Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list CVE-2026-92596, GHSA-2x7j-588g-ccc2 | High | 0.8% | 08 Sep, 2026 | npm nodemailer |
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain CVE-2026-92597, GHSA-cc9r-2j5m-2m83 | High | 0.4% | 08 Sep, 2026 | npm nodemailer |
OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree GHSA-2q42-4q24-7rgv | High | Not scored | 08 Sep, 2026 | npm @typespec/compiler npm @typespec/openapi3 |
sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 CVE-2026-114112, GHSA-rgj7-g3m4-5g8c | High | 0.2% | 08 Sep, 2026 | npm sharp |
Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing GHSA-j95f-988m-3j2f | High | Not scored | 08 Sep, 2026 | npm @tiptap/core |
Microsoft Windows Heap-Based Buffer Overflow Vulnerability CVE-2026-85880 | HighExploited | 0.4% | 08 Sep, 2026 | |
Microsoft Windows Link Following Vulnerability CVE-2026-81963 | HighExploited | 0.4% | 08 Sep, 2026 | |
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json CVE-2026-86540, GHSA-mc52-mwq4-vfx3 | High | 0.2% | 07 Sep, 2026 | npm knowns |
Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools CVE-2026-86439, GHSA-9gfj-28hw-jchp | High | 1.1% | 07 Sep, 2026 | npm knowns |
MikroTik RouterOS Missing Authentication for Critical Function Vulnerability CVE-2026-67277 | HighExploited | 1.6% | 05 Sep, 2026 | |
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop GHSA-7q9c-hpx7-9cwm | High | Not scored | 04 Sep, 2026 | npm @typespec/spector |
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol CVE-2026-19534, GHSA-rfgv-xxqx-mfg5 | High | 0.4% | 04 Sep, 2026 | npm undici |
undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors CVE-2026-85152, GHSA-vp8m-p9jh-q5pm | High | 0.2% | 04 Sep, 2026 | npm undici |
undici vulnerable to Denial of Service via WebSocketStream unclean close CVE-2026-85014, GHSA-rx4f-c7p8-82vq | High | 0.4% | 04 Sep, 2026 | npm undici |
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches CVE-2026-84933, GHSA-2jfj-6hjv-fm6j | High | 0.3% | 04 Sep, 2026 | npm undici |
smol-toml: Denial of Service via malformed TOML documents CVE-2026-85730, GHSA-7w5x-hrqm-74c2 | High | 0.5% | 04 Sep, 2026 | npm smol-toml |
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write) CVE-2026-85651, GHSA-qxpp-qjg8-x4jv | High | 0.5% | 04 Sep, 2026 | npm trigger.dev |
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL CVE-2026-85650, GHSA-xxv7-2vv3-h682 | High | 0.3% | 04 Sep, 2026 | npm trigger.dev |
fastify vulnerable to header validation bypass via incomplete schema case normalization CVE-2026-84428, GHSA-9q9j-q6p8-xq58 | High | 0.5% | 04 Sep, 2026 | npm fastify |
fastify vulnerable to request body replacement via an async validation result collision CVE-2026-84504, GHSA-667r-xxjv-c9mm | High | 0.4% | 04 Sep, 2026 | npm fastify |
fastify vulnerable to request validation bypass via skipped boolean false schemas CVE-2026-84469, GHSA-hwr6-493r-vm6h | High | 0.5% | 04 Sep, 2026 | npm fastify |
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers CVE-2026-76169, GHSA-p68q-wchp-6fh7 | High | 0.5% | 04 Sep, 2026 | npm fastify |
toml-node: Uncontrolled Recursion CVE-2026-77465, GHSA-82x6-q7mm-w9cf | High | 0.6% | 03 Sep, 2026 | npm toml |
toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization CVE-2026-63376, GHSA-v5mp-jgw5-2x6j | High | 0.7% | 03 Sep, 2026 | npm toml |
Google Chromium V8 Type Confusion Vulnerability CVE-2026-85046 | HighExploited | 1.8% | 03 Sep, 2026 | |
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority CVE-2026-84394, GHSA-58mr-gqgx-xq4g | High | 0.4% | 03 Sep, 2026 | npm fast-uri |
