Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Axios: Prototype pollution gadgets can alter axios request construction CVE-2026-67316, GHSA-mmx7-hfxf-jppx | Medium | 0.4% | 20 Jul, 2026 | npm axios |
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios CVE-2026-67315, GHSA-f4gw-2p7v-4548 | Medium | 0.5% | 20 Jul, 2026 | npm axios |
File Browser: Colliding username normalization gives two users the same home directory CVE-2026-62685, GHSA-7rc3-g7h6-22m7, GO-2026-6024 | High | 0.6% | 20 Jul, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser: Share API exposes the password hash and bypass token CVE-2026-62684, GHSA-833g-cqhp-h72j, GO-2026-6025 | Low | 0.4% | 20 Jul, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser: Archive builder turns backslash filenames into path traversal (zip-slip) CVE-2026-62843, GHSA-83xp-526h-j3ww, GO-2026-6026 | Medium | 0.4% | 20 Jul, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Guzzle: Proxy-Authorization headers can be sent to origin servers CVE-2026-67339, GHSA-94pj-82f3-465w | Medium | 0.4% | 20 Jul, 2026 | Packagist guzzlehttp/guzzle |
File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope CVE-2026-55668, GHSA-8wc8-hf36-mjh9, GO-2026-6020 | Medium | 0.4% | 20 Jul, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup CVE-2026-55667, GHSA-fmm7-x4gx-8jhr, GO-2026-6021 | High | 0.5% | 20 Jul, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses CVE-2026-54562, GHSA-x756-g4x3-c64m, GO-2026-6023 | Medium | 0.4% | 20 Jul, 2026 | Go github.com/cloudreve/Cloudreve Go github.com/cloudreve/Cloudreve/v3 Go github.com/cloudreve/Cloudreve/v4 |
Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim CVE-2026-54560, GHSA-vgj4-345g-jcf8, GO-2026-6022 | High | 0.6% | 20 Jul, 2026 | Go github.com/cloudreve/Cloudreve Go github.com/cloudreve/Cloudreve/v3 Go github.com/cloudreve/Cloudreve/v4 |
Astro: Reflected XSS via unescaped View Transition animation properties CVE-2026-73422, GHSA-4g3v-8h47-v7g6 | Medium | 0.5% | 20 Jul, 2026 | npm astro |
Malicious release: Malicious code in trongridmy (PyPI) MAL-2026-10930 | Malicious | Not scored | 20 Jul, 2026 | PyPI trongridmy |
Malicious release: Malicious code in trongrider (PyPI) MAL-2026-10929 | Malicious | Not scored | 20 Jul, 2026 | PyPI trongrider |
Malicious release: Malicious code in upjsma (npm) GHSA-9g67-fm87-8p6v, MAL-2026-10928 | Malicious | Not scored | 20 Jul, 2026 | npm upjsma |
Axios: Excessive recursion in formDataToJSON can cause denial of service CVE-2026-67313, GHSA-42h9-826w-cgv3 | Medium | 0.5% | 20 Jul, 2026 | npm axios |
Malicious release: Malicious code in roles-royce (PyPI) MAL-2026-10927 | Malicious | Not scored | 20 Jul, 2026 | PyPI roles-royce |
Axios: Prototype pollution auth subfields can inject Basic auth CVE-2026-67314, GHSA-xj6q-8x83-jv6g | Medium | 0.4% | 20 Jul, 2026 | npm axios |
Malicious release: Malicious code in defi-kit (PyPI) MAL-2026-10926 | Malicious | Not scored | 20 Jul, 2026 | PyPI defi-kit |
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service CVE-2026-67312, GHSA-pmv8-rq9r-6j72 | Medium | 0.5% | 20 Jul, 2026 | npm axios |
Malicious release: Malicious code in tilaver-mfa (npm) GHSA-4j5x-wjw6-qvq5, MAL-2026-10925 | Malicious | Not scored | 20 Jul, 2026 | npm tilaver-mfa |
Malicious release: Malicious code in s3-lambda-dynamodb-cdk (npm) GHSA-6xqw-c34f-9275, MAL-2026-10924 | Malicious | Not scored | 20 Jul, 2026 | npm s3-lambda-dynamodb-cdk |
Malicious release: Malicious code in alb-lambda-cdk (npm) GHSA-crmc-3m53-3crf, MAL-2026-10920 | Malicious | Not scored | 20 Jul, 2026 | npm alb-lambda-cdk |
Malicious release: Malicious code in lambda-cloudwatch-cdk (npm) GHSA-m74r-g438-3r92, MAL-2026-10922 | Malicious | Not scored | 20 Jul, 2026 | npm lambda-cloudwatch-cdk |
Malicious release: Malicious code in iot-kfh-s3 (npm) GHSA-qg52-c79f-3q5c, MAL-2026-10921 | Malicious | Not scored | 20 Jul, 2026 | npm iot-kfh-s3 |
Malicious release: Malicious code in lwc-slds-lbc (npm) GHSA-xm8f-w286-57x5, MAL-2026-10923 | Malicious | Not scored | 20 Jul, 2026 | npm lwc-slds-lbc |
