Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in secure-test-browser-232piklt (npm) GHSA-h4xp-qxgw-8mg7, MAL-2026-15268 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-232piklt |
Malicious release: Malicious code in secure-test-browser-c5iac3qm (npm) GHSA-jp3c-25c8-3f7g, MAL-2026-15320 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-c5iac3qm |
Malicious release: Malicious code in classlink-hl9uycka (npm) GHSA-jwm2-v249-p454, MAL-2026-15085 | Malicious | Not scored | 28 Aug, 2026 | npm classlink-hl9uycka |
Malicious release: Malicious code in secure-test-browser-ui1d892v (npm) GHSA-mhfm-7fc3-hc4j, MAL-2026-15436 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-ui1d892v |
Malicious release: Malicious code in secure-test-browser-y85jryx0 (npm) GHSA-pxvx-6hq4-g3fh, MAL-2026-15459 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-y85jryx0 |
Malicious release: Malicious code in secure-test-browser-o5kevayg (npm) GHSA-q8j2-vqch-m6f9, MAL-2026-15402 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-o5kevayg |
Malicious release: Malicious code in secure-test-browser-c9b32eoo (npm) GHSA-qq67-hwg6-v727, MAL-2026-15321 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-c9b32eoo |
Malicious release: Malicious code in secure-test-browser-7sktckna (npm) GHSA-vfx5-7jv6-5v35, MAL-2026-15300 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-7sktckna |
Malicious release: Malicious code in secure-test-browser-7s217blm (npm) GHSA-vv7g-9w9x-8hg3, MAL-2026-15299 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-7s217blm |
Malicious release: Malicious code in secure-test-browser-1pe78gsn (npm) GHSA-w2g7-jj6h-pr3j, MAL-2026-15264 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-1pe78gsn |
Malicious release: Malicious code in secure-test-browser-c2df2vbx (npm) GHSA-w98c-qqc7-4cfr, MAL-2026-15319 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-c2df2vbx |
Malicious release: Malicious code in secure-test-browser-ggbh6tng (npm) GHSA-wcx3-864p-wx7c, MAL-2026-15351 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-ggbh6tng |
Malicious release: Malicious code in secure-test-browser-7lp0evnc (npm) GHSA-wq25-mm66-7r52, MAL-2026-15298 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-7lp0evnc |
Malicious release: Malicious code in secure-test-browser-xynt39lg (npm) GHSA-wqj4-68pj-rg86, MAL-2026-15455 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-xynt39lg |
Malicious release: Malicious code in secure-test-browser-y4yd7ndu (npm) GHSA-wvqw-jc46-rh22, MAL-2026-15456 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-y4yd7ndu |
Malicious release: Malicious code in secure-test-browser-khflxpz7 (npm) GHSA-xf8p-w65g-3q5x, MAL-2026-15376 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-khflxpz7 |
Malicious release: Malicious code in secure-test-browser-1yjarnvk (npm) GHSA-6fwp-p6m6-f567, MAL-2026-15266 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-1yjarnvk |
Malicious release: Malicious code in secure-test-browser-z6d4ruii (npm) GHSA-6gqq-8v8v-hhwj, MAL-2026-15465 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-z6d4ruii |
Malicious release: Malicious code in secure-test-browser-r270knja (npm) GHSA-fpp3-rrjf-8849, MAL-2026-15416 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-r270knja |
Malicious release: Malicious code in secure-test-browser-ezbajpcd (npm) GHSA-rrh9-56m7-ww4w, MAL-2026-15339 | Malicious | Not scored | 28 Aug, 2026 | npm secure-test-browser-ezbajpcd |
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh CVE-2026-56854, GO-2026-6303 | 0.4% | 28 Aug, 2026 | Go golang.org/x/crypto | |
Malicious release: Malicious code in cacao1 (npm) MAL-2026-14591 | Malicious | Not scored | 28 Aug, 2026 | npm cacao1 |
Malicious release: Malicious code in yamlformat-tools (PyPI) MAL-2026-14589 | Malicious | Not scored | 28 Aug, 2026 | PyPI yamlformat-tools |
Malicious release: Malicious code in yamlformatter-utils (PyPI) MAL-2026-14590 | Malicious | Not scored | 28 Aug, 2026 | PyPI yamlformatter-utils |
Malicious release: Malicious code in pygame-renderkit (PyPI) MAL-2026-14587 | Malicious | Not scored | 28 Aug, 2026 | PyPI pygame-renderkit |
