Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @kanaraa/baileys (npm) GHSA-m8g7-98g3-qmvm, MAL-2026-17361 | Malicious | Not scored | 19 days ago | npm @kanaraa/baileys |
Malicious release: Malicious code in @jojoxyz/condemnedforce-baileys (npm) GHSA-5j7f-gr36-g6pq, MAL-2026-17360 | Malicious | Not scored | 19 days ago | npm @jojoxyz/condemnedforce-baileys |
Malicious release: Malicious code in @ikanngeming/blubub (npm) GHSA-4qm4-g99f-98jp, MAL-2026-17811 | Malicious | Not scored | 19 days ago | npm @ikanngeming/blubub |
Malicious release: Malicious code in @ikanngeming/ikannbail (npm) GHSA-997h-9663-h8gw, MAL-2026-17355 | Malicious | Not scored | 19 days ago | npm @ikanngeming/ikannbail |
Malicious release: Malicious code in nakkinpm (npm) GHSA-9px4-72qq-2mj6, MAL-2026-17817 | Malicious | Not scored | 19 days ago | npm nakkinpm |
Malicious release: Malicious code in @ikanngeming/npm (npm) GHSA-fr6r-9cvc-942v, MAL-2026-17812 | Malicious | Not scored | 19 days ago | npm @ikanngeming/npm |
Malicious release: Malicious code in ikanngeming (npm) GHSA-j3wm-94vw-jhx7, MAL-2026-17816 | Malicious | Not scored | 19 days ago | npm ikanngeming |
Malicious release: Malicious code in @zaka13/zakasite (npm) GHSA-j7rx-j64h-2fch, MAL-2026-17810 | Malicious | Not scored | 19 days ago | npm @zaka13/zakasite |
Malicious release: Malicious code in minecraftaccfinder (PyPI) MAL-2026-17809 | Malicious | Not scored | 19 days ago | PyPI minecraftaccfinder |
Malicious release: Malicious code in @s4yhiitestpoc/r2-https-b (npm) GHSA-h99w-8693-g33v, MAL-2026-17808 | Malicious | Not scored | 19 days ago | npm @s4yhiitestpoc/r2-https-b |
Malicious release: Malicious code in ap3-foundations-ui (npm) GHSA-g9j6-f655-22p6, MAL-2026-17806 | Malicious | Not scored | 19 days ago | npm ap3-foundations-ui |
Malicious release: Malicious code in luoxy-baileys (npm) MAL-2026-17446 | Malicious | Not scored | 20 days ago | npm luoxy-baileys |
Malicious release: Malicious code in hridoy-ultimate (npm) MAL-2026-17803 | Malicious | Not scored | 20 days ago | npm hridoy-ultimate |
Malicious release: Malicious code in @coopeuch/core (npm) GHSA-8jgp-jmwc-7fxg, MAL-2026-17763 | Malicious | Not scored | 20 days ago | npm @coopeuch/core |
Malicious release: Malicious code in @coopeuch/components (npm) GHSA-8m68-7f2m-4825, MAL-2026-17761 | Malicious | Not scored | 20 days ago | npm @coopeuch/components |
Malicious release: Malicious code in @s4yhiitestpoc/scan-https-d (npm) GHSA-96fg-4mp3-2hj5, MAL-2026-17766 | Malicious | Not scored | 20 days ago | npm @s4yhiitestpoc/scan-https-d |
Malicious release: Malicious code in @coopeuch/common (npm) GHSA-5h58-475h-6287, MAL-2026-17760 | Malicious | Not scored | 20 days ago | npm @coopeuch/common |
Malicious release: Malicious code in @s4yhiitestpoc/r2-https (npm) MAL-2026-17764 | Malicious | Not scored | 20 days ago | npm @s4yhiitestpoc/r2-https |
Malicious release: Malicious code in @s4yhiitestpoc/r3-https (npm) GHSA-798w-mj69-gc2x, MAL-2026-17765 | Malicious | Not scored | 20 days ago | npm @s4yhiitestpoc/r3-https |
Malicious release: Malicious code in react-paginate-v5 (npm) MAL-2026-17777 | Malicious | Not scored | 20 days ago | npm react-paginate-v5 |
Malicious release: Malicious code in liferay-workspace-scripts (npm) GHSA-rm73-xcfr-76qq, MAL-2026-17772 | Malicious | Not scored | 20 days ago | npm liferay-workspace-scripts |
Malicious release: Malicious code in ksp-app (npm) MAL-2026-17770 | Malicious | Not scored | 20 days ago | npm ksp-app |
Malicious release: Malicious code in ksp-client-registry (npm) MAL-2026-17771 | Malicious | Not scored | 20 days ago | npm ksp-client-registry |
Malicious release: Malicious code in another-very-long-name (npm) MAL-2026-17767 | Malicious | Not scored | 20 days ago | npm another-very-long-name |
