Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost CVE-2026-88974, GHSA-5mmc-8pc9-wggg | Medium | 0.4% | 23 Sep, 2026 | Packagist wp-graphql/wp-graphql |
Malicious release: Malicious code in simplenewnpmpackage (npm) MAL-2026-16479 | Malicious | Not scored | 23 Sep, 2026 | npm simplenewnpmpackage |
Malicious release: Malicious code in com.apple.unityplugin.storekit (npm) GHSA-xcvv-h724-8jw8, MAL-2026-16477 | Malicious | Not scored | 23 Sep, 2026 | npm com.apple.unityplugin.storekit |
REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates CVE-2026-63000, GHSA-m8r3-22v6-g877 | Medium | 0.1% | 23 Sep, 2026 | Packagist redaxo/source |
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames CVE-2026-63002, GHSA-w998-qmw9-mf4m | Medium | 0.2% | 23 Sep, 2026 | Packagist redaxo/source |
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()` CVE-2026-63001, GHSA-mf2p-wjp4-99pq | Medium | 0.2% | 23 Sep, 2026 | Packagist redaxo/source |
Malicious release: Malicious code in sea-baileys (npm) MAL-2026-16473 | Malicious | Not scored | 23 Sep, 2026 | npm sea-baileys |
Malicious release: Malicious code in vite-dev-launcher (npm) MAL-2026-16474 | Malicious | Not scored | 23 Sep, 2026 | npm vite-dev-launcher |
Malicious release: Malicious code in @test1230504/probe-7f3k2m-utils (npm) GHSA-3qx9-8g8p-4mcj, MAL-2026-16467 | Malicious | Not scored | 23 Sep, 2026 | npm @test1230504/probe-7f3k2m-utils |
Malicious release: Malicious code in @test1230504/string-format-helper (npm) GHSA-9572-4cpv-x2hp, MAL-2026-16468 | Malicious | Not scored | 23 Sep, 2026 | npm @test1230504/string-format-helper |
Malicious release: Malicious code in @test1230504/test-publish-verify (npm) GHSA-7m76-mq85-8c7w, MAL-2026-16469 | Malicious | Not scored | 23 Sep, 2026 | npm @test1230504/test-publish-verify |
Malicious release: Malicious code in z-deno-truth-va499w (npm) GHSA-76wq-hx78-mw6x, MAL-2026-16471 | Malicious | Not scored | 23 Sep, 2026 | npm z-deno-truth-va499w |
Malicious release: Malicious code in z-deno-truth-ya1t4m (npm) GHSA-qff9-mw3p-hg4c, MAL-2026-16472 | Malicious | Not scored | 23 Sep, 2026 | npm z-deno-truth-ya1t4m |
Malicious release: Malicious code in z-deno-truth-bwhlsz (npm) GHSA-f8xr-gjfq-xfcp, MAL-2026-16470 | Malicious | Not scored | 23 Sep, 2026 | npm z-deno-truth-bwhlsz |
Malicious release: Malicious code in hachutis (npm) MAL-2026-16464 | Malicious | Not scored | 23 Sep, 2026 | npm hachutis |
Malicious release: Malicious code in helpersutils-dev-tools (npm) GHSA-w2cw-5p4p-mc64, MAL-2026-16465 | Malicious | Not scored | 23 Sep, 2026 | npm helpersutils-dev-tools |
Malicious release: Malicious code in godxxx (npm) MAL-2026-16461 | Malicious | Not scored | 23 Sep, 2026 | npm godxxx |
Malicious release: Malicious code in godzz (npm) MAL-2026-16462 | Malicious | Not scored | 23 Sep, 2026 | npm godzz |
Malicious release: Malicious code in godzzz (npm) MAL-2026-16463 | Malicious | Not scored | 23 Sep, 2026 | npm godzzz |
Malicious release: Malicious code in some-tool-package (npm) GHSA-55vw-cpj6-w7w8, MAL-2026-16455 | Malicious | Not scored | 23 Sep, 2026 | npm some-tool-package |
Malicious release: Malicious code in better-md (npm) GHSA-r4h9-57fh-5fj3, MAL-2026-16446 | Malicious | Not scored | 23 Sep, 2026 | npm better-md |
Malicious release: Malicious code in iso-datetime-core (npm) GHSA-fc7h-qf7q-qxw4, MAL-2026-16449 | Malicious | Not scored | 23 Sep, 2026 | npm iso-datetime-core |
Malicious release: Malicious code in debounce-throttle-base (npm) GHSA-g9m6-qcpw-g96x, MAL-2026-16448 | Malicious | Not scored | 23 Sep, 2026 | npm debounce-throttle-base |
Malicious release: Malicious code in webp-https-errors (npm) GHSA-gmm9-q3gf-4hfr, MAL-2026-16459 | Malicious | Not scored | 23 Sep, 2026 | npm webp-https-errors |
Malicious release: Malicious code in solo-async-pipe (npm) GHSA-j96p-xm58-6233, MAL-2026-16454 | Malicious | Not scored | 23 Sep, 2026 | npm solo-async-pipe |
