Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
undici vulnerable to caching and replay of unsafe HTTP method responses CVE-2026-85008, GHSA-8436-99hf-9mmv | Medium | 0.1% | 04 Sep, 2026 | npm undici |
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool CVE-2026-84961, GHSA-w293-vg96-wgc3 | Critical | 0.2% | 04 Sep, 2026 | npm undici |
undici vulnerable to response truncation via oversized chunked responses in the dump interceptor CVE-2026-84947, GHSA-2gqq-gqf2-x968 | Medium | 0.2% | 04 Sep, 2026 | npm undici |
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches CVE-2026-84933, GHSA-2jfj-6hjv-fm6j | High | 0.3% | 04 Sep, 2026 | npm undici |
smol-toml: Denial of Service via malformed TOML documents CVE-2026-85730, GHSA-7w5x-hrqm-74c2 | High | 0.5% | 04 Sep, 2026 | npm smol-toml |
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write) CVE-2026-85651, GHSA-qxpp-qjg8-x4jv | High | 0.5% | 04 Sep, 2026 | npm trigger.dev |
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL CVE-2026-85650, GHSA-xxv7-2vv3-h682 | High | 0.3% | 04 Sep, 2026 | npm trigger.dev |
Malicious release: Malicious code in olympuslib (PyPI) MAL-2026-15928 | Malicious | Not scored | 04 Sep, 2026 | PyPI olympuslib |
Malicious release: Malicious code in pymaas (PyPI) MAL-2026-15929 | Malicious | Not scored | 04 Sep, 2026 | PyPI pymaas |
Malicious release: Malicious code in tpu-raiden-jax (PyPI) MAL-2026-15930 | Malicious | Not scored | 04 Sep, 2026 | PyPI tpu-raiden-jax |
Malicious release: Malicious code in @crysnovax/baileys-fixed (npm) GHSA-262v-p7h8-9574, MAL-2026-15944 | Malicious | Not scored | 04 Sep, 2026 | npm @crysnovax/baileys-fixed |
Malicious release: Malicious code in @crysnovax/baileys-stable (npm) GHSA-p579-542j-6v98, MAL-2026-15945 | Malicious | Not scored | 04 Sep, 2026 | npm @crysnovax/baileys-stable |
Malicious release: Malicious code in @crysnovax/plug (npm) GHSA-vg98-2r8g-7qw2, MAL-2026-15946 | Malicious | Not scored | 04 Sep, 2026 | npm @crysnovax/plug |
fastify vulnerable to header validation bypass via incomplete schema case normalization CVE-2026-84428, GHSA-9q9j-q6p8-xq58 | High | 0.5% | 04 Sep, 2026 | npm fastify |
Malicious release: Malicious code in qoeoe (PyPI) MAL-2026-15927 | Malicious | Not scored | 04 Sep, 2026 | PyPI qoeoe |
Malicious release: Malicious code in astlsi (PyPI) MAL-2026-15926 | Malicious | Not scored | 04 Sep, 2026 | PyPI astlsi |
fastify vulnerable to request body replacement via an async validation result collision CVE-2026-84504, GHSA-667r-xxjv-c9mm | High | 0.4% | 04 Sep, 2026 | npm fastify |
fastify vulnerable to request validation bypass via skipped boolean false schemas CVE-2026-84469, GHSA-hwr6-493r-vm6h | High | 0.5% | 04 Sep, 2026 | npm fastify |
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers CVE-2026-76169, GHSA-p68q-wchp-6fh7 | High | 0.5% | 04 Sep, 2026 | npm fastify |
Malicious release: Malicious code in tailwind-contact-forms (npm) MAL-2026-15925 | Malicious | Not scored | 04 Sep, 2026 | npm tailwind-contact-forms |
Malicious release: Malicious code in box-sign-client-poc (npm) MAL-2026-15921 | Malicious | Not scored | 04 Sep, 2026 | npm box-sign-client-poc |
Malicious release: Malicious code in box-sign-client (npm) MAL-2026-15920 | Malicious | Not scored | 04 Sep, 2026 | npm box-sign-client |
Malicious release: Malicious code in claude-channel-discord (npm) MAL-2026-15922 | Malicious | Not scored | 04 Sep, 2026 | npm claude-channel-discord |
Malicious release: Malicious code in real-router-telemetry (npm) MAL-2026-15924 | Malicious | Not scored | 04 Sep, 2026 | npm real-router-telemetry |
Malicious release: Malicious code in line-through (npm) MAL-2026-15923 | Malicious | Not scored | 04 Sep, 2026 | npm line-through |
