Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is CVE-2026-74882, GHSA-2592-7m3g-7fq6, PYSEC-2026-3744 | High | 0.2% | 17 Aug, 2026 | PyPI openssl-encrypt |
openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password cr CVE-2026-74871, GHSA-vxf9-vwp6-2w43, PYSEC-2026-3976 | Medium | 0.1% | 17 Aug, 2026 | PyPI openssl-encrypt |
openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist CVE-2026-74870, GHSA-p9g8-wvh4-2jmx, PYSEC-2026-3956 | High | 0.3% | 17 Aug, 2026 | PyPI openssl-encrypt |
Malicious release: Malicious code in @siwatfa/yorn (npm) GHSA-3rxm-r82c-h2f9, MAL-2026-14102 | Malicious | Not scored | 17 Aug, 2026 | npm @siwatfa/yorn |
Malicious release: Malicious code in runtime-health (npm) MAL-2026-14116 | Malicious | Not scored | 17 Aug, 2026 | npm runtime-health |
Malicious release: Malicious code in @ai-vertical/ai-agent (npm) GHSA-3248-8gvm-g9jv, MAL-2026-14070 | Malicious | Not scored | 17 Aug, 2026 | npm @ai-vertical/ai-agent |
Malicious release: Malicious code in kb-ai (PyPI) MAL-2026-14069 | Malicious | Not scored | 16 Aug, 2026 | PyPI kb-ai |
Malicious release: Malicious code in depcruise-wrap-stream-in-html (npm) GHSA-fr93-j26p-9j5f, MAL-2026-14068 | Malicious | Not scored | 15 Aug, 2026 | npm depcruise-wrap-stream-in-html |
Malicious release: Malicious code in upload-to-gcp (npm) MAL-2026-14067 | Malicious | Not scored | 15 Aug, 2026 | npm upload-to-gcp |
Malicious release: Malicious code in akamaijs-sensorv1 (npm) GHSA-vf6f-mfc3-9548, MAL-2026-14066 | Malicious | Not scored | 15 Aug, 2026 | npm akamaijs-sensorv1 |
Malicious release: Malicious code in akamai-sensor (npm) GHSA-5rgj-m8xx-vvvj, MAL-2026-14065 | Malicious | Not scored | 15 Aug, 2026 | npm akamai-sensor |
Malicious release: Malicious code in @finaxis/common-js (npm) MAL-2026-14064 | Malicious | Not scored | 15 Aug, 2026 | npm @finaxis/common-js |
Malicious release: Malicious code in adxaa (npm) MAL-2026-14058 | Malicious | Not scored | 15 Aug, 2026 | npm adxaa |
Malicious release: Malicious code in @openrepl/shared (npm) MAL-2026-14057 | Malicious | Not scored | 15 Aug, 2026 | npm @openrepl/shared |
Malicious release: Malicious code in fastly-vcl-language-client (npm) MAL-2026-14060 | Malicious | Not scored | 15 Aug, 2026 | npm fastly-vcl-language-client |
Malicious release: Malicious code in twilio-hackerone-poc-afe6937c (npm) MAL-2026-14063 | Malicious | Not scored | 15 Aug, 2026 | npm twilio-hackerone-poc-afe6937c |
Malicious release: Malicious code in hunterone-build-probe-9210 (npm) MAL-2026-14061 | Malicious | Not scored | 15 Aug, 2026 | npm hunterone-build-probe-9210 |
Malicious release: Malicious code in tw-pkgprobe-7731 (npm) MAL-2026-14062 | Malicious | Not scored | 15 Aug, 2026 | npm tw-pkgprobe-7731 |
Malicious release: Malicious code in autbank-core (npm) MAL-2026-14059 | Malicious | Not scored | 15 Aug, 2026 | npm autbank-core |
Malicious release: Malicious code in gunzip-js (npm) GHSA-2hqf-5jxh-4wp2, MAL-2026-14056 | Malicious | Not scored | 15 Aug, 2026 | npm gunzip-js |
Malicious release: Malicious code in depcruise-fmt (npm) GHSA-gh2x-96f9-2cgf, MAL-2026-14054 | Malicious | Not scored | 15 Aug, 2026 | npm depcruise-fmt |
Malicious release: Malicious code in depcruise-baseline (npm) GHSA-rgcp-8955-2r93, MAL-2026-14053 | Malicious | Not scored | 15 Aug, 2026 | npm depcruise-baseline |
Malicious release: Malicious code in harmony-app-toolkit (npm) MAL-2026-14055 | Malicious | Not scored | 15 Aug, 2026 | npm harmony-app-toolkit |
Malicious release: Malicious code in require-i18next (npm) MAL-2026-14052 | Malicious | Not scored | 15 Aug, 2026 | npm require-i18next |
Malicious release: Malicious code in kit-hydration-vim (npm) GHSA-g9cm-v642-m5rj, MAL-2026-14086 | Malicious | Not scored | 15 Aug, 2026 | npm kit-hydration-vim |
Malicious release: Malicious code in svelte-goal-vim (npm) GHSA-qx34-66jv-3pg5, MAL-2026-14096 | Malicious | Not scored | 15 Aug, 2026 | npm svelte-goal-vim |