Malicious release: Malicious code in some-very-long-package-name (npm) MAL-2026-17778 | Malicious | Not scored | 20 days ago | npm some-very-long-package-name |
Malicious release: Malicious code in nested-lib (npm) MAL-2026-17773 | Malicious | Not scored | 20 days ago | npm nested-lib |
Malicious release: Malicious code in pay-methods-kmf (npm) MAL-2026-17776 | Malicious | Not scored | 20 days ago | npm pay-methods-kmf |
Malicious release: Malicious code in cloudflare_module (npm) MAL-2026-17768 | Malicious | Not scored | 20 days ago | npm cloudflare_module |
Malicious release: Malicious code in @coopeuch/button (npm) GHSA-55qj-2wwm-x5v6, MAL-2026-17759 | Malicious | Not scored | 20 days ago | npm @coopeuch/button |
Malicious release: Malicious code in deposit-limit-fe (npm) MAL-2026-17769 | Malicious | Not scored | 20 days ago | npm deposit-limit-fe |
Malicious release: Malicious code in nitro-cjs-requirer (npm) MAL-2026-17775 | Malicious | Not scored | 20 days ago | npm nitro-cjs-requirer |
Malicious release: Malicious code in @coopeuch/config (npm) GHSA-5w9x-2gg7-px58, MAL-2026-17762 | Malicious | Not scored | 20 days ago | npm @coopeuch/config |
Malicious release: Malicious code in nitro-bundled-dep (npm) MAL-2026-17774 | Malicious | Not scored | 20 days ago | npm nitro-bundled-dep |
Malicious release: Malicious code in orderly-plugin-liquidity-heatmap (npm) GHSA-83cj-fp7v-jmfx, MAL-2026-17848 | Malicious | Not scored | 20 days ago | npm orderly-plugin-liquidity-heatmap |
Malicious release: Malicious code in react-dropzone-v4 (npm) GHSA-cqf2-3c3q-p639, MAL-2026-17758 | Malicious | Not scored | 20 days ago | npm react-dropzone-v4 |
Malicious release: Malicious code in agent-vx (PyPI) MAL-2026-17755 | Malicious | Not scored | 21 days ago | PyPI agent-vx |
Malicious release: Malicious code in pafer (PyPI) MAL-2026-17756 | Malicious | Not scored | 21 days ago | PyPI pafer |
Malicious release: Malicious code in webreader (PyPI) MAL-2026-17757 | Malicious | Not scored | 21 days ago | PyPI webreader |
Malicious release: Malicious code in @library-wide/library-shell (npm) GHSA-8j36-pr5c-f6vx, MAL-2026-17754 | Malicious | Not scored | 21 days ago | npm @library-wide/library-shell |
Malicious release: Malicious code in media-manager5 (PyPI) MAL-2026-17753 | Malicious | Not scored | 21 days ago | PyPI media-manager5 |
Malicious release: Malicious code in agentaix (PyPI) MAL-2026-17752 | Malicious | Not scored | 21 days ago | PyPI agentaix |
Malicious release: Malicious code in passwordcracker (npm) MAL-2026-17864 | Malicious | Not scored | 21 days ago | npm passwordcracker |
Malicious release: Malicious code in passwordcrackv2 (npm) MAL-2026-17865 | Malicious | Not scored | 22 days ago | npm passwordcrackv2 |
Tina: Code injection via unescaped Git branch name in generated client source CVE-2026-108259, GHSA-pwhx-cvv3-qj5c | High | 0.3% | 22 days ago | npm @tinacms/cli |
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment CVE-2026-108261, GHSA-x34j-47hf-4xg7 | Critical | 0.2% | 22 days ago | npm @tinacms/app npm tinacms |
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS CVE-2026-108260, GHSA-c42q-qvc3-j6vg | High | 0.3% | 22 days ago | npm @tinacms/web-components |
Shiny for Python has path traversal in bookmark restore CVE-2026-108258, GHSA-47c3-hpmg-7j6p, PYSEC-2026-4300 | Medium | 0.4% | 22 days ago | PyPI shiny |
Contao: Cross-site request forgery in custom backend actions CVE-2026-107848, GHSA-9ff2-p842-45wq | Low | 0.1% | 22 days ago | Packagist contao/core-bundle |
Contao: Improper access control in the preview links module CVE-2026-107850, GHSA-q6wp-fr43-gm9v | Medium | 0.2% | 22 days ago | Packagist contao/core-bundle |
Contao: Improper access control in the table access voter CVE-2026-107851, GHSA-5974-gfqc-wrcm | Medium | 0.2% | 22 days ago | Packagist contao/core-bundle |