Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution CVE-2026-115895, GHSA-834v-8h66-3h79 | High | 0.4% | 6 days ago | npm happy-dom |
Malicious release: Malicious code in @k18k/entrypoint-sdk-darwin-arm64 (npm) GHSA-8wf7-8825-99q7, MAL-2026-18243 | Malicious | Not scored | 6 days ago | npm @k18k/entrypoint-sdk-darwin-arm64 |
Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root GHSA-h4fr-cmh5-qr62 | Low | Not scored | 6 days ago | crates.io fallow-cli crates.io fallow-config crates.io fallow-core npm @fallow-cli/fallow-node +1 more |
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words GHSA-f2hq-32vh-53cc | High | Not scored | 6 days ago | npm postal-mime |
Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient GHSA-8c8m-p3m8-cjg8 | Medium | Not scored | 6 days ago | npm nodemailer |
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient GHSA-m943-m63m-w62w | Medium | Not scored | 6 days ago | npm nodemailer |
Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name GHSA-85x2-q946-cp5h | Medium | Not scored | 6 days ago | npm nodemailer |
Malicious release: Malicious code in orqiva-runtime-win32-x64 (npm) GHSA-8j59-g9mq-7hf9, MAL-2026-18246 | Malicious | Not scored | 6 days ago | npm orqiva-runtime-win32-x64 |
Malicious release: Malicious code in @k18k/entrypoint-sdk-linux-x64 (npm) GHSA-9fhg-r3w6-g7r4, MAL-2026-18245 | Malicious | Not scored | 6 days ago | npm @k18k/entrypoint-sdk-linux-x64 |
setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description GHSA-xmj3-9gf7-h52w | Low | Not scored | 6 days ago | PyPI setuptools |
Malicious release: Malicious code in @k18k/entrypoint-sdk-darwin-x64 (npm) GHSA-j58m-rwhr-923h, MAL-2026-18244 | Malicious | Not scored | 6 days ago | npm @k18k/entrypoint-sdk-darwin-x64 |
Malicious release: Malicious code in @greenlake/session (npm) GHSA-499v-qcp5-gx7x, MAL-2026-18283 | Malicious | Not scored | 6 days ago | npm @greenlake/session |
Malicious release: Malicious code in @greenlake/mfe-login-url (npm) GHSA-6vg7-x7p2-c749, MAL-2026-18318 | Malicious | Not scored | 6 days ago | npm @greenlake/mfe-login-url |
Malicious release: Malicious code in @greenlake/context-pane (npm) GHSA-5pp4-pvpc-g2xv, MAL-2026-18317 | Malicious | Not scored | 6 days ago | npm @greenlake/context-pane |
FastMCP: Post-transform component authorization is skipped on direct calls GHSA-7xgj-8392-5q4r | Medium | Not scored | 6 days ago | PyPI fastmcp PyPI fastmcp-slim |
Malicious release: Malicious code in @greenlake/common-context (npm) GHSA-mm6p-8j6f-9fch, MAL-2026-18282 | Malicious | Not scored | 6 days ago | npm @greenlake/common-context |
FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server GHSA-vqqp-x5qm-5qp4 | Medium | Not scored | 6 days ago | PyPI fastmcp PyPI fastmcp-slim |
Malicious release: Malicious code in @greenlake/auth (npm) GHSA-h6v3-2957-9j3g, MAL-2026-18316 | Malicious | Not scored | 6 days ago | npm @greenlake/auth |
Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation CVE-2026-83813, GHSA-jj36-9pvh-vj5r | Low | 0.1% | 6 days ago | PyPI Twisted PyPI twisted |
odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values GHSA-2rqm-h6hv-g79v | Medium | Not scored | 6 days ago | npm odf-kit |
Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order GHSA-mhf7-xp6r-6qrc | Medium | Not scored | 6 days ago | Packagist livewire/livewire |
Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH CVE-2026-115774, GHSA-2qrf-pqgx-qh9v | Medium | 0.4% | 6 days ago | PyPI Twisted PyPI twisted |
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer CVE-2026-115776, GHSA-53xc-49m8-p798 | High | 0.5% | 6 days ago | PyPI Twisted PyPI twisted |
