Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in polygon-toolkit-validation (npm) MAL-2026-10640 | Malicious | Not scored | 15 Jul, 2026 | npm polygon-toolkit-validation |
Malicious release: Malicious code in @bcs-mi-ui/message (npm) GHSA-4ppp-p4x6-p4w5, MAL-2026-10645 | Malicious | Not scored | 15 Jul, 2026 | npm @bcs-mi-ui/message |
Malicious release: Malicious code in @bcs-mi-ui/test1243npmpacket76 (npm) GHSA-9gp9-4wmv-j8qf, MAL-2026-10647 | Malicious | Not scored | 15 Jul, 2026 | npm @bcs-mi-ui/test1243npmpacket76 |
Malicious release: Malicious code in @bcs-mi-ui/message-block (npm) GHSA-j6mx-7p76-j3h7, MAL-2026-10646 | Malicious | Not scored | 15 Jul, 2026 | npm @bcs-mi-ui/message-block |
Malicious release: Malicious code in leviosa86-test (npm) MAL-2026-10636 | Malicious | Not scored | 15 Jul, 2026 | npm leviosa86-test |
Malicious release: Malicious code in ai-explain (npm) MAL-2026-10628 | Malicious | Not scored | 15 Jul, 2026 | npm ai-explain |
Malicious release: Malicious code in ai-pro-sdk (npm) GHSA-pw5v-v543-v4mp, MAL-2026-10629 | Malicious | Not scored | 15 Jul, 2026 | npm ai-pro-sdk |
Malicious release: Malicious code in @hkyyy/portal-widget-helper-0601 (npm) GHSA-wgx8-6mv9-p6jm, MAL-2026-10648 | Malicious | Not scored | 15 Jul, 2026 | npm @hkyyy/portal-widget-helper-0601 |
Malicious release: Malicious code in @saladin0x1/js-shared-modules (npm) GHSA-7xh4-j295-69xm, MAL-2026-10649 | Malicious | Not scored | 15 Jul, 2026 | npm @saladin0x1/js-shared-modules |
Malicious release: Malicious code in @leviosa86com/leviosa86-test (npm) MAL-2026-10625 | Malicious | Not scored | 15 Jul, 2026 | npm @leviosa86com/leviosa86-test |
Malicious release: Malicious code in chai-as-byte (npm) MAL-2026-10630 | Malicious | Not scored | 15 Jul, 2026 | npm chai-as-byte |
Malicious release: Malicious code in @sqlite-frame/nodesql (npm) GHSA-r9rm-52xp-prf4, MAL-2026-10627 | Malicious | Not scored | 15 Jul, 2026 | npm @sqlite-frame/nodesql |
Malicious release: Malicious code in @react-case/option (npm) MAL-2026-10626 | Malicious | Not scored | 15 Jul, 2026 | npm @react-case/option |
Malicious release: Malicious code in mc-reg (npm) GHSA-hvhc-6qpw-v5r9, MAL-2026-10637 | Malicious | Not scored | 15 Jul, 2026 | npm mc-reg |
Malicious release: Malicious code in proxy-checker-j (PyPI) MAL-2026-10644 | Malicious | Not scored | 14 Jul, 2026 | PyPI proxy-checker-j |
Malicious release: Malicious code in iwsdk (npm) GHSA-35fw-734c-r8xf, MAL-2026-10651 | Malicious | Not scored | 14 Jul, 2026 | npm iwsdk |
Malicious release: Malicious code in install-skia (npm) GHSA-r9fr-8w7j-4vj6, MAL-2026-10650 | Malicious | Not scored | 14 Jul, 2026 | npm install-skia |
Malicious release: Malicious code in cppt-common (npm) MAL-2026-10632 | Malicious | Not scored | 14 Jul, 2026 | npm cppt-common |
Malicious release: Malicious code in json-bigint-extend (npm) GHSA-h8r4-9vf9-jp96, MAL-2026-10652 | Malicious | Not scored | 14 Jul, 2026 | npm json-bigint-extend |
FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE CVE-2026-77526, GHSA-hgjx-r89m-m7v4 | Critical | Not scored | 14 Jul, 2026 | Packagist facturascripts/facturascripts |
Malicious release: Malicious code in @vite-js/vui (npm) GHSA-6x4h-wrvq-m68h, MAL-2026-10619 | Malicious | Not scored | 14 Jul, 2026 | npm @vite-js/vui |
NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode CVE-2026-54446, GHSA-x9vc-9ffq-p3gj, PYSEC-2026-3490 | High | 0.6% | 14 Jul, 2026 | PyPI netlicensing-mcp |
Malicious release: Malicious code in chai-as-structured (npm) GHSA-wf75-6wm5-v349, MAL-2026-10622 | Malicious | Not scored | 14 Jul, 2026 | npm chai-as-structured |
Malicious release: Malicious code in chai-as-hardened (npm) MAL-2026-10621 | Malicious | Not scored | 14 Jul, 2026 | npm chai-as-hardened |
Malicious release: Malicious code in http-ws-listener (npm) MAL-2026-10623 | Malicious | Not scored | 14 Jul, 2026 | npm http-ws-listener |
Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend CVE-2026-61549, GHSA-qf34-295c-26v8, GO-2026-5992 | High | 0.3% | 14 Jul, 2026 | Go github.com/woodpecker-ci/woodpecker Go go.woodpecker-ci.org/woodpecker Go go.woodpecker-ci.org/woodpecker/v2 Go go.woodpecker-ci.org/woodpecker/v3 |
Malicious release: Malicious code in ahooks-3.7.8 (npm) MAL-2026-10620 | Malicious | Not scored | 14 Jul, 2026 | npm ahooks-3.7.8 |
Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` CVE-2026-63464, GHSA-7rx3-5wx3-5v76, GO-2026-5985 | High | 0.5% | 14 Jul, 2026 | Go github.com/forgekeep/nebula-mesh |
nebula-mesh: Certificate revocation is never enforced at the mesh CVE-2026-61699, GHSA-cm26-5974-52h8, GO-2026-5986 | High | 0.4% | 14 Jul, 2026 | Go github.com/forgekeep/nebula-mesh |
n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode CVE-2026-55608, GHSA-2cf7-hpwf-47h9 | Medium | 0.3% | 14 Jul, 2026 | npm n8n-mcp |
nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens CVE-2026-55513, GHSA-g4x6-jcvr-9m3g, GO-2026-5987 | Medium | 0.3% | 14 Jul, 2026 | Go github.com/forgekeep/nebula-mesh Go github.com/juev/nebula-mesh |
nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting CVE-2026-55512, GHSA-m3cx-mwpg-32jg, GO-2026-5989 | Medium | 0.6% | 14 Jul, 2026 | Go github.com/forgekeep/nebula-mesh Go github.com/juev/nebula-mesh |
Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode CVE-2026-54629, GHSA-mf78-3rpf-r784, GO-2026-5990 | High | 1.0% | 14 Jul, 2026 | Go github.com/julien040/anyquery |
Malicious release: Malicious code in postcss-selector-minify (npm) GHSA-pjfj-gp2h-5692, MAL-2026-10614 | Malicious | Not scored | 14 Jul, 2026 | npm postcss-selector-minify |
Malicious release: Malicious code in tronwe (PyPI) MAL-2026-10624 | Malicious | Not scored | 14 Jul, 2026 | PyPI tronwe |
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-48356 | CriticalExploited | 47.5% | 14 Jul, 2026 | |
nebula-mesh: Operator session tokens stored in plaintext in the database CVE-2026-53603, GHSA-q4vm-pq3q-8wgq, GO-2026-5991 | High | 0.4% | 14 Jul, 2026 | Go github.com/forgekeep/nebula-mesh |
SonicWall SMA1000 Appliances Code Injection Vulnerability CVE-2026-15410 | HighExploited | 11.8% | 14 Jul, 2026 | |
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability CVE-2026-15409 | CriticalExploited | 6.8% | 14 Jul, 2026 | |
Malicious release: Malicious code in cosmos-gradio (PyPI) MAL-2026-10618 | Malicious | Not scored | 14 Jul, 2026 | PyPI cosmos-gradio |
nebula-mesh: CA private key not zeroized on web mobile-bundle error paths CVE-2026-53604, GHSA-2p2f-px33-4vv5, GO-2026-5984 | High | 0.2% | 14 Jul, 2026 | Go github.com/forgekeep/nebula-mesh |
Malicious release: Malicious code in cosmos-cuda (PyPI) MAL-2026-10617 | Malicious | Not scored | 14 Jul, 2026 | PyPI cosmos-cuda |
Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode CVE-2026-54628, GHSA-hwrq-8wxh-q4xv, GO-2026-5988 | High | 0.6% | 14 Jul, 2026 | Go github.com/julien040/anyquery |
Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware GHSA-mqxv-9rm6-w8qc, GO-2026-5981 | High | Not scored | 14 Jul, 2026 | Go github.com/lin-snow/ech0 |
Malicious release: Malicious code in ethereum-lib-utils (npm) GHSA-p99f-7355-gvr8, MAL-2026-10613 | Malicious | Not scored | 14 Jul, 2026 | npm ethereum-lib-utils |
Malicious release: Malicious code in assertion-utils-js (npm) GHSA-q727-8h63-fm25, MAL-2026-10612 | Malicious | Not scored | 14 Jul, 2026 | npm assertion-utils-js |
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser CVE-2026-54448, GHSA-q3fv-x8vg-qqm4, GO-2026-5983 | High | 0.4% | 14 Jul, 2026 | Go github.com/aquasecurity/trivy |
EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField CVE-2026-54087, GHSA-8559-gwj3-q37r | High | 0.4% | 14 Jul, 2026 | Packagist easycorp/easyadmin-bundle |
Malicious release: Malicious code in smb-common-uikit (npm) MAL-2026-10615 | Malicious | Not scored | 14 Jul, 2026 | npm smb-common-uikit |
Malicious release: Malicious code in smb-portal-uikit (npm) MAL-2026-10616 | Malicious | Not scored | 14 Jul, 2026 | npm smb-portal-uikit |