Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @peptide-unit/peptide-modify (npm) GHSA-mw2h-4g9g-g7vv, MAL-2026-11178 | Malicious | Not scored | 29 Jul, 2026 | npm @peptide-unit/peptide-modify |
olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193 GHSA-wchh-9x6h-7f6p | Medium | Not scored | 29 Jul, 2026 | PyPI matrix-commander |
Malicious release: Malicious code in lzd-unified-station-sdk (npm) GHSA-2rgv-qvc2-5q4h, MAL-2026-11187 | Malicious | Not scored | 29 Jul, 2026 | npm lzd-unified-station-sdk |
Malicious release: Malicious code in def-open-client (npm) GHSA-pxmg-gr7p-wx8p, MAL-2026-11183 | Malicious | Not scored | 29 Jul, 2026 | npm def-open-client |
Malicious release: Malicious code in test-skill-zip (npm) GHSA-qw86-6hcg-cj2j, MAL-2026-11189 | Malicious | Not scored | 29 Jul, 2026 | npm test-skill-zip |
Malicious release: Malicious code in lwp-web-client (npm) GHSA-rmm2-5g7m-wj7p, MAL-2026-11186 | Malicious | Not scored | 29 Jul, 2026 | npm lwp-web-client |
Malicious release: Malicious code in uniapi-bridge (npm) GHSA-wpp9-5p7g-7cjh, MAL-2026-11190 | Malicious | Not scored | 29 Jul, 2026 | npm uniapi-bridge |
Malicious release: Malicious code in flight-compare-analyzer (npm) GHSA-wwp4-2j5x-f2m9, MAL-2026-11185 | Malicious | Not scored | 29 Jul, 2026 | npm flight-compare-analyzer |
Malicious release: Malicious code in colder-cli (npm) GHSA-x646-p774-9w26, MAL-2026-11182 | Malicious | Not scored | 29 Jul, 2026 | npm colder-cli |
Malicious release: Malicious code in open-worker-cli (npm) GHSA-2p2c-gx9p-5wg8, MAL-2026-11188 | Malicious | Not scored | 29 Jul, 2026 | npm open-worker-cli |
Malicious release: Malicious code in aone-cloud-cli (npm) GHSA-c6xg-mcq6-m594, MAL-2026-11180 | Malicious | Not scored | 29 Jul, 2026 | npm aone-cloud-cli |
Malicious release: Malicious code in feedback-ai-sdk (npm) GHSA-fh6v-xfxj-m87q, MAL-2026-11184 | Malicious | Not scored | 29 Jul, 2026 | npm feedback-ai-sdk |
prebid-server's request forgery vulnerability allows for possible host environment data extraction CVE-2026-54735, GHSA-4p3g-4hcj-wpvx, GO-2026-6139 | Critical | 0.6% | 29 Jul, 2026 | Go github.com/prebid/prebid-server Go github.com/prebid/prebid-server/v2 Go github.com/prebid/prebid-server/v3 Go github.com/prebid/prebid-server/v4 |
@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate GHSA-pc2w-4mq8-32qw | Low | Not scored | 29 Jul, 2026 | npm @dynatrace-oss/dynatrace-mcp-server |
Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive CVE-2026-50558, GHSA-f42x-p2mx-hm8r, PYSEC-2026-3606 | Medium | 0.4% | 29 Jul, 2026 | PyPI penelope-shell-handler |
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies CVE-2026-54666, GHSA-w284-33mx-6g9v | High | 0.4% | 29 Jul, 2026 | npm swagger-typescript-api |
swagger-typescript-api vulnerable to code injection via unescaped enum string values CVE-2026-54664, GHSA-5f94-x226-ccpm | High | 0.5% | 29 Jul, 2026 | npm swagger-typescript-api |
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template CVE-2026-54661, GHSA-38c3-wv3c-v3xj | High | 0.5% | 29 Jul, 2026 | npm swagger-typescript-api |
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref` CVE-2026-54663, GHSA-x36r-4347-pm5x | Medium | 0.2% | 29 Jul, 2026 | npm swagger-typescript-api |
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template CVE-2026-54662, GHSA-hqj5-cw9f-rx67 | High | 0.3% | 29 Jul, 2026 | npm swagger-typescript-api |
swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref` CVE-2026-54660, GHSA-h754-fxp7-88wx | High | 0.3% | 29 Jul, 2026 | npm swagger-typescript-api |
nanoid: non-secure generators can loop indefinitely with negative size CVE-2026-67214, GHSA-28wg-ghj8-5hjv | High | 0.3% | 29 Jul, 2026 | npm nanoid |
nanoid: custom generators can loop indefinitely when size is zero CVE-2026-67213, GHSA-2v37-7h3g-55p8 | High | 0.3% | 29 Jul, 2026 | npm nanoid |
Malicious release: Malicious code in zer0code (npm) GHSA-frrq-7m67-mgxg, MAL-2026-11191 | Malicious | Not scored | 29 Jul, 2026 | npm zer0code |
Malicious release: Malicious code in @finxsecdemo/utils (npm) MAL-2026-11170 | Malicious | Not scored | 29 Jul, 2026 | npm @finxsecdemo/utils |
Malicious release: Malicious code in test2221 (npm) MAL-2026-11192 | Malicious | Not scored | 29 Jul, 2026 | npm test2221 |
