Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs CVE-2026-62197, GHSA-3x84-qq85-fj65 | Medium | 0.3% | 13 Jul, 2026 | npm openclaw |
tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies CVE-2026-49977, GHSA-jxj7-g6gm-49j7 | Medium | 0.4% | 10 Jul, 2026 | npm tarteaucitronjs |
n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads CVE-2026-58661, GHSA-w867-jm58-p9pv | Medium | 0.4% | 10 Jul, 2026 | npm n8n |
@arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint CVE-2026-55605, GHSA-72f3-6w86-7rv3 | Medium | 0.5% | 09 Jul, 2026 | npm @arikusi/deepseek-mcp-server |
decompress allows arbitrary hardlink creation during archive extraction CVE-2026-39243, GHSA-jwp9-9v96-94mx | Medium | 0.3% | 09 Jul, 2026 | npm decompress |
@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check) CVE-2026-59149, GHSA-8wqc-v2q8-vff2 | Medium | 0.5% | 09 Jul, 2026 | npm @mockoon/cli npm @mockoon/commons-server |
Ghost: Paid gift memberships obtainable at minimal cost via the donations feature BIT-ghost-2026-59817, CVE-2026-59817, GHSA-xm43-3m56-w3wf | Medium | 0.4% | 09 Jul, 2026 | npm ghost |
Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data GHSA-382c-vx95-w3p5 | Medium | Not scored | 09 Jul, 2026 | npm @jsonbored/gittensory-mcp |
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement CVE-2026-12590, GHSA-v422-hmwv-36x6 | Medium | 0.4% | 09 Jul, 2026 | npm body-parser |
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes CVE-2026-58191, GHSA-3wgp-x9p5-c7cc | Medium | 0.6% | 08 Jul, 2026 | npm @appium/base-driver |
Waku: Cross-Origin CSRF on RSC Server Action Dispatch CVE-2026-49455, GHSA-75w3-gmqx-993q | Medium | 0.2% | 08 Jul, 2026 | npm waku |
Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication CVE-2026-59897, GHSA-xgm2-5f3f-mvvc | Medium | 0.2% | 08 Jul, 2026 | npm hono |
hono/jsx does not isolate context per request, leading to cross-request data disclosure CVE-2026-59896, GHSA-hvrm-45r6-mjfj | Medium | 0.3% | 08 Jul, 2026 | npm hono |
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility CVE-2026-59895, GHSA-w62v-xxxg-mg59 | Medium | 0.3% | 08 Jul, 2026 | npm hono |
protobufjs: Text Format string map parsing can mutate returned map object prototype CVE-2026-59876, GHSA-jfj6-75fj-8934 | Medium | 0.3% | 08 Jul, 2026 | npm protobufjs |
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records CVE-2026-59875, GHSA-gvwx-54wh-qm9j | Medium | 0.4% | 08 Jul, 2026 | npm tar |
CyberChef: Prototype pollution in Series Chart operation CVE-2026-57439, GHSA-fx6f-382r-j72c | Medium | 0.1% | 08 Jul, 2026 | npm cyberchef |
n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation CVE-2026-59257, GHSA-hwmj-qg4v-cvg9 | Medium | 0.6% | 08 Jul, 2026 | npm n8n |
n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects CVE-2026-59253, GHSA-2xgm-wc4g-5jvg | Medium | 0.3% | 08 Jul, 2026 | npm n8n |
Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows CVE-2026-67334, GHSA-2vg6-77g8-24mp | Medium | 0.3% | 07 Jul, 2026 | npm @better-auth/scim npm better-auth |
@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators CVE-2026-67332, GHSA-p2fr-6hmx-4528 | Medium | 0.3% | 07 Jul, 2026 | npm @better-auth/oauth-provider |
@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060) CVE-2026-53509, GHSA-g84h-j7jj-x32p | Medium | 0.4% | 07 Jul, 2026 | npm @aborruso/ckan-mcp-server |
Phoenix: Presence keys colliding with `Object.prototype` members break existence checks CVE-2026-56812, EEF-CVE-2026-56812, GHSA-63mc-hw7g-86rr | Medium | 0.8% | 07 Jul, 2026 | Hex phoenix npm phoenix |
showdown allows stored cross-site scripting through table header ID injection CVE-2026-59710, GHSA-22g5-r2x5-97cx | Medium | 0.3% | 06 Jul, 2026 | npm showdown |
showdown metadata title handling allows cross-site scripting CVE-2026-59711, GHSA-cr32-g25g-vxjj | Medium | 0.2% | 06 Jul, 2026 | npm showdown |
