Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Filament: Password validity disclosure for accounts denied panel access on login page CVE-2026-84307, GHSA-xwpv-pqxp-5v36 | Low | 0.5% | 01 Sep, 2026 | Packagist filament/filament |
Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie` CVE-2026-91991, GHSA-wwv5-g3v4-889x | Medium | 0.2% | 01 Sep, 2026 | PyPI tornado |
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml CVE-2026-101043, GHSA-vx52-2968-3vc6 | High | 0.3% | 01 Sep, 2026 | npm pnpm |
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used CVE-2026-84306, GHSA-r3j6-gpjw-qfjr | Medium | 0.4% | 01 Sep, 2026 | Packagist filament/filament |
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption CVE-2026-84305, GHSA-cfqr-cjx5-5jcm, PYSEC-2026-3923 | Medium | 0.2% | 01 Sep, 2026 | PyPI sqlparse |
pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project GHSA-2rx9-3g3h-c2jv | High | Not scored | 01 Sep, 2026 | npm pnpm |
Malicious release: Malicious code in order-package-saas (npm) MAL-2026-15816 | Malicious | Not scored | 01 Sep, 2026 | npm order-package-saas |
Malicious release: Malicious code in bt2-api-gateway-node-js (npm) MAL-2026-15813 | Malicious | Not scored | 01 Sep, 2026 | npm bt2-api-gateway-node-js |
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact GHSA-gqvg-gmmx-x4hm | High | Not scored | 01 Sep, 2026 | PyPI mlflow |
MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials GHSA-3f6p-5ww8-9rcr | High | Not scored | 01 Sep, 2026 | npm mysql2 |
Malicious release: Malicious code in gcphelpit (PyPI) MAL-2026-15810 | Malicious | Not scored | 01 Sep, 2026 | PyPI gcphelpit |
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser CVE-2026-83619, GHSA-x4fp-j954-r2f4 | High | 0.5% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator CVE-2026-83618, GHSA-vr34-hp96-76pp | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator CVE-2026-83617, GHSA-jxjr-3g7g-3944 | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed CVE-2026-83616, GHSA-c7q8-3ch8-vqpv | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: Quadratic-memory consumption CVE-2026-83615, GHSA-965w-775f-mr7g | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge CVE-2026-83614, GHSA-93r5-fhx6-vmg9 | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: Quadratic-time attribute deduplication CVE-2026-83613, GHSA-8344-3jmq-59r6 | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: HTML raw-text closing-tag case mismatch causes output amplification CVE-2026-83612, GHSA-6mj3-qw4j-hgrw | High | 0.5% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content CVE-2026-83611, GHSA-6h8r-xr42-gp59 | Medium | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization CVE-2026-83610, GHSA-6gmq-8vp8-gcm6 | Medium | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path CVE-2026-83609, GHSA-3px3-54cx-rmw9 | High | 0.5% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: DocType `name` Injection Bypasses requireWellFormed CVE-2026-83608, GHSA-27p8-2357-5qqv | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom: Element name injection via createElement() bypasses requireWellFormed CVE-2026-83607, GHSA-w2rr-34g9-rvrj | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions CVE-2026-83606, GHSA-g53g-w8rj-fmg7 | High | 0.5% | 01 Sep, 2026 | npm @xmldom/xmldom |
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed CVE-2026-83605, GHSA-4w3w-2rp5-g8jm | High | 0.6% | 01 Sep, 2026 | npm @xmldom/xmldom npm xmldom |
Malicious release: Malicious code in tallyboxlite (PyPI) MAL-2026-15809 | Malicious | Not scored | 01 Sep, 2026 | PyPI tallyboxlite |
Hugging Face Transformers downloads custom generation code before trust consent CVE-2026-80047, GHSA-x9r9-c232-4q39, PYSEC-2026-4174 | High | 0.1% | 01 Sep, 2026 | PyPI transformers |
