Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @dervix/engine.io (npm) GHSA-p68q-mqrg-7w4p, MAL-2026-10474 | Malicious | Not scored | 13 Jul, 2026 | npm @dervix/engine.io |
Malicious release: Malicious code in @gleamkit/socket.io (npm) GHSA-666h-5h3g-crf4, MAL-2026-10477 | Malicious | Not scored | 13 Jul, 2026 | npm @gleamkit/socket.io |
Malicious release: Malicious code in @gleamkit/engine.io (npm) GHSA-gvp7-6g9j-r5c6, MAL-2026-10476 | Malicious | Not scored | 13 Jul, 2026 | npm @gleamkit/engine.io |
Malicious release: Malicious code in loading-sessions (npm) GHSA-qrjp-fmwp-2rjq, MAL-2026-10471 | Malicious | Not scored | 13 Jul, 2026 | npm loading-sessions |
Malicious release: Malicious code in @uw010010/vite-tree (npm) GHSA-5q9f-77m9-x7c2, MAL-2026-10470 | Malicious | Not scored | 13 Jul, 2026 | npm @uw010010/vite-tree |
DIRAC: SQL injection and lack of access control in PilotManager service GHSA-7xw9-549r-8jrc | High | Not scored | 13 Jul, 2026 | PyPI DIRAC PyPI dirac |
DIRAC: Pilot code downloaded over unverified HTTPS connection CVE-2026-61668, GHSA-vg99-gr89-qhw9, PYSEC-2026-3464 | High | 0.4% | 13 Jul, 2026 | PyPI DIRAC PyPI dirac |
DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval CVE-2026-61667, GHSA-m4m7-4cw8-62j6, PYSEC-2026-3463 | Critical | 1.2% | 13 Jul, 2026 | PyPI DIRAC PyPI dirac |
Malicious release: Malicious code in @sheltr_/agent (npm) MAL-2026-10469 | Malicious | Not scored | 13 Jul, 2026 | npm @sheltr_/agent |
Malicious release: Malicious code in @origindev/ethaccount (npm) MAL-2026-10455 | Malicious | Not scored | 13 Jul, 2026 | npm @origindev/ethaccount |
Malicious release: Malicious code in @spzhongwin/skill-logger-plugin (npm) MAL-2026-10456 | Malicious | Not scored | 13 Jul, 2026 | npm @spzhongwin/skill-logger-plugin |
NukeViet: Pre-authentication SSRF via X-Forwarded-Host CVE-2026-55372, GHSA-4chg-4752-w88r | High | Not scored | 13 Jul, 2026 | Packagist nukeviet/nukeviet |
NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function CVE-2026-54065, GHSA-c9xg-64p9-f2jj | High | Not scored | 13 Jul, 2026 | Packagist nukeviet/nukeviet |
NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module CVE-2026-54064, GHSA-465g-4q99-5x86 | High | Not scored | 13 Jul, 2026 | Packagist nukeviet/nukeviet |
Malicious release: Malicious code in nodemon-sync (npm) GHSA-jj64-x8fg-q524, MAL-2026-10468 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-sync |
Malicious release: Malicious code in hehehee (npm) MAL-2026-10462 | Malicious | Not scored | 13 Jul, 2026 | npm hehehee |
Malicious release: Malicious code in cktool-core (npm) GHSA-qm37-v399-r9m5, MAL-2026-10457 | Malicious | Not scored | 13 Jul, 2026 | npm cktool-core |
Malicious release: Malicious code in polymarket-math-stake-kelly (npm) MAL-2026-10466 | Malicious | Not scored | 13 Jul, 2026 | npm polymarket-math-stake-kelly |
Malicious release: Malicious code in gptlite (npm) MAL-2026-10461 | Malicious | Not scored | 13 Jul, 2026 | npm gptlite |
Malicious release: Malicious code in polymarket-stake-kelly-math (npm) GHSA-2957-xv6c-9vvm, MAL-2026-10467 | Malicious | Not scored | 13 Jul, 2026 | npm polymarket-stake-kelly-math |
Malicious release: Malicious code in compliancepolicyserv (npm) MAL-2026-10458 | Malicious | Not scored | 13 Jul, 2026 | npm compliancepolicyserv |
Malicious release: Malicious code in connectedmerchantsserv (npm) MAL-2026-10459 | Malicious | Not scored | 13 Jul, 2026 | npm connectedmerchantsserv |
Malicious release: Malicious code in datavaultx (npm) MAL-2026-10460 | Malicious | Not scored | 13 Jul, 2026 | npm datavaultx |
Malicious release: Malicious code in node-path-addon (npm) GHSA-87rj-7vj7-vxgg, MAL-2026-10463 | Malicious | Not scored | 13 Jul, 2026 | npm node-path-addon |
Malicious release: Malicious code in node-procmetrics-data (npm) MAL-2026-10464 | Malicious | Not scored | 13 Jul, 2026 | npm node-procmetrics-data |
