Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives CVE-2026-14643, GHSA-jr45-8vmc-qm54 | High | 0.4% | 29 Jul, 2026 | npm undici |
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies CVE-2026-54666, GHSA-w284-33mx-6g9v | High | 0.4% | 29 Jul, 2026 | npm swagger-typescript-api |
swagger-typescript-api vulnerable to code injection via unescaped enum string values CVE-2026-54664, GHSA-5f94-x226-ccpm | High | 0.5% | 29 Jul, 2026 | npm swagger-typescript-api |
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template CVE-2026-54661, GHSA-38c3-wv3c-v3xj | High | 0.5% | 29 Jul, 2026 | npm swagger-typescript-api |
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template CVE-2026-54662, GHSA-hqj5-cw9f-rx67 | High | 0.3% | 29 Jul, 2026 | npm swagger-typescript-api |
swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref` CVE-2026-54660, GHSA-h754-fxp7-88wx | High | 0.3% | 29 Jul, 2026 | npm swagger-typescript-api |
nanoid: non-secure generators can loop indefinitely with negative size CVE-2026-67214, GHSA-28wg-ghj8-5hjv | High | 0.3% | 29 Jul, 2026 | npm nanoid |
nanoid: custom generators can loop indefinitely when size is zero CVE-2026-67213, GHSA-2v37-7h3g-55p8 | High | 0.3% | 29 Jul, 2026 | npm nanoid |
QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding CVE-2026-54609, GHSA-85rg-p3fr-xc2f, PYSEC-2026-3615 | High | 0.5% | 28 Jul, 2026 | Maven com.quietterminal:qti-neon PyPI qti-neon npm qti-neon |
@wakaru/cli arbitrary file write during bundle unpack CVE-2026-54545, GHSA-7wpj-vvmv-pgm8 | High | 0.2% | 28 Jul, 2026 | npm @wakaru/cli |
Shescape: Quadratic-time denial of service in the flag-protection CVE-2026-73413, GHSA-gm3r-q2wp-hw87 | High | 0.6% | 24 Jul, 2026 | npm shescape |
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion CVE-2026-73561, GHSA-g5vv-q72c-7j78 | High | 0.6% | 24 Jul, 2026 | npm @anephenix/hub |
Budibase: SSRF via DNS rebinding in the REST datasource integration CVE-2026-73410, GHSA-v42f-v8xc-j435 | High | 0.3% | 24 Jul, 2026 | npm @budibase/server |
Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete CVE-2026-73617, GHSA-pmpg-2mxq-6xwr | High | 0.3% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF) CVE-2026-72849, GHSA-pvcr-8mvp-w8qr | High | 0.2% | 24 Jul, 2026 | npm @budibase/server |
Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector CVE-2026-73408, GHSA-2xgg-r2wc-c5r2 | High | 0.5% | 24 Jul, 2026 | npm @budibase/server |
Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution CVE-2026-73618, GHSA-qw6m-8fw2-2v64 | High | 0.4% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint CVE-2026-73406, GHSA-hr66-5mqr-8mpx | High | 0.5% | 24 Jul, 2026 | npm @budibase/server |
Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution CVE-2026-72855, GHSA-xg5g-26x8-cvf4 | High | 0.4% | 24 Jul, 2026 | npm @budibase/server |
Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs CVE-2026-72859, GHSA-xcx6-4f2g-hhgx | High | 0.2% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile CVE-2026-73409, GHSA-ppr4-5f46-j9c6 | High | 0.3% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session) CVE-2026-73303, GHSA-c8vc-7pv3-g98p | High | 0.3% | 24 Jul, 2026 | npm @budibase/server |
Budibase: Privilege escalation via public role assignment API missing app-level authorization CVE-2026-73305, GHSA-j9fc-w3mr-x6mv | High | 0.5% | 24 Jul, 2026 | npm @budibase/server |
js-yaml: Exponential parsing time in flow collections leads to denial of service CVE-2026-73643, GHSA-pm4m-ph32-ghv5 | High | 0.5% | 24 Jul, 2026 | npm js-yaml |
