Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @immobiliarelabs/backstage-plugin-ldap-auth-backend (npm) MAL-2026-6529 | Malicious | Not scored | 26 Jun, 2026 | npm @immobiliarelabs/backstage-plugin-ldap-auth-backend |
Malicious release: Malicious code in @immobiliarelabs/backstage-plugin-ldap-auth (npm) MAL-2026-6528 | Malicious | Not scored | 26 Jun, 2026 | npm @immobiliarelabs/backstage-plugin-ldap-auth |
Malicious release: Malicious code in @immobiliarelabs/backstage-plugin-gitlab (npm) GHSA-r4r5-rj2h-xfvg, MAL-2026-6526 | Malicious | Not scored | 26 Jun, 2026 | npm @immobiliarelabs/backstage-plugin-gitlab |
github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction CVE-2026-13426, GHSA-72v2-v53v-4qmm, GO-2026-6910 | Medium | 0.3% | 26 Jun, 2026 | Go github.com/mattermost/mattermost/server/public |
The Tealium iQ Tag Management module provides Drupal integration with Tealium iQ.
`tealiumiq` stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an Object Injection vulnerability when the data are unserialized.
This CVE-2026-13244, DRUPAL-CONTRIB-2026-064 | High | 0.4% | 26 Jun, 2026 | Packagist:https://packages.drupal.org/8 drupal/tealiumiq |
Malicious release: Malicious code in @carvana.authentication-flows/shared (npm) MAL-2026-6521 | Malicious | Not scored | 26 Jun, 2026 | npm @carvana.authentication-flows/shared |
Malicious release: Malicious code in express-plugin (npm) MAL-2026-6523 | Malicious | Not scored | 26 Jun, 2026 | npm express-plugin |
Malicious release: Malicious code in ts-einkle (npm) GHSA-mjcv-m7fg-mg8j, MAL-2026-6524 | Malicious | Not scored | 26 Jun, 2026 | npm ts-einkle |
Malicious release: Malicious code in ts-einkle-slot (npm) GHSA-8cxx-rp6g-mcr9, MAL-2026-6525 | Malicious | Not scored | 26 Jun, 2026 | npm ts-einkle-slot |
Malicious release: Malicious code in @epsteinlovekids483/crossmint-wallets-sdk-pentest (npm) GHSA-x7jg-w433-8q2r, MAL-2026-6522 | Malicious | Not scored | 26 Jun, 2026 | npm @epsteinlovekids483/crossmint-wallets-sdk-pentest |
jupyter/nbconvert allows Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports CVE-2026-6658, GHSA-9754-6rhw-gj3h | Medium | 0.2% | 26 Jun, 2026 | PyPI nbconvert |
Malicious release: Malicious code in react-icon-svgs (npm) GHSA-3462-7h42-6cvg, MAL-2026-6519 | Malicious | Not scored | 26 Jun, 2026 | npm react-icon-svgs |
Malicious release: Malicious code in rollup-plugin-polyfill-connect (npm) GHSA-97cf-xxww-v429, MAL-2026-6520 | Malicious | Not scored | 26 Jun, 2026 | npm rollup-plugin-polyfill-connect |
Malicious release: Malicious code in ai-node-relay (npm) GHSA-25p7-8xj5-25qp, MAL-2026-6518 | Malicious | Not scored | 26 Jun, 2026 | npm ai-node-relay |
Malicious release: Malicious code in ai-node-agent (npm) GHSA-w537-2cgp-4x64, MAL-2026-6517 | Malicious | Not scored | 26 Jun, 2026 | npm ai-node-agent |
Malicious release: Malicious code in inlifegram (PyPI) MAL-2026-6516 | Malicious | Not scored | 26 Jun, 2026 | PyPI inlifegram |
Malicious release: Malicious code in sqligen (PyPI) MAL-2026-6515 | Malicious | Not scored | 26 Jun, 2026 | PyPI sqligen |
Malicious release: Malicious code in dtxto1ols (npm) MAL-2026-6513 | Malicious | Not scored | 26 Jun, 2026 | npm dtxto1ols |
Malicious release: Malicious code in dtxtools (npm) MAL-2026-6514 | Malicious | Not scored | 26 Jun, 2026 | npm dtxtools |
Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P) CVE-2026-49486, GHSA-fgch-86x8-fv43, PYSEC-2026-238 | High | 0.4% | 26 Jun, 2026 | PyPI apache-airflow-providers-ftp |
Malicious release: Malicious code in @merceas/cross-fetch (npm) MAL-2026-6510 | Malicious | Not scored | 26 Jun, 2026 | npm @merceas/cross-fetch |
Malicious release: Malicious code in @merceas/anchor (npm) MAL-2026-6509 | Malicious | Not scored | 26 Jun, 2026 | npm @merceas/anchor |
Malicious release: Malicious code in react-context-form-tdsss (npm) GHSA-pg33-6m24-4p63, MAL-2026-6512 | Malicious | Not scored | 26 Jun, 2026 | npm react-context-form-tdsss |
Malicious release: Malicious code in tw-style-utils (npm) GHSA-75cr-ggc5-8h7g, MAL-2026-6508 | Malicious | Not scored | 26 Jun, 2026 | npm tw-style-utils |
