Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Faker: helpers.fake exploitable into arbritary code execution CVE-2026-73231, GHSA-qxc2-j82w-r537 | High | 0.2% | 11 Aug, 2026 | npm @faker-js/faker |
Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests CVE-2026-73229, GHSA-g47c-3xmw-q6m2, PYSEC-2026-3828 | Medium | 0.4% | 11 Aug, 2026 | PyPI djangorestframework |
Malicious release: Malicious code in joule-sbx-poc (PyPI) MAL-2026-13756 | Malicious | Not scored | 11 Aug, 2026 | PyPI joule-sbx-poc |
Malicious release: Malicious code in telebot-pro (PyPI) MAL-2026-13757 | Malicious | Not scored | 11 Aug, 2026 | PyPI telebot-pro |
Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data` CVE-2026-73228, GHSA-2m8g-3cmr-wg3w, PYSEC-2026-3827 | Medium | 0.6% | 11 Aug, 2026 | PyPI djangorestframework |
Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio) CVE-2026-73222, GHSA-79wm-x847-7cvg | High | 0.3% | 11 Aug, 2026 | npm claude-code-templates |
Malicious release: Malicious code in chapters-core (npm) MAL-2026-13752 | Malicious | Not scored | 11 Aug, 2026 | npm chapters-core |
Malicious release: Malicious code in bjm-low-code-components (npm) MAL-2026-13751 | Malicious | Not scored | 11 Aug, 2026 | npm bjm-low-code-components |
Malicious release: Malicious code in @dgn-src-click-to-pay-org/srcdcfreleasecert (npm) MAL-2026-13744 | Malicious | Not scored | 11 Aug, 2026 | npm @dgn-src-click-to-pay-org/srcdcfreleasecert |
Malicious release: Malicious code in dcfarguscert (npm) MAL-2026-13753 | Malicious | Not scored | 11 Aug, 2026 | npm dcfarguscert |
Malicious release: Malicious code in base65-77x (npm) MAL-2026-13750 | Malicious | Not scored | 11 Aug, 2026 | npm base65-77x |
Malicious release: Malicious code in base65-33x (npm) MAL-2026-13749 | Malicious | Not scored | 11 Aug, 2026 | npm base65-33x |
Malicious release: Malicious code in base65-15x (npm) MAL-2026-13748 | Malicious | Not scored | 11 Aug, 2026 | npm base65-15x |
Adobe Commerce and Magento Incorrect Authorization Vulnerability CVE-2026-71362 | CriticalExploited | 90.5% | 11 Aug, 2026 | |
Malicious release: Malicious code in whs4_ued (npm) MAL-2026-13743 | Malicious | Not scored | 11 Aug, 2026 | npm whs4_ued |
Malicious release: Malicious code in zeal-rq-hooks (npm) MAL-2026-13742 | Malicious | Not scored | 11 Aug, 2026 | npm zeal-rq-hooks |
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM CVE-2026-73089, GHSA-c83g-rgw3-j3cx | High | 0.7% | 11 Aug, 2026 | npm browserslist |
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) CVE-2026-73088, GHSA-73wf-gq98-2v4g | High | 0.7% | 11 Aug, 2026 | npm browserslist |
nanoid: Integer Overflow or Wraparound CVE-2026-73086, GHSA-xwg4-73v4-xw9w | High | 0.3% | 11 Aug, 2026 | npm nanoid |
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability CVE-2026-68820 | HighExploited | 8.6% | 11 Aug, 2026 | |
Microsoft SharePoint Code Injection Vulnerability CVE-2026-65660 | HighExploited | 8.2% | 11 Aug, 2026 | |
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability CVE-2026-20349 | HighExploited | 1.0% | 11 Aug, 2026 | |
Malicious release: Malicious code in svelte-vim-kit (npm) GHSA-rvh4-87p7-h5pm, MAL-2026-13769 | Malicious | Not scored | 11 Aug, 2026 | npm svelte-vim-kit |
Malicious release: Malicious code in sui-gql-client (npm) GHSA-2ggf-86xw-xjp5, MAL-2026-13768 | Malicious | Not scored | 11 Aug, 2026 | npm sui-gql-client |
Malicious release: Malicious code in sui-bcs-codec (npm) GHSA-2wqc-3243-4hxm, MAL-2026-13767 | Malicious | Not scored | 11 Aug, 2026 | npm sui-bcs-codec |
Malicious release: Malicious code in bs58-13 (npm) GHSA-72pr-qcvq-fgpg, MAL-2026-13760 | Malicious | Not scored | 11 Aug, 2026 | npm bs58-13 |
