Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in chai-as-reformed (npm) MAL-2026-13942 | Malicious | Not scored | 13 Aug, 2026 | npm chai-as-reformed |
Malicious release: Malicious code in functions-framework-nodejs (npm) MAL-2026-13951 | Malicious | Not scored | 13 Aug, 2026 | npm functions-framework-nodejs |
Malicious release: Malicious code in cilm-ui-commons (npm) MAL-2026-13943 | Malicious | Not scored | 13 Aug, 2026 | npm cilm-ui-commons |
Malicious release: Malicious code in copytrade-core (npm) MAL-2026-13944 | Malicious | Not scored | 13 Aug, 2026 | npm copytrade-core |
Malicious release: Malicious code in fmt-util-k7x2 (npm) MAL-2026-13950 | Malicious | Not scored | 13 Aug, 2026 | npm fmt-util-k7x2 |
Malicious release: Malicious code in process-live-log (npm) MAL-2026-13960 | Malicious | Not scored | 13 Aug, 2026 | npm process-live-log |
Malicious release: Malicious code in @ethers-js/contracts (npm) MAL-2026-13937 | Malicious | Not scored | 13 Aug, 2026 | npm @ethers-js/contracts |
Malicious release: Malicious code in @opezneppelin/contracts (npm) MAL-2026-13940 | Malicious | Not scored | 13 Aug, 2026 | npm @opezneppelin/contracts |
Malicious release: Malicious code in npm-hex-utils (npm) MAL-2026-13956 | Malicious | Not scored | 13 Aug, 2026 | npm npm-hex-utils |
Malicious release: Malicious code in js-assert-plus (npm) MAL-2026-13953 | Malicious | Not scored | 13 Aug, 2026 | npm js-assert-plus |
Malicious release: Malicious code in minimalistic-assert-plus (npm) MAL-2026-13954 | Malicious | Not scored | 13 Aug, 2026 | npm minimalistic-assert-plus |
Malicious release: Malicious code in power-assert-plus (npm) MAL-2026-13958 | Malicious | Not scored | 13 Aug, 2026 | npm power-assert-plus |
Malicious release: Malicious code in postcss-initialize-plugin (npm) MAL-2026-13957 | Malicious | Not scored | 13 Aug, 2026 | npm postcss-initialize-plugin |
Malicious release: Malicious code in debug-proxy-chrome-devtools (npm) MAL-2026-13948 | Malicious | Not scored | 13 Aug, 2026 | npm debug-proxy-chrome-devtools |
Malicious release: Malicious code in date-fmt-helper-xz (npm) MAL-2026-13946 | Malicious | Not scored | 13 Aug, 2026 | npm date-fmt-helper-xz |
Malicious release: Malicious code in date-fmt-utils-helper (npm) MAL-2026-13947 | Malicious | Not scored | 13 Aug, 2026 | npm date-fmt-utils-helper |
Malicious release: Malicious code in core-js-buffer (npm) MAL-2026-13945 | Malicious | Not scored | 13 Aug, 2026 | npm core-js-buffer |
Malicious release: Malicious code in index-design-system (npm) GHSA-2mmx-39f8-r8rm, MAL-2026-14002 | Malicious | Not scored | 13 Aug, 2026 | npm index-design-system |
Malicious release: Malicious code in finvu-hdfc-sdk (npm) GHSA-h83v-q7wq-gvgf, MAL-2026-14001, SNYK-JS-FINVUHDFCSDK-18758934 | Malicious | Not scored | 13 Aug, 2026 | npm finvu-hdfc-sdk |
Malicious release: Malicious code in @dsp-next-gen-ui/needs-review (npm) GHSA-r336-hh6w-xp9q, MAL-2026-13995 | Malicious | Not scored | 13 Aug, 2026 | npm @dsp-next-gen-ui/needs-review |
Malicious release: Malicious code in blocks-angular (npm) GHSA-v98x-q47m-h6qf, MAL-2026-14000 | Malicious | Not scored | 13 Aug, 2026 | npm blocks-angular |
Malicious release: Malicious code in @caspianph/third-npm-package (npm) GHSA-g4m3-cq7f-6f85, MAL-2026-13994 | Malicious | Not scored | 13 Aug, 2026 | npm @caspianph/third-npm-package |
Malicious release: Malicious code in @caspianph/second-npm-package (npm) GHSA-qmxg-fj5j-hjx8, MAL-2026-13993 | Malicious | Not scored | 13 Aug, 2026 | npm @caspianph/second-npm-package |
Malicious release: Malicious code in @caspianph/first-npm-package (npm) GHSA-r6j8-4ffv-6mcj, MAL-2026-13992 | Malicious | Not scored | 13 Aug, 2026 | npm @caspianph/first-npm-package |
Malicious release: Malicious code in try-lock-runner (npm) GHSA-5wp3-7whm-64mv, MAL-2026-14014 | Malicious | Not scored | 13 Aug, 2026 | npm try-lock-runner |