Malicious release: Malicious code in chain-manager (npm) GHSA-257g-ggr2-j398, MAL-2026-11181 | Malicious | Not scored | 29 Jul, 2026 | npm chain-manager |
Malicious release: Malicious code in @bowozzz/baileys (npm) GHSA-f9vh-885g-hv2f, MAL-2026-11176 | Malicious | Not scored | 29 Jul, 2026 | npm @bowozzz/baileys |
Malicious release: Malicious code in @mypwn/hawkeye (npm) MAL-2026-11157 | Malicious | Not scored | 29 Jul, 2026 | npm @mypwn/hawkeye |
Malicious release: Malicious code in @types-beta/sdk (npm) MAL-2026-11499 | Malicious | Not scored | 29 Jul, 2026 | npm @types-beta/sdk |
goshs has ACL Bypass & Path Traversal CVE-2026-66064, GHSA-964w-f6gj-5236, GO-2026-6134 | Medium | 0.4% | 28 Jul, 2026 | Go github.com/patrickhener/goshs Go github.com/patrickhener/goshs/v2 Go goshs.de/goshs Go goshs.de/goshs/v2 |
Pagy I18n locale option is not validated before being used in a file path CVE-2026-54659, GHSA-2xmw-f8j8-wfxc | Medium | 0.4% | 28 Jul, 2026 | RubyGems pagy |
openhole-server vulnerable to path traversal via URL-decoded request path CVE-2026-54650, GHSA-fh2f-xfxc-q9cc, GO-2026-6135 | High | 0.5% | 28 Jul, 2026 | Go github.com/bablilayoub/openhole |
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution CVE-2026-54658, GHSA-6wcc-39rp-hh9p | Critical | 0.8% | 28 Jul, 2026 | npm @hypequery/clickhouse |
td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode CVE-2026-54638, GHSA-whmm-qj9r-wvr2, GO-2026-6138 | High | 0.6% | 28 Jul, 2026 | Go github.com/gotd/td |
goshs has a Path Traversal issue CVE-2026-66063, GHSA-wg2q-39h6-66x9, GO-2026-6137 | Medium | 0.3% | 28 Jul, 2026 | Go github.com/patrickhener/goshs Go github.com/patrickhener/goshs/v2 Go goshs.de/goshs Go goshs.de/goshs/v2 |
goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite CVE-2026-64863, GHSA-hq33-8jgp-8qq3, GO-2026-6136 | Critical | 0.4% | 28 Jul, 2026 | Go github.com/patrickhener/goshs Go github.com/patrickhener/goshs/v2 Go goshs.de/goshs Go goshs.de/goshs/v2 |
goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) CVE-2026-54719, GHSA-rmxw-pq4x-3fvh, GO-2026-6133 | High | 0.4% | 28 Jul, 2026 | Go github.com/patrickhener/goshs Go github.com/patrickhener/goshs/v2 Go goshs.de/goshs Go goshs.de/goshs/v2 |
goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) CVE-2026-62325, GHSA-rjrw-mjq6-hpmm, GO-2026-6132 | Critical | 0.4% | 28 Jul, 2026 | Go github.com/patrickhener/goshs/v2 Go goshs.de/goshs Go goshs.de/goshs/v2 |
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field CVE-2026-54654, GHSA-wjv6-jcfj-mf9r, PYSEC-2026-3566 | High | 0.2% | 28 Jul, 2026 | PyPI datamodel-code-generator |
datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs` CVE-2026-55389, GHSA-8359-h9fx-j6v9, PYSEC-2026-3558 | High | 0.5% | 28 Jul, 2026 | PyPI datamodel-code-generator |
`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field CVE-2026-54653, GHSA-386q-5hp3-95m9, PYSEC-2026-3555 | High | 0.7% | 28 Jul, 2026 | PyPI datamodel-code-generator |
datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding CVE-2026-55391, GHSA-vx7x-vcc2-c44g, PYSEC-2026-3565 | High | 0.3% | 28 Jul, 2026 | PyPI datamodel-code-generator |
`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data CVE-2026-54656, GHSA-8m8r-38jm-f355, PYSEC-2026-3559 | High | 0.3% | 28 Jul, 2026 | PyPI datamodel-code-generator |
datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default) CVE-2026-54690, GHSA-954p-556p-r752, PYSEC-2026-3560 | High | 0.4% | 28 Jul, 2026 | PyPI datamodel-code-generator |
datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements CVE-2026-55415, GHSA-5578-w22f-pfx9, PYSEC-2026-3557 | High | 0.5% | 28 Jul, 2026 | PyPI datamodel-code-generator |
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description CVE-2026-54621, GHSA-j884-q54q-mmx3, PYSEC-2026-3561 | High | 0.2% | 28 Jul, 2026 | PyPI datamodel-code-generator |
`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator CVE-2026-54655, GHSA-m34r-v34r-rf9q, PYSEC-2026-3562 | High | 0.2% | 28 Jul, 2026 | PyPI datamodel-code-generator |
datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas CVE-2026-55403, GHSA-r5vv-ff45-prp2, PYSEC-2026-3563 | Low | 0.3% | 28 Jul, 2026 | PyPI datamodel-code-generator |
datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects CVE-2026-54691, GHSA-rfr2-mq9m-x2qx, PYSEC-2026-3564 | High | 0.3% | 28 Jul, 2026 | PyPI datamodel-code-generator |