Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in gx-npm-lib (npm) GHSA-wcmr-4783-pq3p, MAL-2026-6480 | Malicious | Not scored | 25 Jun, 2026 | npm gx-npm-lib |
Malicious release: Malicious code in gx-npm-ui (npm) GHSA-5jpv-9x2f-72jj, MAL-2026-6481 | Malicious | Not scored | 25 Jun, 2026 | npm gx-npm-ui |
Malicious release: Malicious code in velocityfix (npm) GHSA-2736-v5cj-q9x5, MAL-2026-6487 | Malicious | Not scored | 25 Jun, 2026 | npm velocityfix |
Malicious release: Malicious code in log-update-ts (npm) GHSA-5866-j382-r7g9, MAL-2026-6483 | Malicious | Not scored | 25 Jun, 2026 | npm log-update-ts |
Malicious release: Malicious code in @salem_jalal/osc-components (npm) MAL-2026-6479 | Malicious | Not scored | 25 Jun, 2026 | npm @salem_jalal/osc-components |
Malicious release: Malicious code in unsafe-malicious-package (npm) GHSA-4gj3-wx83-w2hr, MAL-2026-6486 | Malicious | Not scored | 25 Jun, 2026 | npm unsafe-malicious-package |
Malicious release: Malicious code in starship-timeline (npm) GHSA-7c79-95c2-vgwm, MAL-2026-6485 | Malicious | Not scored | 25 Jun, 2026 | npm starship-timeline |
Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise CVE-2026-55166, GHSA-v2wp-frmc-5q3v, PYSEC-2026-384 | Critical | 0.3% | 25 Jun, 2026 | PyPI lemur |
Lemur: JWT verifier honors attacker-supplied alg, enabling ATO CVE-2026-55165, GHSA-r9gp-7f88-9r54, PYSEC-2026-2589 | Medium | 0.2% | 25 Jun, 2026 | PyPI lemur |
Lemur user-update path stores plaintext passwords CVE-2026-55164, GHSA-q437-g7fv-2jvv, PYSEC-2026-2587 | Medium | 0.3% | 25 Jun, 2026 | PyPI lemur |
Lemur Privilege Escalation: Non-admin role members can rewrite role membership via PUT /api/1/roles/<id> CVE-2026-55163, GHSA-x3vf-mgxj-7785, PYSEC-2026-2591 | Medium | 0.2% | 25 Jun, 2026 | PyPI lemur |
Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF CVE-2026-55162, GHSA-54vg-pfh7-jq95, PYSEC-2026-2586 | Medium | 0.2% | 25 Jun, 2026 | PyPI lemur |
Malicious release: Malicious code in runtimekit (npm) GHSA-v6qq-vq5x-rmxf, MAL-2026-6477 | Malicious | Not scored | 25 Jun, 2026 | npm runtimekit |
Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic CVE-2026-48702, GHSA-47q9-m4ww-924m, GO-2026-5778 | High | 0.5% | 25 Jun, 2026 | Go github.com/sigstore/rekor |
GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion CVE-2026-48529, GHSA-pjp5-fpmr-3349, GO-2026-5779 | Medium | 0.2% | 25 Jun, 2026 | Go github.com/github/github-mcp-server |
Malicious release: Malicious code in mi-test-99-tuapellido (PyPI) MAL-2026-6478 | Malicious | Not scored | 25 Jun, 2026 | PyPI mi-test-99-tuapellido |
Malicious release: Malicious code in ref-slot (npm) GHSA-fm4g-q7h6-hqjw, MAL-2026-6474 | Malicious | Not scored | 25 Jun, 2026 | npm ref-slot |
Malicious release: Malicious code in typedecode (npm) GHSA-wfg2-fj8h-rxj6, MAL-2026-6476 | Malicious | Not scored | 25 Jun, 2026 | npm typedecode |
Malicious release: Malicious code in textshape-css (npm) GHSA-pmmh-8m34-xxwh, MAL-2026-6475 | Malicious | Not scored | 25 Jun, 2026 | npm textshape-css |
Malicious release: Malicious code in colorpicker-ui (npm) MAL-2026-6473 | Malicious | Not scored | 25 Jun, 2026 | npm colorpicker-ui |
Lemur has an authorization bypass in StrictRolePermission / AuthorityCreatorPermission CVE-2026-48508, GHSA-qcqw-jwxc-2hqg, PYSEC-2026-2588 | High | 0.3% | 25 Jun, 2026 | PyPI lemur |
Malicious release: Malicious code in tailwind-color-shades (npm) MAL-2026-6471 | Malicious | Not scored | 25 Jun, 2026 | npm tailwind-color-shades |
Malicious release: Malicious code in tailwindcss-effector (npm) GHSA-5xpc-q26w-px3q, MAL-2026-6472 | Malicious | Not scored | 25 Jun, 2026 | npm tailwindcss-effector |
Malicious release: Malicious code in chlklib (npm) GHSA-pw26-7j7h-jhf5, MAL-2026-6470 | Malicious | Not scored | 25 Jun, 2026 | npm chlklib |
chi Has an IP Spoofing Vulnerability in `middleware.RealIP` CVE-2026-72815, GHSA-3fxj-6jh8-hvhx, GO-2026-5774 | Medium | 0.5% | 25 Jun, 2026 | Go github.com/go-chi/chi/v5 Go github.com/go-chi/chi/v5/middleware |
chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header CVE-2026-72816, GHSA-rjr7-jggh-pgcp, GO-2026-5777 | High | 0.3% | 25 Jun, 2026 | Go github.com/go-chi/chi/middleware Go github.com/go-chi/chi/v2/middleware Go github.com/go-chi/chi/v3/middleware Go github.com/go-chi/chi/v4/middleware +2 more |
chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution CVE-2026-72817, GHSA-9g5q-2w5x-hmxf, GO-2026-5775 | High | 0.2% | 25 Jun, 2026 | Go github.com/go-chi/chi/middleware Go github.com/go-chi/chi/v2/middleware Go github.com/go-chi/chi/v3/middleware Go github.com/go-chi/chi/v4/middleware +2 more |
FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks GHSA-r4v7-6wcg-ghj5, GO-2026-5776 | Medium | Not scored | 25 Jun, 2026 | Go github.com/gtsteffaniak/filebrowser |
pnpm: `stage download` writes outside its destination directory via manifest name/version traversal CVE-2026-55700, GHSA-v23m-ccfg-pq9h | High | 0.4% | 25 Jun, 2026 | npm pnpm |
pnpm: Reserved bin name deletes PNPM_HOME during global remove CVE-2026-55699, GHSA-4gxm-v5v7-fqc4 | Medium | 0.4% | 25 Jun, 2026 | npm pnpm |
pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes CVE-2026-55698, GHSA-w466-c33r-3gjp | High | 0.3% | 25 Jun, 2026 | npm pnpm |
pnpm: Repository-controlled configDependencies can select a pacquet native install engine CVE-2026-55697, GHSA-gj8w-mvpf-x27x | High | 0.2% | 25 Jun, 2026 | npm pnpm |
pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle CVE-2026-55487, GHSA-5wx6-mg75-v57r | High | 0.2% | 25 Jun, 2026 | npm pnpm |
pnpm: Repository config can expand victim environment secrets into registry requests before scripts run CVE-2026-55180, GHSA-3qhv-2rgh-x77r | Medium | 0.4% | 25 Jun, 2026 | npm pnpm |
pnpm: Unsafe default behavior breaks integrity check CVE-2026-50573, GHSA-54hh-g5mx-jqcp | High | 0.2% | 25 Jun, 2026 | npm pnpm |
pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field CVE-2026-50021, GHSA-q6j5-fjx5-2mc3 | High | 0.2% | 25 Jun, 2026 | npm pnpm |
pnpm binds unscoped user-level npm auth credentials to a repository-selected registry CVE-2026-50017, GHSA-cjhr-43r9-cfmw | Medium | 0.4% | 25 Jun, 2026 | npm pnpm |
pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement CVE-2026-50016, GHSA-hwx4-2j3j-g496 | High | 0.5% | 25 Jun, 2026 | npm pnpm |
pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal) CVE-2026-50015, GHSA-rxhj-4m44-96r4 | High | 0.4% | 25 Jun, 2026 | npm pnpm |
pnpm: Git Fetch Argument Injection via Lockfile resolution.commit CVE-2026-50014, GHSA-p4xf-rf54-rj3x | High | 0.3% | 25 Jun, 2026 | npm pnpm |
pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile CVE-2026-48995, GHSA-hg3w-7f8c-63hp | Medium | 0.2% | 25 Jun, 2026 | npm pnpm |
Malicious release: Malicious code in ts-precision (npm) GHSA-g38h-2r6h-pwr8, MAL-2026-6469 | Malicious | Not scored | 25 Jun, 2026 | npm ts-precision |
Malicious release: Malicious code in ts-opus (npm) GHSA-xr76-fgrm-h52p, MAL-2026-6468 | Malicious | Not scored | 25 Jun, 2026 | npm ts-opus |
neotoma has tenant isolation gap in relationship query endpoints GHSA-wrr4-782v-jhwh | Low | Not scored | 25 Jun, 2026 | npm neotoma |
justhtml: to_markdown() code-span blank-line breakout enables XSS CVE-2026-77088, GHSA-jf6w-2mvx-633j | Medium | 0.3% | 25 Jun, 2026 | PyPI justhtml |
Malicious release: Malicious code in @vpms/design-system (npm) GHSA-43r2-9cx9-pv7f, MAL-2026-6467 | Malicious | Not scored | 25 Jun, 2026 | npm @vpms/design-system |
Malicious release: Malicious code in chai-as-built (npm) MAL-2026-6465 | Malicious | Not scored | 25 Jun, 2026 | npm chai-as-built |
Malicious release: Malicious code in gx-npm-feature-flags (npm) GHSA-hhw7-23r7-qwj7, MAL-2026-6466 | Malicious | Not scored | 25 Jun, 2026 | npm gx-npm-feature-flags |
Malicious release: Malicious code in @colibri-event-types/megamarket-ru-web (npm) MAL-2026-6464 | Malicious | Not scored | 25 Jun, 2026 | npm @colibri-event-types/megamarket-ru-web |
@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write CVE-2026-46406, GHSA-4vp2-6q8c-pvq2 | Medium | 0.2% | 25 Jun, 2026 | npm @anthropic-ai/claude-code |