Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Enforce maximum recursion depth in encoding/asn1 BIT-golang-2026-33818, CVE-2026-33818, GO-2026-5972 | 0.6% | 13 Aug, 2026 | Go stdlib | |
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http BIT-golang-2026-56853, CVE-2026-56853, GO-2026-6089 | 0.6% | 13 Aug, 2026 | Go stdlib | |
Fix Javascript regexp context tracking in html/template BIT-golang-2026-56858, CVE-2026-56858, GO-2026-6091 | 0.3% | 13 Aug, 2026 | Go stdlib | |
Add recursion depth guard during decode in encoding/xml BIT-golang-2026-56859, CVE-2026-56859, GO-2026-6088 | 0.6% | 13 Aug, 2026 | Go stdlib | |
Avoid quadratic complexity in resolvePath in net/url BIT-golang-2026-56860, CVE-2026-56860, GO-2026-6218 | 0.5% | 13 Aug, 2026 | Go stdlib | |
Limit handshake messages we are willing to accept post-handshake in crypto/tls BIT-golang-2026-56862, CVE-2026-56862, GO-2026-6090 | 0.6% | 13 Aug, 2026 | Go stdlib | |
Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb BIT-golang-2026-56864, CVE-2026-56864, GO-2026-6180 | 0.3% | 13 Aug, 2026 | Go golang.org/x/mod Go toolchain | |
Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog BIT-golang-2026-56865, CVE-2026-56865, GO-2026-6179 | 0.1% | 13 Aug, 2026 | Go golang.org/x/mod Go toolchain | |
Malicious release: Malicious code in wct-st (npm) MAL-2026-13990 | Malicious | Not scored | 13 Aug, 2026 | npm wct-st |
Malicious release: Malicious code in webautomation_js (npm) MAL-2026-13991 | Malicious | Not scored | 13 Aug, 2026 | npm webautomation_js |
Malicious release: Malicious code in @secauditb20y/sec-test-r3b (npm) GHSA-h95w-3ffr-98m2, MAL-2026-13989 | Malicious | Not scored | 13 Aug, 2026 | npm @secauditb20y/sec-test-r3b |
Malicious release: Malicious code in root-locator (npm) GHSA-57g4-vm3v-74xg, MAL-2026-14009 | Malicious | Not scored | 13 Aug, 2026 | npm root-locator |
Malicious release: Malicious code in source-analyzer (npm) GHSA-p68g-6893-44r8, MAL-2026-14013 | Malicious | Not scored | 13 Aug, 2026 | npm source-analyzer |
Malicious release: Malicious code in path-match-js (npm) GHSA-cgj7-7fj2-6r74, MAL-2026-14005 | Malicious | Not scored | 13 Aug, 2026 | npm path-match-js |
Malicious release: Malicious code in react-shield (npm) GHSA-gmx3-395m-pwc2, MAL-2026-14007 | Malicious | Not scored | 13 Aug, 2026 | npm react-shield |
Malicious release: Malicious code in @jacksher/install-exec-poc (npm) GHSA-4fj2-wwv5-x646, MAL-2026-13972 | Malicious | Not scored | 13 Aug, 2026 | npm @jacksher/install-exec-poc |
Malicious release: Malicious code in node-config-svg-contract (npm) MAL-2026-13985 | Malicious | Not scored | 13 Aug, 2026 | npm node-config-svg-contract |
Malicious release: Malicious code in notafollower (npm) MAL-2026-13986 | Malicious | Not scored | 13 Aug, 2026 | npm notafollower |
Malicious release: Malicious code in datefmt-util-helper (npm) MAL-2026-13978 | Malicious | Not scored | 13 Aug, 2026 | npm datefmt-util-helper |
Malicious release: Malicious code in @khaznatech/common (npm) MAL-2026-13973 | Malicious | Not scored | 13 Aug, 2026 | npm @khaznatech/common |
Malicious release: Malicious code in @khaznatech/utils (npm) MAL-2026-13975 | Malicious | Not scored | 13 Aug, 2026 | npm @khaznatech/utils |
Malicious release: Malicious code in @khaznatech/core (npm) MAL-2026-13974 | Malicious | Not scored | 13 Aug, 2026 | npm @khaznatech/core |
Malicious release: Malicious code in check-audit (npm) GHSA-qqm3-3cpw-q9xx, MAL-2026-13976 | Malicious | Not scored | 13 Aug, 2026 | npm check-audit |
Malicious release: Malicious code in in-install (npm) GHSA-3qfv-pgqh-pvpw, MAL-2026-13982 | Malicious | Not scored | 13 Aug, 2026 | npm in-install |
Malicious release: Malicious code in cspell-esm (npm) GHSA-97mm-cxmj-h672, MAL-2026-13977 | Malicious | Not scored | 13 Aug, 2026 | npm cspell-esm |
