Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization BIT-envoy-gateway-2026-53719, CVE-2026-53719, GHSA-m2v6-2jmh-4c68, GO-2026-6009 | Medium | 0.7% | 16 Jul, 2026 | Go github.com/envoyproxy/gateway |
Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit BIT-envoy-gateway-2026-53716, CVE-2026-53716, GHSA-cxpq-8v7q-cg56, GO-2026-6006 | Medium | 0.7% | 16 Jul, 2026 | Go github.com/envoyproxy/gateway |
Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass BIT-envoy-gateway-2026-53718, CVE-2026-53718, GHSA-fcrp-7gc2-93g7, GO-2026-6007 | Medium | 0.4% | 16 Jul, 2026 | Go github.com/envoyproxy/gateway |
kumactl connects to control plane without verifying TLS certificate when no CA is configured CVE-2026-18678, CVE-2026-50166, GHSA-v95x-xhq5-4929, GO-2026-6010 | Medium | 0.3% | 16 Jul, 2026 | Go github.com/kumahq/kuma Go github.com/kumahq/kuma/v2 |
Malicious release: Malicious code in @ai-support-agent/cli (npm) MAL-2026-10707 | Malicious | Not scored | 16 Jul, 2026 | npm @ai-support-agent/cli |
Malicious release: Malicious code in mfq-private-encoder (PyPI) MAL-2026-10758 | Malicious | Not scored | 16 Jul, 2026 | PyPI mfq-private-encoder |
Malicious release: Malicious code in @cyberrant-rantai/rantai (npm) MAL-2026-10709 | Malicious | Not scored | 16 Jul, 2026 | npm @cyberrant-rantai/rantai |
Malicious release: Malicious code in channel-worker (npm) MAL-2026-10729 | Malicious | Not scored | 16 Jul, 2026 | npm channel-worker |
Malicious release: Malicious code in memtry-cli (npm) MAL-2026-10736 | Malicious | Not scored | 16 Jul, 2026 | npm memtry-cli |
Malicious release: Malicious code in bvm-core (npm) MAL-2026-10728 | Malicious | Not scored | 16 Jul, 2026 | npm bvm-core |
Malicious release: Malicious code in @whalent/agent (npm) MAL-2026-10721 | Malicious | Not scored | 16 Jul, 2026 | npm @whalent/agent |
Malicious release: Malicious code in @agentvox/host (npm) MAL-2026-10706 | Malicious | Not scored | 16 Jul, 2026 | npm @agentvox/host |
Malicious release: Malicious code in @thepayulink/server (npm) MAL-2026-10719 | Malicious | Not scored | 16 Jul, 2026 | npm @thepayulink/server |
Malicious release: Malicious code in axios-test-one (npm) MAL-2026-10727 | Malicious | Not scored | 16 Jul, 2026 | npm axios-test-one |
Malicious release: Malicious code in telemetry-metrics (npm) MAL-2026-10750 | Malicious | Not scored | 16 Jul, 2026 | npm telemetry-metrics |
Malicious release: Malicious code in codeam-cli (npm) MAL-2026-10730 | Malicious | Not scored | 16 Jul, 2026 | npm codeam-cli |
Malicious release: Malicious code in @yeaft/webchat-agent (npm) MAL-2026-10723 | Malicious | Not scored | 16 Jul, 2026 | npm @yeaft/webchat-agent |
Malicious release: Malicious code in agentto (npm) MAL-2026-10725 | Malicious | Not scored | 16 Jul, 2026 | npm agentto |
Malicious release: Malicious code in sakuraai (npm) MAL-2026-10746 | Malicious | Not scored | 16 Jul, 2026 | npm sakuraai |
Malicious release: Malicious code in dde-common (PyPI) MAL-2026-10757 | Malicious | Not scored | 16 Jul, 2026 | PyPI dde-common |
Malicious release: Malicious code in darkglitch (PyPI) MAL-2026-10756 | Malicious | Not scored | 16 Jul, 2026 | PyPI darkglitch |
Malicious release: Malicious code in @sciagent/cli (npm) MAL-2026-10718 | Malicious | Not scored | 16 Jul, 2026 | npm @sciagent/cli |
Malicious release: Malicious code in a3s-code (PyPI) MAL-2026-10753 | Malicious | Not scored | 16 Jul, 2026 | PyPI a3s-code |
Malicious release: Malicious code in captcha-solve-api (PyPI) MAL-2026-10755 | Malicious | Not scored | 16 Jul, 2026 | PyPI captcha-solve-api |
