Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
GitPython unsafe clone option gate bypass through joined short options CVE-2026-67324, GHSA-v396-v7q4-x2qj, PYSEC-2026-3947 | Critical | 0.5% | 21 Jul, 2026 | PyPI GitPython PyPI gitpython |
SVGO removeScripts plugin leaves some executable scripts intact CVE-2026-73650, GHSA-2p49-hgcm-8545 | High | 0.4% | 21 Jul, 2026 | npm svgo |
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. CVE-2026-66010, GHSA-c2j3-45gr-mqc4 | Medium | 0.2% | 21 Jul, 2026 | npm dompurify |
@vitest/browser: Browser Mode provider commands bypass the file-access permission gate CVE-2026-73653, GHSA-p63j-vcc4-9vmv | Critical | 0.8% | 21 Jul, 2026 | npm @vitest/browser |
Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration CVE-2026-57894, GHSA-82f7-87hm-852x, GO-2026-6027 | High | 0.4% | 21 Jul, 2026 | Go code.gitea.io/gitea Go gitea.dev |
websocket-driver-ruby: Denial of service via malformed Host header CVE-2026-61666, GHSA-2x63-gw47-w4mm | High | 0.4% | 21 Jul, 2026 | RubyGems websocket-driver |
Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) GHSA-frvp-7c67-39w9 | Medium | Not scored | 21 Jul, 2026 | npm @hono/node-server |
react-server-dom: Denial of Service in Server Functions CVE-2026-44907, GHSA-wx67-qw84-cm4g | High | 0.6% | 21 Jul, 2026 | npm react-server-dom-parcel npm react-server-dom-turbopack npm react-server-dom-webpack |
Malicious release: Malicious code in veskra (npm) GHSA-pr2p-6xpw-q8vw, MAL-2026-10984 | Malicious | Not scored | 21 Jul, 2026 | npm veskra |
Malicious release: Malicious code in nolby (npm) GHSA-x724-q7wp-wx6q, MAL-2026-10980 | Malicious | Not scored | 21 Jul, 2026 | npm nolby |
Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding CVE-2026-64825, GHSA-5hxg-r395-fqxx, PYSEC-2026-3669 | Critical | 0.6% | 21 Jul, 2026 | PyPI homeassistant |
Malicious release: Malicious code in react-tabulix-ui (npm) GHSA-5jr9-f9w4-93v3, MAL-2026-10988 | Malicious | Not scored | 21 Jul, 2026 | npm react-tabulix-ui |
Malicious release: Malicious code in animated-octo-spoon (PyPI) MAL-2026-10985 | Malicious | Not scored | 21 Jul, 2026 | PyPI animated-octo-spoon |
Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references CVE-2026-73491, GHSA-8whx-365g-h9vv | Low | 0.4% | 21 Jul, 2026 | RubyGems loofah |
Malicious release: Malicious code in react-tabulix-virtual (npm) MAL-2026-10989 | Malicious | Not scored | 21 Jul, 2026 | npm react-tabulix-virtual |
Malicious release: Malicious code in react-tabulix-core (npm) GHSA-5w4q-8fc9-88f4, MAL-2026-10987 | Malicious | Not scored | 21 Jul, 2026 | npm react-tabulix-core |
Malicious release: Malicious code in reimagined-broccoli (PyPI) MAL-2026-10978 | Malicious | Not scored | 21 Jul, 2026 | PyPI reimagined-broccoli |
Malicious release: Malicious code in lebinfmt (PyPI) MAL-2026-10977 | Malicious | Not scored | 21 Jul, 2026 | PyPI lebinfmt |
Malicious release: Malicious code in colorstack (PyPI) MAL-2026-10976 | Malicious | Not scored | 21 Jul, 2026 | PyPI colorstack |
Malicious release: Malicious code in rasterkit (PyPI) MAL-2026-10974 | Malicious | Not scored | 21 Jul, 2026 | PyPI rasterkit |
Malicious release: Malicious code in rasterkit-demo (PyPI) MAL-2026-10975 | Malicious | Not scored | 21 Jul, 2026 | PyPI rasterkit-demo |
Malicious release: Malicious code in fluffy-octo-broccoli (PyPI) MAL-2026-10973 | Malicious | Not scored | 21 Jul, 2026 | PyPI fluffy-octo-broccoli |
Malicious release: Malicious code in commonweb-rewards (npm) GHSA-p7jm-wh46-6hxx, MAL-2026-10968 | Malicious | Not scored | 21 Jul, 2026 | npm commonweb-rewards |
Malicious release: Malicious code in consumerweb-calurls (npm) GHSA-2fpw-cmmr-5j84, MAL-2026-10970 | Malicious | Not scored | 21 Jul, 2026 | npm consumerweb-calurls |
