Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in framework-zero (npm) GHSA-c583-7r3r-x2p8, MAL-2026-15500 | Malicious | Not scored | 28 Aug, 2026 | npm framework-zero |
Malicious release: Malicious code in ring-device-settings-library (npm) GHSA-c9hf-9c62-jcfq, GHSA-f4f7-3wwr-hxfx, MAL-2026-15520 | Malicious | Not scored | 28 Aug, 2026 | npm ring-device-settings-library |
Malicious release: Malicious code in katal-logger (npm) GHSA-f2rf-58x5-5f6w, MAL-2026-15513 | Malicious | Not scored | 28 Aug, 2026 | npm katal-logger |
Malicious release: Malicious code in payments-ui-services (npm) GHSA-jhxr-q6vp-9x3m, MAL-2026-15518 | Malicious | Not scored | 28 Aug, 2026 | npm payments-ui-services |
Malicious release: Malicious code in calcite-web (npm) GHSA-fhxc-p24q-34ch, MAL-2026-15499 | Malicious | Not scored | 28 Aug, 2026 | npm calcite-web |
Malicious release: Malicious code in tabbables (npm) GHSA-4g4c-9232-9cwv, MAL-2026-15524 | Malicious | