Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in reacktjs (npm) GHSA-8f3v-p25f-55vq, MAL-2026-7362 | Malicious | Not scored | 07 Jul, 2026 | npm reacktjs |
Malicious release: Malicious code in reachtjs (npm) GHSA-wwhj-qjr8-75jx, MAL-2026-7361 | Malicious | Not scored | 07 Jul, 2026 | npm reachtjs |
Malicious release: Malicious code in reacetjs (npm) GHSA-4vgp-3j75-cgv5, MAL-2026-7360 | Malicious | Not scored | 07 Jul, 2026 | npm reacetjs |
Malicious release: Malicious code in reabctjs (npm) GHSA-662j-cc9v-5xwm, MAL-2026-7359 | Malicious | Not scored | 07 Jul, 2026 | npm reabctjs |
Malicious release: Malicious code in reaactjs (npm) GHSA-7393-x2p7-jj55, MAL-2026-7358 | Malicious | Not scored | 07 Jul, 2026 | npm reaactjs |
Malicious release: Malicious code in rceactjs (npm) GHSA-cr3p-xq6p-6wfc, MAL-2026-7356 | Malicious | Not scored | 07 Jul, 2026 | npm rceactjs |
Malicious release: Malicious code in rdeactjs (npm) GHSA-g3xv-cjr3-7jfh, MAL-2026-7357 | Malicious | Not scored | 07 Jul, 2026 | npm rdeactjs |
Malicious release: Malicious code in rbeactjs (npm) GHSA-cfcq-79hq-xjvh, MAL-2026-7355 | Malicious | Not scored | 07 Jul, 2026 | npm rbeactjs |
Malicious release: Malicious code in raeactjs (npm) GHSA-gwvv-4qx5-xc6g, MAL-2026-7354 | Malicious | Not scored | 07 Jul, 2026 | npm raeactjs |
Malicious release: Malicious code in qreactjs (npm) GHSA-4c33-j439-rm6f, MAL-2026-7353 | Malicious | Not scored | 07 Jul, 2026 | npm qreactjs |
Malicious release: Malicious code in pull-request-comment-branch (npm) GHSA-crf7-499f-fh3g, MAL-2026-7352 | Malicious | Not scored | 07 Jul, 2026 | npm pull-request-comment-branch |
Malicious release: Malicious code in private-packages-sharingsession (npm) GHSA-372j-r8f9-vw5c, MAL-2026-7351 | Malicious | Not scored | 07 Jul, 2026 | npm private-packages-sharingsession |
Malicious release: Malicious code in private-packages-sharing-sessionz (npm) GHSA-4c2m-x9v5-3wf8, MAL-2026-7350 | Malicious | Not scored | 07 Jul, 2026 | npm private-packages-sharing-sessionz |
Malicious release: Malicious code in postgres-docker-utils (npm) GHSA-r8qh-6rr5-mvh8, MAL-2026-7349 | Malicious | Not scored | 07 Jul, 2026 | npm postgres-docker-utils |
Malicious release: Malicious code in plugin-proposal (npm) GHSA-pxm8-p95f-4vwp, MAL-2026-7348 | Malicious | Not scored | 07 Jul, 2026 | npm plugin-proposal |
Malicious release: Malicious code in picnic-work-app-terms-of-use-nl (npm) GHSA-6qcf-q3p2-m3qg, MAL-2026-7347 | Malicious | Not scored | 07 Jul, 2026 | npm picnic-work-app-terms-of-use-nl |
Malicious release: Malicious code in picnic-work-app-terms-of-use-fr (npm) GHSA-82x3-52vq-69mr, MAL-2026-7346 | Malicious | Not scored | 07 Jul, 2026 | npm picnic-work-app-terms-of-use-fr |
Malicious release: Malicious code in picnic-work-app-terms-of-use-de (npm) GHSA-wrg6-95vq-x427, MAL-2026-7345 | Malicious | Not scored | 07 Jul, 2026 | npm picnic-work-app-terms-of-use-de |
Malicious release: Malicious code in picnic-store-design-system (npm) GHSA-5chj-qm4h-7c4q, MAL-2026-7343 | Malicious | Not scored | 07 Jul, 2026 | npm picnic-store-design-system |
Malicious release: Malicious code in picnic-store-page-platform (npm) GHSA-75rf-v66c-9w8q, MAL-2026-7344 | Malicious | Not scored | 07 Jul, 2026 | npm picnic-store-page-platform |
Malicious release: Malicious code in picnic-decoder-generator (npm) GHSA-547q-4hgq-2rqw, MAL-2026-7340 | Malicious | Not scored | 07 Jul, 2026 | npm picnic-decoder-generator |
Malicious release: Malicious code in picnic-store-basket-miniapp (npm) GHSA-cq64-j7p2-7f7q, MAL-2026-7341 | Malicious | Not scored | 07 Jul, 2026 | npm picnic-store-basket-miniapp |
Malicious release: Malicious code in picnic-store-delivery-miniapp (npm) GHSA-mqpq-v3j7-m4q8, MAL-2026-7342 | Malicious | Not scored | 07 Jul, 2026 | npm picnic-store-delivery-miniapp |
Malicious release: Malicious code in penny-core (npm) GHSA-c95f-h28f-x22h, MAL-2026-7339 | Malicious | Not scored | 07 Jul, 2026 | npm penny-core |
Malicious release: Malicious code in pe3-ihm-plateforme (npm) GHSA-r9hc-5xxf-9573, MAL-2026-7338 | Malicious | Not scored | 07 Jul, 2026 | npm pe3-ihm-plateforme |
