Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
better-auth: OAuth state can be used as a Magic Link to sign in as another user CVE-2026-110862, CVE-2026-114607, GHSA-965c-763c-88jm | Critical | 0.4% | 7 days ago | npm better-auth |
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays GHSA-673q-mjm6-r5xr | Critical | Not scored | 7 days ago | npm next |
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes CVE-2026-116804, GHSA-cg2g-xh64-v4q7 | Critical | 0.2% | 7 days ago | npm dompurify |
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used GHSA-2464-fhr4-w9xw | Critical | Not scored | 7 days ago | npm next |
Sentry-Javascript: Middleware Bypass when using Tunnel route CVE-2026-114139, GHSA-mchm-gjx6-7h55 | Critical | 0.5% | 8 days ago | npm @sentry/nextjs |
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites CVE-2026-114125, GHSA-f2ph-cmg5-wxc8 | Critical | 0.4% | 8 days ago | npm @storybook/addon-mcp npm @storybook/addon-vitest npm @storybook/core npm @storybook/core-server +2 more |
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects CVE-2026-109829, GHSA-4w7w-5xrc-9h26 | Critical | 0.1% | 14 days ago | npm undici |
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent CVE-2026-109383, GHSA-2m5v-pch6-74hx | Critical | 0.2% | 14 days ago | npm undici |
better-auth: OAuth Proxy lets an attacker sign in as another user CVE-2026-110864, GHSA-r4xp-prcw-77qf | Critical | 0.3% | 14 days ago | npm better-auth |
nodejs-whisper allows OS command injection through crafted audio file paths CVE-2026-110644, GHSA-2f48-3555-fpx6 | Critical | 2.7% | 15 days ago | npm nodejs-whisper |
git-diff: OS command injection vulnerability via crafted strings to the gitDiff API CVE-2026-110634, GHSA-6wfj-92cw-88vg | Critical | 2.3% | 15 days ago | npm git-diff |
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses CVE-2026-102989, GHSA-qx66-fv34-fjm8 | Critical | 0.5% | 16 days ago | npm @tanstack/react-start npm @tanstack/solid-start npm @tanstack/start-server-core npm @tanstack/vue-start |
obsidian-tc tokens can access arbitrary configured vaults CVE-2026-77366, GHSA-84c9-qqpq-2pq5 | Critical | 0.3% | 17 days ago | npm obsidian-tc |
obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback CVE-2026-77363, GHSA-pqh8-4pj7-32xx | Critical | 0.2% | 17 days ago | npm obsidian-tc |
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment CVE-2026-108261, GHSA-x34j-47hf-4xg7 | Critical | 0.2% | 20 days ago | npm @tinacms/app npm tinacms |
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion CVE-2026-107722, GHSA-ww5h-9m49-7xx4 | Critical | 0.4% | 20 days ago | npm fast-jwt |
Backstage: Sensitive information exposure in Scaffolder CVE-2026-106501, GHSA-g2v8-7jhw-pp8p | Critical | 0.5% | 22 days ago | npm @backstage/plugin-scaffolder-backend |
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions CVE-2026-106486, GHSA-g8rx-f7m5-7794 | Critical | 0.4% | 23 days ago | npm @backstage/plugin-scaffolder-backend-module-bitbucket-cloud npm @backstage/plugin-scaffolder-backend-module-bitbucket-server |
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) CVE-2026-106446, GHSA-8r5x-fm3f-whwj | Critical | 0.8% | 23 days ago | npm handlebars |
Handlebars: JavaScript Injection via Own Property Check Bypass CVE-2026-106445, GHSA-p8wg-vrv2-v86f | Critical | 0.6% | 23 days ago | npm handlebars |
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead() CVE-2026-106102, GHSA-pq96-jpmf-w254 | Critical | 0.3% | 23 days ago | npm quasar |
Payload authentication token field handling issue CVE-2026-105863, GHSA-66wr-7vmr-p5jq | Critical | 0.4% | 23 days ago | npm payload |
Payload: Unauthorized update to collection documents CVE-2026-105859, GHSA-f7hx-52q9-hcrf | Critical | 0.3% | 23 days ago | npm payload |
Payload Form Builder has an RCE issue CVE-2026-105857, GHSA-r488-j9vj-wx3q | Critical | 0.4% | 23 days ago | npm @payloadcms/plugin-form-builder |
