Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in calmora (npm) GHSA-7wwx-476f-c8gm, MAL-2026-11009 | Malicious | Not scored | 22 Jul, 2026 | npm calmora |
Malicious release: Malicious code in caldryn (npm) GHSA-h9c8-8wq8-r6q2, MAL-2026-11008 | Malicious | Not scored | 22 Jul, 2026 | npm caldryn |
Malicious release: Malicious code in calvora (npm) GHSA-jwm3-4ffq-hr73, MAL-2026-11010 | Malicious | Not scored | 22 Jul, 2026 | npm calvora |
Malicious release: Malicious code in veldora (npm) GHSA-wxrm-vmq9-jp23, MAL-2026-11018 | Malicious | Not scored | 22 Jul, 2026 | npm veldora |
Malicious release: Malicious code in vectormark (npm) GHSA-g48p-2cr5-5hm2, MAL-2026-11017 | Malicious | Not scored | 22 Jul, 2026 | npm vectormark |
Malicious release: Malicious code in react-tabulix-query (npm) GHSA-4rrq-g9w7-39c3, MAL-2026-11015 | Malicious | Not scored | 22 Jul, 2026 | npm react-tabulix-query |
Check Point SmartConsole Improper Authentication Vulnerability CVE-2026-16232 | CriticalExploited | 3.5% | 22 Jul, 2026 | |
Malicious release: Malicious code in react-tabulix-extended (npm) MAL-2026-11040 | Malicious | Not scored | 22 Jul, 2026 | npm react-tabulix-extended |
n8n: Google Service Account Private Key Exposed in JWT Header CVE-2026-65599, GHSA-9r8p-h6cc-6qhm | Medium | 0.2% | 22 Jul, 2026 | npm n8n |
n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution CVE-2026-65598, CVE-2026-71539, GHSA-g3r5-9h93-4j2c | High | 0.3% | 22 Jul, 2026 | npm n8n |
n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview CVE-2026-65597, GHSA-p3rg-hrf9-w9gj | High | 0.3% | 22 Jul, 2026 | npm n8n |
n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction CVE-2026-65596, GHSA-gq66-9cw5-j5jm | Medium | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs CVE-2026-65595, GHSA-777w-rpr6-c52h | High | 0.7% | 22 Jul, 2026 | npm n8n |
n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check CVE-2026-65594, GHSA-q5xf-xhwf-cwqf | Medium | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access CVE-2026-65593, GHSA-9w78-79q7-r4fp | Medium | 0.2% | 22 Jul, 2026 | npm n8n |
n8n: Stored DOM XSS via Resource Locator `cachedResultUrl` CVE-2026-65592, GHSA-9wcp-9r3j-383q | High | 0.2% | 22 Jul, 2026 | npm n8n |
n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution CVE-2026-65591, GHSA-pm35-fqvh-cq5g | High | 0.7% | 22 Jul, 2026 | npm n8n |
n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows CVE-2026-65590, GHSA-fpg6-x68q-5793 | Medium | 0.6% | 22 Jul, 2026 | npm n8n |
n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data CVE-2026-65589, GHSA-89gh-3pgc-v5h2 | Medium | 0.5% | 22 Jul, 2026 | npm n8n |
n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner CVE-2026-65016, GHSA-35q8-9mj6-wjmf | High | 0.4% | 22 Jul, 2026 | npm n8n |
n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool CVE-2026-65015, GHSA-x5vx-c2c8-m3w9 | High | 0.6% | 22 Jul, 2026 | npm n8n |
n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook CVE-2026-65014, GHSA-33q9-f52j-gc75 | Medium | 0.6% | 22 Jul, 2026 | npm n8n |
Malicious release: Malicious code in dev-helper-bg (PyPI) MAL-2026-10992 | Malicious | Not scored | 22 Jul, 2026 | PyPI dev-helper-bg |
Malicious release: Malicious code in make-helper (PyPI) MAL-2026-10991 | Malicious | Not scored | 22 Jul, 2026 | PyPI make-helper |
fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives CVE-2026-45820, GHSA-px8p-9vwx-vf98 | Medium | 0.3% | 22 Jul, 2026 | npm fflate |
Malicious release: Malicious code in streak-calendar (npm) GHSA-2p69-mmpj-h84r, MAL-2026-10981 | Malicious | Not scored | 21 Jul, 2026 | npm streak-calendar |
Malicious release: Malicious code in streak-daycount (npm) GHSA-2v57-6hmf-hpfj, MAL-2026-10982 | Malicious | Not scored | 21 Jul, 2026 | npm streak-daycount |