Malicious release: Malicious code in automatic-octo-invention (PyPI) MAL-2026-10918 | Malicious | Not scored | 20 Jul, 2026 | PyPI automatic-octo-invention |
Malicious release: Malicious code in ml-core-airflow-auth (PyPI) MAL-2026-10919 | Malicious | Not scored | 20 Jul, 2026 | PyPI ml-core-airflow-auth |
Malicious release: Malicious code in your-unique-package-name1337 (npm) GHSA-3w8q-c7m7-62q5, MAL-2026-10906 | Malicious | Not scored | 20 Jul, 2026 | npm your-unique-package-name1337 |
Malicious release: Malicious code in win-build-utils (npm) GHSA-7ffq-88v5-rmwc, MAL-2026-10905 | Malicious | Not scored | 20 Jul, 2026 | npm win-build-utils |
Malicious release: Malicious code in solana-web3-v1 (npm) GHSA-x736-hhp7-jrh7, MAL-2026-10904 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-v1 |
Malicious release: Malicious code in solana-web3-lts (npm) GHSA-8wj2-r9xj-g9p3, MAL-2026-10901 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-lts |
Malicious release: Malicious code in solana-web3-stable (npm) GHSA-c26v-wr8c-3xj8, MAL-2026-10903 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-stable |
Malicious release: Malicious code in solana-web3-patched (npm) GHSA-p492-8qvf-j49c, MAL-2026-10902 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-patched |
Malicious release: Malicious code in solana-web3-fork (npm) GHSA-rf7g-mf44-5m44, MAL-2026-10900 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-fork |
Malicious release: Malicious code in solana-web3-fixed (npm) GHSA-vc55-fvgr-m9jv, MAL-2026-10899 | Malicious | Not scored | 20 Jul, 2026 | npm solana-web3-fixed |
Malicious release: Malicious code in solana-rpc-client (npm) GHSA-p7xx-6w55-gfrg, MAL-2026-10898 | Malicious | Not scored | 20 Jul, 2026 | npm solana-rpc-client |
Malicious release: Malicious code in golan125-homepage-test (npm) GHSA-6p3c-6jvh-3pg8, MAL-2026-10897 | Malicious | Not scored | 20 Jul, 2026 | npm golan125-homepage-test |
Malicious release: Malicious code in flow-eslint-oxidized (npm) GHSA-frhf-jqq4-m95m, MAL-2026-10896 | Malicious | Not scored | 20 Jul, 2026 | npm flow-eslint-oxidized |
Malicious release: Malicious code in exodus-payments (npm) GHSA-hrvv-3w2f-pp24, MAL-2026-10895 | Malicious | Not scored | 20 Jul, 2026 | npm exodus-payments |
Malicious release: Malicious code in exodus-checkout (npm) GHSA-mqx8-fhj5-w597, MAL-2026-10894 | Malicious | Not scored | 20 Jul, 2026 | npm exodus-checkout |
Malicious release: Malicious code in ecto-cargo-wk1tm59a (npm) GHSA-wx6c-2wgg-hcwq, MAL-2026-10893 | Malicious | Not scored | 20 Jul, 2026 | npm ecto-cargo-wk1tm59a |
Malicious release: Malicious code in claude-code-timer (npm) GHSA-6649-vv4q-q9fw, MAL-2026-10892 | Malicious | Not scored | 20 Jul, 2026 | npm claude-code-timer |
Malicious release: Malicious code in bytecraft (npm) GHSA-r2fr-28j9-gjh5, MAL-2026-10891 | Malicious | Not scored | 20 Jul, 2026 | npm bytecraft |
Malicious release: Malicious code in @public-for-cdao/utils (npm) GHSA-f6vj-gmjr-rr3c, MAL-2026-10889 | Malicious | Not scored | 20 Jul, 2026 | npm @public-for-cdao/utils |
Malicious release: Malicious code in @public-for-cdao/signer (npm) GHSA-rjhf-whh4-86cq, MAL-2026-10888 | Malicious | Not scored | 20 Jul, 2026 | npm @public-for-cdao/signer |
Malicious release: Malicious code in @public-for-cdao/deploy (npm) GHSA-8jx6-7rv4-9r5g, MAL-2026-10886 | Malicious | Not scored | 20 Jul, 2026 | npm @public-for-cdao/deploy |
Malicious release: Malicious code in @public-for-cdao/sdk (npm) GHSA-9gf9-q25g-2m67, MAL-2026-10887 | Malicious | Not scored | 20 Jul, 2026 | npm @public-for-cdao/sdk |
Malicious release: Malicious code in @public-for-cdao/core (npm) GHSA-gpx4-hq9v-733f, MAL-2026-10885 | Malicious | Not scored | 20 Jul, 2026 | npm @public-for-cdao/core |
Malicious release: Malicious code in @public-for-cdao/contracts (npm) GHSA-52h2-99jg-wx2p, MAL-2026-10884 | Malicious | Not scored | 20 Jul, 2026 | npm @public-for-cdao/contracts |
Malicious release: Malicious code in @public-for-cdao/bot (npm) GHSA-j5xp-rxh2-qg93, MAL-2026-10883 | Malicious | Not scored | 20 Jul, 2026 | npm @public-for-cdao/bot |