Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @tuluax/errb (npm) MAL-2026-11993 | Malicious | Not scored | 04 Aug, 2026 | npm @tuluax/errb |
Malicious release: Malicious code in emulative (npm) MAL-2026-11996 | Malicious | Not scored | 04 Aug, 2026 | npm emulative |
Malicious release: Malicious code in webdev-conf (npm) MAL-2026-12005 | Malicious | Not scored | 04 Aug, 2026 | npm webdev-conf |
Malicious release: Malicious code in vitest-preview-pro (npm) GHSA-wx22-xm6j-mgqx, MAL-2026-12004 | Malicious | Not scored | 04 Aug, 2026 | npm vitest-preview-pro |
Malicious release: Malicious code in simple-date-formatter-util-7 (npm) MAL-2026-11998 | Malicious | Not scored | 04 Aug, 2026 | npm simple-date-formatter-util-7 |
Malicious release: Malicious code in @zzzgenesis00/web3-provider-engine (npm) MAL-2026-11994 | Malicious | Not scored | 04 Aug, 2026 | npm @zzzgenesis00/web3-provider-engine |
Malicious release: Malicious code in @zzzgenesis00/etherjs (npm) MAL-2026-11530 | Malicious | Not scored | 04 Aug, 2026 | npm @zzzgenesis00/etherjs |
Malicious release: Malicious code in @zzzgenesis00/crypto-config (npm) MAL-2026-11529 | Malicious | Not scored | 04 Aug, 2026 | npm @zzzgenesis00/crypto-config |
Malicious release: Malicious code in @zzzgenesis00/solana-web3 (npm) MAL-2026-11533 | Malicious | Not scored | 04 Aug, 2026 | npm @zzzgenesis00/solana-web3 |
Malicious release: Malicious code in hubert-application-get-document-preview-am (npm) GHSA-7c6g-rhc6-239f, MAL-2026-11540 | Malicious | Not scored | 04 Aug, 2026 | npm hubert-application-get-document-preview-am |
Malicious release: Malicious code in @zzzgenesis00/solana-wallet-adapter (npm) MAL-2026-11532 | Malicious | Not scored | 04 Aug, 2026 | npm @zzzgenesis00/solana-wallet-adapter |
Malicious release: Malicious code in bigops-backend (npm) MAL-2026-11535 | Malicious | Not scored | 04 Aug, 2026 | npm bigops-backend |
Malicious release: Malicious code in eacq-payform-core (npm) GHSA-gpp6-qxfg-2m7x, MAL-2026-11538 | Malicious | Not scored | 04 Aug, 2026 | npm eacq-payform-core |
Malicious release: Malicious code in twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer (npm) GHSA-337w-cgvw-mpg3, MAL-2026-11550 | Malicious | Not scored | 04 Aug, 2026 | npm twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer |
Malicious release: Malicious code in entropyeasybots (npm) MAL-2026-11539 | Malicious | Not scored | 04 Aug, 2026 | npm entropyeasybots |
Malicious release: Malicious code in @zzzgenesis00/hdkey-wallet (npm) MAL-2026-11531 | Malicious | Not scored | 04 Aug, 2026 | npm @zzzgenesis00/hdkey-wallet |
Malicious release: Malicious code in @zzzgenesis00/xrp-lib (npm) MAL-2026-11534 | Malicious | Not scored | 04 Aug, 2026 | npm @zzzgenesis00/xrp-lib |
Malicious release: Malicious code in simple-date-formatter-util-6 (npm) MAL-2026-11546 | Malicious | Not scored | 04 Aug, 2026 | npm simple-date-formatter-util-6 |
Malicious release: Malicious code in simple-date-formatter-util-10 (npm) MAL-2026-11544 | Malicious | Not scored | 04 Aug, 2026 | npm simple-date-formatter-util-10 |
Malicious release: Malicious code in simple-date-formatter-util-9 (npm) MAL-2026-11547 | Malicious | Not scored | 04 Aug, 2026 | npm simple-date-formatter-util-9 |
Malicious release: Malicious code in discord-vibegrations-api-helpers (npm) MAL-2026-11536 | Malicious | Not scored | 04 Aug, 2026 | npm discord-vibegrations-api-helpers |
Malicious release: Malicious code in tinkoff-terminal-kit-carousel (npm) GHSA-g537-jjq6-mv8m, MAL-2026-11549 | Malicious | Not scored | 04 Aug, 2026 | npm tinkoff-terminal-kit-carousel |
Malicious release: Malicious code in streak-math-abz (npm) MAL-2026-11548 | Malicious | Not scored | 04 Aug, 2026 | npm streak-math-abz |
Malicious release: Malicious code in nagixjs (npm) MAL-2026-11541 | Malicious | Not scored | 04 Aug, 2026 | npm nagixjs |
