Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs CVE-2026-118664, GHSA-qr28-fpjm-wq7f | High | Not scored | 5 hours ago | npm decode-uri-component |
@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy GHSA-w9x9-j56r-h98r | High | Not scored | 5 hours ago | npm @eeacms/volto-chatbot |
@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY CVE-2026-62264, GHSA-q344-5v34-gm84 | High | Not scored | 5 hours ago | npm @sylphx/pdf-reader-mcp |
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML CVE-2026-118660, GHSA-c8p4-j97h-3vg8 | High | Not scored | 1 day ago | npm happy-dom |
GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications CVE-2026-118665, GHSA-434m-5hcj-pxf3 | High | Not scored | 1 day ago | npm @graphql-tools/executor-legacy-ws |
mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 GHSA-4mfg-r38w-w8fg | High | Not scored | 1 day ago | npm mcp-sanitizer |
mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths GHSA-7w82-6f9j-v9jp | High | Not scored | 1 day ago | npm mcp-sanitizer |
Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages CVE-2026-118257, GHSA-83rm-6c8r-g728 | High | Not scored | 1 day ago | npm @intlify/core npm @intlify/core-base npm @intlify/shared npm @intlify/vue-i18n-core +2 more |
Highcharts Grid: `javascript:` URL in credits.href runs script on click CVE-2026-118255, GHSA-6hgp-fmhr-mrg4 | High | Not scored | 1 day ago | npm @highcharts/dashboards npm @highcharts/grid-pro |
Highcharts Grid parses pagination language options as HTML CVE-2026-118254, GHSA-r5wg-q8fc-p6w2 | High | Not scored | 1 day ago | npm @highcharts/grid-lite npm @highcharts/grid-pro |
Highcharts Dashboards parses fullscreen labels as HTML CVE-2026-118253, GHSA-58g7-7f52-h92c | High | Not scored | 1 day ago | npm @highcharts/dashboards |
Highcharts Dashboards parses sidebar component labels as HTML CVE-2026-118252, GHSA-rcqf-f6h2-ccg9 | High | Not scored | 1 day ago | npm @highcharts/dashboards |
Highcharts: `javascript:` URL in credits.href runs script on click CVE-2026-118251, GHSA-5793-x2q3-c3q7 | High | Not scored | 1 day ago | npm highcharts |
Highcharts: dotted series.keys paths write to Object.prototype CVE-2026-118250, GHSA-rmqc-xvr3-v46c | High | Not scored | 1 day ago | npm highcharts |
Highcharts: series column construction writes to Object.prototype CVE-2026-118249, GHSA-gfvx-2c2g-38wq | High | Not scored | 1 day ago | npm highcharts |
Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes CVE-2026-118246, GHSA-35rr-xwfh-x789 | High | Not scored | 1 day ago | npm highcharts |
Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace CVE-2026-118245, GHSA-grj7-r4jv-pw9j | High | Not scored | 1 day ago | npm @highcharts/dashboards |
Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing CVE-2026-118244, GHSA-65hg-cf3f-5m39 | High | Not scored | 1 day ago | npm highcharts |
Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>` CVE-2026-118242, GHSA-6g3c-p4fg-xv47 | High | Not scored | 1 day ago | npm @highcharts/grid-lite npm @highcharts/grid-pro |
Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute` CVE-2026-116797, GHSA-5ghw-9mgr-jvx2 | High | Not scored | 1 day ago | npm @highcharts/dashboards npm @highcharts/grid-pro |
Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts CVE-2026-116796, GHSA-mw4f-gj5x-6xr4 | High | Not scored | 1 day ago | npm highcharts |
RE2JS: Quadratic-time denial of service in re2js lookbehind matching CVE-2026-116795, GHSA-gg6h-894w-4m9c | High | Not scored | 1 day ago | npm re2js |
dd-trace: ReDOS in URL query string obfuscation CVE-2026-116693, GHSA-x94g-w73q-hpcw | High | 0.4% | 2 days ago | npm dd-trace |
CKEditor: Cross-site scripting (XSS) in the engine package CVE-2026-116688, GHSA-rh54-vffm-5fvp | High | 0.5% | 2 days ago | npm @ckeditor/ckeditor5-engine npm ckeditor5 |
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length GHSA-f897-62hf-6gxq | High | Not scored | 2 days ago | npm @modelcontextprotocol/hono npm @modelcontextprotocol/node npm @modelcontextprotocol/sdk npm @modelcontextprotocol/server |
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization CVE-2026-116675, GHSA-mf2p-h6hf-fcwm | High | 0.3% | 2 days ago | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length CVE-2026-116584, GHSA-wp97-x4hv-qvhp | High | 0.4% | 3 days ago | npm seroval |
Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS) CVE-2026-116581, GHSA-97r2-qh9m-474h | High | 0.5% | 3 days ago | npm seroval |
Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check CVE-2026-116580, GHSA-7rv5-mrxv-xcr9 | High | 0.3% | 3 days ago | npm seroval |
systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks CVE-2026-116576, GHSA-3f7j-7jwc-fxfj | High | 0.1% | 3 days ago | npm systeminformation |
graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service CVE-2026-115887, GHSA-x8rm-f576-gq67 | High | 0.4% | 5 days ago | npm graphql-scalars |
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution CVE-2026-115895, GHSA-834v-8h66-3h79 | High | 0.4% | 5 days ago | npm happy-dom |
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words GHSA-f2hq-32vh-53cc | High | Not scored | 6 days ago | npm postal-mime |
Electron: Mitigation for compromised eMudhra intermediate certificates CVE-2026-115570, GHSA-jr5w-w6x2-84p9 | High | 0.4% | 6 days ago | npm electron |
@justice8096/sagemath-mcp-server: executes arbitrary code via the escapeShellString and sanitizeCode functions CVE-2026-106763, GHSA-2vq3-mpmf-9xgr | High | Not scored | 6 days ago | npm @justice8096/sagemath-mcp-server |
@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function CVE-2026-106764, GHSA-jwc4-922r-f2rw | High | Not scored | 6 days ago | npm @rog0x/mcp-git-tools |
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes CVE-2026-115478, GHSA-r3g7-r4hr-m258 | High | 0.3% | 6 days ago | npm obsidian-tc |
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP CVE-2026-115477, GHSA-737x-cwfr-5vvc | High | 0.4% | 6 days ago | npm obsidian-tc |
Strands Agents SDK: Exposure of data element to wrong session in the A2A Server CVE-2026-115419, GHSA-4v6f-7vjh-6x4m | High | 0.4% | 7 days ago | PyPI strands-agents npm @strands-agents/sdk |
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments CVE-2026-114604, GHSA-c4qx-w738-7hr3 | High | Not scored | 7 days ago | npm @graphql-tools/utils |
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p) CVE-2026-116803, GHSA-mrv2-3pqr-j5jr | High | 0.2% | 7 days ago | npm dompurify |
Next.js: Denial of Service in App Router using Server Actions CVE-2026-94482, GHSA-p3m5-59mp-jv5r | High | 0.4% | 7 days ago | npm next |
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown CVE-2026-113872, GHSA-q7qp-rjg7-q26m | High | 0.4% | 7 days ago | npm multer |
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body CVE-2026-111181, GHSA-27r3-jxmh-p828 | High | 0.4% | 7 days ago | npm body-parser |
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse() CVE-2026-114144, GHSA-9qmh-m7c6-f92p | High | 0.4% | 8 days ago | npm toml |
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse() CVE-2026-114143, GHSA-9j65-hcg3-gc64 | High | 0.5% | 8 days ago | npm toml |
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype CVE-2026-114142, GHSA-h895-cgqg-jf52 | High | 0.4% | 8 days ago | npm tome npm toml |
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse() CVE-2026-114141, GHSA-4qx8-w7c3-pj3p | High | 0.4% | 8 days ago | npm toml |
Storybook dev server vulnerable to code injection from the local network CVE-2026-114126, GHSA-px85-f4q5-jh77 | High | 0.5% | 8 days ago | npm @storybook/addon-mcp npm @storybook/addon-vitest npm @storybook/core npm @storybook/core-server +2 more |
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) CVE-2026-111758, GHSA-gfr2-rv44-r23c | High | 0.5% | 9 days ago | npm markdown-it |