Malicious release: Malicious code in pump-stream-logger (npm) GHSA-64m4-w85f-wrjj, MAL-2026-6507 | Malicious | Not scored | 26 Jun, 2026 | npm pump-stream-logger |
Malicious release: Malicious code in pump-laserstream-parser (npm) GHSA-cwr6-c222-8hwf, MAL-2026-6506 | Malicious | Not scored | 26 Jun, 2026 | npm pump-laserstream-parser |
Malicious release: Malicious code in pino-zod (npm) GHSA-j7hj-qc4f-x92f, MAL-2026-6505 | Malicious | Not scored | 26 Jun, 2026 | npm pino-zod |
Malicious release: Malicious code in hydanlabs (npm) MAL-2026-6511 | Malicious | Not scored | 26 Jun, 2026 | npm hydanlabs |
Malicious release: Malicious code in openblox (PyPI) MAL-2026-6504 | Malicious | Not scored | 26 Jun, 2026 | PyPI openblox |
Malicious release: Malicious code in js-price-client-node (npm) GHSA-p53q-9fj9-cc6m, MAL-2026-6503 | Malicious | Not scored | 26 Jun, 2026 | npm js-price-client-node |
Malicious release: Malicious code in js-client-node (npm) GHSA-x7hp-6x9v-c662, MAL-2026-6502 | Malicious | Not scored | 26 Jun, 2026 | npm js-client-node |
Malicious release: Malicious code in dttfdsdee (npm) MAL-2026-6498 | Malicious | Not scored | 26 Jun, 2026 | npm dttfdsdee |
Malicious release: Malicious code in chai-as-synced (npm) GHSA-3m37-26mh-fj77, MAL-2026-6497 | Malicious | Not scored | 26 Jun, 2026 | npm chai-as-synced |
Malicious release: Malicious code in set-cookie-ease (npm) MAL-2026-6500 | Malicious | Not scored | 26 Jun, 2026 | npm set-cookie-ease |
Malicious release: Malicious code in mongoose-json-format (npm) GHSA-8fxp-pghh-7w6w, MAL-2026-6499 | Malicious | Not scored | 26 Jun, 2026 | npm mongoose-json-format |
Malicious release: Malicious code in @dervix/ws (npm) GHSA-4mc4-4rf2-2cm6, MAL-2026-6496 | Malicious | Not scored | 26 Jun, 2026 | npm @dervix/ws |
Malicious release: Malicious code in wellnpm (npm) GHSA-2gh4-jhh2-625m, MAL-2026-6501 | Malicious | Not scored | 26 Jun, 2026 | npm wellnpm |
Malicious release: Malicious code in animatecss-postcss-plugin (npm) GHSA-p6ch-cw7w-ff5c, MAL-2026-6495 | Malicious | Not scored | 26 Jun, 2026 | npm animatecss-postcss-plugin |
Malicious release: Malicious code in @help-forms/application-aff (npm) MAL-2026-6494 | Malicious | Not scored | 26 Jun, 2026 | npm @help-forms/application-aff |
Malicious release: Malicious code in data-parser-utils (npm) GHSA-vw6q-xg53-fpxh, MAL-2026-6490 | Malicious | Not scored | 26 Jun, 2026 | npm data-parser-utils |
KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite CVE-2026-13218, GHSA-q3jc-42cq-33fj, GO-2026-6914 | Medium | 0.1% | 26 Jun, 2026 | Go kubevirt.io/kubevirt |
KubeVirt virt-api port-forward handler vulnerable to SSRF via guest-controlled VMI IP address CVE-2026-13318, GHSA-cgm6-wvp9-4g5h | Medium | 0.2% | 26 Jun, 2026 | Go kubevirt.io/kubevirt |
KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumption CVE-2026-13322, GHSA-6f2p-2qg2-qqch, GO-2026-6912 | Low | 0.1% | 26 Jun, 2026 | Go github.com/kubevirt/kubevirt Go kubevirt.io/kubevirt |
Malicious release: Malicious code in prism-silq (npm) GHSA-6hp6-2792-v6q5, MAL-2026-6493 | Malicious | Not scored | 26 Jun, 2026 | npm prism-silq |
Malicious release: Malicious code in hexo-shoka-swiper (npm) GHSA-vwrj-pprq-gjvq, MAL-2026-6492 | Malicious | Not scored | 26 Jun, 2026 | npm hexo-shoka-swiper |
Malicious release: Malicious code in hexo-deployer-wrangler (npm) GHSA-vx8x-rr42-fwhx, MAL-2026-6491 | Malicious | Not scored | 26 Jun, 2026 | npm hexo-deployer-wrangler |
Malicious release: Malicious code in random-string-64 (npm) GHSA-jp8q-gmj4-fx77, MAL-2026-6484 | Malicious | Not scored | 25 Jun, 2026 | npm random-string-64 |
Malicious release: Malicious code in extra-huggingface (PyPI) MAL-2026-6489 | Malicious | Not scored | 25 Jun, 2026 | PyPI extra-huggingface |
Malicious release: Malicious code in pyext6cc8cd (PyPI) MAL-2026-6488 | Malicious | Not scored | 25 Jun, 2026 | PyPI pyext6cc8cd |
Malicious release: Malicious code in kelly-stake (npm) GHSA-9x8c-c54x-vgrv, MAL-2026-6482 | Malicious | Not scored | 25 Jun, 2026 | npm kelly-stake |