Malicious release: Malicious code in napi-raw (npm) GHSA-588j-2jx3-7mqj, MAL-2026-13984 | Malicious | Not scored | 13 Aug, 2026 | npm napi-raw |
Malicious release: Malicious code in eslint-generate-prerelease (npm) GHSA-wqfp-7qwr-4r4g, MAL-2026-13979 | Malicious | Not scored | 13 Aug, 2026 | npm eslint-generate-prerelease |
Malicious release: Malicious code in knip-bun (npm) GHSA-xrrj-hrq9-xvxg, MAL-2026-13983 | Malicious | Not scored | 13 Aug, 2026 | npm knip-bun |
Malicious release: Malicious code in eslint-generate-release (npm) GHSA-3pw3-hc35-j73p, MAL-2026-13980 | Malicious | Not scored | 13 Aug, 2026 | npm eslint-generate-release |
Malicious release: Malicious code in eslint-publish-release (npm) GHSA-rqq3-8xp4-pvcq, MAL-2026-13981 | Malicious | Not scored | 13 Aug, 2026 | npm eslint-publish-release |
Malicious release: Malicious code in resolve-audit (npm) GHSA-69qf-g8jq-47xv, MAL-2026-13987 | Malicious | Not scored | 13 Aug, 2026 | npm resolve-audit |
Malicious release: Malicious code in @hzero-front-ui/cfg (npm) MAL-2026-13968 | Malicious | Not scored | 13 Aug, 2026 | npm @hzero-front-ui/cfg |
Malicious release: Malicious code in @hzero-front-ui/c7n-ui (npm) MAL-2026-13967 | Malicious | Not scored | 13 Aug, 2026 | npm @hzero-front-ui/c7n-ui |
Malicious release: Malicious code in @hzero-front-ui/core (npm) MAL-2026-13969 | Malicious | Not scored | 13 Aug, 2026 | npm @hzero-front-ui/core |
Malicious release: Malicious code in @hzero-front-ui/hzero-ui (npm) MAL-2026-13970 | Malicious | Not scored | 13 Aug, 2026 | npm @hzero-front-ui/hzero-ui |
Malicious release: Malicious code in @hzero-front-ui/themes (npm) MAL-2026-13971 | Malicious | Not scored | 13 Aug, 2026 | npm @hzero-front-ui/themes |
Malicious release: Malicious code in xrblocks-mcp (npm) MAL-2026-13988 | Malicious | Not scored | 13 Aug, 2026 | npm xrblocks-mcp |
Malicious release: Malicious code in tizen-webdriver-cli (npm) MAL-2026-13966 | Malicious | Not scored | 13 Aug, 2026 | npm tizen-webdriver-cli |
Malicious release: Malicious code in nc-verify-127942 (npm) MAL-2026-13965 | Malicious | Not scored | 13 Aug, 2026 | npm nc-verify-127942 |
Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS CVE-2026-73654, GHSA-p28v-f755-9qrg | High | 0.6% | 13 Aug, 2026 | npm @trigger.dev/core |
podman quadlet install --replace does not fully replace the old file CVE-2026-19730, GHSA-fx76-2j3w-2mx6, GO-2026-6588 | Medium | 0.1% | 13 Aug, 2026 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 +1 more |
Malicious release: Malicious code in @solana-js/web3 (npm) MAL-2026-13941 | Malicious | Not scored | 13 Aug, 2026 | npm @solana-js/web3 |
Malicious release: Malicious code in external-process-live-log (npm) MAL-2026-13949 | Malicious | Not scored | 13 Aug, 2026 | npm external-process-live-log |
Malicious release: Malicious code in @leonardo0902/vortex-kit (npm) MAL-2026-13939 | Malicious | Not scored | 13 Aug, 2026 | npm @leonardo0902/vortex-kit |
Malicious release: Malicious code in global-intel (npm) GHSA-gr4h-f42r-xcxf, MAL-2026-13952 | Malicious | Not scored | 13 Aug, 2026 | npm global-intel |
Malicious release: Malicious code in vexium-kit (npm) MAL-2026-13963 | Malicious | Not scored | 13 Aug, 2026 | npm vexium-kit |
Malicious release: Malicious code in @kolbo/mcp (npm) MAL-2026-13938 | Malicious | Not scored | 13 Aug, 2026 | npm @kolbo/mcp |
Malicious release: Malicious code in ventra-kit (npm) MAL-2026-13962 | Malicious | Not scored | 13 Aug, 2026 | npm ventra-kit |
Malicious release: Malicious code in prediction-trader (npm) MAL-2026-13959 | Malicious | Not scored | 13 Aug, 2026 | npm prediction-trader |
Malicious release: Malicious code in velora-kit (npm) GHSA-c48p-mmxp-3g9c, MAL-2026-13961 | Malicious | Not scored | 13 Aug, 2026 | npm velora-kit |