Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in megan-baileys (npm) MAL-2026-15919 | Malicious | Not scored | 03 Sep, 2026 | npm megan-baileys |
ffuf denial of service (OOM) via HTTP response decompression bomb CVE-2026-73232, GHSA-jcvh-xf52-2cwm, GO-2026-6369 | High | Not scored | 03 Sep, 2026 | Go github.com/ffuf/ffuf Go github.com/ffuf/ffuf/v2 |
VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root CVE-2026-61625, GHSA-8q3c-rjr9-xxrp, GO-2026-6366 | Medium | Not scored | 03 Sep, 2026 | Go github.com/VictoriaMetrics/VictoriaMetrics |
OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool CVE-2026-75602, GHSA-h6cj-26g5-67fv, GO-2026-6368 | Medium | Not scored | 03 Sep, 2026 | Go github.com/OpenListTeam/OpenList Go github.com/OpenListTeam/OpenList/v3 Go github.com/OpenListTeam/OpenList/v4 |
Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match BIT-cilium-2026-56743, BIT-cilium-operator-2026-56743, BIT-hubble-relay-2026-56743, CVE-2026-56743, GHSA-fm8w-2m5w-9j7r, GO-2026-6367 | Medium | Not scored | 03 Sep, 2026 | Go github.com/cilium/cilium |
Malicious release: Malicious code in py-1requests (PyPI) MAL-2026-15861 | Malicious | Not scored | 03 Sep, 2026 | PyPI py-1requests |
Malicious release: Malicious code in py-2equests (PyPI) MAL-2026-15862 | Malicious | Not scored | 03 Sep, 2026 | PyPI py-2equests |
Malicious release: Malicious code in py-0requests (PyPI) MAL-2026-15860 | Malicious | Not scored | 03 Sep, 2026 | PyPI py-0requests |
Malicious release: Malicious code in 0requests (PyPI) MAL-2026-15859 | Malicious | Not scored | 03 Sep, 2026 | PyPI 0requests |
Malicious release: Malicious code in html_vue (npm) GHSA-3j85-w3wg-w28x, MAL-2026-15887 | Malicious | Not scored | 03 Sep, 2026 | npm html_vue |
Malicious release: Malicious code in vscode-vue (npm) GHSA-5vjf-q259-p82j, MAL-2026-15894 | Malicious | Not scored | 03 Sep, 2026 | npm vscode-vue |
Malicious release: Malicious code in @a23842/dsh-notifier (npm) GHSA-995p-9xmc-j7v3, MAL-2026-15872 | Malicious | Not scored | 03 Sep, 2026 | npm @a23842/dsh-notifier |
Malicious release: Malicious code in dsh-waste-market (npm) GHSA-h4p9-qw93-r884, MAL-2026-15879 | Malicious | Not scored | 03 Sep, 2026 | npm dsh-waste-market |
Malicious release: Malicious code in uvhttp-custom (PyPI) MAL-2026-15863 | Malicious | Not scored | 03 Sep, 2026 | PyPI uvhttp-custom |
Malicious release: Malicious code in trongridi (PyPI) MAL-2026-15858 | Malicious | Not scored | 03 Sep, 2026 | PyPI trongridi |
Malicious release: Malicious code in @quantixfinance/config (npm) MAL-2026-15850 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/config |
Malicious release: Malicious code in @quantixfinance/tron (npm) MAL-2026-15855 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/tron |
Malicious release: Malicious code in @quantixfinance/common (npm) MAL-2026-15849 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/common |
Malicious release: Malicious code in @quantixfinance/sdk (npm) MAL-2026-15852 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/sdk |
Malicious release: Malicious code in @quantixfinance/contracts (npm) MAL-2026-15851 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/contracts |
Malicious release: Malicious code in @quantixfinance/ui (npm) MAL-2026-15856 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/ui |
Malicious release: Malicious code in @quantixfinance/wallet (npm) MAL-2026-15857 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/wallet |
Malicious release: Malicious code in @quantixfinance/token (npm) MAL-2026-15854 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/token |
Malicious release: Malicious code in @quantixfinance/supabase (npm) MAL-2026-15853 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/supabase |
Malicious release: Malicious code in @quantixfinance/api (npm) MAL-2026-15848 | Malicious | Not scored | 03 Sep, 2026 | npm @quantixfinance/api |
SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f) CVE-2026-65607, GHSA-gw25-m53r-qh88, GO-2026-6365 | Medium | Not scored | 03 Sep, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass CVE-2026-66394, GHSA-99rq-75j6-5j9f, GO-2026-6364 | High | Not scored | 03 Sep, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Malicious release: Malicious code in fieldbase-webapplication-buildtools (npm) MAL-2026-15847 | Malicious | Not scored | 03 Sep, 2026 | npm fieldbase-webapplication-buildtools |
Malicious release: Malicious code in btree-range-store (npm) GHSA-5p9f-98mr-w2hr, MAL-2026-15876 | Malicious | Not scored | 03 Sep, 2026 | npm btree-range-store |
Malicious release: Malicious code in priority-slot-queue (npm) GHSA-7gh9-f2pq-8vf3, MAL-2026-15892 | Malicious | Not scored | 03 Sep, 2026 | npm priority-slot-queue |
Malicious release: Malicious code in btree-time-index (npm) GHSA-7r97-jh52-2rx8, MAL-2026-15877 | Malicious | Not scored | 03 Sep, 2026 | npm btree-time-index |
Malicious release: Malicious code in sliding-score-window (npm) GHSA-7wm7-mj8v-49f7, MAL-2026-15893 | Malicious | Not scored | 03 Sep, 2026 | npm sliding-score-window |
Malicious release: Malicious code in neighbor-key-map (npm) GHSA-c7w5-hg7j-94q4, MAL-2026-15889 | Malicious | Not scored | 03 Sep, 2026 | npm neighbor-key-map |
Malicious release: Malicious code in btree-leaderboard (npm) GHSA-jj56-73wg-7pff, MAL-2026-15874 | Malicious | Not scored | 03 Sep, 2026 | npm btree-leaderboard |
Malicious release: Malicious code in btree-lru-cache (npm) GHSA-p5xg-f96c-j538, MAL-2026-15875 | Malicious | Not scored | 03 Sep, 2026 | npm btree-lru-cache |
Malicious release: Malicious code in ordered-kv-index (npm) GHSA-r948-p23m-ffg3, MAL-2026-15891 | Malicious | Not scored | 03 Sep, 2026 | npm ordered-kv-index |
Malicious release: Malicious code in btree-core (npm) GHSA-wj64-2cmx-c3j4, MAL-2026-15873 | Malicious | Not scored | 03 Sep, 2026 | npm btree-core |
Malicious release: Malicious code in ordered-freq-counter (npm) GHSA-xjh3-6ch8-mr8c, MAL-2026-15890 | Malicious | Not scored | 03 Sep, 2026 | npm ordered-freq-counter |
Malicious release: Malicious code in indexed-btree (npm) GHSA-f3xx-wvxc-5vh4, MAL-2026-15888 | Malicious | Not scored | 03 Sep, 2026 | npm indexed-btree |
Malicious release: Malicious code in cbc97b7a (npm) GHSA-9m3c-67f2-gjwf, MAL-2026-15878 | Malicious | Not scored | 03 Sep, 2026 | npm cbc97b7a |
Malicious release: Malicious code in fullcalendar-windos (npm) GHSA-r79q-6mfx-5r5v, MAL-2026-15883 | Malicious | Not scored | 03 Sep, 2026 | npm fullcalendar-windos |
Malicious release: Malicious code in element-guci-util (npm) GHSA-rv3j-whh5-7gwg, MAL-2026-15880 | Malicious | Not scored | 03 Sep, 2026 | npm element-guci-util |
Malicious release: Malicious code in element-icon-guci (npm) GHSA-vmx8-58pp-r729, MAL-2026-15881 | Malicious | Not scored | 03 Sep, 2026 | npm element-icon-guci |
Malicious release: Malicious code in guci-wxrout (npm) GHSA-wm72-hv9c-mxxr, MAL-2026-15886 | Malicious | Not scored | 03 Sep, 2026 | npm guci-wxrout |
Malicious release: Malicious code in element-utils-guci (npm) GHSA-xmq8-5hmm-8m7p, MAL-2026-15882 | Malicious | Not scored | 03 Sep, 2026 | npm element-utils-guci |
Malicious release: Malicious code in guci-main (npm) GHSA-xv44-v947-3jrh, MAL-2026-15885 | Malicious | Not scored | 03 Sep, 2026 | npm guci-main |
Malicious release: Malicious code in guci-date (npm) GHSA-pg5x-8f3x-f3x5, MAL-2026-15884 | Malicious | Not scored | 03 Sep, 2026 | npm guci-date |
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority CVE-2026-84394, GHSA-58mr-gqgx-xq4g | High | 0.4% | 03 Sep, 2026 | npm fast-uri |
Malicious release: Malicious code in google-cloud-internal-build-helper (npm) GHSA-3qp7-c8c6-w6vj, MAL-2026-15839 | Malicious | Not scored | 03 Sep, 2026 | npm google-cloud-internal-build-helper |
Malicious release: Malicious code in frank-apple-sync-service (npm) GHSA-463x-3972-8874, MAL-2026-15837 | Malicious | Not scored | 03 Sep, 2026 | npm frank-apple-sync-service |