Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution CVE-2026-114095, GHSA-35mr-4567-66vg | High | 0.3% | 29 days ago | PyPI dulwich |
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections CVE-2026-114096, GHSA-8w8g-wq8h-fq33 | High | 0.2% | 29 days ago | PyPI dulwich |
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence CVE-2026-114097, GHSA-5fqc-mrg8-w798 | High | 0.2% | 29 days ago | PyPI dulwich |
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks CVE-2026-114098, GHSA-cm62-gvxx-vmxx | High | 0.2% | 29 days ago | PyPI dulwich |
Malicious release: Malicious code in @smwebserver/static (npm) GHSA-qhx4-m546-6w2x, MAL-2026-17456 | Malicious | Not scored | 29 days ago | npm @smwebserver/static |
probe-image-size: Quadratic-time Denial of Service in the SVG Parser CVE-2026-104861, GHSA-gjj5-9665-rwrc | High | 0.4% | 29 days ago | npm probe-image-size |
@nx/docker: OS command injection in the @nx/docker release pipeline CVE-2026-104859, GHSA-6vc5-vf29-ffr2 | High | 0.1% | 29 days ago | npm @nx/docker |
Nx daemon and plugin worker sockets are accessible to other local users CVE-2026-104854, GHSA-w3vv-58gj-gw77 | High | 0.1% | 29 days ago | npm nx |
Nx: Path traversal in nx migrate package-migrations extraction CVE-2026-104853, GHSA-hrvq-x7jp-36xv | Medium | 0.2% | 29 days ago | npm nx |
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution CVE-2026-104851, GHSA-27vj-qcqg-25rc, PYSEC-2026-4217 | High | 0.5% | 29 days ago | PyPI fsspec |
Tinypool: Prototype Pollution Gadget to RCE in run() options CVE-2026-104849, GHSA-85c8-ppgw-ccpr | Critical | 0.5% | 29 days ago | npm tinypool |
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution CVE-2026-104848, GHSA-5gmw-xhrv-c9v3 | Critical | 0.5% | 29 days ago | npm tinypool |
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages CVE-2026-94544, GHSA-3w37-wq28-93x7 | Medium | 0.2% | 29 days ago | npm next |
Next.js has cache poisoning of SSG and ISR pages in self-hosted applications CVE-2026-94543, GHSA-4jqv-mc3x-m676 | Medium | 0.5% | 29 days ago | npm next |
Next.js has information disclosure in development server's Model Context Protocol endpoint CVE-2026-94486, GHSA-39w2-rjm5-chcv | Low | 0.1% | 29 days ago | npm next |
Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass CVE-2026-94485, GHSA-f87g-xv8r-7p7x | Medium | 0.2% | 29 days ago | npm next |
Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service CVE-2026-94484, GHSA-mcj8-r9mp-w47p | Medium | 0.2% | 29 days ago | npm next |
Next.js has Server-Side Request Forgery in Image Optimization CVE-2026-94483, GHSA-cjq9-62q9-8jv4 | High | 0.3% | 29 days ago | npm next |
ProseMirror has a XSS vulnerability in prosemirror-view's paste handling CVE-2026-104847, GHSA-c8x8-7fp4-3x9w | High | 0.3% | 29 days ago | npm prosemirror-view |
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw) CVE-2026-104846, GHSA-p6vx-979v-rg4c | Critical | 0.3% | 29 days ago | npm seroval |
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization CVE-2026-104845, GHSA-jp82-f5mq-hwhp | High | 0.4% | 29 days ago | npm seroval |
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion CVE-2026-104844, GHSA-rj75-hqrm-r3gf | Medium | 0.4% | 29 days ago | npm postcss-selector-parser |
uv: Path traversal on Windows through wheel extraction CVE-2026-104843, GHSA-2cv4-cqwr-gwf7, PYSEC-2026-4305 | Medium | 0.4% | 29 days ago | PyPI uv crates.io uv |
Malicious release: Malicious code in dedh-devops-automation (PyPI) MAL-2026-17455 | Malicious | Not scored | 29 days ago | PyPI dedh-devops-automation |
Malicious release: Malicious code in kartykgithub-ph-f (npm) GHSA-x2m2-w3gv-m5wg, MAL-2026-17426 | Malicious | Not scored | 02 Oct, 2026 | npm kartykgithub-ph-f |