Malicious release: Malicious code in yaml-report-formatter (PyPI) MAL-2026-14588 | Malicious | Not scored | 28 Aug, 2026 | PyPI yaml-report-formatter |
Malicious release: Malicious code in @fleetbo/svro (npm) GHSA-4hrx-gqq5-q956, MAL-2026-14586 | Malicious | Not scored | 28 Aug, 2026 | npm @fleetbo/svro |
Malicious release: Malicious code in @znan/wabot (npm) GHSA-2jxx-8fv2-h8mj, MAL-2026-14585 | Malicious | Not scored | 28 Aug, 2026 | npm @znan/wabot |
Malicious release: Malicious code in pushgitquickx (npm) GHSA-wx29-h78g-ww4f, MAL-2026-14578 | Malicious | Not scored | 27 Aug, 2026 | npm pushgitquickx |
Malicious release: Malicious code in @hd-team/app-dnpkg-prod (npm) GHSA-35w7-82wv-vwxj, MAL-2026-14571 | Malicious | Not scored | 27 Aug, 2026 | npm @hd-team/app-dnpkg-prod |
Malicious release: Malicious code in @hd-team/app-dnpkg-beta (npm) GHSA-6p53-v557-745c, MAL-2026-14569 | Malicious | Not scored | 27 Aug, 2026 | npm @hd-team/app-dnpkg-beta |
Malicious release: Malicious code in @hd-team/app-impkg-prod (npm) GHSA-g7cq-7vcf-rp48, MAL-2026-14575 | Malicious | Not scored | 27 Aug, 2026 | npm @hd-team/app-impkg-prod |
Malicious release: Malicious code in @hd-team/app-impkg-test (npm) GHSA-hxxw-mprp-h9w7, MAL-2026-14576 | Malicious | Not scored | 27 Aug, 2026 | npm @hd-team/app-impkg-test |
Malicious release: Malicious code in @hd-team/app-dnpkg-three (npm) GHSA-qwcv-3958-fhq5, MAL-2026-14574 | Malicious | Not scored | 27 Aug, 2026 | npm @hd-team/app-dnpkg-three |
Malicious release: Malicious code in @hd-team/app-dnpkg-test (npm) GHSA-6fm3-xp27-2556, MAL-2026-14573 | Malicious | Not scored | 27 Aug, 2026 | npm @hd-team/app-dnpkg-test |
Malicious release: Malicious code in @hd-team/app-dnpkg-eight (npm) GHSA-97qc-463w-p2jr, MAL-2026-14570 | Malicious | Not scored | 27 Aug, 2026 | npm @hd-team/app-dnpkg-eight |
Malicious release: Malicious code in @hd-team/app-dnpkg-ten (npm) GHSA-q7mf-7f69-7qpr, MAL-2026-14572 | Malicious | Not scored | 27 Aug, 2026 | npm @hd-team/app-dnpkg-ten |
Malicious release: Malicious code in flyteplugins-redis (PyPI) MAL-2026-14584 | Malicious | Not scored | 27 Aug, 2026 | PyPI flyteplugins-redis |
Malicious release: Malicious code in flyteplugins-nsight (PyPI) MAL-2026-14583 | Malicious | Not scored | 27 Aug, 2026 | PyPI flyteplugins-nsight |
Malicious release: Malicious code in flyteplugins-agento11y (PyPI) MAL-2026-14581 | Malicious | Not scored | 27 Aug, 2026 | PyPI flyteplugins-agento11y |
Malicious release: Malicious code in flyteplugins-echo (PyPI) MAL-2026-14582 | Malicious | Not scored | 27 Aug, 2026 | PyPI flyteplugins-echo |
Malicious release: Malicious code in svelte-ui-dlx (npm) GHSA-7qq8-vjh5-hpgw, MAL-2026-14579 | Malicious | Not scored | 27 Aug, 2026 | npm svelte-ui-dlx |
Malicious release: Malicious code in hydration-ui-dlx (npm) GHSA-j5x7-qc6j-xwg4, MAL-2026-14577 | Malicious | Not scored | 27 Aug, 2026 | npm hydration-ui-dlx |
mongodb: Reject "." and NUL bytes in database and collection names CVE-2026-81525, GHSA-65fr-j4p9-vc33 | High | 0.5% | 27 Aug, 2026 | Packagist mongodb/mongodb |
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint CVE-2026-37004, GHSA-6wvf-77m9-58rm, PYSEC-2026-3861 | Critical | 0.8% | 27 Aug, 2026 | PyPI litellm |
Malicious release: Malicious code in tailwindcss-3d-animate (npm) GHSA-683p-54mf-9297, MAL-2026-14567 | Malicious | Not scored | 27 Aug, 2026 | npm tailwindcss-3d-animate |
Malicious release: Malicious code in tailwindcss-form-styles (npm) GHSA-8wj9-gw6r-6vqh, MAL-2026-14568 | Malicious | Not scored | 27 Aug, 2026 | npm tailwindcss-form-styles |
Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check CVE-2026-105163, GHSA-mf7q-r4rv-jv94, GO-2026-6302 | High | 0.3% | 27 Aug, 2026 | Go github.com/crossplane/crossplane-runtime/v2 |
libreoffice-convert vulnerable to path traversal / arbitrary file write CVE-2026-54732, GHSA-gmxc-r82q-347r | Medium | 0.4% | 27 Aug, 2026 | npm libreoffice-convert |
NLTK: Downloader.download follows hardlinks and overwrites outside-root files CVE-2026-81727, GHSA-f794-5jv7-7672, PYSEC-2026-3741 | Medium | 0.2% | 27 Aug, 2026 | PyPI nltk |