Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Paymenter has URL parameter injection that bypasses paid plan limits at checkout CVE-2026-47198, GHSA-5q4q-834j-g8g4 | High | 0.4% | 30 Jun, 2026 | Packagist paymenter/paymenter |
Malicious release: Malicious code in procwire (npm) GHSA-5r42-357x-f2mx, MAL-2026-6687 | Malicious | Not scored | 30 Jun, 2026 | npm procwire |
Adobe ColdFusion Path Traversal Vulnerability CVE-2026-48282 | CriticalExploited | 42.4% | 30 Jun, 2026 | |
Malicious release: Malicious code in brock-react-alerts (npm) GHSA-gh2m-x2qr-m2cm, MAL-2026-6681 | Malicious | Not scored | 30 Jun, 2026 | npm brock-react-alerts |
Malicious release: Malicious code in brock-loader (npm) GHSA-gwv3-x257-r43c, MAL-2026-6680 | Malicious | Not scored | 30 Jun, 2026 | npm brock-loader |
Malicious release: Malicious code in quoting (npm) GHSA-x8q6-66jr-wmp3, MAL-2026-6685 | Malicious | Not scored | 30 Jun, 2026 | npm quoting |
fzf vulnerable to denial of service through quadratic HTTP request-body accumulation CVE-2026-53433, GHSA-mvmf-94v6-879g, GO-2026-6620 | Medium | 0.4% | 30 Jun, 2026 | Go github.com/junegunn/fzf |
Malicious release: Malicious code in setup-cicd (npm) GHSA-5rc3-r829-w347, MAL-2026-6686 | Malicious | Not scored | 30 Jun, 2026 | npm setup-cicd |
Malicious release: Malicious code in postcss-property-rollup (npm) GHSA-6g2x-2f5c-wp9w, MAL-2026-6684 | Malicious | Not scored | 30 Jun, 2026 | npm postcss-property-rollup |
Malicious release: Malicious code in nbmolviz-js (npm) GHSA-fc4r-p4fh-6h4p, MAL-2026-6683 | Malicious | Not scored | 30 Jun, 2026 | npm nbmolviz-js |
Malicious release: Malicious code in confluent-kafka-javascript (npm) GHSA-j28m-58xp-3wgh, MAL-2026-6682 | Malicious | Not scored | 30 Jun, 2026 | npm confluent-kafka-javascript |
Malicious release: Malicious code in agent-starter-pack (npm) GHSA-x676-qqgj-qfgg, MAL-2026-6679 | Malicious | Not scored | 30 Jun, 2026 | npm agent-starter-pack |
Malicious release: Malicious code in ts-linting-builder (npm) GHSA-8mpj-272v-jhv7, MAL-2026-6678 | Malicious | Not scored | 30 Jun, 2026 | npm ts-linting-builder |
Malicious release: Malicious code in ts-lint-builders-v2.1 (npm) GHSA-vjgf-xg3j-g9c5, MAL-2026-6677 | Malicious | Not scored | 30 Jun, 2026 | npm ts-lint-builders-v2.1 |
Malicious release: Malicious code in rs-biginteger (npm) GHSA-xm5w-w96q-42f3, MAL-2026-6675 | Malicious | Not scored | 30 Jun, 2026 | npm rs-biginteger |
Malicious release: Malicious code in terminal-prettier (npm) GHSA-m8cr-hv9p-pg3f, MAL-2026-6676 | Malicious | Not scored | 30 Jun, 2026 | npm terminal-prettier |
Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability CVE-2026-8452 | HighExploited | 1.0% | 30 Jun, 2026 | |
Malicious release: Malicious code in vue-demi-fix (npm) GHSA-p53q-mf26-4h26, MAL-2026-6702 | Malicious | Not scored | 30 Jun, 2026 | npm vue-demi-fix |
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups CVE-2026-13149, GHSA-3jxr-9vmj-r5cp | High | 0.4% | 30 Jun, 2026 | npm brace-expansion |
Malicious release: Malicious code in ripshakti1 (npm) MAL-2026-6674 | Malicious | Not scored | 30 Jun, 2026 | npm ripshakti1 |
decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input CVE-2026-45822, GHSA-vcc3-ghjq-m6fr | Medium | 0.5% | 30 Jun, 2026 | npm decode-uri-component |
Malicious release: Malicious code in anthropic-toolkit (npm) GHSA-c7v6-f7mc-9crv, MAL-2026-6673 | Malicious | Not scored | 30 Jun, 2026 | npm anthropic-toolkit |
nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences CVE-2026-12243, GHSA-m42h-3232-vpv3, PYSEC-2026-597 | High | Not scored | 30 Jun, 2026 | PyPI nltk |
Malicious release: Malicious code in log-taker1 (npm) GHSA-35q5-q365-j23w, MAL-2026-6690 | Malicious | Not scored | 30 Jun, 2026 | npm log-taker1 |
Malicious release: Malicious code in thirdwebb (npm) GHSA-46px-g2r9-8vcr, MAL-2026-6694 | Malicious | Not scored | 30 Jun, 2026 | npm thirdwebb |
Malicious release: Malicious code in thirdwb (npm) GHSA-ccmq-q5j8-hvxc, MAL-2026-6693 | Malicious | Not scored | 30 Jun, 2026 | npm thirdwb |