Malicious release: Malicious code in discord-vibegrations-api-natives (npm) MAL-2026-11537 | Malicious | Not scored | 04 Aug, 2026 | npm discord-vibegrations-api-natives |
Malicious release: Malicious code in simple-date-formatter-new-5 (npm) MAL-2026-11543 | Malicious | Not scored | 04 Aug, 2026 | npm simple-date-formatter-new-5 |
Malicious release: Malicious code in osinthell (npm) MAL-2026-11542 | Malicious | Not scored | 04 Aug, 2026 | npm osinthell |
Malicious release: Malicious code in simple-date-formatter-util-15 (npm) MAL-2026-11545 | Malicious | Not scored | 04 Aug, 2026 | npm simple-date-formatter-util-15 |
Malicious release: Malicious code in @ks-openclaw/kim (npm) MAL-2026-11528 | Malicious | Not scored | 04 Aug, 2026 | npm @ks-openclaw/kim |
Ghost: Session Fixation in Ghost Admin BIT-ghost-2026-70594, CVE-2026-70594, GHSA-7mpp-r37j-x5wh | Medium | 0.2% | 04 Aug, 2026 | npm ghost |
Ghost: Theme Upload Path Traversal BIT-ghost-2026-70593, CVE-2026-70593, GHSA-cjc9-q5gf-327p | Medium | 0.4% | 04 Aug, 2026 | npm ghost |
Ghost: Database Backup Path Traversal BIT-ghost-2026-70592, CVE-2026-70592, GHSA-cj62-hvv2-2q5h | Medium | 0.4% | 04 Aug, 2026 | npm ghost |
Ghost: Server-Side Request Forgery in Image Fetching BIT-ghost-2026-70591, CVE-2026-70591, GHSA-gcvv-72q8-9v76 | Medium | 0.4% | 04 Aug, 2026 | npm ghost |
Ghost: Blind Password Hash Disclosure in Ghost Admin API BIT-ghost-2026-70590, CVE-2026-70590, GHSA-jm22-3w23-5q7w | Medium | 0.3% | 04 Aug, 2026 | npm ghost |
Malicious release: Malicious code in streak-metricsaz (npm) MAL-2026-11527 | Malicious | Not scored | 04 Aug, 2026 | npm streak-metricsaz |
Malicious release: Malicious code in beaver-ui-form (npm) MAL-2026-11522 | Malicious | Not scored | 04 Aug, 2026 | npm beaver-ui-form |
Malicious release: Malicious code in nagix-nodejs (npm) MAL-2026-11526 | Malicious | Not scored | 04 Aug, 2026 | npm nagix-nodejs |
Ghost: Archived Offers can be Redeemed BIT-ghost-2026-70589, CVE-2026-70589, GHSA-4wx2-7gvj-qfq3 | Medium | 0.3% | 04 Aug, 2026 | npm ghost |
Malicious release: Malicious code in nagix-node (npm) MAL-2026-11525 | Malicious | Not scored | 04 Aug, 2026 | npm nagix-node |
Ghost: Cross-Site Scripting in Universal Import BIT-ghost-2026-70588, CVE-2026-70588, GHSA-2gx6-7gx2-wwcf | Medium | 0.4% | 04 Aug, 2026 | npm ghost |
Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder CVE-2026-70494, GHSA-3cg5-48j3-v4gv, PYSEC-2026-3638 | High | 0.5% | 04 Aug, 2026 | PyPI open-webui |
Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically CVE-2026-70493, GHSA-2f54-p244-32q6, PYSEC-2026-3637 | Medium | 0.6% | 04 Aug, 2026 | PyPI open-webui |
Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages CVE-2026-70492, GHSA-pwxh-7358-jq2x, PYSEC-2026-3650 | High | 0.4% | 04 Aug, 2026 | PyPI open-webui |
Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints CVE-2026-70491, GHSA-3r7g-q6cg-q2vx, PYSEC-2026-3639 | Medium | 0.5% | 04 Aug, 2026 | PyPI open-webui |
Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check CVE-2026-70490, GHSA-5gpj-vj23-vhhv, PYSEC-2026-3642 | Medium | 0.3% | 04 Aug, 2026 | PyPI open-webui |
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing CVE-2026-70489, GHSA-73cq-mcgh-379c, PYSEC-2026-3644 | Medium | 0.6% | 04 Aug, 2026 | PyPI open-webui |
Open WebUI: DNS Rebinding SSRF Bypass CVE-2026-54020, GHSA-h6x2-583h-x99r, PYSEC-2026-3647 | Medium | 0.3% | 04 Aug, 2026 | PyPI open-webui |
Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata CVE-2026-70487, GHSA-6xhv-rxhv-pwm4, PYSEC-2026-3643 | Medium | 0.4% | 04 Aug, 2026 | PyPI open-webui |
Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup CVE-2026-70488, GHSA-jxc9-xmc4-gr23, PYSEC-2026-3648 | Medium | 0.4% | 04 Aug, 2026 | PyPI open-webui |
Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin CVE-2026-70486, GHSA-3xpf-xq7r-v8c5, PYSEC-2026-3641 | High | 0.4% | 04 Aug, 2026 | PyPI open-webui |