Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @galicia-toolkit-nestjs/commons (npm) MAL-2026-17722 | Malicious | Not scored | 23 days ago | npm @galicia-toolkit-nestjs/commons |
Malicious release: Malicious code in @galicia-toolkit-nestjs/paas (npm) MAL-2026-17723 | Malicious | Not scored | 23 days ago | npm @galicia-toolkit-nestjs/paas |
Malicious release: Malicious code in @galicia-toolkit-nestjs/swagger (npm) MAL-2026-17724 | Malicious | Not scored | 23 days ago | npm @galicia-toolkit-nestjs/swagger |
Malicious release: Malicious code in @galicia-toolkit-nestjs-20/archetype (npm) MAL-2026-17725 | Malicious | Not scored | 23 days ago | npm @galicia-toolkit-nestjs-20/archetype |
Malicious release: Malicious code in @galicia-toolkit-nestjs-20/commons (npm) MAL-2026-17726 | Malicious | Not scored | 23 days ago | npm @galicia-toolkit-nestjs-20/commons |
Malicious release: Malicious code in @galicia-toolkit-nestjs-20/paas (npm) MAL-2026-17727 | Malicious | Not scored | 23 days ago | npm @galicia-toolkit-nestjs-20/paas |
Malicious release: Malicious code in @galicia-toolkit-nestjs-20-lite/archetype (npm) MAL-2026-17728 | Malicious | Not scored | 23 days ago | npm @galicia-toolkit-nestjs-20-lite/archetype |
Malicious release: Malicious code in @galicia-toolkit-nestjs-20-lite/commons (npm) MAL-2026-17729 | Malicious | Not scored | 23 days ago | npm @galicia-toolkit-nestjs-20-lite/commons |
Malicious release: Malicious code in @galicia-toolkit-nestjs-20-lite/paas (npm) MAL-2026-17730 | Malicious | Not scored | 23 days ago | npm @galicia-toolkit-nestjs-20-lite/paas |
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy CVE-2026-107728, GHSA-pfvf-fwfp-25mp, PYSEC-2026-4303 | High | 0.4% | 23 days ago | PyPI strawberry-graphql |
Strawberry legacy graphql-ws retains naturally completed subscription slots CVE-2026-107727, GHSA-m952-2w3f-6r8h, PYSEC-2026-4302 | Low | 0.4% | 23 days ago | PyPI strawberry-graphql |
fast-jwt: Verifier cache accepts expired JWTs without iat. CVE-2026-107719, GHSA-x937-hj6v-793p | Medium | 0.3% | 23 days ago | npm fast-jwt |
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry CVE-2026-107716, GHSA-556j-vv39-8rqv, PYSEC-2026-4201 | High | 0.1% | 23 days ago | PyPI banks |
Banks: User-controlled prompt input can be parsed as privileged chat messages CVE-2026-107717, GHSA-hmq2-7hp6-7crh, PYSEC-2026-4202 | Medium | 0.3% | 23 days ago | PyPI banks |
AdonisJS: Unencoded route parameters can produce open redirects CVE-2026-107718, GHSA-2m6q-8v3h-jqww | Medium | 0.3% | 23 days ago | npm @adonisjs/http-server |
Malicious release: Malicious code in revine (npm) GHSA-gr77-3hqf-674h, MAL-2026-17709 | Malicious | Not scored | 23 days ago | npm revine |
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set CVE-2026-107720, GHSA-8wpc-h4q6-8fxv | High | 0.3% | 23 days ago | npm fast-jwt |
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion CVE-2026-107722, GHSA-ww5h-9m49-7xx4 | Critical | 0.4% | 23 days ago | npm fast-jwt |
fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache) CVE-2026-107721, GHSA-687g-22h4-j4w4 | Medium | 0.3% | 23 days ago | npm fast-jwt |
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array CVE-2026-107723, GHSA-5hjw-83fp-phq9 | High | 0.5% | 23 days ago | npm fast-jwt |
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery CVE-2026-107724, GHSA-g3jj-5cmm-3hxx | High | 0.3% | 23 days ago | npm fast-jwt |
Malicious release: Malicious code in testrrrd (npm) MAL-2026-17706 | Malicious | Not scored | 23 days ago | npm testrrrd |
Malicious release: Malicious code in @wxwxtest/testrrrdd (npm) MAL-2026-17704 | Malicious | Not scored | 23 days ago | npm @wxwxtest/testrrrdd |
Malicious release: Malicious code in wie888r (npm) MAL-2026-17707 | Malicious | Not scored | 23 days ago | npm wie888r |
Malicious release: Malicious code in xblaxw (npm) MAL-2026-17708 | Malicious | Not scored | 23 days ago | npm xblaxw |
Malicious release: Malicious code in css-overscroll-contain (npm) GHSA-xjrr-fv8j-9hw7, MAL-2026-17705 | Malicious | Not scored | 23 days ago | npm css-overscroll-contain |
