Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function CVE-2026-85725, GHSA-c759-cx9p-mrwq, PYSEC-2026-4061 | Medium | 0.4% | 22 Sep, 2026 | PyPI lightrag-hku |
lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses CVE-2026-85709, GHSA-hrmj-7rvj-4hg8, PYSEC-2026-4063 | Medium | 0.4% | 22 Sep, 2026 | PyPI lightrag-hku |
Malicious release: Malicious code in @yuva2210/okx-poc-preinstall (npm) MAL-2026-16531 | Malicious | Not scored | 22 Sep, 2026 | npm @yuva2210/okx-poc-preinstall |
Malicious release: Malicious code in @yuva2210/poc-depconf (npm) MAL-2026-16532 | Malicious | Not scored | 22 Sep, 2026 | npm @yuva2210/poc-depconf |
Malicious release: Malicious code in @ssgw/background-transition (npm) MAL-2026-16530 | Malicious | Not scored | 22 Sep, 2026 | npm @ssgw/background-transition |
Malicious release: Malicious code in @larocas-bbresearch/tp-probe-e29834ce (npm) MAL-2026-16529 | Malicious | Not scored | 22 Sep, 2026 | npm @larocas-bbresearch/tp-probe-e29834ce |
Malicious release: Malicious code in @larocas-bbresearch/tombstone-probe-odvz5y (npm) MAL-2026-16527 | Malicious | Not scored | 22 Sep, 2026 | npm @larocas-bbresearch/tombstone-probe-odvz5y |
Malicious release: Malicious code in @larocas-bbresearch/tp-probe-dc7a3670 (npm) MAL-2026-16528 | Malicious | Not scored | 22 Sep, 2026 | npm @larocas-bbresearch/tp-probe-dc7a3670 |
Malicious release: Malicious code in @larocas-bbresearch/tombstone-probe-live-z6xz56 (npm) MAL-2026-16526 | Malicious | Not scored | 22 Sep, 2026 | npm @larocas-bbresearch/tombstone-probe-live-z6xz56 |
Malicious release: Malicious code in @larocas-bbresearch/tombstone-probe-8ejnsa (npm) MAL-2026-16525 | Malicious | Not scored | 22 Sep, 2026 | npm @larocas-bbresearch/tombstone-probe-8ejnsa |
Malicious release: Malicious code in @ks-cqc/fingerprint-generator (npm) MAL-2026-16523 | Malicious | Not scored | 22 Sep, 2026 | npm @ks-cqc/fingerprint-generator |
Malicious release: Malicious code in @ks-cqc/h5-sig4 (npm) MAL-2026-16524 | Malicious | Not scored | 22 Sep, 2026 | npm @ks-cqc/h5-sig4 |
Malicious release: Malicious code in @egencia/uitk-react-text (npm) MAL-2026-16522 | Malicious | Not scored | 22 Sep, 2026 | npm @egencia/uitk-react-text |
Malicious release: Malicious code in @egencia/uitk-react-spacing (npm) MAL-2026-16521 | Malicious | Not scored | 22 Sep, 2026 | npm @egencia/uitk-react-spacing |
Malicious release: Malicious code in @egencia/uitk-react-foundation (npm) MAL-2026-16519 | Malicious | Not scored | 22 Sep, 2026 | npm @egencia/uitk-react-foundation |
Malicious release: Malicious code in @egencia/uitk-react-layout-flex (npm) MAL-2026-16520 | Malicious | Not scored | 22 Sep, 2026 | npm @egencia/uitk-react-layout-flex |
Malicious release: Malicious code in @egencia/uitk-global-styles-6 (npm) MAL-2026-16517 | Malicious | Not scored | 22 Sep, 2026 | npm @egencia/uitk-global-styles-6 |
Malicious release: Malicious code in @egencia/uitk-react (npm) MAL-2026-16518 | Malicious | Not scored | 22 Sep, 2026 | npm @egencia/uitk-react |
Malicious release: Malicious code in @egencia/uitk-global-styles (npm) MAL-2026-16516 | Malicious | Not scored | 22 Sep, 2026 | npm @egencia/uitk-global-styles |
Malicious release: Malicious code in @egencia/design-tokens (npm) MAL-2026-16515 | Malicious | Not scored | 22 Sep, 2026 | npm @egencia/design-tokens |
Malicious release: Malicious code in @client-web-next/utils (npm) MAL-2026-16514 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/utils |
Malicious release: Malicious code in @client-web-next/ui (npm) MAL-2026-16512 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/ui |
Malicious release: Malicious code in @client-web-next/ui-business (npm) MAL-2026-16513 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/ui-business |
Malicious release: Malicious code in @client-web-next/transfer-state (npm) MAL-2026-16510 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/transfer-state |
