Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in flat-cache (npm) GHSA-8jxr-wprf-45g8, MAL-2026-11971 | Malicious | Not scored | 04 Aug, 2026 | npm flat-cache |
Malicious release: Malicious code in cacheable-request (npm) GHSA-mxgw-gq2g-4fq9, MAL-2026-11964 | Malicious | Not scored | 04 Aug, 2026 | npm cacheable-request |
Malicious release: Malicious code in psbt-helpers (PyPI) MAL-2026-11521 | Malicious | Not scored | 04 Aug, 2026 | PyPI psbt-helpers |
Malicious release: Malicious code in launchdarkly-ai-server-sdk (PyPI) MAL-2026-11519 | Malicious | Not scored | 04 Aug, 2026 | PyPI launchdarkly-ai-server-sdk |
Malicious release: Malicious code in psbt-utils (PyPI) MAL-2026-11520 | Malicious | Not scored | 04 Aug, 2026 | PyPI psbt-utils |
Malicious release: Malicious code in exnesss (npm) GHSA-32p4-hf5c-v228, MAL-2026-11518 | Malicious | Not scored | 04 Aug, 2026 | npm exnesss |
Malicious release: Malicious code in coldcard-helpers (PyPI) MAL-2026-11516 | Malicious | Not scored | 04 Aug, 2026 | PyPI coldcard-helpers |
Malicious release: Malicious code in internallib_v688 (npm) GHSA-jvmj-rg3h-c654, MAL-2026-11517 | Malicious | Not scored | 04 Aug, 2026 | npm internallib_v688 |
Malicious release: Malicious code in @zzzgenesis00/bip39-generator (npm) MAL-2026-11515 | Malicious | Not scored | 04 Aug, 2026 | npm @zzzgenesis00/bip39-generator |
python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees CVE-2026-69248, GHSA-m2h6-j472-rp4c, PYSEC-2026-3554 | Medium | 0.2% | 03 Aug, 2026 | PyPI cryptography |
python-cryptography: Duplicate self-signed intermediates can cause exponential path-building CVE-2026-69249, GHSA-jwv3-5hgf-82ww, PYSEC-2026-3553 | High | 0.3% | 03 Aug, 2026 | PyPI cryptography |
cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing CVE-2026-69247, GHSA-g6cj-pr64-35w5, PYSEC-2026-3552 | High | 0.3% | 03 Aug, 2026 | PyPI cryptography |
Guzzle: Noncanonical host can bypass host-based checks CVE-2026-69246, GHSA-v5mv-p594-2x33 | High | 0.4% | 03 Aug, 2026 | Packagist guzzlehttp/guzzle |
Guzzle: Noncanonical cookie domain keeps subdomain scope CVE-2026-69245, GHSA-f7vp-7xgx-4w4r | Medium | 0.2% | 03 Aug, 2026 | Packagist guzzlehttp/guzzle |
Malicious release: Malicious code in internallib_v524 (npm) GHSA-2wgh-22xm-wp5f, MAL-2026-11512 | Malicious | Not scored | 03 Aug, 2026 | npm internallib_v524 |
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) CVE-2026-69244, GHSA-cq5v-8q36-5273, PYSEC-2026-3545 | High | 0.5% | 03 Aug, 2026 | PyPI aiohttp |
AIOHTTP: HTTP request smuggling via WebSocket upgrade CVE-2026-69243, GHSA-mfx4-hv73-q22v, PYSEC-2026-3546 | Medium | 0.4% | 03 Aug, 2026 | PyPI aiohttp |
Malicious release: Malicious code in instalogin1234 (PyPI) MAL-2026-11503 | Malicious | Not scored | 03 Aug, 2026 | PyPI instalogin1234 |
Sequelize: SQL Injection (Oracle DB) CVE-2026-69240, GHSA-v8fg-2rw7-q452 | Critical | 0.5% | 03 Aug, 2026 | npm sequelize |
Hono: ReDoS in CORS middleware via Access-Control-Request-Headers CVE-2026-69207, GHSA-8j4g-w8fx-2239 | Medium | 0.6% | 03 Aug, 2026 | npm hono |
GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count CVE-2026-73621, GHSA-p538-c434-8v24, PYSEC-2026-3950 | Medium | 0.4% | 03 Aug, 2026 | PyPI GitPython PyPI gitpython |
AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands CVE-2026-18654, GHSA-hqvf-45jj-mccq, PYSEC-2026-3627 | Medium | 0.5% | 03 Aug, 2026 | PyPI awscli |
GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive() CVE-2026-73619, GHSA-539m-9xh6-q6rr, PYSEC-2026-3948 | High | 0.4% | 03 Aug, 2026 | PyPI GitPython PyPI gitpython |
GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read CVE-2026-73620, GHSA-3f7w-8rr8-f37f, PYSEC-2026-3949 | High | 0.6% | 03 Aug, 2026 | PyPI GitPython PyPI gitpython |
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass CVE-2026-69192, GHSA-mwp4-54f8-5fhr | High | 0.5% | 03 Aug, 2026 | npm ip-address |