Malicious release: Malicious code in airflow-provider-spirit (PyPI) MAL-2026-10754 | Malicious | Not scored | 16 Jul, 2026 | PyPI airflow-provider-spirit |
Malicious release: Malicious code in sensorium-mcp (npm) MAL-2026-10747 | Malicious | Not scored | 16 Jul, 2026 | npm sensorium-mcp |
Malicious release: Malicious code in hehehe (npm) GHSA-f5qh-v92x-xcxj, MAL-2026-10732 | Malicious | Not scored | 16 Jul, 2026 | npm hehehe |
Malicious release: Malicious code in @onescience/onecode (npm) MAL-2026-10717 | Malicious | Not scored | 16 Jul, 2026 | npm @onescience/onecode |
Malicious release: Malicious code in @agent-link/agent (npm) MAL-2026-10705 | Malicious | Not scored | 16 Jul, 2026 | npm @agent-link/agent |
Malicious release: Malicious code in @whalent/agent-core (npm) MAL-2026-10722 | Malicious | Not scored | 16 Jul, 2026 | npm @whalent/agent-core |
Malicious release: Malicious code in netcontrol-agent (npm) MAL-2026-10741 | Malicious | Not scored | 16 Jul, 2026 | npm netcontrol-agent |
Malicious release: Malicious code in ryry-cli (PyPI) MAL-2026-10759 | Malicious | Not scored | 16 Jul, 2026 | PyPI ryry-cli |
Malicious release: Malicious code in @vibelet/cli (npm) MAL-2026-10720 | Malicious | Not scored | 16 Jul, 2026 | npm @vibelet/cli |
Malicious release: Malicious code in vanexa-agent (npm) MAL-2026-10751 | Malicious | Not scored | 16 Jul, 2026 | npm vanexa-agent |
Malicious release: Malicious code in @yuandc/aica (npm) MAL-2026-10724 | Malicious | Not scored | 16 Jul, 2026 | npm @yuandc/aica |
Malicious release: Malicious code in infrastructure-common (npm) MAL-2026-10734 | Malicious | Not scored | 16 Jul, 2026 | npm infrastructure-common |
Malicious release: Malicious code in myreviews-core (npm) MAL-2026-10740 | Malicious | Not scored | 16 Jul, 2026 | npm myreviews-core |
Malicious release: Malicious code in mw-server-util (npm) MAL-2026-10739 | Malicious | Not scored | 16 Jul, 2026 | npm mw-server-util |
Malicious release: Malicious code in date-utils-light (npm) MAL-2026-10731 | Malicious | Not scored | 16 Jul, 2026 | npm date-utils-light |
Malicious release: Malicious code in idlive-document-capture-web (npm) MAL-2026-10733 | Malicious | Not scored | 16 Jul, 2026 | npm idlive-document-capture-web |
Malicious release: Malicious code in @equans-services/codex (npm) MAL-2026-10710 | Malicious | Not scored | 16 Jul, 2026 | npm @equans-services/codex |
Malicious release: Malicious code in mmagrt (npm) MAL-2026-10737 | Malicious | Not scored | 16 Jul, 2026 | npm mmagrt |
Malicious release: Malicious code in xxdxa (npm) MAL-2026-10752 | Malicious | Not scored | 16 Jul, 2026 | npm xxdxa |
Malicious release: Malicious code in mui-option (npm) MAL-2026-10738 | Malicious | Not scored | 16 Jul, 2026 | npm mui-option |
Malicious release: Malicious code in sync-grove (npm) MAL-2026-10749 | Malicious | Not scored | 16 Jul, 2026 | npm sync-grove |
Malicious release: Malicious code in @hibachi-xyz/common (npm) MAL-2026-10712 | Malicious | Not scored | 16 Jul, 2026 | npm @hibachi-xyz/common |
Malicious release: Malicious code in isite (npm) GHSA-hmvc-prpq-wwcr, MAL-2026-10735 | Malicious | Not scored | 16 Jul, 2026 | npm isite |
Malicious release: Malicious code in @funny-booth/agent-core (npm) MAL-2026-10711 | Malicious | Not scored | 16 Jul, 2026 | npm @funny-booth/agent-core |
Malicious release: Malicious code in node-as-api (npm) MAL-2026-10742 | Malicious | Not scored | 16 Jul, 2026 | npm node-as-api |
Malicious release: Malicious code in string-formatter-pro (npm) MAL-2026-10748 | Malicious | Not scored | 16 Jul, 2026 | npm string-formatter-pro |