Malicious release: Malicious code in commonweb-card (npm) GHSA-cr8q-p657-jfpv, MAL-2026-10966 | Malicious | Not scored | 21 Jul, 2026 | npm commonweb-card |
Malicious release: Malicious code in commonweb-moneymovement (npm) GHSA-j4gf-r356-ff9m, MAL-2026-10967 | Malicious | Not scored | 21 Jul, 2026 | npm commonweb-moneymovement |
Malicious release: Malicious code in signzy-field-level-encrypter (npm) MAL-2026-10972 | Malicious | Not scored | 21 Jul, 2026 | npm signzy-field-level-encrypter |
Malicious release: Malicious code in commonweb-wallet (npm) GHSA-583v-m69g-vj4g, MAL-2026-10969 | Malicious | Not scored | 21 Jul, 2026 | npm commonweb-wallet |
Malicious release: Malicious code in cxpw-offers (npm) GHSA-9mr2-w7h5-r8c8, MAL-2026-10971 | Malicious | Not scored | 21 Jul, 2026 | npm cxpw-offers |
Malicious release: Malicious code in requestor-util (npm) GHSA-mchg-8mp7-q4m6, MAL-2026-10965 | Malicious | Not scored | 21 Jul, 2026 | npm requestor-util |
Malicious release: Malicious code in chai-leaf (npm) GHSA-m3c7-2j38-rjh7, MAL-2026-10940 | Malicious | Not scored | 21 Jul, 2026 | npm chai-leaf |
Malicious release: Malicious code in chai-as-reddit (npm) GHSA-vc32-h28h-pmhm, MAL-2026-10939 | Malicious | Not scored | 21 Jul, 2026 | npm chai-as-reddit |
Malicious release: Malicious code in ts-vitest (npm) GHSA-2g3m-3343-pgvq, MAL-2026-10990 | Malicious | Not scored | 21 Jul, 2026 | npm ts-vitest |
Malicious release: Malicious code in date-format-utils-xz (npm) MAL-2026-11001 | Malicious | Not scored | 21 Jul, 2026 | npm date-format-utils-xz |
Malicious release: Malicious code in faust-cont (npm) MAL-2026-11042 | Malicious | Not scored | 21 Jul, 2026 | npm faust-cont |
Guzzle: URI fragments disclosed in redirect Referer headers CVE-2026-67354, GHSA-h95v-h523-3mw8 | High | 0.4% | 20 Jul, 2026 | Packagist guzzlehttp/guzzle |
Guzzle: Host-only cookie scope is not preserved CVE-2026-67355, GHSA-wm3w-8rrp-j577 | High | 0.4% | 20 Jul, 2026 | Packagist guzzlehttp/guzzle |
Guzzle: Unbounded response cookies risk denial of service CVE-2026-67353, GHSA-f283-ghqc-fg79 | Medium | 0.4% | 20 Jul, 2026 | Packagist guzzlehttp/guzzle |
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered CVE-2026-73423, GHSA-8mv7-9c27-98vc | Medium | 0.3% | 20 Jul, 2026 | npm astro |
Astro: Unauthenticated path override in the @astrojs/vercel ISR function CVE-2026-73424, GHSA-x27w-589x-frm2 | Medium | 0.4% | 20 Jul, 2026 | npm @astrojs/vercel |
@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped CVE-2026-73425, GHSA-hp3v-mfqw-h74c | Low | 0.3% | 20 Jul, 2026 | npm @astrojs/netlify |
@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect CVE-2026-59730, GHSA-r557-wffq-wvrc | Low | 0.5% | 20 Jul, 2026 | npm @astrojs/node |
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) CVE-2026-59729, GHSA-f48w-9m4c-m7f5 | Medium | 0.5% | 20 Jul, 2026 | npm astro |
@astrojs/rss: XML Injection via Unescaped RSS Feed Fields CVE-2026-59728, GHSA-8j5q-mfj2-5q9q | Medium | 0.3% | 20 Jul, 2026 | npm @astrojs/rss |
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands CVE-2026-59727, GHSA-7pw4-f3q4-r2p2 | Low | 0.4% | 20 Jul, 2026 | npm astro |
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning CVE-2026-67320, GHSA-gcfj-64vw-6mp9 | High | 0.5% | 20 Jul, 2026 | npm axios |
Axios form serializer maxDepth bypass via {} metatoken CVE-2026-67321, GHSA-hcpx-6fm6-wx23 | Medium | 0.5% | 20 Jul, 2026 | npm axios |
Axios: Nested axios option objects can consume polluted prototype values CVE-2026-67319, GHSA-7q8q-rj6j-mhjq | Medium | 0.3% | 20 Jul, 2026 | npm axios |
Axios: HTTP/2 streamed uploads bypass `maxBodyLength` CVE-2026-67318, GHSA-mwf2-3pr3-8698 | Medium | 0.6% | 20 Jul, 2026 | npm axios |
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` CVE-2026-67317, GHSA-jqh4-m9w3-8hp9 | Medium | 0.6% | 20 Jul, 2026 | npm axios |