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks CVE-2026-69198, GHSA-4xrf-jv44-h6hh | Medium | 0.5% | 03 Aug, 2026 | npm ip-address |
Socket.IO: Zero-attachment Memory Exhaustion CVE-2026-69185, GHSA-2m8v-j782-fhvr | High | 0.6% | 03 Aug, 2026 | npm socket.io-parser |
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset CVE-2026-69153, GHSA-fxqj-rqcc-2cmp | Medium | 0.5% | 03 Aug, 2026 | npm postcss |
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation CVE-2026-69152, GHSA-rgw5-rvv9-x895 | High | 0.6% | 03 Aug, 2026 | npm brace-expansion |
Malicious release: Malicious code in simple-date-formatter-new-1 (npm) MAL-2026-11502 | Malicious | Not scored | 03 Aug, 2026 | npm simple-date-formatter-new-1 |
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes CVE-2026-69151, GHSA-jj27-h5hq-8x99 | High | 0.3% | 03 Aug, 2026 | npm @angular/compiler npm @angular/core |
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS) CVE-2026-69149, GHSA-vpx6-8pjr-4g3v | High | 0.4% | 03 Aug, 2026 | npm @angular/platform-server |
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning CVE-2026-68945, GHSA-jhpw-976m-542j | High | 0.2% | 03 Aug, 2026 | npm @angular/common |
Malicious release: Malicious code in internallib_v568 (npm) GHSA-f4rq-x75f-gx73, MAL-2026-11513 | Malicious | Not scored | 03 Aug, 2026 | npm internallib_v568 |
Malicious release: Malicious code in beaver-ui-header (npm) GHSA-qm7r-x5cp-5wc2, MAL-2026-11508 | Malicious | Not scored | 03 Aug, 2026 | npm beaver-ui-header |
Malicious release: Malicious code in beaver-ui-items-with-more (npm) GHSA-qq8g-w3r7-rqp8, MAL-2026-11509 | Malicious | Not scored | 03 Aug, 2026 | npm beaver-ui-items-with-more |
Malicious release: Malicious code in accounts-final-form (npm) GHSA-2rrw-8g3r-w44h, MAL-2026-11504 | Malicious | Not scored | 03 Aug, 2026 | npm accounts-final-form |
Malicious release: Malicious code in bigops-chat-messages (npm) GHSA-7fcf-754p-pfhv, MAL-2026-11511 | Malicious | Not scored | 03 Aug, 2026 | npm bigops-chat-messages |
Malicious release: Malicious code in beaver-ui-date-range-picker (npm) GHSA-x5q8-8mg7-8jvg, MAL-2026-11506 | Malicious | Not scored | 03 Aug, 2026 | npm beaver-ui-date-range-picker |
Malicious release: Malicious code in lifestyle-test-utils (npm) GHSA-5f9f-jfwr-xxvp, MAL-2026-11514 | Malicious | Not scored | 03 Aug, 2026 | npm lifestyle-test-utils |
Malicious release: Malicious code in accounts-loading-state (npm) GHSA-9pwq-f6rq-8q69, MAL-2026-11505 | Malicious | Not scored | 03 Aug, 2026 | npm accounts-loading-state |
Malicious release: Malicious code in beaver-ui-layout (npm) GHSA-w259-8g6c-8ppr, MAL-2026-11510 | Malicious | Not scored | 03 Aug, 2026 | npm beaver-ui-layout |
Malicious release: Malicious code in beaver-ui-grid (npm) GHSA-xjhx-6v3c-9cqp, MAL-2026-11507 | Malicious | Not scored | 03 Aug, 2026 | npm beaver-ui-grid |
Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images CVE-2026-69089, GHSA-w3f4-8pj2-599w | High | 0.5% | 03 Aug, 2026 | Packagist getgrav/grav |
Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure CVE-2026-69088, GHSA-7pgq-cr25-xvc8 | High | 0.3% | 03 Aug, 2026 | Packagist getgrav/grav |
Malicious release: Malicious code in simple-date-formatter-util-5 (npm) MAL-2026-11501 | Malicious | Not scored | 03 Aug, 2026 | npm simple-date-formatter-util-5 |
NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection CVE-2026-12259, CVE-2026-63310, GHSA-5wp5-5229-5g6q, GHSA-gf32-cmjh-8m9v, PYSEC-2026-3729, PYSEC-2026-4318 | Critical | 0.1% | 03 Aug, 2026 | PyPI nltk |
Malicious release: Malicious code in tailwind-anim (npm) GHSA-7xhc-fvmj-h5xj, MAL-2026-11500 | Malicious | Not scored | 03 Aug, 2026 | npm tailwind-anim |
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-18577 | HighExploited | 14.6% | 02 Aug, 2026 | |
Malicious release: Malicious code in list-issue-predecessor-dependencies-block (npm) MAL-2026-11430 | Malicious | Not scored | 02 Aug, 2026 | npm list-issue-predecessor-dependencies-block |