Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks GHSA-8f6j-263m-g72x | Medium | Not scored | 13 Jul, 2026 | PyPI app-store-server-library |
json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS GHSA-xf7x-x43h-rpqh | High | Not scored | 13 Jul, 2026 | PyPI json-repair |
FacturaScripts: Account takeover of any 2FA-enabled user CVE-2026-47677, GHSA-c67f-gmxw-mj93 | Critical | Not scored | 13 Jul, 2026 | Packagist facturascripts/facturascripts |
Malicious release: Malicious code in polymarket-bot-logger (npm) GHSA-v4pc-gmg8-h48w, MAL-2026-10516 | Malicious | Not scored | 13 Jul, 2026 | npm polymarket-bot-logger |
Malicious release: Malicious code in nodemon-client (npm) GHSA-cw3m-3cvq-pwp2, MAL-2026-10513 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-client |
Malicious release: Malicious code in nodemon-eslint (npm) GHSA-v57g-fjf5-426h, MAL-2026-10514 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-eslint |
Malicious release: Malicious code in nodemon-web (npm) GHSA-62c9-p25c-7xxm, MAL-2026-10515 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-web |
Malicious release: Malicious code in type-astr (npm) GHSA-q9rm-w335-55w5, MAL-2026-10510 | Malicious | Not scored | 13 Jul, 2026 | npm type-astr |
Malicious release: Malicious code in type-swap (npm) GHSA-w8hw-4vch-mrj4, MAL-2026-10511 | Malicious | Not scored | 13 Jul, 2026 | npm type-swap |
Malicious release: Malicious code in type-unique (npm) GHSA-h8x5-f48q-v2h7, MAL-2026-10512 | Malicious | Not scored | 13 Jul, 2026 | npm type-unique |
crewai-tools SSRF redirect bypass exposes internal services CVE-2026-62240, GHSA-mr4r-hcgx-8p4h, PYSEC-2026-3819 | High | 0.5% | 13 Jul, 2026 | PyPI crewai-tools |
OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs CVE-2026-62197, GHSA-3x84-qq85-fj65 | Medium | 0.3% | 13 Jul, 2026 | npm openclaw |
OpenClaw Feishu permission tools could ignore per-account disablement CVE-2026-62188, GHSA-w8wf-3qvj-6xqf | High | 0.4% | 13 Jul, 2026 | npm @openclaw/feishu |
OpenClaw Feishu tools could ignore per-account disablement CVE-2026-62187, GHSA-2q7j-2vhx-56g8 | High | 0.4% | 13 Jul, 2026 | npm @openclaw/feishu |
Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ollama. Authentication is not required to exploit this vulnerability.
The specific flaw exists with CVE-2026-15685, PYSEC-2026-3450 | High | 0.7% | 13 Jul, 2026 | PyPI ollama |
Malicious release: Malicious code in nodemon-delog (npm) GHSA-7gjf-8j8g-xm9p, MAL-2026-10507 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-delog |
Malicious release: Malicious code in nodemon-elint (npm) MAL-2026-10508 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-elint |
Malicious release: Malicious code in chai-as-verified (npm) MAL-2026-10504 | Malicious | Not scored | 13 Jul, 2026 | npm chai-as-verified |
Malicious release: Malicious code in node-fsagent (npm) GHSA-qgvj-fw22-j5v6, MAL-2026-10506 | Malicious | Not scored | 13 Jul, 2026 | npm node-fsagent |
Malicious release: Malicious code in test_adminet (npm) MAL-2026-10509 | Malicious | Not scored | 13 Jul, 2026 | npm test_adminet |
Malicious release: Malicious code in express-ini (npm) GHSA-w3p6-c3cm-r253, MAL-2026-10505 | Malicious | Not scored | 13 Jul, 2026 | npm express-ini |
Malicious release: Malicious code in filewisee (npm) GHSA-wp6h-28pg-v4j5, MAL-2026-10501 | Malicious | Not scored | 13 Jul, 2026 | npm filewisee |
Malicious release: Malicious code in bubblestring (npm) MAL-2026-10496 | Malicious | Not scored | 13 Jul, 2026 | npm bubblestring |
Malicious release: Malicious code in ddok-modal (npm) GHSA-5xvp-j6m9-rwr6, MAL-2026-10497 | Malicious | Not scored | 13 Jul, 2026 | npm ddok-modal |
Malicious release: Malicious code in n8n-nodes-rce-poc (npm) GHSA-f4f3-9g54-864m, MAL-2026-10503 | Malicious | Not scored | 13 Jul, 2026 | npm n8n-nodes-rce-poc |
Malicious release: Malicious code in gamified-trading-system (npm) GHSA-h8fc-h568-wwr9, GHSA-hh4c-9fqx-2vc5, MAL-2026-10502 | Malicious | Not scored | 13 Jul, 2026 | npm gamified-trading-system |
