Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in fsociety-tools (PyPI) MAL-2026-6558 | Malicious | Not scored | 28 Jun, 2026 | PyPI fsociety-tools |
Malicious release: Malicious code in polymarket-clob-math (npm) GHSA-3q5w-m6wr-5jp2, MAL-2026-6556 | Malicious | Not scored | 28 Jun, 2026 | npm polymarket-clob-math |
Malicious release: Malicious code in livekit-agents (npm) GHSA-gf82-j362-r5f6, MAL-2026-6555 | Malicious | Not scored | 28 Jun, 2026 | npm livekit-agents |
Malicious release: Malicious code in pkg-fallback (PyPI) MAL-2026-6557 | Malicious | Not scored | 28 Jun, 2026 | PyPI pkg-fallback |
Malicious release: Malicious code in @k18n/creatormarketplace-admin-language (npm) MAL-2026-6550 | Malicious | Not scored | 28 Jun, 2026 | npm @k18n/creatormarketplace-admin-language |
Malicious release: Malicious code in insomnia-test-util-m4gester (npm) MAL-2026-6554 | Malicious | Not scored | 28 Jun, 2026 | npm insomnia-test-util-m4gester |
Malicious release: Malicious code in insomnia-plugin-poc-m4gester (npm) MAL-2026-6552 | Malicious | Not scored | 28 Jun, 2026 | npm insomnia-plugin-poc-m4gester |
Malicious release: Malicious code in insomnia-plugin-poc-m4gester2 (npm) MAL-2026-6553 | Malicious | Not scored | 28 Jun, 2026 | npm insomnia-plugin-poc-m4gester2 |
Malicious release: Malicious code in anthropic-internal-tools (npm) MAL-2026-6551 | Malicious | Not scored | 28 Jun, 2026 | npm anthropic-internal-tools |
Malicious release: Malicious code in discord-token-generator (PyPI) MAL-2026-6549 | Malicious | Not scored | 27 Jun, 2026 | PyPI discord-token-generator |
Malicious release: Malicious code in ts-ankle (npm) GHSA-992p-988h-h55j, MAL-2026-6548 | Malicious | Not scored | 27 Jun, 2026 | npm ts-ankle |
Malicious release: Malicious code in ryan-pdf-js (npm) GHSA-7qr7-hcw4-9826, MAL-2026-6546 | Malicious | Not scored | 27 Jun, 2026 | npm ryan-pdf-js |
Malicious release: Malicious code in react-editable-calendar (npm) MAL-2026-6547 | Malicious | Not scored | 27 Jun, 2026 | npm react-editable-calendar |
Malicious release: Malicious code in crossmint-wallets-sdk (npm) GHSA-7rfm-v32j-2583, MAL-2026-6545 | Malicious | Not scored | 27 Jun, 2026 | npm crossmint-wallets-sdk |
Malicious release: Malicious code in chai-as-persisted (npm) GHSA-4wm6-vmww-2544, MAL-2026-6544 | Malicious | Not scored | 27 Jun, 2026 | npm chai-as-persisted |
pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config CVE-2026-59195, GHSA-qrv3-253h-g69c | High | 0.4% | 27 Jun, 2026 | npm pnpm |
pnpm: `patch-remove` could delete project-selected files outside the patches directory CVE-2026-59194, GHSA-72r4-9c5j-mj57 | High | 0.4% | 27 Jun, 2026 | npm pnpm |
pnpm: Hoisted install imports lockfile alias outside node_modules CVE-2026-59196, GHSA-fr4h-3cph-29xv | High | 0.4% | 27 Jun, 2026 | npm pnpm |
Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API CVE-2026-59155, GHSA-ww5p-j6cj-6mqq, GO-2026-5832 | Medium | 0.4% | 26 Jun, 2026 | Go github.com/nezhahq/nezha |
Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR) CVE-2026-49338, GHSA-hmgp-w9jm-vp95, GO-2026-5830 | High | 0.3% | 26 Jun, 2026 | Go go.senan.xyz/gonic |
gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists CVE-2026-49339, GHSA-2fp4-5v5c-4448, GO-2026-5825 | High | 0.3% | 26 Jun, 2026 | Go go.senan.xyz/gonic |
gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host CVE-2026-49340, GHSA-4gxv-p5g5-j7w7, GO-2026-5827 | High | 0.3% | 26 Jun, 2026 | Go go.senan.xyz/gonic |
Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors CVE-2026-54244, GHSA-7mqq-4v55-88gh | Low | 0.3% | 26 Jun, 2026 | Packagist statamic/cms |
Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection CVE-2026-53523, GHSA-9rc6-8cjv-rcvx, GO-2026-5829 | Medium | 0.3% | 26 Jun, 2026 | Go github.com/nezhahq/nezha |
Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS CVE-2026-53522, GHSA-jg62-j5h6-8mpq, GO-2026-5831 | Medium | 0.3% | 26 Jun, 2026 | Go github.com/nezhahq/nezha |