Malicious release: Malicious code in @client-web-next/ua-parser (npm) MAL-2026-16511 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/ua-parser |
Malicious release: Malicious code in @client-web-next/tarjeta-button (npm) MAL-2026-16508 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/tarjeta-button |
Malicious release: Malicious code in @client-web-next/timer (npm) MAL-2026-16509 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/timer |
Malicious release: Malicious code in @client-web-next/origination-microfront (npm) MAL-2026-16506 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/origination-microfront |
Malicious release: Malicious code in @client-web-next/providers (npm) MAL-2026-16507 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/providers |
Malicious release: Malicious code in @client-web-next/logger (npm) MAL-2026-16504 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/logger |
Malicious release: Malicious code in @client-web-next/navigation-link (npm) MAL-2026-16505 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/navigation-link |
Malicious release: Malicious code in @client-web-next/footer (npm) MAL-2026-16502 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/footer |
Malicious release: Malicious code in @client-web-next/icons (npm) MAL-2026-16503 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/icons |
Malicious release: Malicious code in @client-web-next/feature-flags (npm) MAL-2026-16501 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/feature-flags |
Malicious release: Malicious code in @client-web-next/env-util (npm) MAL-2026-16499 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/env-util |
Malicious release: Malicious code in @client-web-next/event-bus-listener (npm) MAL-2026-16500 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/event-bus-listener |
Malicious release: Malicious code in @client-web-next/api-metrics (npm) MAL-2026-16497 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/api-metrics |
Malicious release: Malicious code in @client-web-next/cms (npm) MAL-2026-16498 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/cms |
Malicious release: Malicious code in @client-web-next/analytics (npm) MAL-2026-16496 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/analytics |
Malicious release: Malicious code in @client-web-next/ab-tests (npm) MAL-2026-16494 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/ab-tests |
Malicious release: Malicious code in @client-web-next/adaptive (npm) MAL-2026-16495 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/adaptive |
Malicious release: Malicious code in @client-web-next/ab-landing-form (npm) MAL-2026-16493 | Malicious | Not scored | 22 Sep, 2026 | npm @client-web-next/ab-landing-form |
Malicious release: Malicious code in @cartradetech/example-package (npm) MAL-2026-16492 | Malicious | Not scored | 22 Sep, 2026 | npm @cartradetech/example-package |
Malicious release: Malicious code in @adominadmininstr/fmt-date-helper (npm) MAL-2026-16491 | Malicious | Not scored | 22 Sep, 2026 | npm @adominadmininstr/fmt-date-helper |
Malicious release: Malicious code in @adominadmininstr/date-util-helper (npm) MAL-2026-16490 | Malicious | Not scored | 22 Sep, 2026 | npm @adominadmininstr/date-util-helper |
9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header CVE-2026-56682, GHSA-32gc-64m7-hj7v | Medium | 0.5% | 22 Sep, 2026 | npm 9router |
Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme CVE-2026-75510, GHSA-8gr3-5j6f-25gp | Medium | 0.5% | 22 Sep, 2026 | npm @novu/js |
9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header CVE-2026-56681, GHSA-5mj8-gf6m-fhw8 | High | 1.1% | 22 Sep, 2026 | npm 9router |
Malicious release: Malicious code in @mikudeveloper/baileys (npm) GHSA-2xx9-x9v7-25x2, MAL-2026-16386 | Malicious | Not scored | 22 Sep, 2026 | npm @mikudeveloper/baileys |
Malicious release: Malicious code in @mr-supun-fernando/supunmd-bail (npm) MAL-2026-16387 | Malicious | Not scored | 22 Sep, 2026 | npm @mr-supun-fernando/supunmd-bail |