Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in raeactjs (npm) GHSA-gwvv-4qx5-xc6g, MAL-2026-7354 | Malicious | Not scored | 07 Jul, 2026 | npm raeactjs |
Malicious release: Malicious code in qreactjs (npm) GHSA-4c33-j439-rm6f, MAL-2026-7353 | Malicious | Not scored | 07 Jul, 2026 | npm qreactjs |
Malicious release: Malicious code in pull-request-comment-branch (npm) GHSA-crf7-499f-fh3g, MAL-2026-7352 | Malicious | Not scored | 07 Jul, 2026 | npm pull-request-comment-branch |
Malicious release: Malicious code in private-packages-sharingsession (npm) GHSA-372j-r8f9-vw5c, MAL-2026-7351 | Malicious | Not scored | 07 Jul, 2026 | npm private-packages-sharingsession |
Malicious release: Malicious code in private-packages-sharing-sessionz (npm) GHSA-4c2m-x9v5-3wf8, MAL-2026-7350 | Malicious | Not scored | 07 Jul, 2026 | npm private-packages-sharing-sessionz |
Malicious release: Malicious code in postgres-docker-utils (npm) GHSA-r8qh-6rr5-mvh8, MAL-2026-7349 | Malicious | Not scored | 07 Jul, 2026 | npm postgres-docker-utils |
Malicious release: Malicious code in plugin-proposal (npm) GHSA-pxm8-p95f-4vwp, MAL-2026-7348 | Malicious | Not scored | 07 Jul, 2026 | npm plugin-proposal |
Malicious release: Malicious code in picnic-work-app-terms-of-use-nl (npm) GHSA-6qcf-q3p2-m3qg, MAL-2026-7347 | Malicious | Not scored | 07 Jul, 2026 | npm picnic-work-app-terms-of-use-nl |
Malicious release: Malicious code in picnic-work-app-terms-of-use-fr (npm) GHSA-82x3-52vq-69mr, MAL-2026-7346 | Malicious | Not scored | 07 Jul, 2026 | npm picnic-work-app-terms-of-use-fr |
Malicious release: Malicious code in picnic-work-app-terms-of-use-de (npm) GHSA-wrg6-95vq-x427, MAL-2026-7345 | Malicious | Not scored | 07 Jul, 2026 | npm picnic-work-app-terms-of-use-de |
Malicious release: Malicious code in picnic-store-design-system (npm) GHSA-5chj-qm4h-7c4q, MAL-2026-7343 | Malicious | Not scored | 07 Jul, 2026 | npm picnic-store-design-system |
Malicious release: Malicious code in picnic-store-page-platform (npm) GHSA-75rf-v66c-9w8q, MAL-2026-7344 | Malicious | Not scored | 07 Jul, 2026 | npm picnic-store-page-platform |
Malicious release: Malicious code in picnic-decoder-generator (npm) GHSA-547q-4hgq-2rqw, MAL-2026-7340 | Malicious | Not scored | 07 Jul, 2026 | npm picnic-decoder-generator |
Malicious release: Malicious code in picnic-store-basket-miniapp (npm) GHSA-cq64-j7p2-7f7q, MAL-2026-7341 | Malicious | Not scored | 07 Jul, 2026 | npm picnic-store-basket-miniapp |
Malicious release: Malicious code in picnic-store-delivery-miniapp (npm) GHSA-mqpq-v3j7-m4q8, MAL-2026-7342 | Malicious | Not scored | 07 Jul, 2026 | npm picnic-store-delivery-miniapp |
Malicious release: Malicious code in penny-core (npm) GHSA-c95f-h28f-x22h, MAL-2026-7339 | Malicious | Not scored | 07 Jul, 2026 | npm penny-core |
Malicious release: Malicious code in pe3-ihm-plateforme (npm) GHSA-r9hc-5xxf-9573, MAL-2026-7338 | Malicious | Not scored | 07 Jul, 2026 | npm pe3-ihm-plateforme |
Malicious release: Malicious code in paypal-legal-components (npm) GHSA-q6c6-fm6j-px59, MAL-2026-7337 | Malicious | Not scored | 07 Jul, 2026 | npm paypal-legal-components |
Malicious release: Malicious code in oztxrk-mfa (npm) GHSA-r94x-4r7j-gw6c, MAL-2026-7336 | Malicious | Not scored | 07 Jul, 2026 | npm oztxrk-mfa |
Malicious release: Malicious code in ovault-evm (npm) GHSA-7q9c-757q-h886, MAL-2026-7335 | Malicious | Not scored | 07 Jul, 2026 | npm ovault-evm |
Malicious release: Malicious code in outer-package (npm) GHSA-qc2x-5qh3-jh3g, MAL-2026-7334 | Malicious | Not scored | 07 Jul, 2026 | npm outer-package |
Malicious release: Malicious code in oreactjs (npm) GHSA-wx9h-9v59-v6f6, MAL-2026-7333 | Malicious | Not scored | 07 Jul, 2026 | npm oreactjs |
EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose CVE-2026-45016, GHSA-c8m7-r2jv-rw63 | Medium | Not scored | 07 Jul, 2026 | Packagist egroupware/egroupware |
Malicious release: Malicious code in options-msg (npm) GHSA-vrvm-pphq-472w, MAL-2026-7332 | Malicious | Not scored | 07 Jul, 2026 | npm options-msg |