Statamic Vulnerable to CSV formula injection in form submission exports CVE-2026-54243, GHSA-h77m-qrj7-jxcw | Medium | 0.3% | 26 Jun, 2026 | Packagist statamic/cms |
Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding) CVE-2026-54242, GHSA-v5c4-wcpj-x73m | Medium | 0.2% | 26 Jun, 2026 | Packagist statamic/cms |
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key CVE-2026-53519, GHSA-5c25-7vpj-9mqh, GO-2026-5828 | Critical | 1.9% | 26 Jun, 2026 | Go github.com/nezhahq/nezha |
Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context CVE-2026-53521, GHSA-39g2-8x68-pmx8, GO-2026-5826 | Medium | 0.3% | 26 Jun, 2026 | Go github.com/nezhahq/nezha |
Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing CVE-2026-53520, GHSA-x6fg-52vr-hj4w, GO-2026-5824 | Medium | 0.3% | 26 Jun, 2026 | Go github.com/nezhahq/nezha |
js-toml has silent type confusion via falsy-primitive duplicate-key bypass CVE-2026-50029, GHSA-m34p-749j-x6m6 | Medium | 0.4% | 26 Jun, 2026 | npm js-toml |
regclient may leak authentication credentials to external blob stores CVE-2026-49349, GHSA-qvqc-4c52-x6qp, GO-2026-5822 | Medium | 0.3% | 26 Jun, 2026 | Go github.com/regclient/regclient |
Authelia has an Edge Case Access Control Rule Mismatch CVE-2026-48794, GHSA-j748-h363-wqj8, GO-2026-5819 | Low | 0.4% | 26 Jun, 2026 | Go github.com/authelia/authelia Go github.com/authelia/authelia/v4 |
Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check CVE-2026-62283, GHSA-q6xx-5vr8-p898, GO-2026-5821 | Critical | 0.6% | 26 Jun, 2026 | Go github.com/nezhahq/nezha |
Blnk has an API key authorization bypass in owner and scope enforcement GHSA-wcr3-9x4c-f5gj, GO-2026-5823 | High | Not scored | 26 Jun, 2026 | Go github.com/blnkfinance/blnk |
YARD static cache reads raw traversal paths before router sanitization CVE-2026-49342, GHSA-pxcc-8665-phx8 | Medium | 0.3% | 26 Jun, 2026 | RubyGems yard |
SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings GHSA-7vfx-4246-jcfh | High | Not scored | 26 Jun, 2026 | Packagist solidinvoice/solidinvoice |
Kestra OSS OS Command Injection Vulnerability CVE-2026-49869 | CriticalExploited | 2.1% | 26 Jun, 2026 | |
Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy CVE-2026-49262, GHSA-mmj8-wcvw-6789 | Low | 0.2% | 26 Jun, 2026 | Packagist aimeos/pagible |
Malicious release: Malicious code in @osmura/treeify (npm) MAL-2026-6542 | Malicious | Not scored | 26 Jun, 2026 | npm @osmura/treeify |
Malicious release: Malicious code in express-initial (npm) GHSA-fh43-48vc-c9r9, MAL-2026-6543 | Malicious | Not scored | 26 Jun, 2026 | npm express-initial |
Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete) CVE-2026-49258, GHSA-c6v2-3ffm-vcmc, GO-2026-5816 | High | 0.5% | 26 Jun, 2026 | Go github.com/juev/nebula-mesh |
Malicious release: Malicious code in db-query-log (npm) GHSA-5p8x-c32p-h2jc, MAL-2026-6539 | Malicious | Not scored | 26 Jun, 2026 | npm db-query-log |
Malicious release: Malicious code in db-rake (npm) GHSA-prxc-r4q3-q88m, MAL-2026-6540 | Malicious | Not scored | 26 Jun, 2026 | npm db-rake |
Malicious release: Malicious code in db-plog (npm) GHSA-j49r-84jx-vq3m, MAL-2026-6538 | Malicious | Not scored | 26 Jun, 2026 | npm db-plog |
@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url GHSA-rp72-5v5q-2446 | Low | Not scored | 26 Jun, 2026 | npm @cardano402/mcp-server |
Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers GHSA-75mw-h36v-2jv7 | Medium | Not scored | 26 Jun, 2026 | PyPI dosage |
nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction GHSA-v2jf-442r-6mjh, GO-2026-5815 | Low | Not scored | 26 Jun, 2026 | Go github.com/juev/nebula-mesh |
WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs GHSA-q683-8468-r6h6 | Medium | Not scored | 26 Jun, 2026 | Packagist web-auth/webauthn-symfony-bundle |
better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server GHSA-3p34-w4f6-5xh2 | High | Not scored | 26 Jun, 2026 | npm better-helperjs |