Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG CVE-2026-61590, GHSA-8g2f-g3gq-5rjv, PYSEC-2026-4039 | High | 0.4% | 16 Sep, 2026 | PyPI djust |
Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Ka CVE-2026-86792, PYSEC-2026-3986 | High | 1.2% | 16 Sep, 2026 | PyPI apache-airflow-providers-apache-kafka |
fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses CVE-2026-92081, GHSA-4mh8-r7rc-xpvc | Medium | 0.4% | 16 Sep, 2026 | npm fastify |
Malicious release: Malicious code in process-mite (npm) MAL-2026-16224 | Malicious | Not scored | 16 Sep, 2026 | npm process-mite |
Malicious release: Malicious code in licloud (PyPI) MAL-2026-16219 | Malicious | Not scored | 16 Sep, 2026 | PyPI licloud |
Malicious release: Malicious code in discord-resolvers (npm) GHSA-whmq-ffxc-4jpc, MAL-2026-16214 | Malicious | Not scored | 16 Sep, 2026 | npm discord-resolvers |
Malicious release: Malicious code in discord-players (npm) GHSA-mvg6-qj9g-3j3j, MAL-2026-16213 | Malicious | Not scored | 16 Sep, 2026 | npm discord-players |
Malicious release: Malicious code in tetomood (npm) MAL-2026-16216 | Malicious | Not scored | 16 Sep, 2026 | npm tetomood |
Malicious release: Malicious code in tetotest (npm) MAL-2026-16217 | Malicious | Not scored | 16 Sep, 2026 | npm tetotest |
Malicious release: Malicious code in engin1 (npm) MAL-2026-16215 | Malicious | Not scored | 16 Sep, 2026 | npm engin1 |
Malicious release: Malicious code in chai-as-agile (npm) MAL-2026-16207 | Malicious | Not scored | 16 Sep, 2026 | npm chai-as-agile |
Malicious release: Malicious code in strapi-plugin-pencc-meeb (npm) MAL-2026-16210 | Malicious | Not scored | 16 Sep, 2026 | npm strapi-plugin-pencc-meeb |
Malicious release: Malicious code in strapi-plugin-ccsuc-meeb (npm) MAL-2026-16209 | Malicious | Not scored | 16 Sep, 2026 | npm strapi-plugin-ccsuc-meeb |
Malicious release: Malicious code in otel-span-adapter (npm) MAL-2026-16208 | Malicious | Not scored | 16 Sep, 2026 | npm otel-span-adapter |
Malicious release: Malicious code in swnwall (npm) MAL-2026-16211 | Malicious | Not scored | 16 Sep, 2026 | npm swnwall |
Malicious release: Malicious code in @prime0/inimatch (npm) MAL-2026-16205 | Malicious | Not scored | 16 Sep, 2026 | npm @prime0/inimatch |
Malicious release: Malicious code in @prime0/pcomatch (npm) MAL-2026-16206 | Malicious | Not scored | 16 Sep, 2026 | npm @prime0/pcomatch |
Malicious release: Malicious code in @prime0/alanced-match (npm) MAL-2026-16204 | Malicious | Not scored | 16 Sep, 2026 | npm @prime0/alanced-match |
Malicious release: Malicious code in cli-anything-ai-market (PyPI) MAL-2026-16212 | Malicious | Not scored | 16 Sep, 2026 | PyPI cli-anything-ai-market |
Malicious release: Malicious code in jexkcode (npm) GHSA-j72h-3h5h-43v5, MAL-2026-16220 | Malicious | Not scored | 16 Sep, 2026 | npm jexkcode |
Malicious release: Malicious code in kartykp-prod-oidc-test-pkg (npm) GHSA-v7jq-fcmp-3w93, MAL-2026-16197 | Malicious | Not scored | 15 Sep, 2026 | npm kartykp-prod-oidc-test-pkg |
Malicious release: Malicious code in kartykp-token-pkg (npm) GHSA-6qx5-2w7p-cf29, MAL-2026-16198 | Malicious | Not scored | 15 Sep, 2026 | npm kartykp-token-pkg |
@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover CVE-2026-61560, GHSA-cv3r-c5h8-f4g5 | Critical | 2.9% | 15 Sep, 2026 | npm @zereight/mcp-gitlab |
adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0 CVE-2026-92000, GHSA-rcw4-f5rp-g42v | High | 0.7% | 15 Sep, 2026 | npm adm-zip |
@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery CVE-2026-61559, GHSA-2h44-8472-frjj | Critical | 0.4% | 15 Sep, 2026 | npm @zereight/mcp-gitlab |
@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport CVE-2026-61568, GHSA-vmp7-252j-cwp7 | Critical | 0.5% | 15 Sep, 2026 | npm @zereight/mcp-gitlab |
@zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS GHSA-5648-rgj9-v224 | High | Not scored | 15 Sep, 2026 | npm @zereight/mcp-gitlab |
Malicious release: Malicious code in tol8t (npm) MAL-2026-16218 | Malicious | Not scored | 15 Sep, 2026 | npm tol8t |
Google Pixel Improper Authorization Vulnerability CVE-2026-58704 | HighExploited | 0.6% | 15 Sep, 2026 | |
Malicious release: Malicious code in bender-rspack-config (npm) MAL-2026-16221 | Malicious | Not scored | 15 Sep, 2026 | npm bender-rspack-config |
Malicious release: Malicious code in chai-as-crack (npm) MAL-2026-16196 | Malicious | Not scored | 15 Sep, 2026 | npm chai-as-crack |
Malicious release: Malicious code in alkajsdfoiwqeusdflkjsdf (npm) MAL-2026-16174 | Malicious | Not scored | 15 Sep, 2026 | npm alkajsdfoiwqeusdflkjsdf |
Malicious release: Malicious code in fulfillment-cuprum-auth-widget (npm) MAL-2026-16176 | Malicious | Not scored | 15 Sep, 2026 | npm fulfillment-cuprum-auth-widget |
Malicious release: Malicious code in strapi-plugin-weccresh-meeb (npm) MAL-2026-16192 | Malicious | Not scored | 15 Sep, 2026 | npm strapi-plugin-weccresh-meeb |
Malicious release: Malicious code in process-tailwind (npm) MAL-2026-16179 | Malicious | Not scored | 15 Sep, 2026 | npm process-tailwind |
Malicious release: Malicious code in process-lhpm (npm) MAL-2026-16178 | Malicious | Not scored | 15 Sep, 2026 | npm process-lhpm |
Malicious release: Malicious code in strapi-plugin-uicc-meeb (npm) MAL-2026-16191 | Malicious | Not scored | 15 Sep, 2026 | npm strapi-plugin-uicc-meeb |
Malicious release: Malicious code in tailwind-forms-styles (npm) GHSA-q8wp-7xrg-83rx, MAL-2026-16195 | Malicious | Not scored | 15 Sep, 2026 | npm tailwind-forms-styles |
Malicious release: Malicious code in strapi-plugin-revs-meeb322k (npm) MAL-2026-16184 | Malicious | Not scored | 15 Sep, 2026 | npm strapi-plugin-revs-meeb322k |
Malicious release: Malicious code in strapi-plugin-yesccresh-meeb (npm) MAL-2026-16194 | Malicious | Not scored | 15 Sep, 2026 | npm strapi-plugin-yesccresh-meeb |
Malicious release: Malicious code in strapi-plugin-revsh-meeb322k (npm) MAL-2026-16187 | Malicious | Not scored | 15 Sep, 2026 | npm strapi-plugin-revsh-meeb322k |
Malicious release: Malicious code in strapi-plugin-sucresh-meeb (npm) MAL-2026-16189 | Malicious | Not scored | 15 Sep, 2026 | npm strapi-plugin-sucresh-meeb |
Malicious release: Malicious code in strapi-plugin-yayccresh-meeb (npm) MAL-2026-16193 | Malicious | Not scored | 15 Sep, 2026 | npm strapi-plugin-yayccresh-meeb |
Malicious release: Malicious code in strapi-plugin-revs02-meeb322k (npm) MAL-2026-16186 | Malicious | Not scored | 15 Sep, 2026 | npm strapi-plugin-revs02-meeb322k |
Malicious release: Malicious code in strapi-plugin-revs01-meeb322k (npm) MAL-2026-16185 | Malicious | Not scored | 15 Sep, 2026 | npm strapi-plugin-revs01-meeb322k |
Malicious release: Malicious code in strapi-plugin-proccresh-meeb (npm) MAL-2026-16182 | Malicious | Not scored | 15 Sep, 2026 | npm strapi-plugin-proccresh-meeb |
Malicious release: Malicious code in n8n-nodes-buildcheck (npm) MAL-2026-16177 | Malicious | Not scored | 15 Sep, 2026 | npm n8n-nodes-buildcheck |
Malicious release: Malicious code in strapi-plugin-resh-meeb322k (npm) MAL-2026-16183 | Malicious | Not scored | 15 Sep, 2026 | npm strapi-plugin-resh-meeb322k |
Malicious release: Malicious code in strapi-plugin-tryccresh-meeb (npm) MAL-2026-16190 | Malicious | Not scored | 15 Sep, 2026 | npm strapi-plugin-tryccresh-meeb |
Malicious release: Malicious code in strapi-plugin-rs-meeb322k (npm) MAL-2026-16188 | Malicious | Not scored | 15 Sep, 2026 | npm strapi-plugin-rs-meeb322k |