Indico: Cross-Site-Scripting in minutes editor CVE-2026-107397, GHSA-cw24-x4mj-fw3q, PYSEC-2026-4228 | Medium | 0.2% | 23 days ago | PyPI indico |
MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element CVE-2026-106435, GHSA-98qm-wvgf-w4cf | High | 0.1% | 23 days ago | PyPI pymongo |
Malicious release: Malicious code in kafka-helmsman (PyPI) MAL-2026-17702 | Malicious | Not scored | 23 days ago | PyPI kafka-helmsman |
Malicious release: Malicious code in kafka-roller (PyPI) MAL-2026-17703 | Malicious | Not scored | 23 days ago | PyPI kafka-roller |
Indico: Cross-Site-Scripting in link fields CVE-2026-107396, GHSA-c4wc-ggrj-jg9v, PYSEC-2026-4227 | Medium | 0.2% | 23 days ago | PyPI indico |
Indico: Missing access check in legacy session export API CVE-2026-107395, GHSA-6p4f-j8j6-463q, PYSEC-2026-4226 | Medium | 0.2% | 23 days ago | PyPI indico |
Indico: Incomplete Server-Side Request Forgery (SSRF) check CVE-2026-107394, GHSA-2v95-h47v-g4x9, PYSEC-2026-4225 | Medium | 0.3% | 23 days ago | PyPI indico |
music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master CVE-2026-107391, GHSA-f94x-6692-553q | High | 0.3% | 23 days ago | npm music-metadata |
music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort CVE-2026-107389, GHSA-5gfj-9q3v-qfp3 | Medium | 0.2% | 23 days ago | npm music-metadata |
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences CVE-2026-107381, GHSA-m9xh-6747-9r6f | Medium | 0.5% | 23 days ago | Packagist enshrined/svg-sanitize |
music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7) CVE-2026-107392, GHSA-8j4c-6x6g-rq3j | High | 0.4% | 23 days ago | npm music-metadata |
music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS CVE-2026-107388, GHSA-jjpr-9cvf-cq55 | Medium | 0.2% | 23 days ago | npm music-metadata |
music-metadata: Uncontrolled memory allocation in APEv2 parser CVE-2026-107387, GHSA-53v6-4h7p-p4gj | Medium | 0.2% | 23 days ago | npm music-metadata |
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES BIT-mariadb-2026-107385, BIT-mariadb-min-2026-107385, BIT-mysql-client-2026-107385, CVE-2026-107385, GHSA-r3rv-jm3r-62q2 | High | 0.4% | 23 days ago | npm mariadb |
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries) BIT-mariadb-2026-107384, BIT-mariadb-min-2026-107384, BIT-mysql-client-2026-107384, CVE-2026-107384, GHSA-v6pj-gxxw-phfw | High | 0.4% | 23 days ago | npm mariadb |
MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters BIT-mariadb-2026-107383, BIT-mariadb-min-2026-107383, BIT-mysql-client-2026-107383, CVE-2026-107383, GHSA-48qf-xh34-q73r | High | 0.4% | 23 days ago | npm mariadb |
MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS BIT-mariadb-2026-107382, BIT-mariadb-min-2026-107382, BIT-mysql-client-2026-107382, CVE-2026-107382, GHSA-cx2f-j9fh-8g68 | Medium | 0.2% | 23 days ago | npm mariadb |
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision CVE-2026-107380, GHSA-9rjx-3jch-6vjf | Medium | 0.3% | 23 days ago | Packagist enshrined/svg-sanitize |
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash CVE-2026-107379, GHSA-v383-3rw5-q8rf | Medium | 0.5% | 23 days ago | Packagist enshrined/svg-sanitize |
CairoSVG: Quadratic-time DoS parsing a crafted SVG <path> CVE-2026-107378, GHSA-c3jg-qh8m-j3h2, PYSEC-2026-4204 | High | 0.4% | 23 days ago | PyPI cairosvg |
datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory CVE-2026-107377, GHSA-77xj-x4rm-935c, PYSEC-2026-4205 | High | 0.5% | 23 days ago | PyPI datamodel-code-generator |
Malicious release: Malicious code in @kxafunc/xbails (npm) MAL-2026-17701 | Malicious | Not scored | 23 days ago | npm @kxafunc/xbails |
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort CVE-2026-107375, GHSA-r223-96jv-q533 | High | 0.4% | 23 days ago | npm generator-jhipster |
JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob CVE-2026-107303, GHSA-9ffp-22j7-56r2 | High | 0.3% | 23 days ago | npm generator-jhipster npm react-jhipster |