Malicious release: Malicious code in paypal-legal-components (npm) GHSA-q6c6-fm6j-px59, MAL-2026-7337 | Malicious | Not scored | 07 Jul, 2026 | npm paypal-legal-components |
Malicious release: Malicious code in oztxrk-mfa (npm) GHSA-r94x-4r7j-gw6c, MAL-2026-7336 | Malicious | Not scored | 07 Jul, 2026 | npm oztxrk-mfa |
Malicious release: Malicious code in ovault-evm (npm) GHSA-7q9c-757q-h886, MAL-2026-7335 | Malicious | Not scored | 07 Jul, 2026 | npm ovault-evm |
Malicious release: Malicious code in outer-package (npm) GHSA-qc2x-5qh3-jh3g, MAL-2026-7334 | Malicious | Not scored | 07 Jul, 2026 | npm outer-package |
Malicious release: Malicious code in oreactjs (npm) GHSA-wx9h-9v59-v6f6, MAL-2026-7333 | Malicious | Not scored | 07 Jul, 2026 | npm oreactjs |
EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose CVE-2026-45016, GHSA-c8m7-r2jv-rw63 | Medium | Not scored | 07 Jul, 2026 | Packagist egroupware/egroupware |
Malicious release: Malicious code in options-msg (npm) GHSA-vrvm-pphq-472w, MAL-2026-7332 | Malicious | Not scored | 07 Jul, 2026 | npm options-msg |
ONNX has Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs) CVE-2026-44512, GHSA-hwpq-hmq9-wj77, PYSEC-2026-2689 | Medium | 0.2% | 07 Jul, 2026 | PyPI onnx |
Malicious release: Malicious code in oidcsessioncheck-enduser (npm) GHSA-2h76-2pq3-hw9p, MAL-2026-7331 | Malicious | Not scored | 07 Jul, 2026 | npm oidcsessioncheck-enduser |
New API is vulnerable to CSRF through user email binding CVE-2026-44342, GHSA-26v7-h57m-gh9m, GO-2026-5929 | Medium | 0.2% | 07 Jul, 2026 | Go github.com/QuantumNous/new-api |
Malicious release: Malicious code in nreactjs (npm) GHSA-mmxv-j56f-h6gq, MAL-2026-7330 | Malicious | Not scored | 07 Jul, 2026 | npm nreactjs |
EGroupware has Authenticated RCE via Malicious eTemplate Upload CVE-2026-40187, GHSA-8737-2x9g-xjj7 | High | 0.9% | 07 Jul, 2026 | Packagist egroupware/egroupware |
Malicious release: Malicious code in notepad-monorepo (npm) GHSA-3g24-crgf-48m5, MAL-2026-7329 | Malicious | Not scored | 07 Jul, 2026 | npm notepad-monorepo |
Malicious release: Malicious code in notepad-frontend (npm) GHSA-84pc-vgj7-x65q, MAL-2026-7328 | Malicious | Not scored | 07 Jul, 2026 | npm notepad-frontend |
New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs CVE-2026-33655, GHSA-6qcr-qxgr-m7fv, GO-2026-5930 | High | 0.4% | 07 Jul, 2026 | Go github.com/QuantumNous/new-api |
EGroupware has a Remote Code Execution Vulnerability CVE-2026-27823, GHSA-h9qx-v5xp-ph8p | Critical | 1.0% | 07 Jul, 2026 | Packagist egroupware/egroupware |
Malicious release: Malicious code in next-runtimejs (npm) GHSA-p2w2-8xx2-cq95, MAL-2026-7327 | Malicious | Not scored | 07 Jul, 2026 | npm next-runtimejs |
Malicious release: Malicious code in newsroom-2022 (npm) GHSA-ccpq-8wv4-3xxf, MAL-2026-7326 | Malicious | Not scored | 07 Jul, 2026 | npm newsroom-2022 |
Malicious release: Malicious code in mx-frontend (npm) GHSA-9j4c-xcrm-qgrx, MAL-2026-7325 | Malicious | Not scored | 07 Jul, 2026 | npm mx-frontend |
Malicious release: Malicious code in mwf-accounts-lib-native-call-language-preference (npm) GHSA-76v7-g58v-39pp, MAL-2026-7324 | Malicious | Not scored | 07 Jul, 2026 | npm mwf-accounts-lib-native-call-language-preference |
Malicious release: Malicious code in mreactjs (npm) GHSA-wq47-f7wx-4v9j, MAL-2026-7323 | Malicious | Not scored | 07 Jul, 2026 | npm mreactjs |
Malicious release: Malicious code in motion-ani (npm) GHSA-866c-qgq4-87vf, MAL-2026-7322 | Malicious | Not scored | 07 Jul, 2026 | npm motion-ani |
Malicious release: Malicious code in modustack (npm) GHSA-j7cm-gp8q-567m, MAL-2026-7321 | Malicious | Not scored | 07 Jul, 2026 | npm modustack |
Malicious release: Malicious code in mngularjs (npm) GHSA-79hp-q67r-6xcj, MAL-2026-7320 | Malicious | Not scored | 07 Jul, 2026 | npm mngularjs |
Malicious release: Malicious code in meta-templates (npm) GHSA-jc4j-8gm8-85jh, MAL-2026-7319 | Malicious | Not scored | 07 Jul, 2026 | npm meta-templates |