Malicious release: Malicious code in base65-12x (npm) GHSA-c4w7-m3hx-xx75, MAL-2026-13746 | Malicious | Not scored | 11 Aug, 2026 | npm base65-12x |
Malicious release: Malicious code in base65-13x (npm) GHSA-fp83-xcpx-v3qm, MAL-2026-13747 | Malicious | Not scored | 11 Aug, 2026 | npm base65-13x |
Malicious release: Malicious code in bs58-11 (npm) GHSA-mw39-7442-3p8m, MAL-2026-13758 | Malicious | Not scored | 11 Aug, 2026 | npm bs58-11 |
Malicious release: Malicious code in bs58-12 (npm) GHSA-x9c8-g63x-mh7q, MAL-2026-13759 | Malicious | Not scored | 11 Aug, 2026 | npm bs58-12 |
Malicious release: Malicious code in base65-11x (npm) GHSA-39c6-h85q-hpcw, MAL-2026-13745 | Malicious | Not scored | 11 Aug, 2026 | npm base65-11x |
Malicious release: Malicious code in dakumangalsingh_virus (npm) GHSA-ppp3-vpgx-2v73, MAL-2026-13761 | Malicious | Not scored | 11 Aug, 2026 | npm dakumangalsingh_virus |
SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle BIT-seaweedfs-2026-73080, CVE-2026-73080, GHSA-87fv-vqqr-m4jr, GO-2026-6219 | Critical | 0.5% | 11 Aug, 2026 | Go github.com/seaweedfs/seaweedfs |
Malicious release: Malicious code in @nzeros/codebreak (npm) MAL-2026-13736 | Malicious | Not scored | 11 Aug, 2026 | npm @nzeros/codebreak |
SWC HTML minifier may allow script element breakout when minifying embedded JSON CVE-2026-72925, GHSA-5qr2-v392-m9g8 | Medium | 0.3% | 11 Aug, 2026 | crates.io swc_html_minifier npm @swc/html |
Malicious release: Malicious code in @openzeppelin-4/contracts (npm) MAL-2026-13737 | Malicious | Not scored | 11 Aug, 2026 | npm @openzeppelin-4/contracts |
Malicious release: Malicious code in @openzeppelin-5/contracts (npm) MAL-2026-13738 | Malicious | Not scored | 11 Aug, 2026 | npm @openzeppelin-5/contracts |
Malicious release: Malicious code in safe-local-env-loader (npm) MAL-2026-13741 | Malicious | Not scored | 11 Aug, 2026 | npm safe-local-env-loader |
Malicious release: Malicious code in kit-vim-map (npm) GHSA-mj69-vr76-h2mq, MAL-2026-13740 | Malicious | Not scored | 11 Aug, 2026 | npm kit-vim-map |
Malicious release: Malicious code in node-internal-svg-loader (npm) GHSA-9rgf-6m2p-q73f, MAL-2026-13766 | Malicious | Not scored | 11 Aug, 2026 | npm node-internal-svg-loader |
Malicious release: Malicious code in developer-dashboard (npm) GHSA-vf74-54mr-mp44, MAL-2026-13762 | Malicious | Not scored | 11 Aug, 2026 | npm developer-dashboard |
Malicious release: Malicious code in newtun (npm) MAL-2026-13733 | Malicious | Not scored | 11 Aug, 2026 | npm newtun |
Malicious release: Malicious code in joule-btp-extension (PyPI) MAL-2026-13732 | Malicious | Not scored | 11 Aug, 2026 | PyPI joule-btp-extension |
Malicious release: Malicious code in dependencyfsdsfdsfg (npm) GHSA-6xhq-px35-hhv9, MAL-2026-13754 | Malicious | Not scored | 11 Aug, 2026 | npm dependencyfsdsfdsfg |
Malicious release: Malicious code in ghazaly (npm) GHSA-g62q-mq3x-765x, MAL-2026-13755 | Malicious | Not scored | 11 Aug, 2026 | npm ghazaly |
Malicious release: Malicious code in fetch-runtime (npm) GHSA-3hqj-592v-g33j, MAL-2026-13763 | Malicious | Not scored | 11 Aug, 2026 | npm fetch-runtime |
Malicious release: Malicious code in lines-columns (npm) GHSA-572q-x4v9-m474, MAL-2026-13765 | Malicious | Not scored | 11 Aug, 2026 | npm lines-columns |
Malicious release: Malicious code in euler-sdk (PyPI) MAL-2026-13730 | Malicious | Not scored | 11 Aug, 2026 | PyPI euler-sdk |
Malicious release: Malicious code in morpho-sdk (PyPI) MAL-2026-13731 | Malicious | Not scored | 11 Aug, 2026 | PyPI morpho-sdk |
TYPO3 CMS - Broken Access Control in Backend and Install Tool CVE-2026-19418, GHSA-68jx-f42c-7599 | High | 0.2% | 11 Aug, 2026 | Packagist typo3/cms-backend Packagist typo3/cms-core |