Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy CVE-2026-86996, GHSA-7hgx-277f-7vmg | Medium | 0.3% | 08 Sep, 2026 | npm n8n |
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain CVE-2026-92598, GHSA-wmmp-3585-3rmp | High | 0.4% | 08 Sep, 2026 | npm nodemailer |
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list CVE-2026-92596, GHSA-2x7j-588g-ccc2 | High | 0.8% | 08 Sep, 2026 | npm nodemailer |
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain CVE-2026-92597, GHSA-cc9r-2j5m-2m83 | High | 0.4% | 08 Sep, 2026 | npm nodemailer |
OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree GHSA-2q42-4q24-7rgv | High | Not scored | 08 Sep, 2026 | npm @typespec/compiler npm @typespec/openapi3 |
Astro: Remote code execution through AVIF image optimization GHSA-26w7-cxv4-gfx2 | Critical | Not scored | 08 Sep, 2026 | npm astro |
sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 CVE-2026-114112, GHSA-rgj7-g3m4-5g8c | High | 0.2% | 08 Sep, 2026 | npm sharp |
Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing GHSA-j95f-988m-3j2f | High | Not scored | 08 Sep, 2026 | npm @tiptap/core |
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used GHSA-2xp9-vwfh-vxw4 | Critical | Not scored | 08 Sep, 2026 | npm next |
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature CVE-2026-92595, GHSA-8m3c-c648-2xjj | Medium | 0.3% | 08 Sep, 2026 | npm nodemailer |
Malicious release: Malicious code in @aspect-adv-ui/consent-manager (npm) MAL-2026-16050 | Malicious | Not scored | 08 Sep, 2026 | npm @aspect-adv-ui/consent-manager |
Malicious release: Malicious code in @umschool/analytics (npm) MAL-2026-16051 | Malicious | Not scored | 08 Sep, 2026 | npm @umschool/analytics |
CakePHP: SmtpTransport vulnerable to CRLF header injection CVE-2026-119417, CVE-2026-77634, GHSA-2qh5-382h-3jpc | High | 0.5% | 08 Sep, 2026 | Packagist cakephp/cakephp |
ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability CVE-2026-84869 | CriticalExploited | 0.9% | 08 Sep, 2026 | |
Malicious release: Malicious code in tailwindcss-aspectratio-styles (npm) MAL-2026-16049 | Malicious | Not scored | 08 Sep, 2026 | npm tailwindcss-aspectratio-styles |
Malicious release: Malicious code in punypump (npm) MAL-2026-16048 | Malicious | Not scored | 08 Sep, 2026 | npm punypump |
n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content CVE-2026-86074, GHSA-q5wm-mgqx-fv2f | Medium | 0.4% | 08 Sep, 2026 | npm n8n |
Microsoft Windows Heap-Based Buffer Overflow Vulnerability CVE-2026-85880 | HighExploited | 0.4% | 08 Sep, 2026 | |
Microsoft Windows Link Following Vulnerability CVE-2026-81963 | HighExploited | 0.4% | 08 Sep, 2026 | |
n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution CVE-2026-86073, GHSA-cw9w-vv67-hf73 | Medium | 0.4% | 08 Sep, 2026 | npm n8n |
DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API CVE-2026-82533, GHSA-8m2g-8cgm-3vcp | Critical | 1.2% | 08 Sep, 2026 | npm @deepseek-ai/dsh-client-connection |
Malicious release: Malicious code in @usemosaik/template-react-js (npm) GHSA-8rcc-9ggm-659p, MAL-2026-16047 | Malicious | Not scored | 08 Sep, 2026 | npm @usemosaik/template-react-js |
Snowflake drivers writes sensitive information to logs CVE-2026-86597, GHSA-qqj6-54q6-cxv6, GO-2026-6665, PYSEC-2026-4301 | Medium | 0.1% | 08 Sep, 2026 | Go github.com/snowflakedb/gosnowflake Go github.com/snowflakedb/gosnowflake/v2 Maven net.snowflake:snowflake-jdbc Maven net.snowflake:snowflake-jdbc-fips +3 more |
Malicious release: Malicious code in i18nexus (npm) GHSA-38hw-f37p-99jj, MAL-2026-16045 | Malicious | Not scored | 08 Sep, 2026 | npm i18nexus |
Malicious release: Malicious code in i18nexus-tools (npm) GHSA-9cfw-xh4g-cc2f, MAL-2026-16046 | Malicious | Not scored | 08 Sep, 2026 | npm i18nexus-tools |
