Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in temp-cloak (npm) GHSA-rr2q-r4vq-r6cm, MAL-2026-10569 | Malicious | Not scored | 14 Jul, 2026 | npm temp-cloak |
Malicious release: Malicious code in sight-bind (npm) GHSA-v3x8-hfcr-q8p2, MAL-2026-10566 | Malicious | Not scored | 14 Jul, 2026 | npm sight-bind |
Malicious release: Malicious code in dom-weave (npm) GHSA-wx59-xwhx-3mmv, MAL-2026-10561 | Malicious | Not scored | 14 Jul, 2026 | npm dom-weave |
Malicious release: Malicious code in @codex2005/logger-core (npm) GHSA-jc68-fr59-2vfv, MAL-2026-10555 | Malicious | Not scored | 14 Jul, 2026 | npm @codex2005/logger-core |
Malicious release: Malicious code in better-tailwindcss (npm) GHSA-w8pj-3w7c-464w, MAL-2026-10550 | Malicious | Not scored | 14 Jul, 2026 | npm better-tailwindcss |
Malicious release: Malicious code in viteplugiin (npm) MAL-2026-10546 | Malicious | Not scored | 14 Jul, 2026 | npm viteplugiin |
Malicious release: Malicious code in chain-devkit (npm) MAL-2026-10531 | Malicious | Not scored | 14 Jul, 2026 | npm chain-devkit |
Malicious release: Malicious code in my-empty-package (npm) GHSA-39q9-338w-8vhv, MAL-2026-10535 | Malicious | Not scored | 14 Jul, 2026 | npm my-empty-package |
Malicious release: Malicious code in pokee-data-utils (PyPI) MAL-2026-10547 | Malicious | Not scored | 14 Jul, 2026 | PyPI pokee-data-utils |
Malicious release: Malicious code in fluterjs (npm) GHSA-gj4r-435f-67cr, MAL-2026-10532 | Malicious | Not scored | 14 Jul, 2026 | npm fluterjs |
Malicious release: Malicious code in cbr-internal-utils (npm) MAL-2026-10530 | Malicious | Not scored | 14 Jul, 2026 | npm cbr-internal-utils |
Malicious release: Malicious code in neon-postgres (npm) MAL-2026-10537 | Malicious | Not scored | 14 Jul, 2026 | npm neon-postgres |
Malicious release: Malicious code in lusha-iam-widgets (npm) GHSA-8xrv-62w2-rp6g, MAL-2026-10533 | Malicious | Not scored | 14 Jul, 2026 | npm lusha-iam-widgets |
Malicious release: Malicious code in n8n-nodes-social-facebook (npm) MAL-2026-10536 | Malicious | Not scored | 14 Jul, 2026 | npm n8n-nodes-social-facebook |
Malicious release: Malicious code in proxy-seller-mcp (npm) MAL-2026-10541 | Malicious | Not scored | 14 Jul, 2026 | npm proxy-seller-mcp |
Malicious release: Malicious code in skrill-payments (npm) MAL-2026-10543 | Malicious | Not scored | 14 Jul, 2026 | npm skrill-payments |
Malicious release: Malicious code in neteller (npm) MAL-2026-10538 | Malicious | Not scored | 14 Jul, 2026 | npm neteller |
Malicious release: Malicious code in skrill-sdk (npm) MAL-2026-10544 | Malicious | Not scored | 14 Jul, 2026 | npm skrill-sdk |
Malicious release: Malicious code in skrill (npm) MAL-2026-10542 | Malicious | Not scored | 14 Jul, 2026 | npm skrill |
Malicious release: Malicious code in postcss-processor-utils (npm) GHSA-r5fg-j5cf-mfgx, MAL-2026-10540 | Malicious | Not scored | 14 Jul, 2026 | npm postcss-processor-utils |
Malicious release: Malicious code in postcss-animatecss (npm) MAL-2026-10539 | Malicious | Not scored | 14 Jul, 2026 | npm postcss-animatecss |
Malicious release: Malicious code in vite-plugin-model (npm) GHSA-p58m-2wrh-74xr, MAL-2026-10545 | Malicious | Not scored | 14 Jul, 2026 | npm vite-plugin-model |
Malicious release: Malicious code in motion-pull (npm) GHSA-6hf9-8x52-w6g3, MAL-2026-10534 | Malicious | Not scored | 14 Jul, 2026 | npm motion-pull |
Malicious release: Malicious code in @velkov/isows (npm) MAL-2026-10524 | Malicious | Not scored | 14 Jul, 2026 | npm @velkov/isows |
Malicious release: Malicious code in @wrenfield/abitype (npm) GHSA-6f83-g2m3-3wwr, MAL-2026-10529 | Malicious | Not scored | 14 Jul, 2026 | npm @wrenfield/abitype |
