Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in strapi-plugin-plsresh-meeb (npm) MAL-2026-16181 | Malicious | Not scored | 15 Sep, 2026 | npm strapi-plugin-plsresh-meeb |
Malicious release: Malicious code in strapi-plugin-ccresh-meeb (npm) MAL-2026-16180 | Malicious | Not scored | 15 Sep, 2026 | npm strapi-plugin-ccresh-meeb |
Malicious release: Malicious code in csa-mfa (npm) MAL-2026-16175 | Malicious | Not scored | 15 Sep, 2026 | npm csa-mfa |
fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization CVE-2026-86818, GHSA-jvvf-x445-j334 | Medium | 0.3% | 15 Sep, 2026 | npm fast-uri |
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets CVE-2026-86472, GHSA-hrr3-gc8f-f4qj | Medium | 0.3% | 15 Sep, 2026 | npm fast-uri |
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet CVE-2026-90711, GHSA-jqcg-44mw-7w3h | Critical | 0.3% | 15 Sep, 2026 | npm proxy-addr |
moment vulnerable to Path Traversal via crafted non-string locale name CVE-2026-17495, GHSA-4p3w-j4w9-5jqw | Medium | 0.5% | 15 Sep, 2026 | npm moment |
Malicious release: Malicious code in n8n-nodes-sysdiag2 (npm) MAL-2026-16162 | Malicious | Not scored | 14 Sep, 2026 | npm n8n-nodes-sysdiag2 |
Malicious release: Malicious code in @yggbrasil/api (npm) GHSA-cmxv-8vgc-m43c, MAL-2026-16163 | Malicious | Not scored | 14 Sep, 2026 | npm @yggbrasil/api |
Malicious release: Malicious code in get-power (npm) GHSA-3g9w-hfq8-vr7p, MAL-2026-16156 | Malicious | Not scored | 14 Sep, 2026 | npm get-power |
ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade CVE-2026-59178, GHSA-rrxg-g2pf-6hh4, PYSEC-2026-4049 | Critical | 0.8% | 14 Sep, 2026 | PyPI esphome-device-builder |
Malicious release: Malicious code in afhmxiewpsf (npm) GHSA-59f6-ch49-395j, MAL-2026-16158 | Malicious | Not scored | 14 Sep, 2026 | npm afhmxiewpsf |
Malicious release: Malicious code in ultra-ws (npm) GHSA-rwhp-v7w5-c6cc, MAL-2026-16155 | Malicious | Not scored | 14 Sep, 2026 | npm ultra-ws |
Cisco Secure Email Gateway SQL Injection Vulnerability CVE-2026-76461 | CriticalExploited | 29.5% | 14 Sep, 2026 | |
October CMS: Incomplete Scheme Validation in Image Resizer CVE-2026-100909, GHSA-2xmm-m4wv-3fjh | Medium | 0.3% | 14 Sep, 2026 | Packagist october/october |
October CMS: PHP Object Injection via Backend Widget Session Storage CVE-2026-49400, GHSA-2ff2-mx52-q8wp | Low | 0.2% | 14 Sep, 2026 | Packagist october/system |
Malicious release: Malicious code in noblox-asset.js (npm) MAL-2026-16148 | Malicious | Not scored | 14 Sep, 2026 | npm noblox-asset.js |
Malicious release: Malicious code in postgreesqlhelper (npm) MAL-2026-16150 | Malicious | Not scored | 14 Sep, 2026 | npm postgreesqlhelper |
Malicious release: Malicious code in sql-limit-enforcer (npm) MAL-2026-16151 | Malicious | Not scored | 14 Sep, 2026 | npm sql-limit-enforcer |
Malicious release: Malicious code in n8n-nodes-sysdiag (npm) MAL-2026-16147 | Malicious | Not scored | 14 Sep, 2026 | npm n8n-nodes-sysdiag |
Malicious release: Malicious code in os-info-meeb322k (npm) MAL-2026-16149 | Malicious | Not scored | 14 Sep, 2026 | npm os-info-meeb322k |
Malicious release: Malicious code in strapi-plugin-os-info-meeb322k (npm) MAL-2026-16152 | Malicious | Not scored | 14 Sep, 2026 | npm strapi-plugin-os-info-meeb322k |
Malicious release: Malicious code in web-main (npm) MAL-2026-16153 | Malicious | Not scored | 14 Sep, 2026 | npm web-main |
Malicious release: Malicious code in @aiwfm/communitywfm.scripts.api (npm) MAL-2026-16146 | Malicious | Not scored | 14 Sep, 2026 | npm @aiwfm/communitywfm.scripts.api |
October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls CVE-2026-46696, GHSA-xv9m-fm3w-8w5x | Low | 0.3% | 14 Sep, 2026 | Packagist october/system |