Malicious release: Malicious code in decimal-format-core (npm) GHSA-jpc6-jpfr-f453, MAL-2026-6689 | Malicious | Not scored | 30 Jun, 2026 | npm decimal-format-core |
Malicious release: Malicious code in console-fmt-cli (npm) GHSA-p3j8-3227-2w78, MAL-2026-6688 | Malicious | Not scored | 30 Jun, 2026 | npm console-fmt-cli |
Malicious release: Malicious code in ts-bn-proto (npm) GHSA-wxpc-r4jx-9jrw, MAL-2026-6695 | Malicious | Not scored | 30 Jun, 2026 | npm ts-bn-proto |
Malicious release: Malicious code in polymarket-clob-maths (npm) MAL-2026-6691 | Malicious | Not scored | 30 Jun, 2026 | npm polymarket-clob-maths |
Malicious release: Malicious code in polymarket-trading-developer-tools (npm) MAL-2026-6692 | Malicious | Not scored | 30 Jun, 2026 | npm polymarket-trading-developer-tools |
Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query CVE-2026-44840, GHSA-q2m9-6jp9-c6mc, GO-2026-5837 | High | 0.5% | 29 Jun, 2026 | Go github.com/dgraph-io/dgraph Go github.com/dgraph-io/dgraph/v25 Go github.com/hypermodeinc/dgraph/v24 |
MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints CVE-2026-11720, GHSA-vwxw-jrg6-9jxv, GO-2026-6411 | Critical | 0.5% | 29 Jun, 2026 | Go github.com/googleapis/mcp-toolbox |
Malicious release: Malicious code in @webda-infra-ui/static-images (npm) GHSA-pp6c-f2ph-gxmm, MAL-2026-6652 | Malicious | Not scored | 29 Jun, 2026 | npm @webda-infra-ui/static-images |
Malicious release: Malicious code in @appsource/utils (npm) GHSA-28xf-wrjx-23mj, MAL-2026-6601 | Malicious | Not scored | 29 Jun, 2026 | npm @appsource/utils |
Malicious release: Malicious code in @bscom/styling (npm) GHSA-29c6-c7cm-r8ch, MAL-2026-6605 | Malicious | Not scored | 29 Jun, 2026 | npm @bscom/styling |
Malicious release: Malicious code in @bc-workspace/utils (npm) GHSA-3vmg-w948-phr5, MAL-2026-6603 | Malicious | Not scored | 29 Jun, 2026 | npm @bc-workspace/utils |
Malicious release: Malicious code in @cseo-hr/trpweb-shared (npm) GHSA-5x3r-97g5-r9j5, MAL-2026-6610 | Malicious | Not scored | 29 Jun, 2026 | npm @cseo-hr/trpweb-shared |
Malicious release: Malicious code in @sixt-payment/form-react (npm) GHSA-8cxm-2pmw-c822, MAL-2026-6649 | Malicious | Not scored | 29 Jun, 2026 | npm @sixt-payment/form-react |
Malicious release: Malicious code in @deel-ui/animation (npm) GHSA-9rwq-pr4x-fhqg, MAL-2026-6614 | Malicious | Not scored | 29 Jun, 2026 | npm @deel-ui/animation |
Malicious release: Malicious code in @contentprod-authoring/block-manager (npm) GHSA-cpfg-m96g-j4j9, MAL-2026-6609 | Malicious | Not scored | 29 Jun, 2026 | npm @contentprod-authoring/block-manager |
Malicious release: Malicious code in @digitalpharmacist/http-error-util (npm) GHSA-jw9w-w49g-cx4h, MAL-2026-6615 | Malicious | Not scored | 29 Jun, 2026 | npm @digitalpharmacist/http-error-util |
Malicious release: Malicious code in @bodata/angular-client (npm) GHSA-m7gq-xcwc-78ff, MAL-2026-6604 | Malicious | Not scored | 29 Jun, 2026 | npm @bodata/angular-client |
Malicious release: Malicious code in @alerts/components (npm) GHSA-m86f-3q43-wmpg, MAL-2026-6599 | Malicious | Not scored | 29 Jun, 2026 | npm @alerts/components |
Malicious release: Malicious code in @concerns/i18n (npm) GHSA-rp2m-w359-5cqp, MAL-2026-6606 | Malicious | Not scored | 29 Jun, 2026 | npm @concerns/i18n |
Malicious release: Malicious code in @deel-core/client-payroll-onboarding-types (npm) GHSA-v8wg-p2qh-9q7g, MAL-2026-6613 | Malicious | Not scored | 29 Jun, 2026 | npm @deel-core/client-payroll-onboarding-types |
Malicious release: Malicious code in @report-portal/service-ui (npm) GHSA-4gpj-m85h-j7rq, MAL-2026-6644 | Malicious | Not scored | 29 Jun, 2026 | npm @report-portal/service-ui |
Malicious release: Malicious code in @planetlabs/admin-ng (npm) GHSA-4x72-8x46-jqmw, MAL-2026-6637 | Malicious | Not scored | 29 Jun, 2026 | npm @planetlabs/admin-ng |
Malicious release: Malicious code in @tbe-ui/ides (npm) GHSA-cf57-g4p6-cqjh, MAL-2026-6651 | Malicious | Not scored | 29 Jun, 2026 | npm @tbe-ui/ides |
Malicious release: Malicious code in @react-thee/rapier (npm) GHSA-h7fx-c9v6-pg77, MAL-2026-6642 | Malicious | Not scored | 29 Jun, 2026 | npm @react-thee/rapier |