Malicious release: Malicious code in semver-bump-io (npm) GHSA-m877-5x7f-7r88, MAL-2026-16453 | Malicious | Not scored | 23 Sep, 2026 | npm semver-bump-io |
Malicious release: Malicious code in moudeva (npm) MAL-2026-16442 | Malicious | Not scored | 23 Sep, 2026 | npm moudeva |
Malicious release: Malicious code in moidevl (npm) MAL-2026-16441 | Malicious | Not scored | 23 Sep, 2026 | npm moidevl |
Malicious release: Malicious code in caphsmgiwy (npm) GHSA-35mc-7f44-62rg, MAL-2026-16447 | Malicious | Not scored | 23 Sep, 2026 | npm caphsmgiwy |
Malicious release: Malicious code in tuxcmdfhjkw (npm) GHSA-67q5-w9wg-mvvv, MAL-2026-16458 | Malicious | Not scored | 23 Sep, 2026 | npm tuxcmdfhjkw |
Malicious release: Malicious code in xsjukcnv8low26 (npm) GHSA-6g8g-gw7h-prch, MAL-2026-16460 | Malicious | Not scored | 23 Sep, 2026 | npm xsjukcnv8low26 |
Malicious release: Malicious code in luftzxyuiwgbgsp (npm) GHSA-cppx-756q-g98p, MAL-2026-16451 | Malicious | Not scored | 23 Sep, 2026 | npm luftzxyuiwgbgsp |
Malicious release: Malicious code in mob4zchvuine (npm) GHSA-f232-pcw4-j7qg, MAL-2026-16452 | Malicious | Not scored | 23 Sep, 2026 | npm mob4zchvuine |
Malicious release: Malicious code in tib2jcvowuyma (npm) GHSA-hqgj-c9q6-8qv8, MAL-2026-16456 | Malicious | Not scored | 23 Sep, 2026 | npm tib2jcvowuyma |
Malicious release: Malicious code in kamafhbnowct (npm) GHSA-j87m-pgqx-mpg5, MAL-2026-16450 | Malicious | Not scored | 23 Sep, 2026 | npm kamafhbnowct |
Malicious release: Malicious code in tibcwmpoeafh (npm) GHSA-vcg8-c5h2-55w6, MAL-2026-16457 | Malicious | Not scored | 23 Sep, 2026 | npm tibcwmpoeafh |
Malicious release: Malicious code in n8n-nodes-healthmon (npm) MAL-2026-16444 | Malicious | Not scored | 23 Sep, 2026 | npm n8n-nodes-healthmon |
Malicious release: Malicious code in n8n-nodes-metricsagent (npm) MAL-2026-16445 | Malicious | Not scored | 23 Sep, 2026 | npm n8n-nodes-metricsagent |
Malicious release: Malicious code in my-company-device (npm) MAL-2026-16443 | Malicious | Not scored | 23 Sep, 2026 | npm my-company-device |
Malicious release: Malicious code in internallib_v550 (npm) MAL-2026-16439 | Malicious | Not scored | 23 Sep, 2026 | npm internallib_v550 |
Malicious release: Malicious code in turbo-ws (npm) GHSA-3933-m2c5-xfm8, MAL-2026-16440 | Malicious | Not scored | 23 Sep, 2026 | npm turbo-ws |
Malicious release: Malicious code in internallib_v497 (npm) GHSA-94q5-67r5-mwjx, MAL-2026-16438 | Malicious | Not scored | 23 Sep, 2026 | npm internallib_v497 |
Malicious release: Malicious code in catplatebarcodeparser (npm) MAL-2026-16434 | Malicious | Not scored | 23 Sep, 2026 | npm catplatebarcodeparser |
Malicious release: Malicious code in catqrcodeconverter (npm) MAL-2026-16435 | Malicious | Not scored | 23 Sep, 2026 | npm catqrcodeconverter |
Malicious release: Malicious code in eslint-plugin-i18n-shreddit (npm) MAL-2026-16437 | Malicious | Not scored | 23 Sep, 2026 | npm eslint-plugin-i18n-shreddit |
Malicious release: Malicious code in efhthrthrthregerht (npm) MAL-2026-16436 | Malicious | Not scored | 23 Sep, 2026 | npm efhthrthrthregerht |
Malicious release: Malicious code in @vitemirrorte/element-plus-vite-cli (npm) MAL-2026-16433 | Malicious | Not scored | 23 Sep, 2026 | npm @vitemirrorte/element-plus-vite-cli |
Malicious release: Malicious code in @wizloft/harness-file-providers (npm) GHSA-2jrv-g43f-qm7f, MAL-2026-16427 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-file-providers |
Malicious release: Malicious code in @wizloft/harness-commands (npm) GHSA-cv26-mq7q-h5hq, MAL-2026-16425 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-commands |
Malicious release: Malicious code in @wizloft/harness-cli-adapter (npm) GHSA-hmmw-27v2-3qc8, MAL-2026-16424 | Malicious | Not scored | 23 Sep, 2026 | npm @wizloft/harness-cli-adapter |