Malicious release: Malicious code in taskforge-9xv (npm) MAL-2026-15914 | Malicious | Not scored | 04 Sep, 2026 | npm taskforge-9xv |
Malicious release: Malicious code in taskforge-8xv (npm) MAL-2026-15913 | Malicious | Not scored | 04 Sep, 2026 | npm taskforge-8xv |
Malicious release: Malicious code in text-transform-plus (npm) MAL-2026-15915 | Malicious | Not scored | 04 Sep, 2026 | npm text-transform-plus |
Malicious release: Malicious code in tailwind-aspect (npm) MAL-2026-15912 | Malicious | Not scored | 04 Sep, 2026 | npm tailwind-aspect |
Malicious release: Malicious code in 2nestjs (npm) MAL-2026-15911 | Malicious | Not scored | 04 Sep, 2026 | npm 2nestjs |
Malicious release: Malicious code in xcryption (npm) MAL-2026-15916 | Malicious | Not scored | 04 Sep, 2026 | npm xcryption |
Malicious release: Malicious code in timeweave (PyPI) MAL-2026-15910 | Malicious | Not scored | 04 Sep, 2026 | PyPI timeweave |
Malicious release: Malicious code in net-util-y8 (npm) MAL-2026-15901 | Malicious | Not scored | 04 Sep, 2026 | npm net-util-y8 |
Malicious release: Malicious code in easypanel-ctl (npm) MAL-2026-15898 | Malicious | Not scored | 04 Sep, 2026 | npm easypanel-ctl |
Malicious release: Malicious code in tailwindcss-3d-styles (npm) MAL-2026-15905 | Malicious | Not scored | 04 Sep, 2026 | npm tailwindcss-3d-styles |
Malicious release: Malicious code in easypanel-core (npm) MAL-2026-15897 | Malicious | Not scored | 04 Sep, 2026 | npm easypanel-core |
Malicious release: Malicious code in easypanel-client (npm) MAL-2026-15896 | Malicious | Not scored | 04 Sep, 2026 | npm easypanel-client |
Malicious release: Malicious code in easypanel-app (npm) MAL-2026-15895 | Malicious | Not scored | 04 Sep, 2026 | npm easypanel-app |
Malicious release: Malicious code in easypanel-docker (npm) MAL-2026-15899 | Malicious | Not scored | 04 Sep, 2026 | npm easypanel-docker |
Malicious release: Malicious code in tailwindcss-animate-styles (npm) MAL-2026-15906 | Malicious | Not scored | 04 Sep, 2026 | npm tailwindcss-animate-styles |
Malicious release: Malicious code in peertube-plugin-video-views-counter (npm) MAL-2026-15902 | Malicious | Not scored | 04 Sep, 2026 | npm peertube-plugin-video-views-counter |
Malicious release: Malicious code in tailwind-scrollbar-styles (npm) MAL-2026-15904 | Malicious | Not scored | 04 Sep, 2026 | npm tailwind-scrollbar-styles |
Malicious release: Malicious code in tiny-folder-tree (npm) MAL-2026-15907 | Malicious | Not scored | 04 Sep, 2026 | npm tiny-folder-tree |
Malicious release: Malicious code in tailwind-container-queries (npm) MAL-2026-15903 | Malicious | Not scored | 04 Sep, 2026 | npm tailwind-container-queries |
Malicious release: Malicious code in hydration-ui-pkg (npm) MAL-2026-15900 | Malicious | Not scored | 04 Sep, 2026 | npm hydration-ui-pkg |
Malicious release: Malicious code in wallet-watcher (npm) GHSA-jq3q-655j-wjqh, MAL-2026-15871 | Malicious | Not scored | 04 Sep, 2026 | npm wallet-watcher |
Malicious release: Malicious code in vitest-cli-dev (npm) MAL-2026-15870 | Malicious | Not scored | 04 Sep, 2026 | npm vitest-cli-dev |
Malicious release: Malicious code in mcp-consultasdeveiculos-client (npm) MAL-2026-15869 | Malicious | Not scored | 04 Sep, 2026 | npm mcp-consultasdeveiculos-client |
Malicious release: Malicious code in @bx-ui-framework/authentication (npm) MAL-2026-15866 | Malicious | Not scored | 04 Sep, 2026 | npm @bx-ui-framework/authentication |
Malicious release: Malicious code in @bx-ui-framework/microfrontend (npm) MAL-2026-15868 | Malicious | Not scored | 04 Sep, 2026 | npm @bx-ui-framework/microfrontend |