Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in ts-utility-plus (npm) MAL-2026-13617 | Malicious | Not scored | 07 Aug, 2026 | npm ts-utility-plus |
Malicious release: Malicious code in hardhat-cap (npm) GHSA-3jrx-49jf-x2rp, MAL-2026-13616 | Malicious | Not scored | 07 Aug, 2026 | npm hardhat-cap |
Malicious release: Malicious code in atlas-internal (PyPI) MAL-2026-13619 | Malicious | Not scored | 07 Aug, 2026 | PyPI atlas-internal |
GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution CVE-2026-76220, GHSA-wvpp-8hx9-p66j, PYSEC-2026-3843 | High | 0.6% | 07 Aug, 2026 | PyPI GitPython PyPI gitpython |
GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE) CVE-2026-76221, GHSA-jm78-9fvv-mhgr, PYSEC-2026-3783 | High | 0.5% | 07 Aug, 2026 | PyPI GitPython PyPI gitpython |
GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython CVE-2026-76222, GHSA-hmq2-w58f-27jc, PYSEC-2026-3784 | High | 0.4% | 07 Aug, 2026 | PyPI GitPython PyPI gitpython |
GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout() CVE-2026-76217, GHSA-hh9p-6wh2-4mfc, PYSEC-2026-3841 | High | 0.4% | 07 Aug, 2026 | PyPI GitPython PyPI gitpython |
GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks CVE-2026-76218, GHSA-9rj7-rf2p-w77r, PYSEC-2026-3840 | High | 0.7% | 07 Aug, 2026 | PyPI GitPython PyPI gitpython |
GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite CVE-2026-76219, GHSA-4gmw-gg2m-w46p, PYSEC-2026-3838 | High | 0.5% | 07 Aug, 2026 | PyPI GitPython PyPI gitpython |
DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS CVE-2026-75838, GHSA-55q2-fjhq-7xh7 | Medium | 0.4% | 07 Aug, 2026 | npm dompurify |
Smarty Security stream restriction bypass through stream: resource CVE-2026-62996, GHSA-rjhh-76wf-8xmw | Medium | 0.5% | 07 Aug, 2026 | Packagist smarty/smarty |
Smarty: Symlink path traversal out of trusted directories CVE-2026-62992, GHSA-f6wf-28g6-769x | Medium | 0.5% | 07 Aug, 2026 | Packagist smarty/smarty |
Craft CMS: Passkey login accepts replayed WebAuthn assertions CVE-2026-72780, GHSA-wg23-69c2-gjc8 | Critical | 0.4% | 07 Aug, 2026 | Packagist craftcms/cms |
Malicious release: Malicious code in big-tss (npm) MAL-2026-13613 | Malicious | Not scored | 07 Aug, 2026 | npm big-tss |
Malicious release: Malicious code in mangomind-agent (npm) MAL-2026-13611 | Malicious | Not scored | 07 Aug, 2026 | npm mangomind-agent |
Malicious release: Malicious code in transform-es2015-unicode-regex (npm) GHSA-fmrp-cpm8-5245, GHSA-jcxm-5v55-599q, MAL-2026-13612, SNYK-JS-DEPUPAWSSDKCREDENTIALPROVIDERPROCESS-18584483 | Malicious | Not scored | 07 Aug, 2026 | npm transform-es2015-unicode-regex |
Malicious release: Malicious code in f-termx (npm) MAL-2026-13610 | Malicious | Not scored | 07 Aug, 2026 | npm f-termx |
Malicious release: Malicious code in hardhat-set (npm) MAL-2026-13609 | Malicious | Not scored | 07 Aug, 2026 | npm hardhat-set |
Malicious release: Malicious code in @vertexa/prisma-fetch-engine (npm) MAL-2026-13608 | Malicious | Not scored | 07 Aug, 2026 | npm @vertexa/prisma-fetch-engine |
Malicious release: Malicious code in yakuza0 (npm) MAL-2026-13605 | Malicious | Not scored | 07 Aug, 2026 | npm yakuza0 |
Malicious release: Malicious code in @aster110/cc2wechat (npm) MAL-2026-13520 | Malicious | Not scored | 07 Aug, 2026 | npm @aster110/cc2wechat |
Malicious release: Malicious code in dojo-rn-interview (npm) GHSA-7phf-cqrv-j3jg, MAL-2026-13549 | Malicious | Not scored | 07 Aug, 2026 | npm dojo-rn-interview |
Malicious release: Malicious code in delivery-ci-codeceptjs (npm) MAL-2026-13539 | Malicious | Not scored | 07 Aug, 2026 | npm delivery-ci-codeceptjs |
Malicious release: Malicious code in dolyame-ui-inputautocomplete (npm) MAL-2026-13574 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-inputautocomplete |
Malicious release: Malicious code in devplatform-spa-plugin-remote-module (npm) MAL-2026-13547 | Malicious | Not scored | 07 Aug, 2026 | npm devplatform-spa-plugin-remote-module |