Malicious release: Malicious code in @web2apk/baileys (npm) GHSA-f4f2-cqqp-jcrx, MAL-2026-16043 | Malicious | Not scored | 08 Sep, 2026 | npm @web2apk/baileys |
Malicious release: Malicious code in krdpass-auth-react-native (npm) GHSA-3j7p-44mj-76hx, MAL-2026-16042 | Malicious | Not scored | 08 Sep, 2026 | npm krdpass-auth-react-native |
@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP) CVE-2026-76969, GHSA-955m-rr6m-2f9v | Critical | 0.4% | 08 Sep, 2026 | npm @sap/cds-mtxs |
Malicious release: Malicious code in plogme (npm) MAL-2026-16199 | Malicious | Not scored | 08 Sep, 2026 | npm plogme |
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json CVE-2026-86540, GHSA-mc52-mwq4-vfx3 | High | 0.2% | 07 Sep, 2026 | npm knowns |
Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools CVE-2026-86439, GHSA-9gfj-28hw-jchp | High | 1.1% | 07 Sep, 2026 | npm knowns |
Malicious release: Malicious code in telegram-helper (PyPI) MAL-2026-16017 | Malicious | Not scored | 07 Sep, 2026 | PyPI telegram-helper |
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability CVE-2026-75650 | CriticalExploited | 3.9% | 07 Sep, 2026 | |
Malicious release: Malicious code in cv-train (PyPI) MAL-2026-16016 | Malicious | Not scored | 07 Sep, 2026 | PyPI cv-train |
Malicious release: Malicious code in @cp-shared-14/frontend-ui (npm) MAL-2026-16015 | Malicious | Not scored | 07 Sep, 2026 | npm @cp-shared-14/frontend-ui |
Malicious release: Malicious code in @aircanada/navigation-handler (npm) GHSA-356v-pcf2-7958, MAL-2026-16020 | Malicious | Not scored | 07 Sep, 2026 | npm @aircanada/navigation-handler |
Malicious release: Malicious code in @aircanada/core (npm) GHSA-46mp-56rw-qpmm, MAL-2026-16019 | Malicious | Not scored | 07 Sep, 2026 | npm @aircanada/core |
Malicious release: Malicious code in @aircanada/components (npm) GHSA-w6c3-rrw8-wxrx, MAL-2026-16018 | Malicious | Not scored | 07 Sep, 2026 | npm @aircanada/components |
Malicious release: Malicious code in @idkruan-10/dpd-depconf-probe (npm) GHSA-994q-v55m-r2mw, MAL-2026-16021 | Malicious | Not scored | 07 Sep, 2026 | npm @idkruan-10/dpd-depconf-probe |
Malicious release: Malicious code in op-ts-server-core (npm) GHSA-cj4c-268v-m597, MAL-2026-16034 | Malicious | Not scored | 07 Sep, 2026 | npm op-ts-server-core |
Malicious release: Malicious code in service-home (npm) GHSA-m2c9-2v7c-fxf9, MAL-2026-16039 | Malicious | Not scored | 07 Sep, 2026 | npm service-home |
Malicious release: Malicious code in redis-type-intel (npm) GHSA-v9rh-vg7p-gwqm, MAL-2026-16036 | Malicious | Not scored | 07 Sep, 2026 | npm redis-type-intel |
Malicious release: Malicious code in oscar-redis (npm) GHSA-c6m6-wr2f-6f63, MAL-2026-16035 | Malicious | Not scored | 07 Sep, 2026 | npm oscar-redis |
Malicious release: Malicious code in kiki-baileys (npm) GHSA-g8cr-3r7q-pcr6, MAL-2026-16033 | Malicious | Not scored | 07 Sep, 2026 | npm kiki-baileys |
Malicious release: Malicious code in bmc-i18n-extract-cli (npm) GHSA-327g-rcr8-hp3p, MAL-2026-16025 | Malicious | Not scored | 07 Sep, 2026 | npm bmc-i18n-extract-cli |
Malicious release: Malicious code in bmc-translate-utils (npm) GHSA-997w-vpm2-ww7x, MAL-2026-16026 | Malicious | Not scored | 07 Sep, 2026 | npm bmc-translate-utils |
Malicious release: Malicious code in blueai-cli (npm) GHSA-c2v5-8c2f-jj54, MAL-2026-16024 | Malicious | Not scored | 07 Sep, 2026 | npm blueai-cli |
Malicious release: Malicious code in feishu-docx-mcp (npm) GHSA-q5c6-p5q5-g3px, MAL-2026-16032 | Malicious | Not scored | 07 Sep, 2026 | npm feishu-docx-mcp |
Malicious release: Malicious code in scw-mobile (npm) GHSA-h9g8-rwcg-hpmh, MAL-2026-16038 | Malicious | Not scored | 07 Sep, 2026 | npm scw-mobile |
Malicious release: Malicious code in base-account-core (npm) GHSA-vgm8-2vf8-769j, MAL-2026-16022 | Malicious | Not scored | 07 Sep, 2026 | npm base-account-core |