ONNX has Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs) CVE-2026-44512, GHSA-hwpq-hmq9-wj77, PYSEC-2026-2689 | Medium | 0.2% | 07 Jul, 2026 | PyPI onnx |
Malicious release: Malicious code in oidcsessioncheck-enduser (npm) GHSA-2h76-2pq3-hw9p, MAL-2026-7331 | Malicious | Not scored | 07 Jul, 2026 | npm oidcsessioncheck-enduser |
New API is vulnerable to CSRF through user email binding CVE-2026-44342, GHSA-26v7-h57m-gh9m, GO-2026-5929 | Medium | 0.2% | 07 Jul, 2026 | Go github.com/QuantumNous/new-api |
Malicious release: Malicious code in nreactjs (npm) GHSA-mmxv-j56f-h6gq, MAL-2026-7330 | Malicious | Not scored | 07 Jul, 2026 | npm nreactjs |
EGroupware has Authenticated RCE via Malicious eTemplate Upload CVE-2026-40187, GHSA-8737-2x9g-xjj7 | High | 0.9% | 07 Jul, 2026 | Packagist egroupware/egroupware |
Malicious release: Malicious code in notepad-monorepo (npm) GHSA-3g24-crgf-48m5, MAL-2026-7329 | Malicious | Not scored | 07 Jul, 2026 | npm notepad-monorepo |
Malicious release: Malicious code in notepad-frontend (npm) GHSA-84pc-vgj7-x65q, MAL-2026-7328 | Malicious | Not scored | 07 Jul, 2026 | npm notepad-frontend |
New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs CVE-2026-33655, GHSA-6qcr-qxgr-m7fv, GO-2026-5930 | High | 0.4% | 07 Jul, 2026 | Go github.com/QuantumNous/new-api |
EGroupware has a Remote Code Execution Vulnerability CVE-2026-27823, GHSA-h9qx-v5xp-ph8p | Critical | 1.0% | 07 Jul, 2026 | Packagist egroupware/egroupware |
Malicious release: Malicious code in next-runtimejs (npm) GHSA-p2w2-8xx2-cq95, MAL-2026-7327 | Malicious | Not scored | 07 Jul, 2026 | npm next-runtimejs |
Malicious release: Malicious code in newsroom-2022 (npm) GHSA-ccpq-8wv4-3xxf, MAL-2026-7326 | Malicious | Not scored | 07 Jul, 2026 | npm newsroom-2022 |
Malicious release: Malicious code in mx-frontend (npm) GHSA-9j4c-xcrm-qgrx, MAL-2026-7325 | Malicious | Not scored | 07 Jul, 2026 | npm mx-frontend |
Malicious release: Malicious code in mwf-accounts-lib-native-call-language-preference (npm) GHSA-76v7-g58v-39pp, MAL-2026-7324 | Malicious | Not scored | 07 Jul, 2026 | npm mwf-accounts-lib-native-call-language-preference |
Malicious release: Malicious code in mreactjs (npm) GHSA-wq47-f7wx-4v9j, MAL-2026-7323 | Malicious | Not scored | 07 Jul, 2026 | npm mreactjs |
Malicious release: Malicious code in motion-ani (npm) GHSA-866c-qgq4-87vf, MAL-2026-7322 | Malicious | Not scored | 07 Jul, 2026 | npm motion-ani |
Malicious release: Malicious code in modustack (npm) GHSA-j7cm-gp8q-567m, MAL-2026-7321 | Malicious | Not scored | 07 Jul, 2026 | npm modustack |
Malicious release: Malicious code in mngularjs (npm) GHSA-79hp-q67r-6xcj, MAL-2026-7320 | Malicious | Not scored | 07 Jul, 2026 | npm mngularjs |
Malicious release: Malicious code in meta-templates (npm) GHSA-jc4j-8gm8-85jh, MAL-2026-7319 | Malicious | Not scored | 07 Jul, 2026 | npm meta-templates |
Malicious release: Malicious code in mcp-ci-runner-poc (npm) GHSA-fw9m-r33c-qgj2, MAL-2026-7318 | Malicious | Not scored | 07 Jul, 2026 | npm mcp-ci-runner-poc |
Malicious release: Malicious code in manage-subscription-app (npm) GHSA-76rg-37p7-6389, MAL-2026-7317 | Malicious | Not scored | 07 Jul, 2026 | npm manage-subscription-app |
Malicious release: Malicious code in lunkr (npm) GHSA-9gcm-959p-qpm6, MAL-2026-7316 | Malicious | Not scored | 07 Jul, 2026 | npm lunkr |
Malicious release: Malicious code in lreactjs (npm) GHSA-rv4m-mmhm-6v2c, MAL-2026-7315 | Malicious | Not scored | 07 Jul, 2026 | npm lreactjs |
Malicious release: Malicious code in logfuse (npm) GHSA-qxfw-2vwr-x4mp, MAL-2026-7314 | Malicious | Not scored | 07 Jul, 2026 | npm logfuse |
Malicious release: Malicious code in liportal-web-app (npm) GHSA-hpwq-8fw5-xf8r, MAL-2026-7313 | Malicious | Not scored | 07 Jul, 2026 | npm liportal-web-app |
Malicious release: Malicious code in lint-prettier (npm) GHSA-xvmc-hj7q-4272, MAL-2026-7312 | Malicious | Not scored | 07 Jul, 2026 | npm lint-prettier |
Malicious release: Malicious code in launchdarkly-ai-tooling (npm) GHSA-gf94-87jf-6pg8, MAL-2026-7311 | Malicious | Not scored | 07 Jul, 2026 | npm launchdarkly-ai-tooling |