Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
DD-WRT Stack-Based Buffer Overflow Vulnerability CVE-2021-27137 | HighExploited | 4.0% | 16 Jul, 2026 | |
Malicious release: Malicious code in discordia-telemetria (PyPI) MAL-2026-10702 | Malicious | Not scored | 16 Jul, 2026 | PyPI discordia-telemetria |
Prompty: Arbitrary file read via file reference expansion CVE-2026-53598, GHSA-wxhm-2mq7-7697, PYSEC-2026-3538 | High | 1.3% | 16 Jul, 2026 | NuGet Prompty.Core PyPI prompty crates.io prompty npm @prompty/core |
Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader CVE-2026-53597, GHSA-c4gh-rv8h-q9vw | High | 1.0% | 16 Jul, 2026 | npm @prompty/core |
Malicious release: Malicious code in time-format-kit (npm) MAL-2026-10700 | Malicious | Not scored | 16 Jul, 2026 | npm time-format-kit |
Malicious release: Malicious code in discord-telemetry (PyPI) MAL-2026-10701 | Malicious | Not scored | 16 Jul, 2026 | PyPI discord-telemetry |
Malicious release: Malicious code in http-req-lite (npm) MAL-2026-10699 | Malicious | Not scored | 16 Jul, 2026 | npm http-req-lite |
Malicious release: Malicious code in @across-toolkit/eslint-config (npm) MAL-2026-10703 | Malicious | Not scored | 16 Jul, 2026 | npm @across-toolkit/eslint-config |
Malicious release: Malicious code in @hibachi-xyz/types (npm) MAL-2026-10715 | Malicious | Not scored | 16 Jul, 2026 | npm @hibachi-xyz/types |
Malicious release: Malicious code in @hibachi-xyz/config (npm) MAL-2026-10713 | Malicious | Not scored | 16 Jul, 2026 | npm @hibachi-xyz/config |
Malicious release: Malicious code in @hibachi-xyz/ui (npm) MAL-2026-10716 | Malicious | Not scored | 16 Jul, 2026 | npm @hibachi-xyz/ui |
Malicious release: Malicious code in @hibachi-xyz/sdk (npm) MAL-2026-10714 | Malicious | Not scored | 16 Jul, 2026 | npm @hibachi-xyz/sdk |
Malicious release: Malicious code in ai-p2p (npm) GHSA-g5cv-hmr5-x42p, MAL-2026-10695 | Malicious | Not scored | 16 Jul, 2026 | npm ai-p2p |
Malicious release: Malicious code in loader1 (npm) GHSA-wp48-4xqv-v7fq, MAL-2026-10696 | Malicious | Not scored | 16 Jul, 2026 | npm loader1 |
Malicious release: Malicious code in websight-p2p (npm) GHSA-f4xq-pw58-878h, MAL-2026-10697 | Malicious | Not scored | 16 Jul, 2026 | npm websight-p2p |
Malicious release: Malicious code in websight2-p2p (npm) GHSA-jqc8-qp8m-m77v, MAL-2026-10698 | Malicious | Not scored | 16 Jul, 2026 | npm websight2-p2p |
Malicious release: Malicious code in vor8zakon (npm) GHSA-9f89-97fj-pqmp, MAL-2026-10694 | Malicious | Not scored | 16 Jul, 2026 | npm vor8zakon |
Snowflake Connector for Python improperly verifies TLS hostnames CVE-2026-15925, GHSA-5cc2-282f-jjq2, PYSEC-2026-3920 | Critical | 0.2% | 16 Jul, 2026 | PyPI snowflake-connector-python |
Malicious release: Malicious code in nordpass (npm) MAL-2026-10743 | Malicious | Not scored | 16 Jul, 2026 | npm nordpass |
Malicious release: Malicious code in nyt-cms (npm) GHSA-r98c-r926-c796, MAL-2026-10692 | Malicious | Not scored | 16 Jul, 2026 | npm nyt-cms |
Malicious release: Malicious code in @edgecommons/streamlog-node (npm) GHSA-4rqf-6883-f59f, MAL-2026-10763 | Malicious | Not scored | 16 Jul, 2026 | npm @edgecommons/streamlog-node |
Malicious release: Malicious code in @edgecommons/edgecommons (npm) GHSA-8p39-h6xv-p2g9, MAL-2026-10762 | Malicious | Not scored | 16 Jul, 2026 | npm @edgecommons/edgecommons |
Malicious release: Malicious code in @across-toolkit/typescript-config (npm) MAL-2026-10704 | Malicious | Not scored | 16 Jul, 2026 | npm @across-toolkit/typescript-config |
Malicious release: Malicious code in syft-acp-atoms (npm) MAL-2026-10764 | Malicious | Not scored | 16 Jul, 2026 | npm syft-acp-atoms |
Malicious release: Malicious code in syft-acp-core (npm) MAL-2026-10765 | Malicious | Not scored | 16 Jul, 2026 | npm syft-acp-core |
Malicious release: Malicious code in syft-acp-uikit (npm) MAL-2026-10766 | Malicious | Not scored | 16 Jul, 2026 | npm syft-acp-uikit |
