Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in css-gap-decorations-polyfill (npm) MAL-2026-17479 | Malicious | Not scored | 27 days ago | npm css-gap-decorations-polyfill |
Malicious release: Malicious code in css-anchor-pos-fallback (npm) MAL-2026-17476 | Malicious | Not scored | 27 days ago | npm css-anchor-pos-fallback |
Malicious release: Malicious code in css-a11y-contrast-utils (npm) MAL-2026-17475 | Malicious | Not scored | 27 days ago | npm css-a11y-contrast-utils |
Malicious release: Malicious code in focus-visible-polyfill-lite (npm) MAL-2026-17491 | Malicious | Not scored | 27 days ago | npm focus-visible-polyfill-lite |
Malicious release: Malicious code in anthropic-sdk (PyPI) MAL-2026-17472 | Malicious | Not scored | 27 days ago | PyPI anthropic-sdk |
Ahsay AhsayCBS Command Injection Vulnerability CVE-2026-105134 | CriticalExploited | 81.8% | 28 days ago | |
Ahsay AhsayCBS Improper Authentication Vulnerability CVE-2026-105133 | MediumExploited | 79.5% | 28 days ago | |
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability CVE-2026-88779 | HighExploited | 11.4% | 28 days ago | |
Malicious release: Malicious code in zencleaner (PyPI) MAL-2026-17629 | Malicious | Not scored | 28 days ago | PyPI zencleaner |
Malicious release: Malicious code in virgil-cli (npm) MAL-2026-17630 | Malicious | Not scored | 28 days ago | npm virgil-cli |
Malicious release: Malicious code in caoxiltts (PyPI) MAL-2026-17471 | Malicious | Not scored | 28 days ago | PyPI caoxiltts |
Malicious release: Malicious code in infrabench (PyPI) MAL-2026-17469 | Malicious | Not scored | 28 days ago | PyPI infrabench |
Malicious release: Malicious code in voxcpmruntime (PyPI) MAL-2026-17470 | Malicious | Not scored | 28 days ago | PyPI voxcpmruntime |
Malicious release: Malicious code in voxcpmintel (PyPI) MAL-2026-17468 | Malicious | Not scored | 28 days ago | PyPI voxcpmintel |
Malicious release: Malicious code in voxcpmeval (PyPI) MAL-2026-17465 | Malicious | Not scored | 28 days ago | PyPI voxcpmeval |
Malicious release: Malicious code in voxcpmkit (PyPI) MAL-2026-17466 | Malicious | Not scored | 28 days ago | PyPI voxcpmkit |
Malicious release: Malicious code in voxcpmui4 (PyPI) MAL-2026-17467 | Malicious | Not scored | 28 days ago | PyPI voxcpmui4 |
Malicious release: Malicious code in voxcpmui3 (PyPI) MAL-2026-17464 | Malicious | Not scored | 28 days ago | PyPI voxcpmui3 |
Malicious release: Malicious code in @nagular/router (npm) MAL-2026-17500 | Malicious | Not scored | 29 days ago | npm @nagular/router |
Malicious release: Malicious code in @angularr/router (npm) MAL-2026-17494 | Malicious | Not scored | 29 days ago | npm @angularr/router |
Malicious release: Malicious code in @babell/core (npm) MAL-2026-17497 | Malicious | Not scored | 29 days ago | npm @babell/core |
Malicious release: Malicious code in @nagular/core (npm) MAL-2026-17499 | Malicious | Not scored | 29 days ago | npm @nagular/core |
Malicious release: Malicious code in @angularr/core (npm) MAL-2026-17493 | Malicious | Not scored | 29 days ago | npm @angularr/core |
Malicious release: Malicious code in @angularr/cli (npm) MAL-2026-17492 | Malicious | Not scored | 29 days ago | npm @angularr/cli |
Malicious release: Malicious code in express-enhanced (npm) MAL-2026-17489 | Malicious | Not scored | 29 days ago | npm express-enhanced |
Malicious release: Malicious code in express-fork (npm) MAL-2026-17490 | Malicious | Not scored | 29 days ago | npm express-fork |
Malicious release: Malicious code in echogen (PyPI) MAL-2026-17462 | Malicious | Not scored | 29 days ago | PyPI echogen |