Malicious release: Malicious code in concierge-sdk (npm) MAL-2026-16145 | Malicious | Not scored | 14 Sep, 2026 | npm concierge-sdk |
Malicious release: Malicious code in app-rrhh (npm) MAL-2026-16144 | Malicious | Not scored | 14 Sep, 2026 | npm app-rrhh |
Malicious release: Malicious code in meraz-project-tracker (npm) GHSA-54v8-j59m-366h, MAL-2026-16161 | Malicious | Not scored | 14 Sep, 2026 | npm meraz-project-tracker |
Malicious release: Malicious code in lpulogin (npm) GHSA-5823-3hg3-27v8, MAL-2026-16160 | Malicious | Not scored | 14 Sep, 2026 | npm lpulogin |
Malicious release: Malicious code in @merazmz/project-tracker (npm) GHSA-x98w-cqq8-v3q2, MAL-2026-16157 | Malicious | Not scored | 14 Sep, 2026 | npm @merazmz/project-tracker |
Malicious release: Malicious code in dilxztech (npm) GHSA-5wh2-j94m-rwpf, MAL-2026-16159 | Malicious | Not scored | 14 Sep, 2026 | npm dilxztech |
multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads CVE-2026-88932, GHSA-3pph-fpjx-jg34 | Medium | 0.5% | 14 Sep, 2026 | npm multer |
Malicious release: Malicious code in @biz44/process-runtime-utils (npm) MAL-2026-16171 | Malicious | Not scored | 14 Sep, 2026 | npm @biz44/process-runtime-utils |
Malicious release: Malicious code in @biz44/runtime-utils (npm) MAL-2026-16172 | Malicious | Not scored | 14 Sep, 2026 | npm @biz44/runtime-utils |
Malicious release: Malicious code in webpackbootstrap5 (npm) GHSA-2q27-vrr7-584g, MAL-2026-16201 | Malicious | Not scored | 14 Sep, 2026 | npm webpackbootstrap5 |
Malicious release: Malicious code in @zaka13/thing (npm) GHSA-fxc7-fpjq-q7vf, MAL-2026-16200 | Malicious | Not scored | 14 Sep, 2026 | npm @zaka13/thing |
Malicious release: Malicious code in pino-ulid (npm) MAL-2026-16154 | Malicious | Not scored | 14 Sep, 2026 | npm pino-ulid |
Malicious release: Malicious code in webpackbootstrapscripts (npm) MAL-2026-16202 | Malicious | Not scored | 14 Sep, 2026 | npm webpackbootstrapscripts |
Malicious release: Malicious code in faiss-cpu-avx512 (PyPI) MAL-2026-16203 | Malicious | Not scored | 14 Sep, 2026 | PyPI faiss-cpu-avx512 |
Malicious release: Malicious code in chroma-client (PyPI) MAL-2026-16143 | Malicious | Not scored | 13 Sep, 2026 | PyPI chroma-client |
Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser) CVE-2026-90776, GHSA-prgh-xp8r-p3m5 | High | 0.7% | 13 Sep, 2026 | npm nodemailer |
joi messages compilation allows prototype replacement through __proto__ error codes CVE-2026-90771, GHSA-wr44-6hxh-3jwq | Medium | 0.4% | 13 Sep, 2026 | npm joi |
Malicious release: Malicious code in @biz44/id79-client (npm) MAL-2026-16168 | Malicious | Not scored | 12 Sep, 2026 | npm @biz44/id79-client |
Malicious release: Malicious code in @biz44/id12-client (npm) MAL-2026-16166 | Malicious | Not scored | 12 Sep, 2026 | npm @biz44/id12-client |
Malicious release: Malicious code in @biz44/id10-client (npm) MAL-2026-16165 | Malicious | Not scored | 12 Sep, 2026 | npm @biz44/id10-client |
Malicious release: Malicious code in @biz44/id95-client (npm) MAL-2026-16169 | Malicious | Not scored | 12 Sep, 2026 | npm @biz44/id95-client |
Malicious release: Malicious code in @biz44/id99-client (npm) MAL-2026-16170 | Malicious | Not scored | 12 Sep, 2026 | npm @biz44/id99-client |
Malicious release: Malicious code in id79-client (npm) MAL-2026-16173 | Malicious | Not scored | 12 Sep, 2026 | npm id79-client |
vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with CVE-2026-90553, GHSA-3c86-2m5g-59q7, PYSEC-2026-3985 | High | 0.3% | 12 Sep, 2026 | PyPI vllm |
Malicious release: Malicious code in python-fork (PyPI) MAL-2026-16142 | Malicious | Not scored | 12 Sep, 2026 | PyPI python-fork |