Malicious release: Malicious code in syft-acp-util (npm) MAL-2026-10767 | Malicious | Not scored | 16 Jul, 2026 | npm syft-acp-util |
Malicious release: Malicious code in internallib_v907 (npm) GHSA-4jf7-q8jf-84cg, MAL-2026-10691 | Malicious | Not scored | 15 Jul, 2026 | npm internallib_v907 |
ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) CVE-2026-58196, GHSA-pr64-jmmf-jp54, GO-2026-6002 | Low | 0.4% | 15 Jul, 2026 | Go github.com/stacklok/toolhive |
adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files GHSA-xg43-5579-qw6v | Medium | Not scored | 15 Jul, 2026 | Packagist adawolfa/isdoc |
@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default CVE-2026-54504, GHSA-6f5r-5672-72j7 | High | 0.6% | 15 Jul, 2026 | npm @andrea9293/mcp-documentation-server |
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux CVE-2026-50289, GHSA-5xpp-75jx-m839 | High | 2.2% | 15 Jul, 2026 | npm systeminformation |
Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback CVE-2026-50285, GHSA-ggw3-5987-rx77 | High | 0.7% | 15 Jul, 2026 | Go github.com/pomerium/pomerium |
dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS CVE-2026-50276, GHSA-p5f6-rccc-jv98 | High | 0.8% | 15 Jul, 2026 | RubyGems datadog |
dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS CVE-2026-50274, GHSA-74j5-xf3v-crq8, GO-2026-6000 | High | 0.8% | 15 Jul, 2026 | Go github.com/DataDog/dd-trace-go Go github.com/DataDog/dd-trace-go/v2 |
dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS CVE-2026-50272, GHSA-wxqq-gcq8-c443 | High | 0.8% | 15 Jul, 2026 | npm dd-trace |
dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS CVE-2026-50271, GHSA-mw54-j2v2-42hr, PYSEC-2026-3461 | High | 0.8% | 15 Jul, 2026 | PyPI ddtrace |
ViewComponent: Reused Component Instances Retain Stale Render Context CVE-2026-54497, GHSA-9h85-g7w3-rh49 | Medium | 0.3% | 15 Jul, 2026 | RubyGems view_component |
ViewComponent: around_render HTML-Safety Bypass CVE-2026-54498, GHSA-97jw-64cj-jc58 | High | 0.5% | 15 Jul, 2026 | RubyGems view_component |
open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters CVE-2026-54495, GHSA-398h-7f66-3h4p, GO-2026-5998 | Medium | 0.3% | 15 Jul, 2026 | Go github.com/open-feature/open-feature-operator |
django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result Deserialization CVE-2026-105315, GHSA-r3hx-x5rh-p9vv | High | 0.3% | 15 Jul, 2026 | PyPI django-haystack |
Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication CVE-2026-55445, GHSA-v667-gc2r-2xm7 | Critical | 0.5% | 15 Jul, 2026 | npm @whyour/qinglong |
GPT Researcher MCP STDIO configuration allows remote command execution CVE-2025-65720, GHSA-8j86-h8gg-797p, PYSEC-2026-4219 | Critical | 0.7% | 15 Jul, 2026 | PyPI gpt-researcher |
websocket-driver: Resource limit bypass via message compression CVE-2026-54490, GHSA-mp7j-qc5w-4988 | Medium | 0.4% | 15 Jul, 2026 | npm websocket-driver |
websocket-driver: Message corruption via abuse of protocol length headers CVE-2026-54466, GHSA-xv26-6w52-cph6 | Critical | 0.4% | 15 Jul, 2026 | npm websocket-driver |
websocket-driver: Memory exhaustion in HTTP header parser CVE-2026-54465, GHSA-8j3g-f24p-4mpw | Medium | 0.5% | 15 Jul, 2026 | RubyGems websocket-driver |
websocket-driver: Resource limit bypass via message compression CVE-2026-54464, GHSA-33ph-fccm-39pj | Medium | 0.4% | 15 Jul, 2026 | RubyGems websocket-driver |
websocket-driver: Memory exhaustion via abuse of protocol length headers CVE-2026-54463, GHSA-ghhp-3qvg-889p | Medium | 0.5% | 15 Jul, 2026 | RubyGems websocket-driver |
Pixeldrain API key shared with unverified thirdparty sites CVE-2026-54254, GHSA-f5pf-q7c7-m3vv, PYSEC-2026-3460 | Medium | 0.5% | 15 Jul, 2026 | PyPI cyberdrop-dl-patched |
TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint CVE-2026-54457, GHSA-824w-x939-6cmc, PYSEC-2026-3541 | High | 0.4% | 15 Jul, 2026 | PyPI tensorzero |