Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @gocortexio/npmgremlinbox-agpl-3-0-only (npm) GHSA-hrqc-mppq-7pr5, MAL-2026-10787 | Malicious | Not scored | 20 Jul, 2026 | npm @gocortexio/npmgremlinbox-agpl-3-0-only |
Malicious release: Malicious code in @gocortexio/npmgremlinbox-cal-1-0-combined-work-exception (npm) GHSA-vjjx-v6cg-9v97, MAL-2026-10795 | Malicious | Not scored | 20 Jul, 2026 | npm @gocortexio/npmgremlinbox-cal-1-0-combined-work-exception |
Malicious release: Malicious code in @gocortexio/npmgremlinbox-busl-1-1 (npm) GHSA-x724-cv8r-x29f, MAL-2026-10793 | Malicious | Not scored | 20 Jul, 2026 | npm @gocortexio/npmgremlinbox-busl-1-1 |
Malicious release: Malicious code in @gocortexio/npmgremlinbox-agpl-3-0 (npm) GHSA-6ff8-mg9c-x59x, MAL-2026-10786 | Malicious | Not scored | 20 Jul, 2026 | npm @gocortexio/npmgremlinbox-agpl-3-0 |
Malicious release: Malicious code in @gocortexio/npmgremlinbox-agpl-1-0-only (npm) GHSA-8rqf-7352-m3m9, MAL-2026-10784 | Malicious | Not scored | 20 Jul, 2026 | npm @gocortexio/npmgremlinbox-agpl-1-0-only |
Malicious release: Malicious code in @gocortexio/npmgremlinbox-agpl-1-0-or-later (npm) GHSA-q6xg-rf9w-r3q7, MAL-2026-10785 | Malicious | Not scored | 20 Jul, 2026 | npm @gocortexio/npmgremlinbox-agpl-1-0-or-later |
Malicious release: Malicious code in @gocortexio/npmgremlinbox-agpl-1-0 (npm) GHSA-r5w6-4v34-wvg7, MAL-2026-10783 | Malicious | Not scored | 20 Jul, 2026 | npm @gocortexio/npmgremlinbox-agpl-1-0 |
Malicious release: Malicious code in telebot-bot-run (PyPI) MAL-2026-10863 | Malicious | Not scored | 20 Jul, 2026 | PyPI telebot-bot-run |
Malicious release: Malicious code in org-twilio-phone-numbers-utils (npm) MAL-2026-10931 | Malicious | Not scored | 20 Jul, 2026 | npm org-twilio-phone-numbers-utils |
Malicious release: Malicious code in twilio-assets (npm) MAL-2026-10932 | Malicious | Not scored | 20 Jul, 2026 | npm twilio-assets |
Malicious release: Malicious code in twilio-deploy (npm) MAL-2026-10933 | Malicious | Not scored | 20 Jul, 2026 | npm twilio-deploy |
Malicious release: Malicious code in twilio-internal (npm) MAL-2026-10934 | Malicious | Not scored | 20 Jul, 2026 | npm twilio-internal |
Malicious release: Malicious code in twilio-platform-async-data-fetch (npm) MAL-2026-10935 | Malicious | Not scored | 20 Jul, 2026 | npm twilio-platform-async-data-fetch |
Malicious release: Malicious code in twilio-platform-request (npm) MAL-2026-10936 | Malicious | Not scored | 20 Jul, 2026 | npm twilio-platform-request |
Malicious release: Malicious code in twilio-serverless (npm) MAL-2026-10937 | Malicious | Not scored | 20 Jul, 2026 | npm twilio-serverless |
Malicious release: Malicious code in twiliointernal-messaging-toolbox (npm) MAL-2026-10938 | Malicious | Not scored | 20 Jul, 2026 | npm twiliointernal-messaging-toolbox |
Malicious release: Malicious code in aftermath-finance (npm) MAL-2026-10941 | Malicious | Not scored | 20 Jul, 2026 | npm aftermath-finance |
Malicious release: Malicious code in aftermath-sui (npm) MAL-2026-10942 | Malicious | Not scored | 20 Jul, 2026 | npm aftermath-sui |
Malicious release: Malicious code in aftermathfi (npm) MAL-2026-10943 | Malicious | Not scored | 20 Jul, 2026 | npm aftermathfi |
Malicious release: Malicious code in zer0onetencent (npm) MAL-2026-10944 | Malicious | Not scored | 20 Jul, 2026 | npm zer0onetencent |
Malicious release: Malicious code in zer0onetencent2 (npm) MAL-2026-10945 | Malicious | Not scored | 20 Jul, 2026 | npm zer0onetencent2 |
Malicious release: Malicious code in @akrai/core (npm) MAL-2026-10946 | Malicious | Not scored | 20 Jul, 2026 | npm @akrai/core |
Malicious release: Malicious code in @akrai/report (npm) MAL-2026-10947 | Malicious | Not scored | 20 Jul, 2026 | npm @akrai/report |