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer CVE-2026-115778, GHSA-cwm5-jh59-mwxr | High | 0.5% | 6 days ago | PyPI Twisted PyPI twisted |
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree CVE-2026-115775, GHSA-3476-c5c2-fr73 | High | 0.4% | 6 days ago | PyPI Twisted PyPI twisted |
Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value CVE-2026-115877, GHSA-q7qq-6mhp-9rc4 | Medium | 0.3% | 6 days ago | PyPI Twisted PyPI twisted |
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) BIT-virtualenv-2026-115586, CVE-2026-115586, GHSA-cx6f-vjhg-g3cc | High | 0.2% | 6 days ago | PyPI virtualenv |
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) CVE-2026-115585, GHSA-jr96-gvgh-j3r4 | High | 0.4% | 6 days ago | PyPI pypdf |
pypdf: Possible long runtimes for large xref table header limits CVE-2026-115580, GHSA-gmh7-3g9r-mjh5 | High | 0.4% | 6 days ago | PyPI pypdf |
pypdf: Possible long runtimes for repeated references to the same missing object CVE-2026-115572, GHSA-6c7f-9265-g8fw | High | 0.4% | 6 days ago | PyPI pypdf |
Electron: Mitigation for compromised eMudhra intermediate certificates CVE-2026-115570, GHSA-jr5w-w6x2-84p9 | High | 0.4% | 6 days ago | npm electron |
Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root CVE-2026-115569, GHSA-jfwm-3p3c-6hx5 | Low | 0.2% | 6 days ago | crates.io fallow-cli crates.io fallow-core npm @fallow-cli/fallow-node npm fallow |
Malicious release: Malicious code in sitecard (PyPI) MAL-2026-18242 | Malicious | Not scored | 6 days ago | PyPI sitecard |
Malicious release: Malicious code in jobwharf (PyPI) MAL-2026-18228 | Malicious | Not scored | 6 days ago | PyPI jobwharf |
Malicious release: Malicious code in slatejob (PyPI) MAL-2026-18237 | Malicious | Not scored | 6 days ago | PyPI slatejob |
Malicious release: Malicious code in reedworker (PyPI) MAL-2026-18234 | Malicious | Not scored | 6 days ago | PyPI reedworker |
Malicious release: Malicious code in loadferry (PyPI) MAL-2026-18231 | Malicious | Not scored | 6 days ago | PyPI loadferry |
Malicious release: Malicious code in runpier (PyPI) MAL-2026-18235 | Malicious | Not scored | 6 days ago | PyPI runpier |
Malicious release: Malicious code in sedgehaul (PyPI) MAL-2026-18236 | Malicious | Not scored | 6 days ago | PyPI sedgehaul |
Malicious release: Malicious code in taskquay (PyPI) MAL-2026-18238 | Malicious | Not scored | 6 days ago | PyPI taskquay |
Malicious release: Malicious code in marshrunner (PyPI) MAL-2026-18232 | Malicious | Not scored | 6 days ago | PyPI marshrunner |
Malicious release: Malicious code in workslip (PyPI) MAL-2026-18241 | Malicious | Not scored | 6 days ago | PyPI workslip |
Malicious release: Malicious code in brookworker (PyPI) MAL-2026-18224 | Malicious | Not scored | 6 days ago | PyPI brookworker |
Malicious release: Malicious code in cobbleload (PyPI) MAL-2026-18225 | Malicious | Not scored | 6 days ago | PyPI cobbleload |
Malicious release: Malicious code in brambletask (PyPI) MAL-2026-18223 | Malicious | Not scored | 6 days ago | PyPI brambletask |
Malicious release: Malicious code in ferretqueue (PyPI) MAL-2026-18226 | Malicious | Not scored | 6 days ago | PyPI ferretqueue |
Malicious release: Malicious code in otterload (PyPI) MAL-2026-18233 | Malicious | Not scored | 6 days ago | PyPI otterload |
Malicious release: Malicious code in badgertask (PyPI) MAL-2026-18222 | Malicious | Not scored | 6 days ago | PyPI badgertask |
Malicious release: Malicious code in larchworker (PyPI) MAL-2026-18230 | Malicious | Not scored | 6 days ago | PyPI larchworker |
Malicious release: Malicious code in thornqueue (PyPI) MAL-2026-18240 | Malicious | Not scored | 6 days ago | PyPI thornqueue |