Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in vybscan-testbed-inert-postinstall (npm) GHSA-cwcf-rmgg-qg9w, MAL-2026-10078 | Malicious | Not scored | 09 Jul, 2026 | npm vybscan-testbed-inert-postinstall |
Malicious release: Malicious code in ts-eslint-jest (npm) GHSA-r8h6-7hvm-3xcp, MAL-2026-10076 | Malicious | Not scored | 09 Jul, 2026 | npm ts-eslint-jest |
Malicious release: Malicious code in nodemon-gulp (npm) GHSA-wqr5-5c9r-9rj7, MAL-2026-10065 | Malicious | Not scored | 09 Jul, 2026 | npm nodemon-gulp |
Malicious release: Malicious code in chai-as-modified (npm) GHSA-mq6v-3fqr-9cp6, MAL-2026-10043 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-modified |
Malicious release: Malicious code in chai-as-buffered (npm) GHSA-jvvq-ph8p-7cc9, MAL-2026-10041 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-buffered |
Malicious release: Malicious code in chai-await-dom (npm) GHSA-5368-rr57-2vg7, MAL-2026-10049 | Malicious | Not scored | 09 Jul, 2026 | npm chai-await-dom |
Malicious release: Malicious code in chai-as-staged (npm) GHSA-fchw-g3j3-hxh3, MAL-2026-10047 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-staged |
Malicious release: Malicious code in chain-chai-async (npm) GHSA-wqgh-vp7f-x5q6, MAL-2026-10055 | Malicious | Not scored | 09 Jul, 2026 | npm chain-chai-async |
Malicious release: Malicious code in chai-as-align (npm) GHSA-8vcr-xf6w-wg45, MAL-2026-10039 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-align |
Malicious release: Malicious code in chai-promised-test (npm) MAL-2026-10052 | Malicious | Not scored | 09 Jul, 2026 | npm chai-promised-test |
Malicious release: Malicious code in chain-chai-await (npm) GHSA-v7w8-4wfr-cvwf, MAL-2026-10056 | Malicious | Not scored | 09 Jul, 2026 | npm chain-chai-await |
Malicious release: Malicious code in chai-as-serialized (npm) GHSA-9q7j-cc9w-c9rf, MAL-2026-10044 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-serialized |
Malicious release: Malicious code in chai-as-thread (npm) GHSA-pjgc-4vf2-4cj7, MAL-2026-10048 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-thread |
Malicious release: Malicious code in chai-as-balanced (npm) MAL-2026-10040 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-balanced |
Malicious release: Malicious code in chai-deflect (npm) GHSA-7p2p-g2j6-w6v3, MAL-2026-10051 | Malicious | Not scored | 09 Jul, 2026 | npm chai-deflect |
Malicious release: Malicious code in chai-as-sharpened (npm) GHSA-wm45-4mwq-2pg6, MAL-2026-10045 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-sharpened |
Malicious release: Malicious code in chai-secure (npm) MAL-2026-10053 | Malicious | Not scored | 09 Jul, 2026 | npm chai-secure |
Malicious release: Malicious code in chai-smart (npm) GHSA-22f3-fmp6-x5c8, MAL-2026-10054 | Malicious | Not scored | 09 Jul, 2026 | npm chai-smart |
Malicious release: Malicious code in chai-as-disarmed (npm) MAL-2026-10042 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-disarmed |
Malicious release: Malicious code in chai-defender (npm) GHSA-hqh4-jccw-jxg6, MAL-2026-10050 | Malicious | Not scored | 09 Jul, 2026 | npm chai-defender |
Malicious release: Malicious code in tailwind-animate-v4 (npm) GHSA-rh36-94jf-9566, MAL-2026-10073 | Malicious | Not scored | 09 Jul, 2026 | npm tailwind-animate-v4 |
Malicious release: Malicious code in chai-as-smart (npm) MAL-2026-10046 | Malicious | Not scored | 09 Jul, 2026 | npm chai-as-smart |
Malicious release: Malicious code in txs-builder-lib (npm) GHSA-r4hr-3frr-jgjv, MAL-2026-10021 | Malicious | Not scored | 09 Jul, 2026 | npm txs-builder-lib |
Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data GHSA-382c-vx95-w3p5 | Medium | Not scored | 09 Jul, 2026 | npm @jsonbored/gittensory-mcp |
Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests CVE-2026-53760, GHSA-hm42-q32m-vj4f | Medium | 0.2% | 09 Jul, 2026 | Packagist admidio/admidio |
