Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
qs array-limit bypass via bracket-key comma parsing CVE-2026-82562, GHSA-x5fp-wj9c-mxmx | Medium | 0.5% | 30 Aug, 2026 | npm qs |
qs: Denial of Service via Attacker Controlled isBuffer CVE-2026-82417, GHSA-4mjr-xmp4-gh2g | Medium | 0.4% | 30 Aug, 2026 | npm qs |
Malicious release: Malicious code in grafeno-webhook (npm) MAL-2026-15573 | Malicious | Not scored | 29 Aug, 2026 | npm grafeno-webhook |
Malicious release: Malicious code in grafeno-billing (npm) MAL-2026-15571 | Malicious | Not scored | 29 Aug, 2026 | npm grafeno-billing |
Malicious release: Malicious code in grafeno-payments (npm) MAL-2026-15572 | Malicious | Not scored | 29 Aug, 2026 | npm grafeno-payments |
Malicious release: Malicious code in node-net-pool (npm) GHSA-vm9g-mp9v-6q5p, MAL-2026-15570 | Malicious | Not scored | 29 Aug, 2026 | npm node-net-pool |
Malicious release: Malicious code in npx-oob-package (npm) GHSA-95gx-59fv-gfg6, MAL-2026-15597 | Malicious | Not scored | 29 Aug, 2026 | npm npx-oob-package |
Malicious release: Malicious code in manager-thedate (npm) GHSA-3rww-v3p8-fw9p, MAL-2026-15568 | Malicious | Not scored | 29 Aug, 2026 | npm manager-thedate |
Malicious release: Malicious code in htps-provider (npm) GHSA-gcqr-3vw3-7fqm, MAL-2026-15567 | Malicious | Not scored | 29 Aug, 2026 | npm htps-provider |
Malicious release: Malicious code in nuvyra-marketplace-sdk (npm) GHSA-rq2p-956p-32h6, MAL-2026-15569 | Malicious | Not scored | 29 Aug, 2026 | npm nuvyra-marketplace-sdk |
Malicious release: Malicious code in flask-header-guard (PyPI) MAL-2026-15566 | Malicious | Not scored | 29 Aug, 2026 | PyPI flask-header-guard |
Malicious release: Malicious code in @testrelic/playwright-analytics (npm) MAL-2026-15565 | Malicious | Not scored | 29 Aug, 2026 | npm @testrelic/playwright-analytics |
Malicious release: Malicious code in ckeditor5-ckbox (npm) MAL-2026-15549 | Malicious | Not scored | 29 Aug, 2026 | npm ckeditor5-ckbox |
Malicious release: Malicious code in common-array-token (npm) MAL-2026-15550 | Malicious | Not scored | 29 Aug, 2026 | npm common-array-token |
Malicious release: Malicious code in supersignaturenature (npm) GHSA-x67q-xvcf-f2rw, MAL-2026-15560 | Malicious | Not scored | 29 Aug, 2026 | npm supersignaturenature |
Malicious release: Malicious code in secretkey2fa (npm) MAL-2026-15559 | Malicious | Not scored | 29 Aug, 2026 | npm secretkey2fa |
Malicious release: Malicious code in js-tokens-array (npm) MAL-2026-15556 | Malicious | Not scored | 29 Aug, 2026 | npm js-tokens-array |
Malicious release: Malicious code in date-fns-sync (npm) MAL-2026-15551 | Malicious | Not scored | 29 Aug, 2026 | npm date-fns-sync |
Malicious release: Malicious code in eth-pino (npm) MAL-2026-15554 | Malicious | Not scored | 29 Aug, 2026 | npm eth-pino |
Malicious release: Malicious code in techportal (npm) MAL-2026-15561 | Malicious | Not scored | 29 Aug, 2026 | npm techportal |
Malicious release: Malicious code in vs-modules (npm) GHSA-8hpw-v4hq-pg99, MAL-2026-15564 | Malicious | Not scored | 29 Aug, 2026 | npm vs-modules |
Malicious release: Malicious code in js-array-tokens (npm) MAL-2026-15555 | Malicious | Not scored | 29 Aug, 2026 | npm js-array-tokens |
Malicious release: Malicious code in es6-migrator (npm) MAL-2026-15553 | Malicious | Not scored | 29 Aug, 2026 | npm es6-migrator |
Malicious release: Malicious code in vitest-chalk-pro (npm) MAL-2026-15563 | Malicious | Not scored | 29 Aug, 2026 | npm vitest-chalk-pro |
Malicious release: Malicious code in mfacord (npm) MAL-2026-15557 | Malicious | Not scored | 29 Aug, 2026 | npm mfacord |
Malicious release: Malicious code in discord-mfa (npm) MAL-2026-15552 | Malicious | Not scored | 29 Aug, 2026 | npm discord-mfa |
Malicious release: Malicious code in test-in-one (npm) MAL-2026-15562 | Malicious | Not scored | 29 Aug, 2026 | npm test-in-one |