Windows ML CLI: CORS misconfig enables localhost RCE CVE-2026-84452, GHSA-96p9-rh4f-92cf, PYSEC-2026-3944 | High | 1.6% | 02 Sep, 2026 | PyPI winml-cli |
fast-uri vulnerable to authority injection via an unvalidated port in serialize CVE-2026-84292, GHSA-qw65-cvwx-89v3 | High | 0.2% | 02 Sep, 2026 | npm fast-uri |
HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification) CVE-2026-84382, GHSA-8xx6-hgc6-gc2m, PYSEC-2026-3846 | High | 0.6% | 02 Sep, 2026 | PyPI httpx2 |
HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies CVE-2026-84381, GHSA-7mj9-2mp8-4m2p, PYSEC-2026-3844, PYSEC-2026-3845 | High | 0.1% | 02 Sep, 2026 | PyPI httpcore2 PyPI httpx2 |
TOON: Prototype pollution when decoding untrusted TOON input CVE-2026-82404, GHSA-p95v-992w-h6c3 | High | 0.7% | 02 Sep, 2026 | npm @toon-format/toon |
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources CVE-2026-84375, GHSA-2883-xcg3-v3hh | High | 0.5% | 01 Sep, 2026 | npm js-yaml |
Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path CVE-2026-84374, GHSA-c7r6-vx3h-w5g2 | High | 0.8% | 01 Sep, 2026 | Packagist maatwebsite/excel |
SonicWall SMA1000 Appliances OS Command Injection Vulnerability CVE-2026-83549 | HighExploited | 9.9% | 01 Sep, 2026 | |
SVGO: removeScripts allows executable links through namespace and control-character bypasses CVE-2026-84370, GHSA-w27v-7q3p-w38r | High | 0.5% | 01 Sep, 2026 | npm svgo |
Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default CVE-2026-84366, GHSA-76g3-c3x4-crvx, PYSEC-2026-3918 | High | 0.3% | 01 Sep, 2026 | PyPI scrapy |
Composer arbitrary command execution via a malicious package's Perforce source URL BIT-composer-2026-84361, CVE-2026-84361, GHSA-rvx4-ffvw-m9q3 | High | 0.5% | 01 Sep, 2026 | Packagist composer/composer |
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension CVE-2026-86428, GHSA-8rr7-cvq3-gmfh | High | 0.5% | 01 Sep, 2026 | Packagist league/commonmark |
league/commonmark: Denial of service in the SmartPunct and Attributes extensions CVE-2026-86429, GHSA-jjv6-8j6v-6j52 | High | 0.5% | 01 Sep, 2026 | Packagist league/commonmark |
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed CVE-2026-86431, GHSA-f8fg-pg57-v4j8 | High | 0.4% | 01 Sep, 2026 | Packagist league/commonmark |
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters CVE-2026-86430, GHSA-j8pm-gj4c-rq4x | High | 0.5% | 01 Sep, 2026 | Packagist league/commonmark |
tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34) CVE-2026-91990, GHSA-8423-8fgw-73vq | High | 0.4% | 01 Sep, 2026 | PyPI tornado |
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml CVE-2026-101043, GHSA-vx52-2968-3vc6 | High | 0.3% | 01 Sep, 2026 | npm pnpm |
pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project GHSA-2rx9-3g3h-c2jv | High | Not scored | 01 Sep, 2026 | npm pnpm |
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact GHSA-gqvg-gmmx-x4hm | High | Not scored | 01 Sep, 2026 | PyPI mlflow |
MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials GHSA-3f6p-5ww8-9rcr | High | Not scored | 01 Sep, 2026 | npm mysql2 |
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser CVE-2026-83619, GHSA-x4fp-j954-r2f4 | High | 0.5% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator CVE-2026-83618, GHSA-vr34-hp96-76pp | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator CVE-2026-83617, GHSA-jxjr-3g7g-3944 | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed CVE-2026-83616, GHSA-c7q8-3ch8-vqpv | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |