Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @fdr-mar/promos-types (npm) GHSA-gj3w-q938-w6m6, MAL-2026-15648 | Malicious | Not scored | 01 Sep, 2026 | npm @fdr-mar/promos-types |
Malicious release: Malicious code in kendo-angular-window (npm) GHSA-jjx4-p3qc-rhrq, MAL-2026-15669 | Malicious | Not scored | 01 Sep, 2026 | npm kendo-angular-window |
Malicious release: Malicious code in core_main (npm) GHSA-rxjr-qr5x-q4q7, MAL-2026-15668 | Malicious | Not scored | 01 Sep, 2026 | npm core_main |
Malicious release: Malicious code in quartz-core (npm) GHSA-w63g-6crc-rq2w, MAL-2026-15671 | Malicious | Not scored | 01 Sep, 2026 | npm quartz-core |
Malicious release: Malicious code in @mrlegendbot/baileys (npm) MAL-2026-15819 | Malicious | Not scored | 01 Sep, 2026 | npm @mrlegendbot/baileys |
Malicious release: Malicious code in @systemzero/baileys (npm) MAL-2026-15820 | Malicious | Not scored | 01 Sep, 2026 | npm @systemzero/baileys |
MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS GHSA-rgwj-5xj2-c3m3 | Medium | Not scored | 31 Aug, 2026 | npm mysql2 |
pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace CVE-2026-82398, GHSA-fc8x-2rww-xw9m, PYSEC-2026-3912 | Medium | 0.5% | 31 Aug, 2026 | PyPI pypdf |
Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop CVE-2026-82397, GHSA-mpf4-983q-p7j4, PYSEC-2026-3928 | High | 0.3% | 31 Aug, 2026 | PyPI tornado |
Sulu: Stored XSS via media download inline-disposition override CVE-2026-82396, GHSA-pp4x-ccxq-6r33 | Medium | 0.3% | 31 Aug, 2026 | Packagist sulu/sulu |
Sulu: Media move/update authorization bypass (IDOR) CVE-2026-82395, GHSA-h6cx-gjxx-v25c | Medium | 0.4% | 31 Aug, 2026 | Packagist sulu/sulu |
Sulu: Fix authorization bypass when creating preview links CVE-2026-82394, GHSA-65cv-w493-7vhq | Medium | 0.6% | 31 Aug, 2026 | Packagist sulu/sulu |
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install CVE-2026-82393, GHSA-vq4v-j7r6-jq4m | High | 0.6% | 31 Aug, 2026 | npm pnpm |
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph CVE-2026-82392, GHSA-c59q-g84q-2gj5 | High | 0.6% | 31 Aug, 2026 | npm pnpm |
EasyAdmin custom-action dispatcher bypasses access_control on other routes CVE-2026-81892, GHSA-g2fm-8hr4-j82h | High | 0.4% | 31 Aug, 2026 | Packagist easycorp/easyadmin-bundle |
elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE) CVE-2026-81891, GHSA-gxmj-r5rf-ggwq | High | 0.9% | 31 Aug, 2026 | Packagist Studio-42/elFinder |
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections CVE-2026-81890, GHSA-9hjf-w35w-6vx2 | Medium | 0.2% | 31 Aug, 2026 | Packagist studio-42/elfinder |
Livewire DOM-based cross-site scripting during client-side state handling CVE-2026-81887, GHSA-g3hc-697w-wm82 | Medium | 0.7% | 31 Aug, 2026 | Packagist livewire/livewire |
Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling CVE-2026-75594, GHSA-9vx2-j98c-p72w | High | 0.8% | 31 Aug, 2026 | Packagist getkirby/cms |
Kirby: Access to image files outside of the site root via path traversal in the media handling CVE-2026-75592, GHSA-6j4c-mgqr-qv76 | Medium | 0.7% | 31 Aug, 2026 | Packagist getkirby/cms |
Kirby: File upload permissions are not checked during processing of chunk data CVE-2026-71415, GHSA-67mx-6wf2-92xp | High | 0.4% | 31 Aug, 2026 | Packagist getkirby/cms |
Smarty: SSRF via redirect bypass of trusted_uri using {fetch} CVE-2026-62993, GHSA-cq55-c7wv-pxmq | Medium | 0.6% | 31 Aug, 2026 | Packagist smarty/smarty |
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking CVE-2026-81888, GHSA-fm3f-ch8h-qw8q | Medium | 0.2% | 31 Aug, 2026 | npm @hono/oauth-providers |
elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback CVE-2026-81889, GHSA-8x3q-jpjh-qh5c | High | 0.5% | 31 Aug, 2026 | Packagist studio-42/elfinder |
