Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in motiondnb (npm) GHSA-278r-46x5-pfjm, MAL-2026-10145 | Malicious | Not scored | 10 Jul, 2026 | npm motiondnb |
Malicious release: Malicious code in ng-search-api (npm) GHSA-rgrc-mmg8-pgrr, MAL-2026-10146 | Malicious | Not scored | 10 Jul, 2026 | npm ng-search-api |
9router: Image prefetch DNS rebinding allows SSRF to internal services CVE-2026-56676, GHSA-cmhj-wh2f-9cgx | High | 0.2% | 10 Jul, 2026 | npm 9router |
Malicious release: Malicious code in react-jsonwebtoken (npm) MAL-2026-10132 | Malicious | Not scored | 10 Jul, 2026 | npm react-jsonwebtoken |
Malicious release: Malicious code in theta-sdk-js (npm) GHSA-qj2r-27rj-cc82, MAL-2026-10135 | Malicious | Not scored | 10 Jul, 2026 | npm theta-sdk-js |
Malicious release: Malicious code in polygon-gamma-apis (npm) GHSA-hg4h-mv37-7x88, MAL-2026-10148 | Malicious | Not scored | 10 Jul, 2026 | npm polygon-gamma-apis |
Malicious release: Malicious code in polygon-gama-apis (npm) GHSA-pvwq-8chv-g96r, MAL-2026-10147 | Malicious | Not scored | 10 Jul, 2026 | npm polygon-gama-apis |
Malicious release: Malicious code in mdb-vite (npm) GHSA-w572-cxjv-46jc, MAL-2026-10144 | Malicious | Not scored | 10 Jul, 2026 | npm mdb-vite |
Malicious release: Malicious code in polymarket-gamma-apis (npm) GHSA-59wg-mh66-248p, MAL-2026-10149 | Malicious | Not scored | 10 Jul, 2026 | npm polymarket-gamma-apis |
Malicious release: Malicious code in marked-prettier (npm) GHSA-hwmr-cmgq-wr7x, MAL-2026-10143 | Malicious | Not scored | 10 Jul, 2026 | npm marked-prettier |
Malicious release: Malicious code in eslint-jest (npm) GHSA-m3v6-5prj-x7rp, MAL-2026-10142 | Malicious | Not scored | 10 Jul, 2026 | npm eslint-jest |
tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies CVE-2026-49977, GHSA-jxj7-g6gm-49j7 | Medium | 0.4% | 10 Jul, 2026 | npm tarteaucitronjs |
Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs CVE-2026-49865, GHSA-pj8j-p4g4-4vw8 | Medium | 0.4% | 10 Jul, 2026 | Packagist kimai/kimai |
Malicious release: Malicious code in stella-ai-cli (npm) GHSA-v3hh-vj73-4924, MAL-2026-10133 | Malicious | Not scored | 10 Jul, 2026 | npm stella-ai-cli |
Malicious release: Malicious code in stella-coder (npm) MAL-2026-10134 | Malicious | Not scored | 10 Jul, 2026 | npm stella-coder |
Malicious release: Malicious code in turbocalc (PyPI) MAL-2026-10139 | Malicious | Not scored | 10 Jul, 2026 | PyPI turbocalc |
Malicious release: Malicious code in uac-package (npm) GHSA-7cmm-649r-p3q2, MAL-2026-10138 | Malicious | Not scored | 10 Jul, 2026 | npm uac-package |
Malicious release: Malicious code in express-session-kit (npm) GHSA-v8j2-pw9x-xx7p, MAL-2026-10131 | Malicious | Not scored | 10 Jul, 2026 | npm express-session-kit |
Malicious release: Malicious code in transform-es2015-sticky-regex (npm) GHSA-2j63-q9jc-966c, MAL-2026-10136 | Malicious | Not scored | 10 Jul, 2026 | npm transform-es2015-sticky-regex |
Malicious release: Malicious code in type-elint (npm) GHSA-v69h-23wr-hjg4, MAL-2026-10137 | Malicious | Not scored | 10 Jul, 2026 | npm type-elint |
Malicious release: Malicious code in ohcm-culture-formatting (npm) MAL-2026-10128 | Malicious | Not scored | 10 Jul, 2026 | npm ohcm-culture-formatting |
Malicious release: Malicious code in eth-react-redirection (npm) MAL-2026-10127 | Malicious | Not scored | 10 Jul, 2026 | npm eth-react-redirection |
Malicious release: Malicious code in rtc-integration-frontend-sdk (npm) MAL-2026-10129 | Malicious | Not scored | 10 Jul, 2026 | npm rtc-integration-frontend-sdk |
Malicious release: Malicious code in type-plint (npm) GHSA-8mhh-r4mc-2293, MAL-2026-10130 | Malicious | Not scored | 10 Jul, 2026 | npm type-plint |
PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow CVE-2026-61437, GHSA-4gfv-wg42-7jw5, PYSEC-2026-4267 | High | 0.2% | 10 Jul, 2026 | PyPI praisonaiagents |
PraisonAI: Shell command allowlist bypass via find -exec built-in action CVE-2026-61434, GHSA-cv3g-hj65-pcfh, PYSEC-2026-4254 | High | 0.7% | 10 Jul, 2026 | PyPI praisonai |
PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace CVE-2026-61432, GHSA-4xxv-6wmf-xf45, PYSEC-2026-4268 | Medium | 0.3% | 10 Jul, 2026 | PyPI praisonaiagents |
PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace CVE-2026-61431, GHSA-q7m5-3jmv-vm48, PYSEC-2026-4258 | Medium | 0.4% | 10 Jul, 2026 | PyPI praisonai |
PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF CVE-2026-60091, GHSA-4w49-gwv8-fpjg, PYSEC-2026-4249 | High | 0.2% | 10 Jul, 2026 | PyPI praisonai |
PraisonAI: Project config can auto-save agent output outside the project root CVE-2026-60089, GHSA-qjw5-xwrp-xwpq, PYSEC-2026-4273 | Medium | 0.2% | 10 Jul, 2026 | PyPI praisonaiagents |
PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked CVE-2026-60086, GHSA-4r3p-w3mc-5v34, PYSEC-2026-4248 | Medium | 0.3% | 10 Jul, 2026 | PyPI praisonai |
n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads CVE-2026-58661, GHSA-w867-jm58-p9pv | Medium | 0.4% | 10 Jul, 2026 | npm n8n |
phpMyFAQ public FAQ APIs expose inactive FAQ content CVE-2026-57994, GHSA-mf8r-wm2w-f8c5 | Medium | 0.4% | 10 Jul, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
phpMyFAQ has Potential Authenticated Path Traversal in PDF Export CVE-2026-57961, GHSA-88g4-74f3-63x9 | Medium | 0.4% | 10 Jul, 2026 | Packagist phpmyfaq/phpmyfaq Packagist thorsten/phpmyfaq |
Malicious release: Malicious code in dowload_ebok_superior_spider_man_1_marvel_collection_by_dan_slott_tc3wo (npm) GHSA-32gm-qj4x-q887, MAL-2026-10125 | Malicious | Not scored | 10 Jul, 2026 | npm dowload_ebok_superior_spider_man_1_marvel_collection_by_dan_slott_tc3wo |
Malicious release: Malicious code in dowload_ebok_programming_in_haskell_second_edition_by_graham_hutton_c19wm (npm) GHSA-7cqx-w44w-2w4m, MAL-2026-10123 | Malicious | Not scored | 10 Jul, 2026 | npm dowload_ebok_programming_in_haskell_second_edition_by_graham_hutton_c19wm |
Malicious release: Malicious code in dowload_ebok_river_of_time_by_naomi_judd_marcia_wilkie_i1ze3 (npm) GHSA-gmw4-2r8x-wcrh, MAL-2026-10124 | Malicious | Not scored | 10 Jul, 2026 | npm dowload_ebok_river_of_time_by_naomi_judd_marcia_wilkie_i1ze3 |
Malicious release: Malicious code in dowload_ebok_leila_a_filha_de_charles_by_denise_correa_de_macedo_arnold_de_numiers_o103j (npm) GHSA-jf9x-crpq-qr4p, MAL-2026-10121 | Malicious | Not scored | 10 Jul, 2026 | npm dowload_ebok_leila_a_filha_de_charles_by_denise_correa_de_macedo_arnold_de_numiers_o103j |
Malicious release: Malicious code in dowload_ebok_wrath_of_the_gods_by_j_robert_kennedy_61o88 (npm) GHSA-g57p-g83q-gcxh, MAL-2026-10126 | Malicious | Not scored | 10 Jul, 2026 | npm dowload_ebok_wrath_of_the_gods_by_j_robert_kennedy_61o88 |
Malicious release: Malicious code in dowload_ebok_murder_in_plain_english_by_michael_arntfield_marcel_danesi_uleto (npm) GHSA-j3fj-g64g-f923, MAL-2026-10122 | Malicious | Not scored | 10 Jul, 2026 | npm dowload_ebok_murder_in_plain_english_by_michael_arntfield_marcel_danesi_uleto |
Malicious release: Malicious code in dowload_ebok_goodbye_things_by_fumio_sasaki_ptu02 (npm) GHSA-rffj-cpwp-q65h, MAL-2026-10120 | Malicious | Not scored | 10 Jul, 2026 | npm dowload_ebok_goodbye_things_by_fumio_sasaki_ptu02 |
Malicious release: Malicious code in execfences (npm) GHSA-34gj-pgfv-8qgf, MAL-2026-10118 | Malicious | Not scored | 10 Jul, 2026 | npm execfences |
Malicious release: Malicious code in sankislayer (PyPI) MAL-2026-10119 | Malicious | Not scored | 10 Jul, 2026 | PyPI sankislayer |
Malicious release: Malicious code in nodemon-slint (npm) GHSA-wr24-8cj8-p627, MAL-2026-10117 | Malicious | Not scored | 10 Jul, 2026 | npm nodemon-slint |
Malicious release: Malicious code in driftpin (npm) MAL-2026-10114 | Malicious | Not scored | 10 Jul, 2026 | npm driftpin |
Malicious release: Malicious code in jwtmethod (npm) MAL-2026-10116 | Malicious | Not scored | 10 Jul, 2026 | npm jwtmethod |
Malicious release: Malicious code in workspace-lint (npm) GHSA-2667-2whh-v3mf, MAL-2026-10112 | Malicious | Not scored | 10 Jul, 2026 | npm workspace-lint |
Malicious release: Malicious code in workspace-scripts (npm) GHSA-pcrx-c762-59jm, MAL-2026-10113 | Malicious | Not scored | 10 Jul, 2026 | npm workspace-scripts |
Malicious release: Malicious code in nodemon-patch (npm) GHSA-5v8m-v9mp-gf8h, MAL-2026-10110 | Malicious | Not scored | 10 Jul, 2026 | npm nodemon-patch |
Malicious release: Malicious code in nodepack-daemon (npm) GHSA-v7fc-qvp5-6qx3, MAL-2026-10111 | Malicious | Not scored | 10 Jul, 2026 | npm nodepack-daemon |