Malicious release: Malicious code in dolyame-ui-checkablegroup (npm) MAL-2026-13557 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-checkablegroup |
Malicious release: Malicious code in dolyame-ui-inputdate (npm) MAL-2026-13577 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-inputdate |
Malicious release: Malicious code in delivery-ci-jira (npm) MAL-2026-13542 | Malicious | Not scored | 07 Aug, 2026 | npm delivery-ci-jira |
Malicious release: Malicious code in dolyame-boxy-independent-bnpl-main-title (npm) MAL-2026-13552 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-boxy-independent-bnpl-main-title |
Malicious release: Malicious code in dolyame-ui-progressline (npm) MAL-2026-13596 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-progressline |
Malicious release: Malicious code in dolyame-ui-inputsearchtagged (npm) MAL-2026-13583 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-inputsearchtagged |
Malicious release: Malicious code in dolyame-ui-deprecatepropshoc (npm) MAL-2026-13566 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-deprecatepropshoc |
Malicious release: Malicious code in dolyame-ui-inputcount (npm) MAL-2026-13576 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-inputcount |
Malicious release: Malicious code in dolyame-ui-datatable (npm) MAL-2026-13565 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-datatable |
Malicious release: Malicious code in bigops-shared-product-design (npm) MAL-2026-13526 | Malicious | Not scored | 07 Aug, 2026 | npm bigops-shared-product-design |
Malicious release: Malicious code in dolyame-ui-inputtag (npm) MAL-2026-13585 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-inputtag |
Malicious release: Malicious code in dolyame-ui-tablemobile (npm) MAL-2026-13601 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-tablemobile |
Malicious release: Malicious code in dolyame-ui-collapseblock (npm) MAL-2026-13559 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-collapseblock |
Malicious release: Malicious code in dolyame-ui-contextmenusearchable (npm) MAL-2026-13562 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-contextmenusearchable |
Malicious release: Malicious code in dolyame-ui-inputsearch (npm) MAL-2026-13582 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-inputsearch |
Malicious release: Malicious code in devplatform-stylelint-config (npm) MAL-2026-13548 | Malicious | Not scored | 07 Aug, 2026 | npm devplatform-stylelint-config |
Malicious release: Malicious code in dolyame-ui-postcsscustomproperties (npm) MAL-2026-13595 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-postcsscustomproperties |
Malicious release: Malicious code in dolyame-ui-inputsecure (npm) MAL-2026-13584 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-inputsecure |
Malicious release: Malicious code in delivery-ci-core (npm) MAL-2026-13540 | Malicious | Not scored | 07 Aug, 2026 | npm delivery-ci-core |
Malicious release: Malicious code in dolyame-ui-scrollblock (npm) MAL-2026-13597 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-scrollblock |
Malicious release: Malicious code in bnpl-blocks-atom-bnpl-faq-item (npm) MAL-2026-13528 | Malicious | Not scored | 07 Aug, 2026 | npm bnpl-blocks-atom-bnpl-faq-item |
Malicious release: Malicious code in ded-pwa-bnpl-forms-test-demo (npm) MAL-2026-13532 | Malicious | Not scored | 07 Aug, 2026 | npm ded-pwa-bnpl-forms-test-demo |
Malicious release: Malicious code in ded-pwa-c-mapping (npm) MAL-2026-13535 | Malicious | Not scored | 07 Aug, 2026 | npm ded-pwa-c-mapping |
Malicious release: Malicious code in dolyame-ui-inputfio (npm) MAL-2026-13578 | Malicious | Not scored | 07 Aug, 2026 | npm dolyame-ui-inputfio |
Malicious release: Malicious code in ded-pwa-c-boxy-di (npm) MAL-2026-13534 | Malicious | Not scored | 07 Aug, 2026 | npm ded-pwa-c-boxy-di |