react-dev-utils openBrowser permits command injection on macOS CVE-2026-14802, GHSA-g9g6-gvq9-j4vp | Medium | 2.1% | 06 Jul, 2026 | npm react-dev-utils |
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header CVE-2026-14631, GHSA-m28w-2pqf-7qgj | Medium | 0.5% | 03 Jul, 2026 | npm webpack-dev-server |
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints CVE-2026-14620, GHSA-f5vj-f2hx-8m93 | Medium | 0.5% | 03 Jul, 2026 | npm webpack-dev-server |
@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation GHSA-x4hg-hfwf-p9mw | Medium | Not scored | 02 Jul, 2026 | npm @asymmetric-effort/nogginlessdom |
@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration GHSA-gj2h-2fpw-fhv9 | Medium | Not scored | 02 Jul, 2026 | npm @nuxt/ui |
@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString CVE-2026-50290, GHSA-93q6-wwjh-jc6h | Medium | 0.5% | 02 Jul, 2026 | npm @asymmetric-effort/specifyjs |
@asymmetric-effort/specifyjs: No redirect target validation in secureFetch GHSA-j5qp-p44g-2m49 | Medium | Not scored | 02 Jul, 2026 | npm @asymmetric-effort/specifyjs |
@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction GHSA-2944-57xv-2682 | Medium | Not scored | 02 Jul, 2026 | npm @asymmetric-effort/specifyjs |
@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range) GHSA-xw57-23p8-9wc5 | Medium | Not scored | 02 Jul, 2026 | npm @asymmetric-effort/specifyjs |
@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state GHSA-qcr8-x557-7cp3 | Medium | Not scored | 02 Jul, 2026 | npm @asymmetric-effort/specifyjs |
@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection GHSA-5c7w-4wm3-85vw | Medium | Not scored | 02 Jul, 2026 | npm @asymmetric-effort/specifyjs |
OpenClaw MCP SSE redirects could forward Authorization headers CVE-2026-62208, GHSA-9c3v-684m-579c | Medium | 0.4% | 01 Jul, 2026 | npm openclaw |
Jodit has prototype pollution via Jodit.configure() / ConfigMerge CVE-2026-54756, GHSA-5957-5c94-3v7w | Medium | 0.5% | 01 Jul, 2026 | npm jodit |
@hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key CVE-2026-48819, GHSA-hhx9-57xq-r5rw | Medium | 0.3% | 01 Jul, 2026 | npm @hey-api/openapi-ts |
sigstore-js has Insufficient Verification of Data Authenticity CVE-2026-48816, GHSA-xgjw-pm74-86q4 | Medium | 0.1% | 01 Jul, 2026 | npm @sigstore/verify |
repomix: attach_packed_output can bypass file-read secret scanning for supported local files CVE-2026-49988, GHSA-hwpp-h97w-2h3j | Medium | 0.2% | 01 Jul, 2026 | npm repomix |
@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization CVE-2026-49856, GHSA-c5r6-m4mr-8q5j | Medium | 0.3% | 01 Jul, 2026 | npm @jshookmcp/jshook |
decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input CVE-2026-45822, GHSA-vcc3-ghjq-m6fr | Medium | 0.5% | 30 Jun, 2026 | npm decode-uri-component |
js-toml has silent type confusion via falsy-primitive duplicate-key bypass CVE-2026-50029, GHSA-m34p-749j-x6m6 | Medium | 0.4% | 26 Jun, 2026 | npm js-toml |
@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths GHSA-5vwr-qchf-q4pf | Medium | Not scored | 26 Jun, 2026 | npm @cyclonedx/cdxgen |
`nx graph` dev server permissive CORS policy CVE-2026-54753, GHSA-g2r8-wvmj-jf5w | Medium | 1.2% | 26 Jun, 2026 | npm nx |
@sigstore/core has DSSE payloadType type-binding failure CVE-2026-48758, GHSA-jfc7-64v2-mr8c | Medium | 0.2% | 26 Jun, 2026 | npm @sigstore/core |
Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts CVE-2026-11779, GHSA-jg8r-5jh2-v2xj | Medium | 0.4% | 26 Jun, 2026 | npm payload |
pnpm: Reserved bin name deletes PNPM_HOME during global remove CVE-2026-55699, GHSA-4gxm-v5v7-fqc4 | Medium | 0.4% | 25 Jun, 2026 | npm pnpm |
pnpm: Repository config can expand victim environment secrets into registry requests before scripts run CVE-2026-55180, GHSA-3qhv-2rgh-x77r | Medium | 0.4% | 25 Jun, 2026 | npm pnpm |