Malicious release: Malicious code in @tabrex/bs58 (npm) MAL-2026-10523 | Malicious | Not scored | 14 Jul, 2026 | npm @tabrex/bs58 |
Malicious release: Malicious code in @vite-mcp/vite-type (npm) GHSA-mqf9-3wx8-45cj, MAL-2026-10525 | Malicious | Not scored | 14 Jul, 2026 | npm @vite-mcp/vite-type |
Malicious release: Malicious code in @vitets/vite-ts (npm) GHSA-733v-wc48-f65r, MAL-2026-10528 | Malicious | Not scored | 14 Jul, 2026 | npm @vitets/vite-ts |
Malicious release: Malicious code in @vite-ts/vite-ui (npm) GHSA-jm6h-xxm2-2mr3, MAL-2026-10527 | Malicious | Not scored | 14 Jul, 2026 | npm @vite-ts/vite-ui |
Malicious release: Malicious code in @vite-pro/vite-ui (npm) GHSA-phpx-wpr2-26pv, MAL-2026-10526 | Malicious | Not scored | 14 Jul, 2026 | npm @vite-pro/vite-ui |
Malicious release: Malicious code in @amedit/vercel-builder-probe (npm) GHSA-wvc3-vq7q-w2mw, MAL-2026-10548 | Malicious | Not scored | 14 Jul, 2026 | npm @amedit/vercel-builder-probe |
Malicious release: Malicious code in flick-test-app (npm) GHSA-94ph-qqm7-h26r, MAL-2026-10522 | Malicious | Not scored | 14 Jul, 2026 | npm flick-test-app |
Malicious release: Malicious code in @flcik/flick.js (npm) GHSA-f5p8-w3hq-m27h, MAL-2026-10521 | Malicious | Not scored | 14 Jul, 2026 | npm @flcik/flick.js |
Malicious release: Malicious code in fastify-bundler (npm) GHSA-f99h-9jhg-jrxw, MAL-2026-10520 | Malicious | Not scored | 14 Jul, 2026 | npm fastify-bundler |
Malicious release: Malicious code in @tqm-mfe/main (npm) GHSA-cg4c-94r8-hqjq, MAL-2026-10517 | Malicious | Not scored | 14 Jul, 2026 | npm @tqm-mfe/main |
Malicious release: Malicious code in chai-as-sets (npm) MAL-2026-10519 | Malicious | Not scored | 14 Jul, 2026 | npm chai-as-sets |
Malicious release: Malicious code in chai-as-auth (npm) MAL-2026-10518 | Malicious | Not scored | 14 Jul, 2026 | npm chai-as-auth |
SAP Approuter has an Open Redirect vulnerability CVE-2026-44745, GHSA-44p5-3m5g-vfhj | High | 0.5% | 14 Jul, 2026 | npm @sap/approuter |
SAP Approuter Vulnerable to HTTP Request Smuggling CVE-2026-27690, GHSA-8m85-wqg7-c529 | Critical | 0.7% | 14 Jul, 2026 | npm @sap/approuter |
Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access CVE-2026-52828, GHSA-rw46-qg69-vg6h | Medium | 0.5% | 14 Jul, 2026 | Packagist kimai/kimai |
Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP CVE-2026-52827, GHSA-v8hx-4vx8-wc96 | High | 0.6% | 14 Jul, 2026 | Packagist kimai/kimai |
Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation CVE-2026-52826, GHSA-2xgg-2x8h-8xw4 | Medium | 0.4% | 14 Jul, 2026 | Packagist kimai/kimai |
Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility CVE-2026-52825, GHSA-xv4r-4885-gwpg | Medium | 0.4% | 14 Jul, 2026 | Packagist kimai/kimai |
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover CVE-2026-52824, GHSA-jr9p-4h4j-6c58 | Critical | 1.3% | 14 Jul, 2026 | Packagist kimai/kimai |
Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes CVE-2026-52823, GHSA-r8vr-m544-qh4h | Medium | 0.3% | 14 Jul, 2026 | Packagist kimai/kimai |
Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation CVE-2026-52822, GHSA-c6w6-57jj-62vh | Medium | 0.5% | 14 Jul, 2026 | Packagist kimai/kimai |
Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects CVE-2026-52821, GHSA-3q6q-26vg-v97x | Medium | 0.4% | 14 Jul, 2026 | Packagist kimai/kimai |
Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass CVE-2026-52820, GHSA-vrr2-g9gh-c3jc | Medium | 0.4% | 13 Jul, 2026 | Packagist kimai/kimai |
Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target CVE-2026-52819, GHSA-4m8q-55qv-9pwp | Medium | 0.5% | 13 Jul, 2026 | Packagist kimai/kimai |
Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes CVE-2026-49992, GHSA-pgcc-vfmc-7cw5 | Medium | 0.2% | 13 Jul, 2026 | Packagist kimai/kimai |