Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in list-issue-predecessor-dependencies-block (npm) MAL-2026-11430 | Malicious | Not scored | 02 Aug, 2026 | npm list-issue-predecessor-dependencies-block |
Malicious release: Malicious code in tailwindcss-anim (npm) GHSA-m326-xg22-g2fx, MAL-2026-11487 | Malicious | Not scored | 02 Aug, 2026 | npm tailwindcss-anim |
Malicious release: Malicious code in simple-date-formatter-util (npm) GHSA-q32h-xc3m-rc77, MAL-2026-11483 | Malicious | Not scored | 02 Aug, 2026 | npm simple-date-formatter-util |
Malicious release: Malicious code in simple-date-formatter-util-2 (npm) GHSA-q43f-5xj6-8v63, MAL-2026-11485 | Malicious | Not scored | 02 Aug, 2026 | npm simple-date-formatter-util-2 |
Malicious release: Malicious code in simple-date-formatter-util-1 (npm) GHSA-mmc7-8pmj-h3xj, MAL-2026-11484 | Malicious | Not scored | 02 Aug, 2026 | npm simple-date-formatter-util-1 |
Transformers save_pretrained path traversal allows arbitrary file writes through chat template names CVE-2026-9856, GHSA-xrqw-3rrv-vx5w, PYSEC-2026-3929 | High | 0.5% | 02 Aug, 2026 | PyPI transformers |
Malicious release: Malicious code in trongriden (PyPI) MAL-2026-11429 | Malicious | Not scored | 02 Aug, 2026 | PyPI trongriden |
Malicious release: Malicious code in wacve-utils (PyPI) MAL-2026-11428 | Malicious | Not scored | 02 Aug, 2026 | PyPI wacve-utils |
Keras: HDF5 links can disclose local file contents CVE-2026-9335, GHSA-m8wh-29wm-52mv, PYSEC-2026-3633 | Medium | 0.8% | 02 Aug, 2026 | PyPI keras |
Malicious release: Malicious code in @custombots/custombot (npm) MAL-2026-11498 | Malicious | Not scored | 02 Aug, 2026 | npm @custombots/custombot |
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-18556 | HighExploited | 7.9% | 01 Aug, 2026 | |
Malicious release: Malicious code in pp-react-worldready (npm) MAL-2026-11427 | Malicious | Not scored | 01 Aug, 2026 | npm pp-react-worldready |
Malicious release: Malicious code in nvtorch-oot-nightly (PyPI) MAL-2026-11425 | Malicious | Not scored | 01 Aug, 2026 | PyPI nvtorch-oot-nightly |
Malicious release: Malicious code in trtllm-subdir-test (PyPI) MAL-2026-11426 | Malicious | Not scored | 01 Aug, 2026 | PyPI trtllm-subdir-test |
Malicious release: Malicious code in test-dev-host (npm) GHSA-6v46-5v2x-c3c5, MAL-2026-11491 | Malicious | Not scored | 01 Aug, 2026 | npm test-dev-host |
Malicious release: Malicious code in test-dev-boot (npm) GHSA-fxj3-2jph-p7mg, MAL-2026-11488 | Malicious | Not scored | 01 Aug, 2026 | npm test-dev-boot |
Malicious release: Malicious code in test-dev-store (npm) GHSA-2ph5-h7fc-33mm, MAL-2026-11493 | Malicious | Not scored | 01 Aug, 2026 | npm test-dev-store |
Malicious release: Malicious code in test-dev-sync (npm) GHSA-c2gc-7pfc-7fjf, MAL-2026-11494 | Malicious | Not scored | 01 Aug, 2026 | npm test-dev-sync |
Malicious release: Malicious code in test-dev-dispatch (npm) GHSA-qx8w-r9j6-p4g5, MAL-2026-11489 | Malicious | Not scored | 01 Aug, 2026 | npm test-dev-dispatch |
Malicious release: Malicious code in test-dev-watch (npm) GHSA-qxrq-qr5j-h4rw, MAL-2026-11495 | Malicious | Not scored | 01 Aug, 2026 | npm test-dev-watch |
Malicious release: Malicious code in test-dev-link (npm) GHSA-vf2p-478v-vg76, MAL-2026-11492 | Malicious | Not scored | 01 Aug, 2026 | npm test-dev-link |
Malicious release: Malicious code in test-dev-exec (npm) GHSA-vxp9-h9vh-8mp3, MAL-2026-11490 | Malicious | Not scored | 01 Aug, 2026 | npm test-dev-exec |
Malicious release: Malicious code in @moxfive-llc/common (npm) GHSA-x9jj-732w-pjvr, MAL-2026-11441 | Malicious | Not scored | 01 Aug, 2026 | npm @moxfive-llc/common |
Malicious release: Malicious code in @spending-behavior-ui/widget-insights (npm) GHSA-m955-rhgf-m5fx, MAL-2026-11451 | Malicious | Not scored | 31 Jul, 2026 | npm @spending-behavior-ui/widget-insights |
Malicious release: Malicious code in @meli-testing/jest-react (npm) GHSA-2rh8-4vrh-7vh3, MAL-2026-11440 | Malicious | Not scored | 31 Jul, 2026 | npm @meli-testing/jest-react |
Malicious release: Malicious code in @one-chat/react (npm) GHSA-598h-mgjc-c42f, MAL-2026-11446 | Malicious | Not scored | 31 Jul, 2026 | npm @one-chat/react |
