Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in sme-rko-finance-front-operations-pegasus (npm) MAL-2026-13644 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-operations-pegasus |
Malicious release: Malicious code in sme-rko-finance-front-operations-widget-models (npm) MAL-2026-13652 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-operations-widget-models |
Malicious release: Malicious code in sme-rko-finance-front-payments-feed-display-list-impl (npm) MAL-2026-13663 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-payments-feed-display-list-impl |
Malicious release: Malicious code in sme-rko-finance-front-operations-widget-impl (npm) MAL-2026-13651 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-operations-widget-impl |
Malicious release: Malicious code in sme-rko-finance-front-operations-holding-domain (npm) MAL-2026-13638 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-operations-holding-domain |
Malicious release: Malicious code in sme-rko-finance-front-operations-providers (npm) MAL-2026-13646 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-operations-providers |
Malicious release: Malicious code in sme-rko-finance-front-payments-feed-display-list (npm) MAL-2026-13662 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-payments-feed-display-list |
Malicious release: Malicious code in sme-rko-finance-front-operations-special-payments (npm) MAL-2026-13648 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-operations-special-payments |
Malicious release: Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl (npm) MAL-2026-13657 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl |
Malicious release: Malicious code in sme-rko-finance-front-operations-notifications-models (npm) MAL-2026-13641 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-operations-notifications-models |
Malicious release: Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models (npm) MAL-2026-13658 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models |
Malicious release: Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm) MAL-2026-13654 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-payments-allowed-tariffs-filter |
Malicious release: Malicious code in sme-rko-finance-front-operations-shared (npm) MAL-2026-13647 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-operations-shared |
Malicious release: Malicious code in sme-rko-finance-front-operations-overnight (npm) MAL-2026-13643 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-operations-overnight |
Malicious release: Malicious code in sme-rko-finance-front-payment-registers-operations-domain (npm) MAL-2026-13653 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-payment-registers-operations-domain |
Malicious release: Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models (npm) MAL-2026-13656 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models |
Malicious release: Malicious code in sme-rko-finance-front-operations-income (npm) MAL-2026-13639 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-operations-income |
Malicious release: Malicious code in sme-rko-finance-front-operations-feed-impl (npm) MAL-2026-13636 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-operations-feed-impl |
Malicious release: Malicious code in sme-rko-finance-front-operations-penalty (npm) MAL-2026-13645 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-operations-penalty |
Malicious release: Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl (npm) MAL-2026-13655 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl |
Malicious release: Malicious code in sme-rko-finance-front-operations-feed-models (npm) MAL-2026-13637 | Malicious | Not scored | 08 Aug, 2026 | npm sme-rko-finance-front-operations-feed-models |
Segv on unknown address in match_many_CHARACTER_REV OSV-2026-1125 | Not scored | 08 Aug, 2026 | PyPI mrab-regex | |
JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login BIT-jupyterhub-2026-54338, CVE-2026-54338, GHSA-p43p-whwx-q52h, PYSEC-2026-3853 | Medium | 0.4% | 07 Aug, 2026 | PyPI jupyterhub |