Malicious release: Malicious code in svelte-streaks (npm) GHSA-8vq2-5c69-fm3w, MAL-2026-10983 | Malicious | Not scored | 21 Jul, 2026 | npm svelte-streaks |
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 CVE-2026-114113, GHSA-f88m-g3jw-g9cj | High | 0.1% | 21 Jul, 2026 | npm sharp |
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits CVE-2026-73569, GHSA-8r6m-32jq-jx6q | High | 0.5% | 21 Jul, 2026 | npm fast-xml-parser |
GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL CVE-2026-67322, GHSA-rwj8-pgh3-r573, PYSEC-2026-3842 | High | 0.3% | 21 Jul, 2026 | PyPI GitPython PyPI gitpython |
Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations CVE-2026-73648, GHSA-cj75-f6xr-r4g7 | Medium | 0.5% | 21 Jul, 2026 | RubyGems rails-html-sanitizer |
Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake CVE-2026-73565, GHSA-9mqv-5hh9-4cgg | Medium | 0.5% | 21 Jul, 2026 | npm @hono/node-server |
gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities GHSA-hrxh-6v49-42gf, GO-2026-6061 | High | Not scored | 21 Jul, 2026 | Go google.golang.org/grpc |
Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons CVE-2026-73492, GHSA-5qhf-9phg-95m2 | Low | 0.4% | 21 Jul, 2026 | RubyGems loofah |
Loofah: SVG `href` attribute bypasses local-reference restriction CVE-2026-73490, GHSA-9wjq-cp2p-hrgf | Medium | 0.3% | 21 Jul, 2026 | RubyGems loofah |
TypeORM: migration:generate template-literal code injection CVE-2026-73651, GHSA-2rp8-mm9q-fp49 | Medium | 0.4% | 21 Jul, 2026 | npm typeorm |
Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface CVE-2026-20779, GHSA-gx3v-q759-g323, GO-2026-6057 | High | 0.5% | 21 Jul, 2026 | Go code.gitea.io/gitea |
Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints CVE-2026-58429, GHSA-fq2p-5p22-8g6j, GO-2026-6053 | Medium | 0.5% | 21 Jul, 2026 | Go code.gitea.io/gitea Go gitea.dev |
Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata BIT-gitea-2026-34966, CVE-2026-34966, CVE-2026-59765, GHSA-2wm4-vwp6-v7xc, GO-2026-6039 | Medium | 0.4% | 21 Jul, 2026 | Go code.gitea.io/gitea Go gitea.dev |
Gitea: Webhook Authorization Header Returned in Plaintext via API CVE-2026-58511, GHSA-3r5c-2xxx-h872, GO-2026-6040 | Low | 0.4% | 21 Jul, 2026 | Go code.gitea.io/gitea Go gitea.dev |
Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs CVE-2026-57897, GHSA-frpw-3h2q-4jj6, GO-2026-6054 | Medium | 0.4% | 21 Jul, 2026 | Go code.gitea.io/gitea Go gitea.dev |
Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private CVE-2026-58510, GHSA-q423-49rw-g9mh, GO-2026-6069 | Medium | 0.3% | 21 Jul, 2026 | Go code.gitea.io/gitea Go gitea.dev |
Gitea: Public-only API token restriction is not enforced on team API routes CVE-2026-58431, GHSA-h56g-4qw7-2mxg, GO-2026-6059 | Medium | 0.3% | 21 Jul, 2026 | Go gitea.dev |
Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 CVE-2026-58427, GHSA-prr9-9mp4-5gp2, GO-2026-6068 | Medium | 0.5% | 21 Jul, 2026 | Go gitea.dev |
Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts CVE-2026-58422, GHSA-g9g6-qhrc-p3qc, GO-2026-6056 | High | 0.4% | 21 Jul, 2026 | Go code.gitea.io/gitea |
Gitea: Notification API leaks private issue metadata after access revocation CVE-2026-58419, GHSA-44qc-pgvp-wx7v, GO-2026-6041 | High | 0.4% | 21 Jul, 2026 | Go code.gitea.io/gitea |
Gitea: Unauthorized Access to Labels of Private Organizations CVE-2026-25038, GHSA-v73x-hx65-6pf4, GO-2026-6076 | High | 0.6% | 21 Jul, 2026 | Go code.gitea.io/gitea |
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write CVE-2026-27775, GHSA-649p-mmhf-85c7, GO-2026-6043 | High | 0.9% | 21 Jul, 2026 | Go code.gitea.io/gitea |
Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private CVE-2026-24451, GHSA-wrf9-r3h7-7x5v, GO-2026-6081 | High | 0.4% | 21 Jul, 2026 | Go code.gitea.io/gitea |