicious | Not scored | 15 Aug, 2026 | npm require-i18next |
Malicious release: Malicious code in kit-hydration-vim (npm) GHSA-g9cm-v642-m5rj, MAL-2026-14086 | Malicious | Not scored | 15 Aug, 2026 | npm kit-hydration-vim |
Malicious release: Malicious code in svelte-goal-vim (npm) GHSA-qx34-66jv-3pg5, MAL-2026-14096 | Malicious | Not scored | 15 Aug, 2026 | npm svelte-goal-vim |
Malicious release: Malicious code in @velliajs/discord (npm) MAL-2026-14051 | Malicious | Not scored | 14 Aug, 2026 | npm @velliajs/discord |
Malicious release: Malicious code in bcs-mini (npm) GHSA-9q3f-qc6p-62mm, MAL-2026-14076 | Malicious | Not scored | 14 Aug, 2026 | npm bcs-mini |