Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in tailwindcss-keyframe-kit (npm) GHSA-282x-w96h-wv7f, MAL-2026-18088 | Malicious | Not scored | 12 days ago | npm tailwindcss-keyframe-kit |
Malicious release: Malicious code in tailwindcss-motionanimate (npm) MAL-2026-18089 | Malicious | Not scored | 12 days ago | npm tailwindcss-motionanimate |
Malicious release: Malicious code in tailwindcss-visual-kit (npm) GHSA-f37w-2g4f-58r3, MAL-2026-18090 | Malicious | Not scored | 12 days ago | npm tailwindcss-visual-kit |
Malicious release: Malicious code in @pkgship/frpc-linux-arm64 (npm) GHSA-753f-gx8g-q88w, MAL-2026-17922 | Malicious | Not scored | 12 days ago | npm @pkgship/frpc-linux-arm64 |
Malicious release: Malicious code in rootaccessxvv-bbmarker (npm) MAL-2026-18108 | Malicious | Not scored | 13 days ago | npm rootaccessxvv-bbmarker |
Malicious release: Malicious code in leakdeep (PyPI) MAL-2026-17921 | Malicious | Not scored | 13 days ago | PyPI leakdeep |
ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process CVE-2026-111997, GHSA-rxp7-6hxx-x8q5 | Medium | 0.3% | 13 days ago | npm ip-address |
Malicious release: Malicious code in tonemaptts (PyPI) MAL-2026-17918 | Malicious | Not scored | 14 days ago | PyPI tonemaptts |
Malicious release: Malicious code in pyrechoasr (PyPI) MAL-2026-17916 | Malicious | Not scored | 14 days ago | PyPI pyrechoasr |
Malicious release: Malicious code in driftwavets (PyPI) MAL-2026-17912 | Malicious | Not scored | 14 days ago | PyPI driftwavets |
Malicious release: Malicious code in novalithtts (PyPI) MAL-2026-17915 | Malicious | Not scored | 14 days ago | PyPI novalithtts |
Malicious release: Malicious code in voltswannts (PyPI) MAL-2026-17920 | Malicious | Not scored | 14 days ago | PyPI voltswannts |
Malicious release: Malicious code in glassbeakasr (PyPI) MAL-2026-17914 | Malicious | Not scored | 14 days ago | PyPI glassbeakasr |
Malicious release: Malicious code in emberlytts (PyPI) MAL-2026-17913 | Malicious | Not scored | 14 days ago | PyPI emberlytts |
Malicious release: Malicious code in quasitonnts (PyPI) MAL-2026-17917 | Malicious | Not scored | 14 days ago | PyPI quasitonnts |
Malicious release: Malicious code in ukraine69 (PyPI) MAL-2026-17919 | Malicious | Not scored | 14 days ago | PyPI ukraine69 |
Malicious release: Malicious code in itsa-react-maskedinput (npm) GHSA-hhr5-rjw6-9hr5, MAL-2026-17911 | Malicious | Not scored | 14 days ago | npm itsa-react-maskedinput |
Malicious release: Malicious code in itsa-react-focuscontainer (npm) GHSA-8c34-p746-v5rq, MAL-2026-17910 | Malicious | Not scored | 14 days ago | npm itsa-react-focuscontainer |
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files CVE-2026-108372, GHSA-vx2m-gpq4-8j5q | High | 0.3% | 14 days ago | PyPI loopx |
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution CVE-2026-96620, GHSA-h4mw-j7qp-8mwm | Critical | 0.7% | 14 days ago | PyPI claude-agent-sdk |
ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out) CVE-2026-76894, GHSA-vqff-r82h-9crc | Low | Not scored | 14 days ago | npm @aborruso/ckan-mcp-server |
ClickMigrate has Path Traversal in "revision -m" argument CVE-2026-68549, GHSA-vgf9-9mxx-hq54 | Low | Not scored | 14 days ago | PyPI ClickMigrate PyPI clickmigrate |
Malicious release: Malicious code in @beloved-lenora/opencode-orchestrator (npm) GHSA-7wq2-8pc2-wm26, MAL-2026-17905 | Malicious | Not scored | 14 days ago | npm @beloved-lenora/opencode-orchestrator |
Malicious release: Malicious code in @beloved-lenora/opencode-shared-rpc (npm) GHSA-8c9g-fwgq-rqq5, MAL-2026-17906 | Malicious | Not scored | 14 days ago | npm @beloved-lenora/opencode-shared-rpc |
Malicious release: Malicious code in @beloved-lenora/opencode-todo (npm) GHSA-9rjq-6mhc-46c5, MAL-2026-17909 | Malicious | Not scored | 14 days ago | npm @beloved-lenora/opencode-todo |