Malicious release: Malicious code in mfakit (npm) MAL-2026-15558 | Malicious | Not scored | 29 Aug, 2026 | npm mfakit |
Malicious release: Malicious code in 2fasecretkey (npm) MAL-2026-15548 | Malicious | Not scored | 29 Aug, 2026 | npm 2fasecretkey |
Malicious release: Malicious code in 2fa-secretkey (npm) MAL-2026-15547 | Malicious | Not scored | 29 Aug, 2026 | npm 2fa-secretkey |
Malicious release: Malicious code in sentrykit (npm) GHSA-qq6h-882h-g88f, MAL-2026-15544 | Malicious | Not scored | 28 Aug, 2026 | npm sentrykit |
Malicious release: Malicious code in analytics-web-client (npm) GHSA-5g5q-647h-8vv8, MAL-2026-15526 | Malicious | Not scored | 28 Aug, 2026 | npm analytics-web-client |
Malicious release: Malicious code in confluence-create-content (npm) GHSA-j52x-8r24-hw6x, MAL-2026-15530 | Malicious | Not scored | 28 Aug, 2026 | npm confluence-create-content |
Malicious release: Malicious code in confluence-editor (npm) GHSA-cwcw-cv28-7jfm, MAL-2026-15531 | Malicious | Not scored | 28 Aug, 2026 | npm confluence-editor |
Malicious release: Malicious code in confluence-rest (npm) GHSA-g338-wxvv-vg5q, MAL-2026-15532 | Malicious | Not scored | 28 Aug, 2026 | npm confluence-rest |
Malicious release: Malicious code in prm-bundles (npm) GHSA-g57v-rj8p-j52h, MAL-2026-15543 | Malicious | Not scored | 28 Aug, 2026 | npm prm-bundles |
Malicious release: Malicious code in ir-annuities-client-authentication-module (npm) GHSA-4hpj-q7v8-mjf7, MAL-2026-15536 | Malicious | Not scored | 28 Aug, 2026 | npm ir-annuities-client-authentication-module |
Malicious release: Malicious code in paper-password-input (npm) GHSA-p8fv-qch5-j7m9, MAL-2026-15542 | Malicious | Not scored | 28 Aug, 2026 | npm paper-password-input |
Malicious release: Malicious code in aura-instrumentation (npm) GHSA-p4vf-c829-4m2m, MAL-2026-15527 | Malicious | Not scored | 28 Aug, 2026 | npm aura-instrumentation |
Malicious release: Malicious code in loading-performance-instrumentation (npm) GHSA-hx7g-4f5f-7hq9, MAL-2026-15539 | Malicious | Not scored | 28 Aug, 2026 | npm loading-performance-instrumentation |
Malicious release: Malicious code in axis-datagrid (npm) GHSA-7f64-56gx-r4cm, GHSA-c6gq-r9w4-xg7j, MAL-2026-15528 | Malicious | Not scored | 28 Aug, 2026 | npm axis-datagrid |
Malicious release: Malicious code in ux-metrics-client-interaction-subscriber (npm) GHSA-5v45-27j3-r52f, GHSA-fgwj-qvjx-g92h, MAL-2026-15545 | Malicious | Not scored | 28 Aug, 2026 | npm ux-metrics-client-interaction-subscriber |
Malicious release: Malicious code in bui-react-10themes (npm) GHSA-mj9w-ffv9-m8rf, MAL-2026-15529 | Malicious | Not scored | 28 Aug, 2026 | npm bui-react-10themes |
Malicious release: Malicious code in mkt-ui-library (npm) GHSA-w4pq-8q38-v8jr, MAL-2026-15540 | Malicious | Not scored | 28 Aug, 2026 | npm mkt-ui-library |
Malicious release: Malicious code in firestore-lite (npm) GHSA-q556-gm72-jcp7, MAL-2026-15534 | Malicious | Not scored | 28 Aug, 2026 | npm firestore-lite |
Malicious release: Malicious code in librastandardlib (npm) GHSA-p943-f2p4-7xfx, MAL-2026-15538 | Malicious | Not scored | 28 Aug, 2026 | npm librastandardlib |
Malicious release: Malicious code in vui-gateway (npm) GHSA-69cq-ggff-w363, MAL-2026-15546 | Malicious | Not scored | 28 Aug, 2026 | npm vui-gateway |
Malicious release: Malicious code in jira-projects-backbone (npm) GHSA-8569-7m7w-7gf9, MAL-2026-15537 | Malicious | Not scored | 28 Aug, 2026 | npm jira-projects-backbone |
Malicious release: Malicious code in data-value (npm) GHSA-rq5q-gpqf-p4vp, MAL-2026-15533 | Malicious | Not scored | 28 Aug, 2026 | npm data-value |
Malicious release: Malicious code in oit-lib-oracle-util (npm) GHSA-rqm2-xgr5-297v, MAL-2026-15541 | Malicious | Not scored | 28 Aug, 2026 | npm oit-lib-oracle-util |