Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
React Router: RSCErrorHandler Missing Protocol Validation (XSS) CVE-2026-53667, GHSA-h8fp-f39c-q6mh | Medium | 0.4% | 23 Jul, 2026 | npm react-router |
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration CVE-2026-53666, GHSA-337j-9hxr-rhxg | Medium | 0.4% | 23 Jul, 2026 | npm react-router |
find-my-way: DDoS with HTTP2 CVE-2026-47219, GHSA-c96f-x56v-gq3h | High | 0.5% | 23 Jul, 2026 | npm find-my-way |
Malicious release: Malicious code in chai-as-stringify (npm) GHSA-vh7h-h87g-qv6x, MAL-2026-11032 | Malicious | Not scored | 23 Jul, 2026 | npm chai-as-stringify |
Malicious release: Malicious code in yuinpm (npm) GHSA-vpgm-qmgp-w4h4, MAL-2026-11039 | Malicious | Not scored | 23 Jul, 2026 | npm yuinpm |
Malicious release: Malicious code in eth-codergen (npm) GHSA-87w3-vjw9-8h4w, MAL-2026-11033 | Malicious | Not scored | 23 Jul, 2026 | npm eth-codergen |
AWS API MCP Server Security Policy Bypass via Startup Initialization Failure CVE-2026-16584, GHSA-29w2-fq35-v728, PYSEC-2026-3549 | High | 0.2% | 23 Jul, 2026 | PyPI awslabs-aws-api-mcp-server PyPI awslabs.aws-api-mcp-server |
Malicious release: Malicious code in streak-lib-math (npm) GHSA-c7rv-9j9g-pqh2, MAL-2026-11036 | Malicious | Not scored | 23 Jul, 2026 | npm streak-lib-math |
Malicious release: Malicious code in svelte-streak-metrics (npm) GHSA-fc4x-xfq3-5f35, MAL-2026-11038 | Malicious | Not scored | 23 Jul, 2026 | npm svelte-streak-metrics |
Malicious release: Malicious code in svelte-goal-streak (npm) GHSA-jw9g-wvg5-7rjg, MAL-2026-11037 | Malicious | Not scored | 23 Jul, 2026 | npm svelte-goal-streak |
Malicious release: Malicious code in streak-bucket-lib (npm) GHSA-rg2p-8587-wx3w, MAL-2026-11035 | Malicious | Not scored | 23 Jul, 2026 | npm streak-bucket-lib |
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments CVE-2026-45623, GHSA-6g55-p6wh-862q | Critical | 0.6% | 23 Jul, 2026 | npm postcss |
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion CVE-2026-59933, GHSA-xh5m-36r6-47m3 | High | 0.5% | 23 Jul, 2026 | Packagist phpoffice/phpspreadsheet |
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion CVE-2026-59932, GHSA-2mrg-gjxq-2gvr | High | 0.5% | 23 Jul, 2026 | Packagist phpoffice/phpspreadsheet |
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist CVE-2026-59931, GHSA-6hq5-7373-42rg | High | 0.5% | 23 Jul, 2026 | Packagist phpoffice/phpspreadsheet |
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error) CVE-2026-73421, GHSA-8fpg-xm3f-6cx3 | Critical | 0.6% | 23 Jul, 2026 | npm next-auth |
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers CVE-2026-73418, GHSA-xmf8-cvqr-rfgj | High | 0.9% | 23 Jul, 2026 | npm @auth/core npm next-auth |
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass CVE-2026-73420, GHSA-7rqj-j65f-68wh | Critical | 0.7% | 23 Jul, 2026 | npm @auth/core npm next-auth |
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them CVE-2026-73419, GHSA-x445-f3h2-j279 | Medium | 0.2% | 23 Jul, 2026 | npm @auth/core npm next-auth |
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash CVE-2026-14257, GHSA-mh99-v99m-4gvg | High | 0.6% | 23 Jul, 2026 | npm brace-expansion |
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation CVE-2026-65608, GHSA-c4wf-2xxc-68qm | High | 1.1% | 23 Jul, 2026 | Packagist getgrav/grav |
@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths CVE-2026-7120, GHSA-8pvw-jcv7-9cmj | Medium | 0.4% | 23 Jul, 2026 | npm @fastify/static |
@fastify/static vulnerable to route guard bypass via path traversal CVE-2026-15074, GHSA-83w8-p2f5-377r | High | 0.7% | 23 Jul, 2026 | npm @fastify/static |
Malicious release: Malicious code in vitest-axios (npm) GHSA-6v5g-7h35-h33q, MAL-2026-11030 | Malicious | Not scored | 23 Jul, 2026 | npm vitest-axios |
Malicious release: Malicious code in fs-extra-core (npm) GHSA-f246-8cf4-26v7, MAL-2026-11027 | Malicious | Not scored | 23 Jul, 2026 | npm fs-extra-core |