Malicious release: Malicious code in @velliajs/discord (npm) MAL-2026-14051 | Malicious | Not scored | 14 Aug, 2026 | npm @velliajs/discord |
Malicious release: Malicious code in bcs-mini (npm) GHSA-9q3f-qc6p-62mm, MAL-2026-14076 | Malicious | Not scored | 14 Aug, 2026 | npm bcs-mini |
Malicious release: Malicious code in sui-gql-lite (npm) GHSA-r92j-xvgv-4q9c, MAL-2026-14095 | Malicious | Not scored | 14 Aug, 2026 | npm sui-gql-lite |
Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints CVE-2026-55156, GHSA-76pc-mqxp-3rq5 | Medium | 0.4% | 14 Aug, 2026 | npm @ooples/token-optimizer-mcp |
Token Optimizer MCP: OS command injection in smart_user via username in get-user-info CVE-2026-55157, GHSA-49mq-fc6q-3h46 | High | 0.9% | 14 Aug, 2026 | npm @ooples/token-optimizer-mcp |
Malicious release: Malicious code in @peptideventure/peptide-unit (npm) GHSA-73vr-mf4r-r3p5, MAL-2026-14072 | Malicious | Not scored | 14 Aug, 2026 | npm @peptideventure/peptide-unit |
Malicious release: Malicious code in @peptideventure/peptide-score-modifier (npm) GHSA-jw4c-f75m-9wfj, MAL-2026-14071 | Malicious | Not scored | 14 Aug, 2026 | npm @peptideventure/peptide-score-modifier |
Malicious release: Malicious code in @polymarkets/clob-client-v2 (npm) MAL-2026-14050 | Malicious | Not scored | 14 Aug, 2026 | npm @polymarkets/clob-client-v2 |
Malicious release: Malicious code in @mexc/shared-utils (npm) MAL-2026-14049 | Malicious | Not scored | 14 Aug, 2026 | npm @mexc/shared-utils |
Malicious release: Malicious code in @lodash-js/lodash-js (npm) MAL-2026-14048 | Malicious | Not scored | 14 Aug, 2026 | npm @lodash-js/lodash-js |
ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`) CVE-2026-53708, GHSA-9hgc-g3w5-67cm, PYSEC-2026-3684 | Medium | 0.4% | 14 Aug, 2026 | PyPI mcp-contextforge-gateway |
Malicious release: Malicious code in @guangnao/agent-proxy (npm) MAL-2026-14047 | Malicious | Not scored | 14 Aug, 2026 | npm @guangnao/agent-proxy |
Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter CVE-2026-53658, GHSA-xghw-p77p-3r7x, GO-2026-6234 | Medium | 0.4% | 14 Aug, 2026 | Go github.com/hyperledger/fabric-ca |
Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket CVE-2026-53657, GHSA-2j9v-p4xj-cjw2, GO-2026-6230 | High | 0.2% | 14 Aug, 2026 | Go github.com/lima-vm/lima Go github.com/lima-vm/lima/v2 |
Malicious release: Malicious code in @ghost_debugger/nanocache (npm) MAL-2026-14046 | Malicious | Not scored | 14 Aug, 2026 | npm @ghost_debugger/nanocache |
Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist CVE-2026-35219, GHSA-5fpj-28rv-84r7 | High | 0.5% | 14 Aug, 2026 | npm @budibase/server |
Malicious release: Malicious code in @ferudionz/webautomation (npm) MAL-2026-14045 | Malicious | Not scored | 14 Aug, 2026 | npm @ferudionz/webautomation |
Malicious release: Malicious code in @ferudionz/web_logger_js (npm) MAL-2026-14044 | Malicious | Not scored | 14 Aug, 2026 | npm @ferudionz/web_logger_js |
CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning CVE-2026-73846, GHSA-78x9-fhhx-v2g6 | Medium | 0.2% | 14 Aug, 2026 | npm @aborruso/ckan-mcp-server |
CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`) CVE-2026-73845, GHSA-83x6-42hr-jc76 | Medium | 0.4% | 14 Aug, 2026 | npm @aborruso/ckan-mcp-server |
CKAN MCP Server: Information disclosure via verbose error reflection CVE-2026-73844, GHSA-6f9w-9hf2-5rg3 | Low | 0.4% | 14 Aug, 2026 | npm @aborruso/ckan-mcp-server |
Malicious release: Malicious code in @divineubg/divine (npm) MAL-2026-14043 | Malicious | Not scored | 14 Aug, 2026 | npm @divineubg/divine |
Malicious release: Malicious code in @devmikets/hyperliquid-sdk (npm) MAL-2026-14042 | Malicious | Not scored | 14 Aug, 2026 | npm @devmikets/hyperliquid-sdk |
Excessive memory allocation during VP8L decoding in golang.org/x/image CVE-2026-46603, GO-2026-6222 | 0.4% | 14 Aug, 2026 | Go golang.org/x/image |