Malicious release: Malicious code in eslint-angular-react (npm) GHSA-jp3x-3mrw-3vwf, MAL-2026-10498 | Malicious | Not scored | 13 Jul, 2026 | npm eslint-angular-react |
Malicious release: Malicious code in express-bunker (npm) GHSA-mrw6-p6x7-7jj3, GHSA-w7r5-8cmj-m893, MAL-2026-10500, SNYK-JS-EXPRESSBUNKER-19161375 | Malicious | Not scored | 13 Jul, 2026 | npm express-bunker |
Malicious release: Malicious code in @quukk/opencode-clawmessenger (npm) MAL-2026-10495 | Malicious | Not scored | 13 Jul, 2026 | npm @quukk/opencode-clawmessenger |
Malicious release: Malicious code in @quickcall/krew (npm) MAL-2026-10494 | Malicious | Not scored | 13 Jul, 2026 | npm @quickcall/krew |
Malicious release: Malicious code in eth-lib-utils (npm) GHSA-q57p-j3v9-q767, MAL-2026-10499 | Malicious | Not scored | 13 Jul, 2026 | npm eth-lib-utils |
Malicious release: Malicious code in insomnia-plugin-poc-m4gester-run (npm) MAL-2026-10493 | Malicious | Not scored | 13 Jul, 2026 | npm insomnia-plugin-poc-m4gester-run |
Malicious release: Malicious code in assertcoreutils (npm) GHSA-22qr-5q9r-7v6x, MAL-2026-10491 | Malicious | Not scored | 13 Jul, 2026 | npm assertcoreutils |
Malicious release: Malicious code in font-huge (npm) GHSA-x8f8-q6m3-g4pq, MAL-2026-10492 | Malicious | Not scored | 13 Jul, 2026 | npm font-huge |
Malicious release: Malicious code in @sqlite-panel/createsql (npm) GHSA-mq68-3vc3-ch3q, MAL-2026-10490 | Malicious | Not scored | 13 Jul, 2026 | npm @sqlite-panel/createsql |
Malicious release: Malicious code in permcarmserver (npm) GHSA-9499-pgrg-v7w7, MAL-2026-10488 | Malicious | Not scored | 13 Jul, 2026 | npm permcarmserver |
Malicious release: Malicious code in permcserver (npm) GHSA-vjr2-cx8x-3q2x, MAL-2026-10489 | Malicious | Not scored | 13 Jul, 2026 | npm permcserver |
Malicious release: Malicious code in @omniwatch-wick/cli (npm) GHSA-x4cm-7r6h-pjg3, MAL-2026-10486 | Malicious | Not scored | 13 Jul, 2026 | npm @omniwatch-wick/cli |
Malicious release: Malicious code in @outsmartly/metaobjects (npm) MAL-2026-10487 | Malicious | Not scored | 13 Jul, 2026 | npm @outsmartly/metaobjects |
Malicious release: Malicious code in polymarket-stake-kelly-math-check (npm) GHSA-w387-g22r-3pw7, MAL-2026-10485 | Malicious | Not scored | 13 Jul, 2026 | npm polymarket-stake-kelly-math-check |
Malicious release: Malicious code in react-icons-svgo (npm) GHSA-m78v-9w6f-xwf2, MAL-2026-10482 | Malicious | Not scored | 13 Jul, 2026 | npm react-icons-svgo |
Malicious release: Malicious code in browser-use-headless (PyPI) MAL-2026-10484 | Malicious | Not scored | 13 Jul, 2026 | PyPI browser-use-headless |
Malicious release: Malicious code in node-fsmetrics-data (npm) GHSA-85wr-m3c9-v62j, MAL-2026-10479 | Malicious | Not scored | 13 Jul, 2026 | npm node-fsmetrics-data |
Malicious release: Malicious code in route-processor (npm) GHSA-8mrq-4593-6x5p, MAL-2026-10483 | Malicious | Not scored | 13 Jul, 2026 | npm route-processor |
Malicious release: Malicious code in node-fsmetrics-native (npm) GHSA-hfgq-7j44-m23h, MAL-2026-10480 | Malicious | Not scored | 13 Jul, 2026 | npm node-fsmetrics-native |
Malicious release: Malicious code in @sectest429/hello-npm-world (npm) GHSA-q7w2-749v-c98p, MAL-2026-10478 | Malicious | Not scored | 13 Jul, 2026 | npm @sectest429/hello-npm-world |
Malicious release: Malicious code in @torbeck/priority-queue (npm) GHSA-v2rg-75ch-7cfx, MAL-2026-10472 | Malicious | Not scored | 13 Jul, 2026 | npm @torbeck/priority-queue |
Laravel-Mediable: path traversal vulnerability in the File::sanitizePath() CVE-2026-49970, GHSA-xv8g-76mx-2rxc | High | 1.0% | 13 Jul, 2026 | Packagist plank/laravel-mediable |
Malicious release: Malicious code in claude-team-tracker (npm) MAL-2026-10473 | Malicious | Not scored | 13 Jul, 2026 | npm claude-team-tracker |
Malicious release: Malicious code in @dervix/socket.io (npm) GHSA-8hwh-fjw2-33qq, MAL-2026-10475 | Malicious | Not scored | 13 Jul, 2026 | npm @dervix/socket.io |