Ruby CSS Parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file` CVE-2026-53727, GHSA-9pmc-p236-855h | High | 0.5% | 09 Jul, 2026 | RubyGems css_parser |
pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small CVE-2026-53720, GHSA-8f95-v3jq-cj86, PYSEC-2026-3000 | Medium | 0.2% | 09 Jul, 2026 | PyPI pymonocypher |
Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) CVE-2026-50553, GHSA-rqrh-8wpv-x7hh, GO-2026-5949 | High | 0.5% | 09 Jul, 2026 | Go github.com/enchant97/note-mark/backend |
Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books CVE-2026-50554, GHSA-588f-fvcv-xhvf, GO-2026-5948 | Medium | 0.4% | 09 Jul, 2026 | Go github.com/enchant97/note-mark/backend |
Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser CVE-2026-49477, GHSA-836r-79rf-4m37, PYSEC-2026-3072 | High | 0.6% | 09 Jul, 2026 | PyPI soupsieve |
Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists CVE-2026-49476, GHSA-2wc2-fm75-p42x, PYSEC-2026-3071 | High | 0.6% | 09 Jul, 2026 | PyPI soupsieve |
Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths GHSA-52vm-mxx8-f227 | High | Not scored | 09 Jul, 2026 | PyPI phantom-audio |
pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager CVE-2026-48987, GHSA-c2f9-4mc8-j656, PYSEC-2026-2992 | Medium | 0.4% | 09 Jul, 2026 | PyPI pyload-ng |
pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs CVE-2026-48737, GHSA-m5x5-28jr-gpjj, PYSEC-2026-2995 | Medium | 0.3% | 09 Jul, 2026 | PyPI pyload-ng |
Malicious release: Malicious code in client-cookies-agent (npm) MAL-2026-10019 | Malicious | Not scored | 09 Jul, 2026 | npm client-cookies-agent |
Malicious release: Malicious code in playwrightr (PyPI) MAL-2026-10020 | Malicious | Not scored | 09 Jul, 2026 | PyPI playwrightr |
Malicious release: Malicious code in n8n-nodes-mcputils (npm) GHSA-rxc8-p2w2-g5jg, MAL-2026-10013 | Malicious | Not scored | 09 Jul, 2026 | npm n8n-nodes-mcputils |
Malicious release: Malicious code in chain-api-sdk (npm) GHSA-6vrp-3g92-phhf, MAL-2026-10009 | Malicious | Not scored | 09 Jul, 2026 | npm chain-api-sdk |
Malicious release: Malicious code in mchain-sdk (npm) GHSA-frcx-7v83-jfwx, MAL-2026-10012 | Malicious | Not scored | 09 Jul, 2026 | npm mchain-sdk |
Malicious release: Malicious code in testing-d3do (npm) MAL-2026-10006 | Malicious | Not scored | 09 Jul, 2026 | npm testing-d3do |
Malicious release: Malicious code in feedback-api (npm) GHSA-48f9-4ww2-87xr, MAL-2026-10010 | Malicious | Not scored | 09 Jul, 2026 | npm feedback-api |
Malicious release: Malicious code in breeze-feature-flag-poc (npm) GHSA-549f-jwr2-69q2, MAL-2026-10008 | Malicious | Not scored | 09 Jul, 2026 | npm breeze-feature-flag-poc |
Malicious release: Malicious code in poc-node-npm (npm) GHSA-72cg-2g98-8fcp, MAL-2026-10015 | Malicious | Not scored | 09 Jul, 2026 | npm poc-node-npm |
Malicious release: Malicious code in rabi-snooze-api (npm) GHSA-cpfq-7jvh-rc7w, MAL-2026-10017 | Malicious | Not scored | 09 Jul, 2026 | npm rabi-snooze-api |
Malicious release: Malicious code in fusion-client (npm) GHSA-j6qf-7f37-jfrh, MAL-2026-10011 | Malicious | Not scored | 09 Jul, 2026 | npm fusion-client |
Malicious release: Malicious code in security-console-ui (npm) GHSA-jxmh-936f-pxv7, MAL-2026-10018 | Malicious | Not scored | 09 Jul, 2026 | npm security-console-ui |
Malicious release: Malicious code in bizapi-portal (npm) GHSA-w3w9-8p53-87h5, MAL-2026-10007 | Malicious | Not scored | 09 Jul, 2026 | npm bizapi-portal |
Malicious release: Malicious code in qlkube (npm) GHSA-w88p-pj99-p5g3, MAL-2026-10016 | Malicious | Not scored | 09 Jul, 2026 | npm qlkube |
Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-56291 | CriticalExploited | 14.9% | 09 Jul, 2026 | |
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement CVE-2026-12590, GHSA-v422-hmwv-36x6 | Medium | 0.4% | 09 Jul, 2026 | npm body-parser |