Malicious release: Malicious code in voxcpmtts3 (PyPI) MAL-2026-17463 | Malicious | Not scored | 29 days ago | PyPI voxcpmtts3 |
Malicious release: Malicious code in voxel-tts (PyPI) MAL-2026-17461 | Malicious | Not scored | 29 days ago | PyPI voxel-tts |
Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values CVE-2026-114073, GHSA-fj2x-mqqp-3v2w | Medium | 0.2% | 29 days ago | npm trigger.dev |
Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain CVE-2026-114108, GHSA-v2f8-6655-7grj | Critical | 0.5% | 29 days ago | PyPI vibe-trading-ai |
Vibe-Trading file-read tools expose arbitrary server-readable files CVE-2026-114106, GHSA-5rmq-chc7-m22f | High | 0.4% | 29 days ago | PyPI vibe-trading-ai |
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF CVE-2026-114107, GHSA-jqmf-mx4f-hfr6 | Critical | 0.6% | 29 days ago | PyPI vibe-trading-ai |
Trigger.dev: Cross-environment deployment cancel CVE-2026-114079, GHSA-4672-hwv6-gq62 | Medium | 0.3% | 29 days ago | npm trigger.dev |
Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name CVE-2026-114081, GHSA-9q4r-4842-93vw | High | 0.4% | 29 days ago | npm trigger.dev |
Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId CVE-2026-114086, GHSA-59h8-w5q6-mfmp | Medium | 0.4% | 29 days ago | npm trigger.dev |
Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise CVE-2026-114087, GHSA-pqxw-g93w-hj9x | Critical | 0.5% | 29 days ago | npm trigger.dev |
Trigger.dev: V1 coordinator default-secret unauth Socket.IO CVE-2026-114088, GHSA-gg6r-gp4c-89hp | Critical | 0.4% | 29 days ago | npm trigger.dev |
Trigger.dev: Blind SSRF via alert-channel webhook CVE-2026-114076, GHSA-q567-cr4x-96w4 | Medium | 0.3% | 29 days ago | npm trigger.dev |
Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR) GHSA-pp95-gc86-jq6q | High | Not scored | 29 days ago | npm trigger.dev |
Malicious release: Malicious code in voxeval (PyPI) MAL-2026-17457 | Malicious | Not scored | 29 days ago | PyPI voxeval |
Malicious release: Malicious code in ui.dist.min.js (npm) GHSA-325f-rjxf-3gm9, MAL-2026-17460 | Malicious | Not scored | 29 days ago | npm ui.dist.min.js |
Malicious release: Malicious code in translate-base-font (npm) GHSA-grv5-7wp6-vw6h, MAL-2026-17458 | Malicious | Not scored | 29 days ago | npm translate-base-font |
Malicious release: Malicious code in ui-base-colors (npm) GHSA-qgqx-3mhx-jwx3, MAL-2026-17459 | Malicious | Not scored | 29 days ago | npm ui-base-colors |
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction CVE-2026-104874, GHSA-54p9-h82j-f925, PYSEC-2026-4244 | Medium | 0.4% | 29 days ago | PyPI multidict |
LangGraph SDK custom auth silently ignores actions= on resource decorators CVE-2026-104873, GHSA-fvww-7h3r-vfhp, PYSEC-2026-4240 | High | 0.3% | 29 days ago | PyPI langgraph-sdk |
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute CVE-2026-104872, GHSA-qqmp-wf37-98f9 | Medium | 0.2% | 29 days ago | npm @opentelemetry/instrumentation-cassandra-driver npm @opentelemetry/instrumentation-knex npm @opentelemetry/instrumentation-mongoose npm @opentelemetry/instrumentation-mysql +4 more |
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows CVE-2026-104871, GHSA-7g7c-h8rr-7p6q | Medium | 0.4% | 29 days ago | npm @angular/ssr |
@orpc/zod: Prototype injection in smart coercion CVE-2026-103918, GHSA-gcgf-fh7c-8gf2 | Medium | 0.2% | 29 days ago | npm @orpc/zod |
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths CVE-2026-114094, GHSA-8mcx-5rqc-vhmf | High | 0.9% | 29 days ago | PyPI dulwich |