Malicious release: Malicious code in kartykgithub-ph-e (npm) GHSA-7hq7-x7ww-7cxr, MAL-2026-17425 | Malicious | Not scored | 02 Oct, 2026 | npm kartykgithub-ph-e |
Malicious release: Malicious code in kartykgithub-ph-b (npm) GHSA-27m4-jjxc-69wf, MAL-2026-17424 | Malicious | Not scored | 02 Oct, 2026 | npm kartykgithub-ph-b |
Malicious release: Malicious code in @erlanzz/baileys (npm) MAL-2026-17440 | Malicious | Not scored | 01 Oct, 2026 | npm @erlanzz/baileys |
Malicious release: Malicious code in @smart-dev-wa/baileys (npm) MAL-2026-17442 | Malicious | Not scored | 01 Oct, 2026 | npm @smart-dev-wa/baileys |
Malicious release: Malicious code in danz-bails (npm) MAL-2026-17444 | Malicious | Not scored | 01 Oct, 2026 | npm danz-bails |
Malicious release: Malicious code in mikuhostt-baileys (npm) MAL-2026-17447 | Malicious | Not scored | 01 Oct, 2026 | npm mikuhostt-baileys |
Malicious release: Malicious code in wailib (npm) MAL-2026-17451 | Malicious | Not scored | 01 Oct, 2026 | npm wailib |
Malicious release: Malicious code in illusion-datalab (npm) GHSA-834w-x8gq-8rmx, MAL-2026-17423 | Malicious | Not scored | 01 Oct, 2026 | npm illusion-datalab |
Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description CVE-2026-51886, GHSA-w584-2h2r-2hvf, PYSEC-2026-4236 | Critical | 0.6% | 01 Oct, 2026 | PyPI langflow |
figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width CVE-2026-96780, GHSA-62ch-8vmq-8xm7 | High | 0.5% | 01 Oct, 2026 | npm figlet |
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects CVE-2026-104183, GHSA-mjw6-4jj6-33hc | Medium | 0.2% | 01 Oct, 2026 | npm stream-json |
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk CVE-2026-104182, GHSA-hqr4-qq8f-hg3x | Medium | 0.2% | 01 Oct, 2026 | npm stream-json |
Filament: Multi-factor authentication (app) management actions do not require password reauthentication CVE-2026-104181, GHSA-7m6h-rg42-m449 | Medium | 0.3% | 01 Oct, 2026 | Packagist filament/filament |
Malicious release: Malicious code in shortneer (PyPI) MAL-2026-17422 | Malicious | Not scored | 01 Oct, 2026 | PyPI shortneer |
Fortinet FortiMail Path Traversal Vulnerability CVE-2026-104286 | CriticalExploited | 4.6% | 01 Oct, 2026 | |
Malicious release: Malicious code in spo365-graph (PyPI) MAL-2026-17421 | Malicious | Not scored | 01 Oct, 2026 | PyPI spo365-graph |
KaTeX: Existing prototype pollution can bypass trust restrictions CVE-2026-103923, GHSA-238p-pmpm-9mq7 | Low | 0.3% | 01 Oct, 2026 | npm katex |
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path CVE-2026-103922, GHSA-rvm3-566m-v7fv | Critical | 0.3% | 01 Oct, 2026 | Maven com.capacitorjs:core SwiftURL github.com/ionic-team/capacitor-swift-pm npm @capacitor/android npm @capacitor/ios |
Zod can exhaust memory while validating oversized constrained collections CVE-2023-54404, GHSA-mrhx-c7xc-m3w5 | High | 0.3% | 01 Oct, 2026 | npm zod |
geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point CVE-2026-77387, GHSA-mhvh-fq92-pfmr, PYSEC-2026-4218 | Medium | 0.2% | 01 Oct, 2026 | PyPI geopy |
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor CVE-2026-103921, GHSA-6fw5-9hq8-w87g | High | 0.3% | 01 Oct, 2026 | npm @graphql-tools/executor-legacy-ws |
Malicious release: Malicious code in @kelvdra/baileys (npm) MAL-2026-17362 | Malicious | Not scored | 01 Oct, 2026 | npm @kelvdra/baileys |
Malicious release: Malicious code in @bottino/baileys (npm) GHSA-qg7r-f2jp-2mmx, MAL-2026-17351 | Malicious | Not scored | 01 Oct, 2026 | npm @bottino/baileys |
devalue: Residual sparse-array CPU amplification in uneval GHSA-hx4r-w6wj-j8fg | Medium | Not scored | 01 Oct, 2026 | npm devalue |
devalue: Repeated primitive strings cause quadratic expansion in uneval GHSA-mcm9-63f2-9j32 | High | Not scored | 01 Oct, 2026 | npm devalue |