Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in chatgpt-pro-activator (npm) GHSA-qp43-mgx6-56x2, MAL-2026-18057 | Malicious | Not scored | 10 days ago | npm chatgpt-pro-activator |
Malicious release: Malicious code in chatgpt-pro-setup-tool (npm) GHSA-xwx3-5h3q-2v8r, MAL-2026-18058 | Malicious | Not scored | 10 days ago | npm chatgpt-pro-setup-tool |
Malicious release: Malicious code in asurion (PyPI) MAL-2026-18045 | Malicious | Not scored | 10 days ago | PyPI asurion |
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290) BIT-pillow-2026-112395, CVE-2026-112395, GHSA-462x-pgg6-55fp | High | 0.5% | 10 days ago | PyPI pillow |
Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size BIT-pillow-2026-112394, CVE-2026-112394, GHSA-4558-3h8r-v8xp, PYSEC-2026-4327 | Medium | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO BIT-pillow-2026-112393, CVE-2026-112393, GHSA-332p-7hrc-92wf | Critical | 1.0% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree() BIT-pillow-2026-112391, CVE-2026-112391, GHSA-254f-3936-288h | Medium | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Infinite loop in MIC n_frames when the embedded TIFF BIT-pillow-2026-112390, CVE-2026-112390, GHSA-22hg-r758-rrw9 | High | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled CVE-2026-111766, GHSA-vfgh-jcmw-g37q | Low | 0.4% | 10 days ago | npm markdown-it |
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes CVE-2026-111759, GHSA-r7fv-28h4-cvq7 | High | 0.6% | 10 days ago | npm markdown-it |
Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths CVE-2026-109955, CVE-2026-111757, GHSA-5r4p-p66f-jhc7 | Medium | 0.3% | 10 days ago | npm hono |
follow-redirects sensitiveHeaders regex escaping can expose credential headers CVE-2026-111755, GHSA-8r9p-f939-6h3c | High | 0.5% | 10 days ago | npm follow-redirects |
AIOHTTP: Pure-Python parser request smuggling CVE-2026-111750, GHSA-pqxq-w44r-73xw | Medium | 0.4% | 10 days ago | PyPI aiohttp |
AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies CVE-2026-111749, GHSA-gx76-c99x-2c96 | Low | 0.4% | 10 days ago | PyPI aiohttp |
AIOHTTP: Absolute-form request targets can spoof Request.scheme CVE-2026-111748, GHSA-f9xw-jh8m-3mwq | Medium | 0.4% | 10 days ago | PyPI aiohttp |
AIOHTTP: File descriptor exhaustion in multipart requests CVE-2026-111066, GHSA-9xw5-w5jj-pvcg | High | 0.4% | 10 days ago | PyPI aiohttp |
AIOHTTP: Connector pool exhaustion via Max-Age overflow CVE-2026-111065, GHSA-6cjc-53gc-5rqm | Medium | 0.4% | 10 days ago | PyPI aiohttp |
aiohttp server lacks an initial request/header timeout CVE-2026-111064, GHSA-5wr8-gcqf-gqf3 | High | 0.4% | 10 days ago | PyPI aiohttp |
AIOHTTP: Secure attribute not enforced for shared cookie CVE-2026-111063, GHSA-494j-54xm-rwp3 | Medium | 0.2% | 10 days ago | PyPI aiohttp |
aiohttp: Multiple instances of excessive or unbounded memory/CPU use GHSA-2g87-pp6c-29x5 | High | Not scored | 10 days ago | PyPI aiohttp |
Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML CVE-2026-111059, GHSA-2658-85cv-9wwq | Medium | 0.3% | 10 days ago | PyPI mercury |
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo GHSA-pcc4-rvhr-2pr8 | Medium | Not scored | 10 days ago | PyPI graphifyy |
Mercury: Unauthenticated Remote Code Execution via /api/kernels CVE-2026-111058, GHSA-rv4m-xm3f-3ccq | Critical | 0.5% | 10 days ago | PyPI mercury |
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass CVE-2026-111057, GHSA-f8c7-rwf9-fmgm | Critical | 0.7% | 10 days ago | PyPI mercury |