Malicious release: Malicious code in node-sysmon-native (npm) MAL-2026-10465 | Malicious | Not scored | 13 Jul, 2026 | npm node-sysmon-native |
NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-49259, GHSA-w2w5-w2pw-r929 | High | Not scored | 13 Jul, 2026 | Packagist nukeviet/nukeviet |
NukeViet: Unauthenticated Reflected XSS in Comment Module CVE-2026-48118, GHSA-mxpf-qgg6-v3ff | High | Not scored | 13 Jul, 2026 | Packagist nukeviet/nukeviet |
DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input CVE-2026-45579, GHSA-9jpv-c7p4-997x, PYSEC-2026-3462 | Critical | 0.9% | 13 Jul, 2026 | PyPI DIRAC PyPI dirac |
Decidim: Push subscriptions can be abused for server-side requests CVE-2026-45573, GHSA-2g9c-vf8h-prxx | Medium | 0.3% | 13 Jul, 2026 | RubyGems decidim-core |
Decidim: HTML content blocks allow stored script execution CVE-2026-45572, GHSA-533c-2vh9-4r86 | Medium | 0.3% | 13 Jul, 2026 | RubyGems decidim-core |
Decidim: CSV census record endpoints improper authorization CVE-2026-45415, GHSA-q79h-67vx-m9xg | Medium | 0.4% | 13 Jul, 2026 | RubyGems decidim-verifications |
Decidim: JWT-backed authentication can be replayed across organizations CVE-2026-45414, GHSA-r3v7-5x4c-c69q | High | 0.5% | 13 Jul, 2026 | RubyGems decidim |
Decidim: Verification documents can be downloaded through reusable links CVE-2026-45378, GHSA-3mvf-82qp-8qh5 | High | 0.4% | 13 Jul, 2026 | RubyGems decidim-verifications |
Decidim: Private exports can be downloaded through reusable links CVE-2026-45377, GHSA-767h-63j4-5226 | Medium | 0.5% | 13 Jul, 2026 | RubyGems decidim-core |
Decidim: Admin user search allows SQL injection through similarity-based sorting CVE-2026-45376, GHSA-jvqq-cvh4-xm37 | Medium | 0.6% | 13 Jul, 2026 | RubyGems decidim-admin |
Decidim: Verification admins can access supplied IDs from other organizations CVE-2026-45330, GHSA-86fh-w43w-338c | Medium | 0.5% | 13 Jul, 2026 | RubyGems decidim-verifications |
Decidim: Forms admin question editor lacks authorization CVE-2026-45086, GHSA-vq6j-hj8w-7v39 | Medium | 0.3% | 13 Jul, 2026 | RubyGems decidim-demographics |
Malicious release: Malicious code in nodemon-async (npm) GHSA-p75m-7xf4-8cqw, MAL-2026-10454 | Malicious | Not scored | 13 Jul, 2026 | npm nodemon-async |
Malicious release: Malicious code in router-processor (npm) MAL-2026-10453 | Malicious | Not scored | 13 Jul, 2026 | npm router-processor |
Malicious release: Malicious code in font-hub (npm) MAL-2026-10450 | Malicious | Not scored | 13 Jul, 2026 | npm font-hub |
Malicious release: Malicious code in @sqlite-group/schema-generator (npm) GHSA-cf6c-6x68-cf8r, MAL-2026-10448 | Malicious | Not scored | 13 Jul, 2026 | npm @sqlite-group/schema-generator |
Malicious release: Malicious code in gifuct (npm) GHSA-829c-v26f-5g9m, MAL-2026-10451 | Malicious | Not scored | 13 Jul, 2026 | npm gifuct |
Malicious release: Malicious code in auth-gen-next (npm) MAL-2026-10449 | Malicious | Not scored | 13 Jul, 2026 | npm auth-gen-next |
Malicious release: Malicious code in markdown-editable-table (npm) GHSA-jf3r-qgv3-frvm, MAL-2026-10452 | Malicious | Not scored | 13 Jul, 2026 | npm markdown-editable-table |
Malicious release: Malicious code in @oliviamcdaniel12/safer-buffer (npm) GHSA-88h2-qq8c-r5pv, MAL-2026-10442 | Malicious | Not scored | 13 Jul, 2026 | npm @oliviamcdaniel12/safer-buffer |
Malicious release: Malicious code in react-markable-table (npm) GHSA-37wc-pv88-9vwq, MAL-2026-10446 | Malicious | Not scored | 13 Jul, 2026 | npm react-markable-table |
Malicious release: Malicious code in remarkable-table (npm) GHSA-pw78-w6gv-hfcr, MAL-2026-10447 | Malicious | Not scored | 13 Jul, 2026 | npm remarkable-table |
Malicious release: Malicious code in markable-table (npm) GHSA-qc34-pqm6-35rf, MAL-2026-10444 | Malicious | Not scored | 13 Jul, 2026 | npm markable-table |
Malicious release: Malicious code in home-sections-web-ui (npm) GHSA-343f-5692-gj8q, MAL-2026-10443 | Malicious | Not scored | 13 Jul, 2026 | npm home-sections-web-ui |