Malicious release: Malicious code in react-mongoose (npm) GHSA-wvgj-m2p9-jf3c, MAL-2026-15845 | Malicious | Not scored | 01 Sep, 2026 | npm react-mongoose |
Malicious release: Malicious code in @yane88/ripgrep-win (npm) GHSA-274r-44qv-6xwc, MAL-2026-15660 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/ripgrep-win |
Malicious release: Malicious code in @yane88/workbuddy-01 (npm) GHSA-2w3r-v82c-4rvg, MAL-2026-15665 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/workbuddy-01 |
Malicious release: Malicious code in @yane88/listary-01 (npm) GHSA-46j3-wfp2-66m2, MAL-2026-15658 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/listary-01 |
Malicious release: Malicious code in @yane88/workbuddy-02 (npm) GHSA-677c-x838-7qj5, MAL-2026-15666 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/workbuddy-02 |
Malicious release: Malicious code in @yane88/listary (npm) GHSA-6qjf-3c98-5gr7, MAL-2026-15657 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/listary |
Malicious release: Malicious code in @yane88/hexhub-client (npm) GHSA-75h3-gh74-47p2, MAL-2026-15649 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/hexhub-client |
Malicious release: Malicious code in @yane88/term-reqable-01 (npm) GHSA-m76v-4h4c-w693, MAL-2026-15662 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/term-reqable-01 |
Malicious release: Malicious code in @yane88/workbuddy-03 (npm) GHSA-qpjf-29xc-g688, MAL-2026-15667 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/workbuddy-03 |
Malicious release: Malicious code in @yane88/listary-02 (npm) GHSA-rg2v-g672-8773, MAL-2026-15659 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/listary-02 |
Malicious release: Malicious code in @yane88/workbuddy (npm) GHSA-v22h-4j6c-58cm, MAL-2026-15664 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/workbuddy |
Malicious release: Malicious code in @yane88/term-reqable-02 (npm) GHSA-vq2v-vw6h-9g9f, MAL-2026-15663 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/term-reqable-02 |
Malicious release: Malicious code in @yane88/term-reqable (npm) GHSA-xx48-j637-66x2, MAL-2026-15661 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/term-reqable |
Malicious release: Malicious code in @yane88/idea-2026.2-01 (npm) GHSA-2fmg-86jf-r56c, MAL-2026-15651 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/idea-2026.2-01 |
Malicious release: Malicious code in @yane88/idea-2026.2 (npm) GHSA-5qw7-3hqh-q33m, MAL-2026-15650 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/idea-2026.2 |
Malicious release: Malicious code in @yane88/idea-2026.2-02 (npm) GHSA-fgwh-qm8c-9mv8, MAL-2026-15652 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/idea-2026.2-02 |
Malicious release: Malicious code in @yane88/idea-2026.2-03 (npm) GHSA-fw5q-2vvv-w862, MAL-2026-15653 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/idea-2026.2-03 |
Malicious release: Malicious code in @yane88/idea-2026.2-06 (npm) GHSA-j62v-qq84-cr9v, MAL-2026-15656 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/idea-2026.2-06 |
Malicious release: Malicious code in @yane88/idea-2026.2-05 (npm) GHSA-mv54-8cx5-2fc9, MAL-2026-15655 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/idea-2026.2-05 |
Malicious release: Malicious code in @yane88/idea-2026.2-04 (npm) GHSA-xpjx-pwwq-qg46, MAL-2026-15654 | Malicious | Not scored | 01 Sep, 2026 | npm @yane88/idea-2026.2-04 |
Malicious release: Malicious code in matrix-by-lmx (npm) GHSA-jhgv-vh9h-q3r9, MAL-2026-15670 | Malicious | Not scored | 01 Sep, 2026 | npm matrix-by-lmx |
Malicious release: Malicious code in randomunblockedwebsite (npm) GHSA-5x4x-f7h5-6p47, MAL-2026-15672 | Malicious | Not scored | 01 Sep, 2026 | npm randomunblockedwebsite |