Malicious release: Malicious code in vinted-mocked-apis (PyPI) MAL-2026-17943 | Malicious | Not scored | 10 days ago | PyPI vinted-mocked-apis |
Malicious release: Malicious code in esgbz5 (npm) GHSA-25f9-m2r5-6fcq, MAL-2026-18009 | Malicious | Not scored | 10 days ago | npm esgbz5 |
Malicious release: Malicious code in tkacg3 (npm) GHSA-27jv-jmw5-c2v5, MAL-2026-18037 | Malicious | Not scored | 10 days ago | npm tkacg3 |
Malicious release: Malicious code in v49yzy (npm) GHSA-299j-xhj5-p4mq, MAL-2026-18038 | Malicious | Not scored | 10 days ago | npm v49yzy |
Malicious release: Malicious code in 3gr841 (npm) GHSA-3268-6cgx-qmp3, MAL-2026-17946 | Malicious | Not scored | 10 days ago | npm 3gr841 |
Malicious release: Malicious code in 4p9kgm (npm) GHSA-37g4-578m-87mr, MAL-2026-17948 | Malicious | Not scored | 10 days ago | npm 4p9kgm |
Malicious release: Malicious code in j019qc (npm) GHSA-3c65-77q8-3cv8, MAL-2026-18018 | Malicious | Not scored | 10 days ago | npm j019qc |
Malicious release: Malicious code in noe77e (npm) GHSA-3f7v-wqcp-rcj5, MAL-2026-18033 | Malicious | Not scored | 10 days ago | npm noe77e |
Malicious release: Malicious code in 8h66ok (npm) GHSA-4755-8q82-c3cq, MAL-2026-17951 | Malicious | Not scored | 10 days ago | npm 8h66ok |
Malicious release: Malicious code in ju0oud (npm) GHSA-4vwp-4cgf-q7hm, MAL-2026-18020 | Malicious | Not scored | 10 days ago | npm ju0oud |
Malicious release: Malicious code in zubn7b (npm) GHSA-56wf-ffww-7w6r, MAL-2026-18044 | Malicious | Not scored | 10 days ago | npm zubn7b |
Malicious release: Malicious code in lstsyw (npm) GHSA-6f5h-29pq-736p, MAL-2026-18022 | Malicious | Not scored | 10 days ago | npm lstsyw |
Malicious release: Malicious code in g23p4g (npm) GHSA-6jj8-jfq4-rh25, MAL-2026-18013 | Malicious | Not scored | 10 days ago | npm g23p4g |
Malicious release: Malicious code in ysqp68 (npm) GHSA-6mmf-g5rj-3qxv, MAL-2026-18041 | Malicious | Not scored | 10 days ago | npm ysqp68 |
Malicious release: Malicious code in g8ez1y (npm) GHSA-6rc2-wmvg-58vj, MAL-2026-18014 | Malicious | Not scored | 10 days ago | npm g8ez1y |
Malicious release: Malicious code in f4iomt (npm) GHSA-75h5-8c3h-fgfg, MAL-2026-18011 | Malicious | Not scored | 10 days ago | npm f4iomt |
Malicious release: Malicious code in 3gr2dj (npm) GHSA-7w9w-mcrx-mq63, MAL-2026-17945 | Malicious | Not scored | 10 days ago | npm 3gr2dj |
Malicious release: Malicious code in rhlozh (npm) GHSA-8h9g-w7hc-m2vg, MAL-2026-18035 | Malicious | Not scored | 10 days ago | npm rhlozh |
Malicious release: Malicious code in x294tn (npm) GHSA-946x-h6wx-r4jh, MAL-2026-18040 | Malicious | Not scored | 10 days ago | npm x294tn |
Malicious release: Malicious code in 8i7pp4 (npm) GHSA-97qj-xxch-gv59, MAL-2026-17952 | Malicious | Not scored | 10 days ago | npm 8i7pp4 |
Malicious release: Malicious code in aqj3w7 (npm) GHSA-c92v-wc47-vg7h, MAL-2026-17971 | Malicious | Not scored | 10 days ago | npm aqj3w7 |
Malicious release: Malicious code in giu094 (npm) GHSA-crpr-3p42-5v4g, MAL-2026-18015 | Malicious | Not scored | 10 days ago | npm giu094 |
Malicious release: Malicious code in ljem3j (npm) GHSA-h7g9-pxwg-hr57, MAL-2026-18021 | Malicious | Not scored | 10 days ago | npm ljem3j |
Malicious release: Malicious code in waojpf (npm) GHSA-jjpm-7wrx-wm3x, MAL-2026-18039 | Malicious | Not scored | 10 days ago | npm waojpf |
Malicious release: Malicious code in oo9fja (npm) GHSA-jm54-39g7-2x5f, MAL-2026-18034 | Malicious | Not scored | 10 days ago | npm oo9fja |
Malicious release: Malicious code in j5opb7 (npm) GHSA-jrcj-7fj7-rcj5, MAL-2026-18019 | Malicious | Not scored | 10 days ago | npm j5opb7 |