Malicious release: Malicious code in create-kumo-project (npm) GHSA-7jg3-v58m-2f3p, MAL-2026-11024 | Malicious | Not scored | 23 Jul, 2026 | npm create-kumo-project |
Malicious release: Malicious code in lychee-norm-cache (npm) GHSA-pj38-6jj4-4x3p, MAL-2026-11029 | Malicious | Not scored | 23 Jul, 2026 | npm lychee-norm-cache |
Malicious release: Malicious code in aio-commerce-lib-app (npm) GHSA-897j-xx2q-x2h9, MAL-2026-11022 | Malicious | Not scored | 23 Jul, 2026 | npm aio-commerce-lib-app |
Malicious release: Malicious code in helix-deploy (npm) GHSA-fhpm-cq57-j289, MAL-2026-11028 | Malicious | Not scored | 23 Jul, 2026 | npm helix-deploy |
Malicious release: Malicious code in da-sc-sdk (npm) GHSA-vxfh-w38r-2g54, MAL-2026-11025 | Malicious | Not scored | 23 Jul, 2026 | npm da-sc-sdk |
Malicious release: Malicious code in ethers-packge (npm) GHSA-67vw-rvv3-mh93, MAL-2026-11026 | Malicious | Not scored | 23 Jul, 2026 | npm ethers-packge |
Malicious release: Malicious code in bs58-88 (npm) GHSA-qj7h-vp7h-8v85, MAL-2026-11023 | Malicious | Not scored | 23 Jul, 2026 | npm bs58-88 |
Malicious release: Malicious code in @bcryptln/bcryptjs (npm) GHSA-qw92-vxcv-397r, MAL-2026-11021 | Malicious | Not scored | 23 Jul, 2026 | npm @bcryptln/bcryptjs |
Malicious release: Malicious code in hardhat-gas-tracker (npm) MAL-2026-11020 | Malicious | Not scored | 22 Jul, 2026 | npm hardhat-gas-tracker |
n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation CVE-2026-72750, GHSA-652q-gvq3-74qv | Medium | 0.5% | 22 Jul, 2026 | npm n8n |
n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances CVE-2026-72775, GHSA-jqwr-vx3p-r266 | Medium | 0.5% | 22 Jul, 2026 | npm n8n |
n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner CVE-2026-72764, GHSA-9cmh-xcqm-5hqr | Medium | 0.8% | 22 Jul, 2026 | npm n8n |
JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`) BIT-jupyterlab-2026-73417, CVE-2026-73417, GHSA-pppj-hq3g-57pj, PYSEC-2026-3672 | High | 0.7% | 22 Jul, 2026 | PyPI jupyterlab |
JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab BIT-jupyterlab-2026-73415, CVE-2026-73415, GHSA-gx64-gj6p-pc4c, PYSEC-2026-3671 | High | 0.7% | 22 Jul, 2026 | PyPI jupyterlab |
JupyterLab: PyPI extension blocklist package-name canonicalization bypass BIT-jupyterlab-2026-73416, CVE-2026-73416, GHSA-89vp-jrxv-24w8, PYSEC-2026-3670 | Medium | 0.7% | 22 Jul, 2026 | PyPI jupyterlab |
JupyterLab PluginManager lock-rule enforcement bypass BIT-jupyterlab-2026-73627, CVE-2026-73627, GHSA-h5v5-8746-g7mm | Medium | 0.4% | 22 Jul, 2026 | PyPI jupyterlab |
JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`) BIT-jupyterlab-2026-73626, CVE-2026-73626, GHSA-whvh-wf3x-g77j | High | 0.4% | 22 Jul, 2026 | PyPI jupyterlab |
Next.js: Server-Side Request Forgery in Server Actions on custom servers CVE-2026-64649, GHSA-89xv-2m56-2m9x | High | 0.5% | 22 Jul, 2026 | npm next |
Next.js: Cache confusion of response bodies for requests with bodies CVE-2026-64648, GHSA-68g3-v927-f742 | Medium | 0.3% | 22 Jul, 2026 | npm next |
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences CVE-2026-64647, GHSA-4633-3j49-mh5q | Medium | 0.3% | 22 Jul, 2026 | npm next |
Next.js: Unbounded Server Action payload in Edge runtime CVE-2026-64646, GHSA-4c39-4ccg-62r3 | Medium | 0.5% | 22 Jul, 2026 | npm next |
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname CVE-2026-64645, GHSA-p9j2-gv94-2wf4 | High | 0.4% | 22 Jul, 2026 | npm next |
Next.js: Denial of Service in the Image Optimization API using SVGs CVE-2026-64644, GHSA-q8wf-6r8g-63ch | Medium | 0.7% | 22 Jul, 2026 | npm next |
Next.js: Unauthenticated disclosure of internal Server Function endpoints CVE-2026-64643, GHSA-955p-x3mx-jcvp | Medium | 0.5% | 22 Jul, 2026 | npm next |
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale CVE-2026-64642, GHSA-6gpp-xcg3-4w24 | High | 0.6% | 22 Jul, 2026 | npm next |