Malicious release: Malicious code in @testrelic/appium-analytics (npm) GHSA-6cpr-jwvc-jhg7, MAL-2026-15647 | Malicious | Not scored | 31 Aug, 2026 | npm @testrelic/appium-analytics |
Malicious release: Malicious code in claude-channel-telegram (npm) MAL-2026-15624 | Malicious | Not scored | 31 Aug, 2026 | npm claude-channel-telegram |
Malicious release: Malicious code in nextjsupdater (npm) MAL-2026-15631 | Malicious | Not scored | 31 Aug, 2026 | npm nextjsupdater |
Malicious release: Malicious code in mfaatest (npm) MAL-2026-15629 | Malicious | Not scored | 31 Aug, 2026 | npm mfaatest |
Malicious release: Malicious code in hyperliquid-composer (npm) GHSA-5v7v-27c5-fr8q, MAL-2026-15627 | Malicious | Not scored | 31 Aug, 2026 | npm hyperliquid-composer |
Malicious release: Malicious code in test__123q2 (npm) MAL-2026-15638 | Malicious | Not scored | 31 Aug, 2026 | npm test__123q2 |
Malicious release: Malicious code in spc-grafeno-login (npm) MAL-2026-15633 | Malicious | Not scored | 31 Aug, 2026 | npm spc-grafeno-login |
Malicious release: Malicious code in node-request-utils (npm) MAL-2026-15632 | Malicious | Not scored | 31 Aug, 2026 | npm node-request-utils |
Malicious release: Malicious code in tailwind-minanimated (npm) MAL-2026-15634 | Malicious | Not scored | 31 Aug, 2026 | npm tailwind-minanimated |
Malicious release: Malicious code in mfafix (npm) MAL-2026-15630 | Malicious | Not scored | 31 Aug, 2026 | npm mfafix |
Malicious release: Malicious code in tailwind-modernanimation (npm) MAL-2026-15635 | Malicious | Not scored | 31 Aug, 2026 | npm tailwind-modernanimation |
Malicious release: Malicious code in mfa.io (npm) MAL-2026-15628 | Malicious | Not scored | 31 Aug, 2026 | npm mfa.io |
Malicious release: Malicious code in tailwindcss-forms-style (npm) MAL-2026-15636 | Malicious | Not scored | 31 Aug, 2026 | npm tailwindcss-forms-style |
Malicious release: Malicious code in test__123q1 (npm) MAL-2026-15637 | Malicious | Not scored | 31 Aug, 2026 | npm test__123q1 |
Malicious release: Malicious code in @baipiaodajun/npmsshx (npm) GHSA-g966-5c49-vx6m, MAL-2026-15641 | Malicious | Not scored | 31 Aug, 2026 | npm @baipiaodajun/npmsshx |
Malicious release: Malicious code in @baipiaodajun/reverseproxy-fm (npm) GHSA-gfhr-qx4h-34fv, MAL-2026-15643 | Malicious | Not scored | 31 Aug, 2026 | npm @baipiaodajun/reverseproxy-fm |
Malicious release: Malicious code in @baipiaodajun/mcbots (npm) GHSA-j3fw-7753-9v62, MAL-2026-15640 | Malicious | Not scored | 31 Aug, 2026 | npm @baipiaodajun/mcbots |
Malicious release: Malicious code in @baipiaodajun/podman_env (npm) GHSA-p684-v3gf-5wj2, MAL-2026-15642 | Malicious | Not scored | 31 Aug, 2026 | npm @baipiaodajun/podman_env |
Malicious release: Malicious code in kisama-js (npm) GHSA-vqwx-8v7g-55j3, MAL-2026-15645 | Malicious | Not scored | 31 Aug, 2026 | npm kisama-js |
Malicious release: Malicious code in @baipiaodajun/mcbot (npm) GHSA-wfgg-7wr2-9fwc, MAL-2026-15639 | Malicious | Not scored | 31 Aug, 2026 | npm @baipiaodajun/mcbot |
Malicious release: Malicious code in @pipi596888/ccursor (npm) GHSA-46qc-q49r-c3q4, MAL-2026-15644 | Malicious | Not scored | 31 Aug, 2026 | npm @pipi596888/ccursor |
Malicious release: Malicious code in pig-ui-first (npm) GHSA-cj5g-xq95-52x6, MAL-2026-15646 | Malicious | Not scored | 31 Aug, 2026 | npm pig-ui-first |
Malicious release: Malicious code in selfsigned-certificate (npm) GHSA-3whj-3fjw-x5w8, MAL-2026-15623 | Malicious | Not scored | 31 Aug, 2026 | npm selfsigned-certificate |
Malicious release: Malicious code in spc_login (npm) MAL-2026-15622 | Malicious | Not scored | 31 Aug, 2026 | npm spc_login |
Malicious release: Malicious code in gas-monitor (npm) MAL-2026-15621 | Malicious | Not scored | 31 Aug, 2026 | npm gas-monitor |
Malicious release: Malicious code in evilpostinstall (npm) MAL-2026-15625 | Malicious | Not scored | 31 Aug, 2026 | npm evilpostinstall |