Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating CVE-2026-28391, GHSA-qj77-c3c8-9c3q | Critical | 0.5% | 17 Feb, 2026 | npm openclaw |
OpenClaw's gateway connect could skip device identity checks when auth.token was present but not yet validated CVE-2026-28472, GHSA-rv39-79c4-7459 | Critical | 0.4% | 17 Feb, 2026 | npm openclaw |
nanotar is vulnerable to path traversal in parseTar() and parseTarGzip() CVE-2025-69874, GHSA-92fh-27vv-894w | Critical | 0.9% | 11 Feb, 2026 | npm nanotar |
set-in Affected by Prototype Pollution CVE-2026-26021, GHSA-2c4m-g7rx-63q7 | Critical | 0.6% | 11 Feb, 2026 | npm set-in |
CASL Ability is Vulnerable to Prototype Pollution CVE-2026-1774, GHSA-x9vf-53q3-cvx6 | Critical | 0.7% | 10 Feb, 2026 | npm @casl/ability |
FUXA Unauthenticated Remote Arbitrary Scheduler Write CVE-2026-25939, GHSA-c869-jx4c-q5fc | Critical | 12.7% | 09 Feb, 2026 | npm fuxa-server |
FUXA Unauthenticated Remote Code Execution in Node-RED Integration CVE-2026-25938, GHSA-v4p5-w6r3-2x4f | Critical | 1.1% | 09 Feb, 2026 | npm fuxa-server |
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape) CVE-2026-25881, GHSA-ww7g-4gwx-m7wj | Critical | 0.6% | 09 Feb, 2026 | npm @nyariv/sandboxjs |
@nyariv/sandboxjs vulnerable to sandbox escape via TOCTOU bug on keys in property accesses CVE-2026-25641, GHSA-7x3h-rm86-3342 | Critical | 0.5% | 05 Feb, 2026 | npm @nyariv/sandboxjs |
@nyariv/sandboxjs has a Sandbox Escape vulnerability CVE-2026-25587, GHSA-66h4-qj4x-38xp | Critical | 0.7% | 05 Feb, 2026 | npm @nyariv/sandboxjs |
@nyariv/sandboxjs has Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution CVE-2026-25586, GHSA-jjpw-65fv-8g48 | Critical | 0.7% | 05 Feb, 2026 | npm @nyariv/sandboxjs |
@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters CVE-2026-25544, GHSA-xx6w-jxg9-2wh8 | Critical | 0.8% | 05 Feb, 2026 | npm @payloadcms/drizzle |
@nyariv/sandboxjs has a Sandbox Escape issue CVE-2026-25520, GHSA-58jh-xv4v-pcx4 | Critical | 0.9% | 05 Feb, 2026 | npm @nyariv/sandboxjs |
FUXA Unauthenticated Remote Arbitrary Device Tag Write CVE-2026-25752, GHSA-ggxw-g3cp-mgf8 | Critical | 0.5% | 05 Feb, 2026 | npm fuxa-server |
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API CVE-2026-25895, GHSA-88qh-cphv-996c | Critical | 13.0% | 05 Feb, 2026 | npm fuxa-server |
FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration CVE-2026-25894, GHSA-32cc-x95p-fxcg | Critical | 0.9% | 05 Feb, 2026 | npm fuxa-server |
FUXA Unauthenticated Exposure of Plaintext Database Credentials CVE-2026-25751, GHSA-c5gq-4h56-4mmx | Critical | 0.3% | 05 Feb, 2026 | npm fuxa-server |
FUXA Unauthenticated Remote Code Execution via Admin JWT Minting CVE-2026-25893, GHSA-vwcg-c828-9822 | Critical | 0.8% | 05 Feb, 2026 | npm fuxa-server |
survey-pdf Upgraded jsPDF Version Due to Security Vulnerability CVE-2026-25630, GHSA-h3q6-jfrg-3x6q | Critical | Not scored | 04 Feb, 2026 | npm survey-pdf |
n8n Vulnerable to Command Injection in Community Package Installation CVE-2026-21893, GHSA-7c4h-vh2m-743m | Critical | 1.6% | 04 Feb, 2026 | npm n8n |
n8n has a Python sandbox escape CVE-2026-25115, GHSA-8398-gmmx-564h | Critical | 0.6% | 04 Feb, 2026 | npm n8n |
n8n Merge Node has Arbitrary File Write leading to RCE CVE-2026-25056, GHSA-hv53-3329-vmrm | Critical | 0.7% | 04 Feb, 2026 | npm n8n |
n8n has OS Command Injection in Git Node CVE-2026-25053, GHSA-9g95-qf3f-ggrw | Critical | 0.6% | 04 Feb, 2026 | npm n8n |
n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users CVE-2026-25052, GHSA-gfvg-qv54-r4pc | Critical | 0.3% | 04 Feb, 2026 | npm n8n |
n8n Has Expression Escape Vulnerability Leading to RCE CVE-2026-25049, GHSA-6cqr-8cfr-67f8 | Critical | 1.6% | 04 Feb, 2026 | npm n8n |