Malicious release: Malicious code in @sw-commons-components/message-upsell (npm) GHSA-8w99-rvcw-j7cf, MAL-2026-11452 | Malicious | Not scored | 31 Jul, 2026 | npm @sw-commons-components/message-upsell |
Malicious release: Malicious code in @nordic-dev/linting-tools (npm) GHSA-95g5-jx8f-9835, MAL-2026-11445 | Malicious | Not scored | 31 Jul, 2026 | npm @nordic-dev/linting-tools |
Malicious release: Malicious code in @sof-assistant-fe-lib/vertical-faqs (npm) GHSA-chhc-9q4w-p5vq, MAL-2026-11449 | Malicious | Not scored | 31 Jul, 2026 | npm @sof-assistant-fe-lib/vertical-faqs |
Malicious release: Malicious code in @finance-ui/finance-view (npm) GHSA-cwvh-hhv3-v52q, MAL-2026-11436 | Malicious | Not scored | 31 Jul, 2026 | npm @finance-ui/finance-view |
Malicious release: Malicious code in @spending-behavior-ui/cashflow-widget (npm) GHSA-mqcg-v4cw-rgr3, MAL-2026-11450 | Malicious | Not scored | 31 Jul, 2026 | npm @spending-behavior-ui/cashflow-widget |
Malicious release: Malicious code in @fuji-web-components/maps (npm) GHSA-qmwr-pvcq-hhrm, MAL-2026-11438 | Malicious | Not scored | 31 Jul, 2026 | npm @fuji-web-components/maps |
Malicious release: Malicious code in @mp-op-ss-front-lib/tracks (npm) GHSA-rcc9-cq4p-xv77, MAL-2026-11442 | Malicious | Not scored | 31 Jul, 2026 | npm @mp-op-ss-front-lib/tracks |
Malicious release: Malicious code in @mplay-core-lib/utilities (npm) GHSA-w8v3-x4pv-78rp, MAL-2026-11443 | Malicious | Not scored | 31 Jul, 2026 | npm @mplay-core-lib/utilities |
Malicious release: Malicious code in @global-theme/context (npm) GHSA-whq3-7x3r-pv39, MAL-2026-11439 | Malicious | Not scored | 31 Jul, 2026 | npm @global-theme/context |
Malicious release: Malicious code in @mplay-frontend-ui/link (npm) GHSA-xxrf-9xmw-rq5r, MAL-2026-11444 | Malicious | Not scored | 31 Jul, 2026 | npm @mplay-frontend-ui/link |
Malicious release: Malicious code in @cr-invested-ui-components/chart (npm) GHSA-8g97-c5r5-8hjr, MAL-2026-11435 | Malicious | Not scored | 31 Jul, 2026 | npm @cr-invested-ui-components/chart |
Malicious release: Malicious code in metrics-ui (npm) GHSA-g4m5-r29v-w7gh, MAL-2026-11473 | Malicious | Not scored | 31 Jul, 2026 | npm metrics-ui |
Malicious release: Malicious code in @finance-ui/snackbar-ifpe (npm) GHSA-rcgh-7xjx-4rh6, MAL-2026-11437 | Malicious | Not scored | 31 Jul, 2026 | npm @finance-ui/snackbar-ifpe |
FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files CVE-2026-54910, GHSA-vvp7-h4fj-m28w, GO-2026-6164 | High | 0.4% | 31 Jul, 2026 | Go github.com/gtsteffaniak/filebrowser/backend |
guard-livereload has a directory traversal vulnerability CVE-2016-1000305, GHSA-g65v-27r3-5p6m | Medium | Not scored | 31 Jul, 2026 | RubyGems guard-livereload |
gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode CVE-2026-54785, GHSA-c5px-58j2-7fqp, PYSEC-2026-3574 | Medium | 0.2% | 31 Jul, 2026 | PyPI gemini-bridge |
Malicious release: Malicious code in telerape (PyPI) MAL-2026-11424 | Malicious | Not scored | 31 Jul, 2026 | PyPI telerape |
WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design) CVE-2026-54768, GHSA-jhh7-832h-f8hv | Medium | 0.4% | 31 Jul, 2026 | Packagist wp-graphql/wp-graphql |
Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message CVE-2026-54908, GHSA-wg4g-wm44-ch5j, GO-2026-6165 | Medium | 0.5% | 31 Jul, 2026 | Go github.com/pion/dtls/v3 |
Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute CVE-2026-54909, GHSA-34rh-wp3j-6cxc, GO-2026-6163 | Medium | 0.6% | 31 Jul, 2026 | Go github.com/pion/stun Go github.com/pion/stun/v2 Go github.com/pion/stun/v3 |
Malicious release: Malicious code in refbase-mcp (npm) GHSA-5xcj-w4qg-g78g, MAL-2026-11477 | Malicious | Not scored | 31 Jul, 2026 | npm refbase-mcp |
Malicious release: Malicious code in hit-mcp (npm) GHSA-fmvj-j52v-97x4, MAL-2026-11466 | Malicious | Not scored | 31 Jul, 2026 | npm hit-mcp |
Malicious release: Malicious code in allurectl (npm) GHSA-gpj6-4r9m-prh8, MAL-2026-11455 | Malicious | Not scored | 31 Jul, 2026 | npm allurectl |
Malicious release: Malicious code in mcp-server-boilerplate (npm) GHSA-694g-9jgf-5566, MAL-2026-11472 | Malicious | Not scored | 31 Jul, 2026 | npm mcp-server-boilerplate |