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response GHSA-qwww-vcr4-c8h2 | High | Not scored | 24 Jul, 2026 | npm react-router |
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection CVE-2026-73566, GHSA-r292-9mhp-454m | High | 0.5% | 24 Jul, 2026 | npm tar |
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure CVE-2026-73646, GHSA-r28c-9q8g-f849 | High | 0.5% | 24 Jul, 2026 | npm postcss |
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in CVE-2026-67327, GHSA-qq9h-g4jm-xgf3 | High | 0.4% | 24 Jul, 2026 | npm better-auth |
@better-auth/stripe: cross-organization billing tampering in organization subscription actions CVE-2026-67329, GHSA-h3rm-78g3-j7cp | High | 0.3% | 24 Jul, 2026 | npm @better-auth/stripe |
React Router: Unauthenticated Denial of Service via Inefficient Route Matching CVE-2026-55685, GHSA-chx6-hx7r-mcp5 | High | 0.7% | 24 Jul, 2026 | npm react-router |
find-my-way: DDoS with HTTP2 CVE-2026-47219, GHSA-c96f-x56v-gq3h | High | 0.5% | 23 Jul, 2026 | npm find-my-way |
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers CVE-2026-73418, GHSA-xmf8-cvqr-rfgj | High | 0.9% | 23 Jul, 2026 | npm @auth/core npm next-auth |
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash CVE-2026-14257, GHSA-mh99-v99m-4gvg | High | 0.6% | 23 Jul, 2026 | npm brace-expansion |
@fastify/static vulnerable to route guard bypass via path traversal CVE-2026-15074, GHSA-83w8-p2f5-377r | High | 0.7% | 23 Jul, 2026 | npm @fastify/static |
Next.js: Server-Side Request Forgery in Server Actions on custom servers CVE-2026-64649, GHSA-89xv-2m56-2m9x | High | 0.5% | 22 Jul, 2026 | npm next |
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname CVE-2026-64645, GHSA-p9j2-gv94-2wf4 | High | 0.4% | 22 Jul, 2026 | npm next |
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale CVE-2026-64642, GHSA-6gpp-xcg3-4w24 | High | 0.6% | 22 Jul, 2026 | npm next |
Next.js: Denial of Service in App Router using Server Actions CVE-2026-64641, GHSA-m99w-x7hq-7vfj | High | 0.9% | 22 Jul, 2026 | npm next |
n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service CVE-2026-72749, GHSA-xwx6-jjhv-84p8 | High | 0.6% | 22 Jul, 2026 | npm n8n |
n8n: Edit Image Node Format Injection Allows Arbitrary File Write CVE-2026-72762, GHSA-xmc9-4f2h-jf9c | High | 0.5% | 22 Jul, 2026 | npm n8n |
n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON CVE-2026-72763, GHSA-cj9h-qx8g-pq2g | High | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType` CVE-2026-72774, GHSA-6qc9-mqvw-jg7x | High | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: Expression sandbox escape via arrow-function bodies enabling command execution CVE-2026-72765, GHSA-gv7g-jm28-cr3m | High | 0.9% | 22 Jul, 2026 | npm n8n |
n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion CVE-2026-72766, GHSA-2x35-3fw4-9jr4 | High | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: Authenticated code execution in the n8n Git node CVE-2026-72767, GHSA-rcv6-pvrj-4xcg | High | 0.9% | 22 Jul, 2026 | npm n8n |
n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction CVE-2026-72770, GHSA-gf29-4f56-r2jf | High | 0.7% | 22 Jul, 2026 | npm n8n |
n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes CVE-2026-72771, GHSA-64xh-79j6-r5v8 | High | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login CVE-2026-72772, GHSA-8342-988q-86cr | High | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution CVE-2026-65598, CVE-2026-71539, GHSA-g3r5-9h93-4j2c | High | 0.3% | 22 Jul, 2026 | npm n8n |
n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview CVE-2026-65597, GHSA-p3rg-hrf9-w9gj | High | 0.3% | 22 Jul, 2026 | npm n8n |