Malicious release: Malicious code in async-lock-queue (npm) GHSA-h6x7-5w93-p56j, MAL-2026-13999 | Malicious | Not scored | 13 Aug, 2026 | npm async-lock-queue |
Malicious release: Malicious code in single-flight-lock (npm) GHSA-m29h-wrvw-xpqw, MAL-2026-14012 | Malicious | Not scored | 13 Aug, 2026 | npm single-flight-lock |
Malicious release: Malicious code in mutex-forge (npm) GHSA-2gqm-6m3p-62g5, MAL-2026-13955 | Malicious | Not scored | 13 Aug, 2026 | npm mutex-forge |
Malicious release: Malicious code in lock-deadline-guard (npm) GHSA-c74f-2wp8-f38r, MAL-2026-14004 | Malicious | Not scored | 13 Aug, 2026 | npm lock-deadline-guard |
Malicious release: Malicious code in priority-mutex-lane (npm) GHSA-fx8h-qw3r-xvf3, MAL-2026-14006 | Malicious | Not scored | 13 Aug, 2026 | npm priority-mutex-lane |
Malicious release: Malicious code in semaphore-job-pool (npm) GHSA-m4rw-m6pc-rjrx, MAL-2026-14010 | Malicious | Not scored | 13 Aug, 2026 | npm semaphore-job-pool |
Malicious release: Malicious code in resource-lease-pool (npm) GHSA-mf7m-8rhh-j3vr, MAL-2026-14008 | Malicious | Not scored | 13 Aug, 2026 | npm resource-lease-pool |
Malicious release: Malicious code in shared-slot-gate (npm) GHSA-r7rw-hjv5-9hcj, MAL-2026-14011 | Malicious | Not scored | 13 Aug, 2026 | npm shared-slot-gate |
Malicious release: Malicious code in keyed-mutex-map (npm) GHSA-vcgv-x4wj-fr9f, MAL-2026-14003 | Malicious | Not scored | 13 Aug, 2026 | npm keyed-mutex-map |
Malicious release: Malicious code in async-critical-section (npm) GHSA-wpw5-2h95-j823, MAL-2026-13998 | Malicious | Not scored | 13 Aug, 2026 | npm async-critical-section |
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability CVE-2026-73570 | HighExploited | 71.7% | 13 Aug, 2026 | |
vLLM: Completion prompt lists fan out into unbounded engine requests CVE-2026-73559, GHSA-87x5-vmc3-756j, PYSEC-2026-3704 | Medium | 0.6% | 13 Aug, 2026 | PyPI vllm |
Malicious release: Malicious code in ts-enum-helper (npm) GHSA-7q63-6v9w-j7mf, MAL-2026-14015 | Malicious | Not scored | 13 Aug, 2026 | npm ts-enum-helper |
vLLM: Cross-User Data Leak Vulnerability CVE-2026-73558, GHSA-7m6h-x95x-82q5, PYSEC-2026-3935 | Medium | 0.4% | 13 Aug, 2026 | PyPI vllm |
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts CVE-2026-73557, GHSA-pr7f-p5mw-fc87, PYSEC-2026-3938 | Medium | 0.2% | 13 Aug, 2026 | PyPI vllm |
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m CVE-2026-73556, GHSA-48jh-3gj7-fg8v, PYSEC-2026-3933 | Medium | 0.5% | 13 Aug, 2026 | PyPI vllm |
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages CVE-2026-73555, GHSA-hwrm-c4cx-rf4j, PYSEC-2026-3937 | Medium | 0.4% | 13 Aug, 2026 | PyPI vllm |
Malicious release: Malicious code in ai-analyzer (npm) GHSA-fqv8-262c-j5xv, MAL-2026-13934 | Malicious | Not scored | 13 Aug, 2026 | npm ai-analyzer |
Malicious release: Malicious code in datetime-format-xutil (npm) MAL-2026-13936 | Malicious | Not scored | 13 Aug, 2026 | npm datetime-format-xutil |
Malicious release: Malicious code in datetime-fmt-xutil (npm) MAL-2026-13935 | Malicious | Not scored | 13 Aug, 2026 | npm datetime-fmt-xutil |
atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read CVE-2026-91989, GHSA-rm43-82j9-r4mj | High | 1.3% | 13 Aug, 2026 | PyPI atomic-agents-stack |
Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892) BIT-argo-workflows-2026-54526, CVE-2026-54526, GHSA-48p8-g2fx-3wwm, GO-2026-6223 | High | 0.6% | 13 Aug, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 Go github.com/argoproj/argo-workflows/v4 |
hashi-vault-js: Vault token and secret values exposed in thrown errors CVE-2026-55102, GHSA-5pq8-3ffp-7w5m | Medium | 0.2% | 13 Aug, 2026 | npm hashi-vault-js |
ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token CVE-2026-55088, GHSA-vqfp-p66c-xrp9 | Medium | 0.4% | 13 Aug, 2026 | npm ep_etherpad-lite |
ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite CVE-2026-55086, GHSA-2jwf-f4xq-f24h | Medium | 0.1% | 13 Aug, 2026 | npm ep_etherpad-lite |