Malicious release: Malicious code in @beloved-lenora/opencode-goal (npm) GHSA-c78h-wwhq-g6j8, MAL-2026-17904 | Malicious | Not scored | 14 days ago | npm @beloved-lenora/opencode-goal |
Malicious release: Malicious code in @beloved-lenora/opencode-stats (npm) GHSA-f4h2-68pg-ffhj, MAL-2026-17908 | Malicious | Not scored | 14 days ago | npm @beloved-lenora/opencode-stats |
Malicious release: Malicious code in @beloved-lenora/opencode-shell-guard (npm) GHSA-pm76-w63j-7j29, MAL-2026-17907 | Malicious | Not scored | 14 days ago | npm @beloved-lenora/opencode-shell-guard |
Malicious release: Malicious code in @beloved-lenora/opencode-btw (npm) GHSA-xv54-6gmc-3xph, MAL-2026-17903 | Malicious | Not scored | 14 days ago | npm @beloved-lenora/opencode-btw |
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint CVE-2026-109461, GHSA-xcx6-jx8p-x3h5 | High | 0.4% | 14 days ago | npm @azure/msal-node |
Malicious release: Malicious code in pyyi (PyPI) MAL-2026-17866 | Malicious | Not scored | 15 days ago | PyPI pyyi |
Malicious release: Malicious code in @xatancchii/natabaileys (npm) GHSA-cgq9-cff6-pf33, MAL-2026-17901 | Malicious | Not scored | 15 days ago | npm @xatancchii/natabaileys |
Malicious release: Malicious code in parxleys (npm) GHSA-rg3c-8x72-6pmc, MAL-2026-17902 | Malicious | Not scored | 15 days ago | npm parxleys |
Malicious release: Malicious code in marocolor (PyPI) MAL-2026-17900 | Malicious | Not scored | 15 days ago | PyPI marocolor |
Malicious release: Malicious code in @flexmr/survey-conversation (npm) GHSA-hc8w-gq4q-fr74, MAL-2026-17899 | Malicious | Not scored | 15 days ago | npm @flexmr/survey-conversation |
Malicious release: Malicious code in @flexmr/survey-client (npm) GHSA-rh7q-f888-q36c, MAL-2026-17898 | Malicious | Not scored | 15 days ago | npm @flexmr/survey-client |
Malicious release: Malicious code in fromthehotel-poems (PyPI) MAL-2026-17897 | Malicious | Not scored | 15 days ago | PyPI fromthehotel-poems |
Malicious release: Malicious code in xmd-baileys (npm) GHSA-m3qf-j9rf-pqrh, MAL-2026-17892 | Malicious | Not scored | 15 days ago | npm xmd-baileys |
Malicious release: Malicious code in @developmentyora/baileyss (npm) GHSA-v8xh-mr86-2fpq, MAL-2026-17439 | Malicious | Not scored | 15 days ago | npm @developmentyora/baileyss |
Malicious release: Malicious code in @developmentyora/yorakids (npm) GHSA-xgr5-84p3-qqmf, MAL-2026-17890 | Malicious | Not scored | 15 days ago | npm @developmentyora/yorakids |
Malicious release: Malicious code in asistenyorstore (npm) GHSA-qgh5-36wr-3vvw, MAL-2026-17891 | Malicious | Not scored | 15 days ago | npm asistenyorstore |
Malicious release: Malicious code in @celestial-community/baileys (npm) GHSA-5ghv-64gv-gv29, MAL-2026-17438 | Malicious | Not scored | 15 days ago | npm @celestial-community/baileys |
Malicious release: Malicious code in @apexacc/audit (npm) MAL-2026-17923 | Malicious | Not scored | 15 days ago | npm @apexacc/audit |
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability CVE-2026-111357 | HighExploited | 0.3% | 15 days ago | |
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability CVE-2026-102764 | CriticalExploited | 18.9% | 15 days ago | |
Malicious release: Malicious code in proxyrobika (PyPI) MAL-2026-17889 | Malicious | Not scored | 15 days ago | PyPI proxyrobika |
borg extract might modify out-of-tree files when extracting maliciously crafted archives CVE-2026-62268, GHSA-gfp8-w835-v44j | Medium | Not scored | 15 days ago | PyPI borgbackup |
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor CVE-2026-87029, GHSA-55wc-3pg8-jfw6 | High | 0.3% | 15 days ago | npm undici |
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation CVE-2026-87018, GHSA-qrxm-fqhp-jwvm | High | 0.2% | 15 days ago | npm undici |
Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign) CVE-2026-62322, GHSA-526j-582w-7fm9 | Medium | 0.2% | 15 days ago | PyPI social-auth-core |