pypdf: Possible large memory usage for large /ToUnicode streams CVE-2026-71870, GHSA-fp3f-mc75-235c, PYSEC-2026-3655 | Medium | 0.1% | 07 Aug, 2026 | PyPI pypdf |
Kirby: System path exposure from error messages in the REST API CVE-2026-69127, GHSA-rf2p-vh74-7vvh | Medium | 0.7% | 07 Aug, 2026 | Packagist getkirby/cms |
pypdf: Possible long runtimes/large memory usage for large CID font width ranges CVE-2026-71852, GHSA-fwg2-594c-jp42, PYSEC-2026-3656 | Medium | 0.1% | 07 Aug, 2026 | PyPI pypdf |
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain CVE-2026-71851, GHSA-rg76-677x-56q9 | Critical | 0.5% | 07 Aug, 2026 | npm crypto-js |
Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure CVE-2026-71850, GHSA-f23p-vx2j-j53r | Medium | 0.3% | 07 Aug, 2026 | npm hono |
Hono: Proxy Helper does not remove response headers listed in the `Connection` header CVE-2026-71849, GHSA-79qm-7rj5-m7r9 | Low | 0.4% | 07 Aug, 2026 | npm hono |
Hono: Algorithmic Complexity DoS in Language Middleware CVE-2026-71848, GHSA-54fx-42gc-7vw4 | Medium | 0.5% | 07 Aug, 2026 | npm hono |
Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams CVE-2026-71847, GHSA-9hj4-r449-hfvc | Low | 0.4% | 07 Aug, 2026 | RubyGems json |
Malicious release: Malicious code in streak-map-kit (npm) GHSA-w8wc-wm2m-27hv, MAL-2026-13628 | Malicious | Not scored | 07 Aug, 2026 | npm streak-map-kit |
Malicious release: Malicious code in @nestjs-passport/jwt (npm) MAL-2026-13627 | Malicious | Not scored | 07 Aug, 2026 | npm @nestjs-passport/jwt |
Malicious release: Malicious code in svelte-map-visual (npm) GHSA-5qqf-5c4c-p53q, MAL-2026-13678 | Malicious | Not scored | 07 Aug, 2026 | npm svelte-map-visual |
Malicious release: Malicious code in svelte-cache-kit (npm) GHSA-9qqc-qrf8-gp8j, MAL-2026-13676 | Malicious | Not scored | 07 Aug, 2026 | npm svelte-cache-kit |
Malicious release: Malicious code in @mrbenty8jf1p9y5/oidc-bind-canary (npm) MAL-2026-13626 | Malicious | Not scored | 07 Aug, 2026 | npm @mrbenty8jf1p9y5/oidc-bind-canary |
Malicious release: Malicious code in @depup/memfs (npm) MAL-2026-13624 | Malicious | Not scored | 07 Aug, 2026 | npm @depup/memfs |
Malicious release: Malicious code in @depup/nuxt (npm) MAL-2026-13625 | Malicious | Not scored | 07 Aug, 2026 | npm @depup/nuxt |
Malicious release: Malicious code in @depup/astro (npm) MAL-2026-13622 | Malicious | Not scored | 07 Aug, 2026 | npm @depup/astro |
Malicious release: Malicious code in @depup/aws-sdk__credential-provider-process (npm) MAL-2026-13623 | Malicious | Not scored | 07 Aug, 2026 | npm @depup/aws-sdk__credential-provider-process |
Malicious release: Malicious code in @decido/backend-core (npm) MAL-2026-13621 | Malicious | Not scored | 07 Aug, 2026 | npm @decido/backend-core |
Malicious release: Malicious code in @lambda-platform/lambda-vue (npm) GHSA-jm85-g3fj-922w, MAL-2026-13668 | Malicious | Not scored | 07 Aug, 2026 | npm @lambda-platform/lambda-vue |
Malicious release: Malicious code in @catamania/front-components (npm) MAL-2026-13620 | Malicious | Not scored | 07 Aug, 2026 | npm @catamania/front-components |
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header CVE-2026-66062, GHSA-29g2-3rmr-qm68 | Medium | 0.5% | 07 Aug, 2026 | npm @sveltejs/kit |
Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint CVE-2026-72744, GHSA-7c4v-fwgw-9rf7 | Medium | 0.2% | 07 Aug, 2026 | npm nuxt |
go-git: Malicious reference names may modify files outside the reference storage CVE-2026-71557, GHSA-qgq7-7hm3-q39j, GO-2026-6214 | Medium | 0.4% | 07 Aug, 2026 | Go github.com/go-git/go-git/v5 Go github.com/go-git/go-git/v6 |
go-git: Worktree operations may follow symlinks CVE-2026-71556, GHSA-hc8v-wwc9-vgxm, GO-2026-6213 | High | 0.4% | 07 Aug, 2026 | Go github.com/go-git/go-git/v5 Go github.com/go-git/go-git/v6 |
Malicious release: Malicious code in aclade-agent (npm) MAL-2026-13614 | Malicious | Not scored | 07 Aug, 2026 | npm aclade-agent |
Malicious release: Malicious code in w-screenctl (npm) MAL-2026-13618 | Malicious | Not scored | 07 Aug, 2026 | npm w-screenctl |
Malicious release: Malicious code in agenthub-ai (npm) MAL-2026-13615 | Malicious | Not scored | 07 Aug, 2026 | npm agenthub-ai |