Malicious release: Malicious code in @akrai/report_new (npm) MAL-2026-10948 | Malicious | Not scored | 20 Jul, 2026 | npm @akrai/report_new |
Malicious release: Malicious code in @iphouse/api (npm) MAL-2026-10949 | Malicious | Not scored | 20 Jul, 2026 | npm @iphouse/api |
Malicious release: Malicious code in @iphouse/core (npm) MAL-2026-10950 | Malicious | Not scored | 20 Jul, 2026 | npm @iphouse/core |
Malicious release: Malicious code in @markscan/api (npm) MAL-2026-10951 | Malicious | Not scored | 20 Jul, 2026 | npm @markscan/api |
Malicious release: Malicious code in @markscan/core (npm) MAL-2026-10952 | Malicious | Not scored | 20 Jul, 2026 | npm @markscan/core |
Malicious release: Malicious code in @markscan/reports (npm) MAL-2026-10953 | Malicious | Not scored | 20 Jul, 2026 | npm @markscan/reports |
Malicious release: Malicious code in @markscan/utils (npm) MAL-2026-10954 | Malicious | Not scored | 20 Jul, 2026 | npm @markscan/utils |
Malicious release: Malicious code in akrai-report (npm) MAL-2026-10955 | Malicious | Not scored | 20 Jul, 2026 | npm akrai-report |
Malicious release: Malicious code in akrai-report-new (npm) MAL-2026-10956 | Malicious | Not scored | 20 Jul, 2026 | npm akrai-report-new |
Malicious release: Malicious code in iphouse (npm) MAL-2026-10957 | Malicious | Not scored | 20 Jul, 2026 | npm iphouse |
Malicious release: Malicious code in iphouse-api (npm) MAL-2026-10958 | Malicious | Not scored | 20 Jul, 2026 | npm iphouse-api |
Malicious release: Malicious code in iphouse-core (npm) MAL-2026-10959 | Malicious | Not scored | 20 Jul, 2026 | npm iphouse-core |
Malicious release: Malicious code in markscan (npm) MAL-2026-10960 | Malicious | Not scored | 20 Jul, 2026 | npm markscan |
Malicious release: Malicious code in markscan-api (npm) MAL-2026-10961 | Malicious | Not scored | 20 Jul, 2026 | npm markscan-api |
Malicious release: Malicious code in markscan-core (npm) MAL-2026-10962 | Malicious | Not scored | 20 Jul, 2026 | npm markscan-core |
Malicious release: Malicious code in markscan-reports (npm) MAL-2026-10963 | Malicious | Not scored | 20 Jul, 2026 | npm markscan-reports |
Malicious release: Malicious code in markscan-utils (npm) MAL-2026-10964 | Malicious | Not scored | 20 Jul, 2026 | npm markscan-utils |
Malicious release: Malicious code in supplyhub (npm) MAL-2026-11043 | Malicious | Not scored | 20 Jul, 2026 | npm supplyhub |
Malicious release: Malicious code in tailwind-gutenberg-block-zero (npm) MAL-2026-11044 | Malicious | Not scored | 20 Jul, 2026 | npm tailwind-gutenberg-block-zero |
Malicious release: Malicious code in chart-animation-helper (npm) GHSA-8vgc-wrpv-6v7h, MAL-2026-10781 | Malicious | Not scored | 19 Jul, 2026 | npm chart-animation-helper |
Malicious release: Malicious code in zoom-widget-xss-poc-paresh (npm) GHSA-gq92-h7j2-g9x5, MAL-2026-10782 | Malicious | Not scored | 19 Jul, 2026 | npm zoom-widget-xss-poc-paresh |
Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data CVE-2026-12484, GHSA-v2w2-w228-c444, PYSEC-2026-3634 | High | 0.3% | 19 Jul, 2026 | PyPI keras |
Malicious release: Malicious code in data-parser-utils (PyPI) MAL-2026-10780 | Malicious | Not scored | 19 Jul, 2026 | PyPI data-parser-utils |
fast-uri vulnerable to host confusion via literal backslash authority delimiter CVE-2026-16221, GHSA-v2hh-gcrm-f6hx | High | 0.4% | 19 Jul, 2026 | npm fast-uri |
SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations on u CVE-2023-54366, GHSA-x5fr-7hhj-34j3, PYSEC-2026-3718 | High | 0.5% | 18 Jul, 2026 | PyPI surrealdb |
Malicious release: Malicious code in tinkoff-cloud-apis-internal (PyPI) MAL-2026-10917 | Malicious | Not scored | 18 Jul, 2026 | PyPI tinkoff-cloud-apis-internal |
Malicious release: Malicious code in python-devplatform-client (PyPI) MAL-2026-10916 | Malicious | Not scored | 18 Jul, 2026 | PyPI python-devplatform-client |