Payload: Field access control bypass on auth collections CVE-2026-105851, GHSA-vc4h-q48j-5hcx | Critical | 0.2% | 23 days ago | npm payload |
Payload: Prototype pollution in Payload Import Export plugin CVE-2026-105844, GHSA-qf28-8hc6-vwrp | Critical | 0.7% | 23 days ago | npm @payloadcms/plugin-import-export |
Payload: SQL Injection in SQLite and Postgres CVE-2026-105845, GHSA-v49j-62m6-pgrr | Critical | 0.4% | 23 days ago | npm payload |
Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise CVE-2026-114087, GHSA-pqxw-g93w-hj9x | Critical | 0.5% | 26 days ago | npm trigger.dev |
Trigger.dev: V1 coordinator default-secret unauth Socket.IO CVE-2026-114088, GHSA-gg6r-gp4c-89hp | Critical | 0.4% | 26 days ago | npm trigger.dev |
Tinypool: Prototype Pollution Gadget to RCE in run() options CVE-2026-104849, GHSA-85c8-ppgw-ccpr | Critical | 0.5% | 27 days ago | npm tinypool |
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution CVE-2026-104848, GHSA-5gmw-xhrv-c9v3 | Critical | 0.5% | 27 days ago | npm tinypool |
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw) CVE-2026-104846, GHSA-p6vx-979v-rg4c | Critical | 0.3% | 27 days ago | npm seroval |
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path CVE-2026-103922, GHSA-rvm3-566m-v7fv | Critical | 0.3% | 28 days ago | Maven com.capacitorjs:core SwiftURL github.com/ionic-team/capacitor-swift-pm npm @capacitor/android npm @capacitor/ios |
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env CVE-2026-102992, GHSA-67c8-pqhq-4rmx | Critical | 0.5% | 29 days ago | npm piscina |
Next.js: Remote Code Execution in next/og ImageResponse GHSA-vcvr-r3jv-pc5j | Critical | Not scored | 29 days ago | npm next |
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection CVE-2026-102829, GHSA-v5rq-49vh-5v5c | Critical | 0.3% | 29 Sep, 2026 | npm @simple-git/argv-parser |
simple-git unsafe-operation guard does not block trailer command configuration CVE-2026-102828, GHSA-x6jw-m9v5-85vh | Critical | 0.4% | 29 Sep, 2026 | npm simple-git |
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291) CVE-2026-102827, GHSA-858h-whjf-mvg5 | Critical | 0.6% | 29 Sep, 2026 | npm simple-git |
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions CVE-2026-102676, GHSA-9qh4-3jw8-366w | Critical | 0.5% | 29 Sep, 2026 | npm electron |
shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token CVE-2026-102422, GHSA-pqg4-j6r4-53mv | Critical | 0.4% | 29 Sep, 2026 | npm shell-quote |
@xhmikosr/decompress: Path traversal via symlink chain CVE-2026-101894, GHSA-hrh2-vp3x-79xf | Critical | 0.8% | 28 Sep, 2026 | npm @xhmikosr/decompress npm decompress |
vm2: NodeVM custom resolution bypasses external path boundaries CVE-2026-100721, GHSA-5h3f-q97h-ccvc | Critical | 0.6% | 27 Sep, 2026 | npm vm2 |
DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution CVE-2026-61742, GHSA-fm8p-53ww-hf6w | Critical | 0.2% | 24 Sep, 2026 | npm @bytebase/dbhub |
SunEditor: Critical XSS vulnerability - sanitizer bypass CVE-2026-59167, GHSA-6rf4-v2fh-m6p4 | Critical | 0.5% | 23 Sep, 2026 | npm suneditor |
vm2 contains a sandbox escape vulnerability CVE-2026-93605, GHSA-pq68-rvw4-xp4r | Critical | 0.7% | 18 Sep, 2026 | npm vm2 |
Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification CVE-2026-63472, GHSA-6j36-r6pr-59x4 | Critical | 0.6% | 17 Sep, 2026 | npm @vendure/core |
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process CVE-2026-92957, GHSA-8686-vhfx-7r3j | Critical | 0.5% | 17 Sep, 2026 | npm vm2 |
vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass CVE-2026-92956, GHSA-wjwh-qqvp-g4p4 | Critical | 0.6% | 17 Sep, 2026 | npm vm2 |
vm2: Sandbox Escape (NodeVM) CVE-2026-92955, GHSA-88hf-g992-jg85 | Critical | 0.7% | 17 Sep, 2026 | npm vm2 |
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process CVE-2026-92954, GHSA-gjq8-xm47-88rc | Critical | 0.5% | 17 Sep, 2026 | npm vm2 |