Prototype Pollution via FormData Processing in Qwik City CVE-2026-25150, GHSA-xqg6-98cw-gxhq | Critical | 0.7% | 03 Feb, 2026 | npm @builder.io/qwik-city |
@isaacs/brace-expansion has Uncontrolled Resource Consumption CVE-2026-25547, GHSA-7h2j-956f-4vf2 | Critical | 0.5% | 03 Feb, 2026 | npm @isaacs/brace-expansion |
FUXA allows Remote Code Execution (RCE) via the project import functionality. CVE-2025-69983, GHSA-5r63-q8hg-p8qx | Critical | 0.5% | 03 Feb, 2026 | npm fuxa-server |
FUXA contains an Unrestricted File Upload vulnerability CVE-2025-69981, GHSA-7g56-fwxj-cm23 | Critical | 0.8% | 03 Feb, 2026 | npm fuxa-server |
FUXA has a hardcoded fallback JWT signing secret CVE-2025-69971, GHSA-c8m8-3jcr-6rj5 | Critical | 2.2% | 03 Feb, 2026 | npm @frangoteam/fuxa |
FUXA contains an insecure default configuration vulnerability CVE-2025-69970, GHSA-r5m2-fqcf-qrf7 | Critical | 0.5% | 03 Feb, 2026 | npm fuxa-server |
locutus is vulnerable to Prototype Pollution CVE-2026-25521, GHSA-rxrv-835q-v5mh | Critical | 0.3% | 02 Feb, 2026 | npm locutus |
SandboxJS Vulnerable to Prototype Pollution -> Sandbox Escape -> RCE CVE-2026-25142, GHSA-9p4w-fq8m-2hp7 | Critical | 1.2% | 02 Feb, 2026 | npm @nyariv/sandboxjs |
Signal K set-system-time plugin vulnerable to RCE - Command Injection CVE-2026-23515, GHSA-p8gp-2w28-mhwg | Critical | 4.6% | 02 Feb, 2026 | npm @signalk/set-system-time |
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments CVE-2026-25141, GHSA-gch2-phqh-fg9q | Critical | 0.7% | 30 Jan, 2026 | npm @orval/core |
deepHas vulnerable to Prototype Pollution via constructor.prototype CVE-2026-25047, GHSA-2733-6c58-pf27 | Critical | 0.8% | 29 Jan, 2026 | npm deephas |
Maker.js has Unsafe Property Copying in makerjs.extendObject CVE-2026-24888, GHSA-2cp6-34r9-54xx | Critical | 1.0% | 28 Jan, 2026 | npm makerjs |
JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js CVE-2025-61140, GHSA-6c59-mwgh-r2x6 | Critical | 0.5% | 28 Jan, 2026 | npm jsonpath |
SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor CVE-2026-23830, GHSA-wxhw-j4hc-fmq6 | Critical | 1.2% | 27 Jan, 2026 | npm @nyariv/sandboxjs |
n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution CVE-2026-1470, GHSA-5xrp-6693-jjx9 | Critical | 20.4% | 27 Jan, 2026 | npm n8n |
Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE GHSA-cr3w-cw5w-h3fj | Critical | Not scored | 26 Jan, 2026 | npm @saltcorn/server |
vm2 has a Sandbox Escape CVE-2026-22709, GHSA-99p7-6v5w-7xg8 | Critical | 1.3% | 26 Jan, 2026 | npm vm2 |
dcap-qvl has Missing Verification for QE Identity CVE-2026-22696, GHSA-796p-j2gh-9m2q, PYSEC-2026-326 | Critical | 0.2% | 26 Jan, 2026 | PyPI dcap-qvl crates.io dcap-qvl npm @phala/dcap-qvl npm @phala/dcap-qvl-node +1 more |
gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755) CVE-2026-0755, GHSA-4h5r-5jm8-jxjm | Critical | 3.4% | 23 Jan, 2026 | npm gemini-mcp-tool |
sm-crypto Affected by Private Key Recovery in SM2-PKE CVE-2026-23966, GHSA-pgx9-497m-6c4v | Critical | 0.2% | 21 Jan, 2026 | npm sm-crypto |
seroval Affected by Prototype Pollution via JSON Deserialization CVE-2026-23736, GHSA-hj76-42vx-jwp4 | Critical | 0.3% | 21 Jan, 2026 | npm seroval |
Orval has a code injection via unsanitized x-enum-descriptions in enum generation CVE-2026-23947, GHSA-h526-wf6g-67jv | Critical | 0.8% | 20 Jan, 2026 | npm @orval/core |
Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE) CVE-2026-23733, GHSA-4gpc-rhpj-9443 | Critical | 0.1% | 18 Jan, 2026 | npm @lobehub/chat |
REC in MCPJam inspector due to HTTP Endpoint exposes CVE-2026-23744, GHSA-232v-j27c-5pp6 | Critical | 67.5% | 16 Jan, 2026 | npm @mcpjam/inspector |
h3 v1 has Request Smuggling (TE.TE) issue CVE-2026-23527, GHSA-mp2g-9vg9-f4cg | Critical | 0.6% | 15 Jan, 2026 | npm h3 |