Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in @pkgship/frpc-darwin-amd64 (npm) GHSA-fhh5-55p8-29hj, MAL-2026-18191 | Malicious | Not scored | 7 days ago | npm @pkgship/frpc-darwin-amd64 |
Malicious release: Malicious code in opencode-skills-collection (npm) GHSA-9855-prwc-mfp2, MAL-2026-18193 | Malicious | Not scored | 7 days ago | npm opencode-skills-collection |
Malicious release: Malicious code in agentic-awesome-skills (npm) GHSA-rgwm-3jj9-h563, MAL-2026-18192 | Malicious | Not scored | 7 days ago | npm agentic-awesome-skills |
fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()' CVE-2026-114610, GHSA-wqw6-wpr3-45rh | Medium | 0.5% | 7 days ago | PyPI fpdf2 |
fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content CVE-2026-114609, GHSA-rw7v-4hrq-x6r9 | Medium | 0.3% | 7 days ago | PyPI fpdf2 |
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading CVE-2026-108360, GHSA-2phh-27fw-q4gc | Medium | 0.2% | 7 days ago | Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) CVE-2026-108359, GHSA-j2w7-387v-m2rq | High | 0.4% | 7 days ago | Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service CVE-2026-108358, GHSA-3x94-m842-937c | High | 0.5% | 7 days ago | Packagist phpoffice/phpspreadsheet |
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service CVE-2026-108357, GHSA-rxj4-h86g-25gc | High | 0.4% | 7 days ago | Packagist phpoffice/phpspreadsheet |
Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME CVE-2026-114608, GHSA-22qq-2fwx-7p67 | Medium | 0.1% | 7 days ago | PyPI pylint |
better-auth: OAuth state can be used as a Magic Link to sign in as another user CVE-2026-110862, CVE-2026-114607, GHSA-965c-763c-88jm | Critical | 0.4% | 7 days ago | npm better-auth |
dnspython dns.name.from_wire_parser() excessive CPU use CVE-2026-114605, GHSA-45c3-73f7-pv4m | High | 0.3% | 7 days ago | PyPI dnspython |
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load() GHSA-78g4-xqwv-q3g8 | High | Not scored | 7 days ago | PyPI pillow |
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays GHSA-673q-mjm6-r5xr | Critical | Not scored | 7 days ago | npm next |
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments CVE-2026-114604, GHSA-c4qx-w738-7hr3 | High | Not scored | 7 days ago | npm @graphql-tools/utils |
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit CVE-2026-75508, GHSA-r77w-qph3-7vf8 | High | 0.6% | 7 days ago | PyPI graphql-core |
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule CVE-2026-75507, GHSA-vj8h-fx38-h3vc | High | 0.6% | 7 days ago | PyPI graphql-core |
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes CVE-2026-116804, GHSA-cg2g-xh64-v4q7 | Critical | 0.2% | 7 days ago | npm dompurify |
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p) CVE-2026-116803, GHSA-mrv2-3pqr-j5jr | High | 0.2% | 7 days ago | npm dompurify |
DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml CVE-2026-116802, GHSA-c6gr-qvv4-5v3f | Medium | 0.2% | 7 days ago | npm dompurify |
Black: GitHub Action installs unvalidated required-version from pyproject.toml CVE-2026-114134, GHSA-cg8m-r9f2-5wm2 | High | Not scored | 7 days ago | PyPI black |
OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api CVE-2026-114603, GHSA-xcq7-p3pf-p88h | Medium | 0.5% | 7 days ago | PyPI opentelemetry-api |
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used GHSA-2464-fhr4-w9xw | Critical | Not scored | 7 days ago | npm next |
Next.js: Denial of Service in App Router using Server Actions CVE-2026-94482, GHSA-p3m5-59mp-jv5r | High | 0.4% | 7 days ago | npm next |
PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery GHSA-pxh4-856f-4h89 | High | Not scored | 7 days ago | PyPI pyjwt |
Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content CVE-2026-114510, GHSA-vqrg-773h-4wxc | High | 0.2% | 7 days ago | PyPI flexible-graphrag |
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown CVE-2026-113872, GHSA-q7qp-rjg7-q26m | High | 0.4% | 7 days ago | npm multer |
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body CVE-2026-111181, GHSA-27r3-jxmh-p828 | High | 0.4% | 7 days ago | npm body-parser |
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package BIT-brotli-2026-111497, BIT-dotnet-2026-111497, BIT-dotnet-sdk-2026-111497, BIT-node-2026-111497, BIT-node-min-2026-111497, BIT-powershell-2026-111497, CVE-2026-111497, GHSA-9v8h-qqgm-4m35, PYSEC-2026-4322, PYSEC-2026-4323 | CriticalExploited | 82.6% | 7 days ago | PyPI brotli PyPI brotlicffi |
Malicious release: Malicious code in 1h1 (PyPI) MAL-2026-18188 | Malicious | Not scored | 7 days ago | PyPI 1h1 |
Malicious release: Malicious code in aanthropic (PyPI) MAL-2026-18189 | Malicious | Not scored | 7 days ago | PyPI aanthropic |
mem0ai Databricks vector store vulnerable to SQL injection CVE-2026-115324, GHSA-7587-9684-52r6 | Critical | 0.3% | 7 days ago | PyPI mem0ai |
Malicious release: Malicious code in net-codec-testmetest (npm) MAL-2026-18186 | Malicious | Not scored | 8 days ago | npm net-codec-testmetest |
Malicious release: Malicious code in log-rotate-testmetest (npm) MAL-2026-18185 | Malicious | Not scored | 8 days ago | npm log-rotate-testmetest |
Malicious release: Malicious code in formatting-subtitles (npm) MAL-2026-18184 | Malicious | Not scored | 8 days ago | npm formatting-subtitles |
Malicious release: Malicious code in @conduitops/logview-archive (npm) MAL-2026-18183 | Malicious | Not scored | 8 days ago | npm @conduitops/logview-archive |
Malicious release: Malicious code in simplewave (npm) MAL-2026-18187 | Malicious | Not scored | 8 days ago | npm simplewave |
Malicious release: Malicious code in acoustichub (PyPI) MAL-2026-18155 | Malicious | Not scored | 8 days ago | PyPI acoustichub |
Malicious release: Malicious code in phonemeprobe (PyPI) MAL-2026-18164 | Malicious | Not scored | 8 days ago | PyPI phonemeprobe |
Malicious release: Malicious code in ttsflow (PyPI) MAL-2026-18170 | Malicious | Not scored | 8 days ago | PyPI ttsflow |
Malicious release: Malicious code in evalstream (PyPI) MAL-2026-18161 | Malicious | Not scored | 8 days ago | PyPI evalstream |
Malicious release: Malicious code in speakbench (PyPI) MAL-2026-18166 | Malicious | Not scored | 8 days ago | PyPI speakbench |
Malicious release: Malicious code in audiokit (PyPI) MAL-2026-18158 | Malicious | Not scored | 8 days ago | PyPI audiokit |
Malicious release: Malicious code in phonemeforge (PyPI) MAL-2026-18163 | Malicious | Not scored | 8 days ago | PyPI phonemeforge |
Malicious release: Malicious code in vocabbench (PyPI) MAL-2026-18173 | Malicious | Not scored | 8 days ago | PyPI vocabbench |
Malicious release: Malicious code in asrloom (PyPI) MAL-2026-18157 | Malicious | Not scored | 8 days ago | PyPI asrloom |
Malicious release: Malicious code in benchworks (PyPI) MAL-2026-18160 | Malicious | Not scored | 8 days ago | PyPI benchworks |
Malicious release: Malicious code in benchbridge (PyPI) MAL-2026-18159 | Malicious | Not scored | 8 days ago | PyPI benchbridge |
Malicious release: Malicious code in speechprobe (PyPI) MAL-2026-18168 | Malicious | Not scored | 8 days ago | PyPI speechprobe |
Malicious release: Malicious code in soundsocket (PyPI) MAL-2026-18165 | Malicious | Not scored | 8 days ago | PyPI soundsocket |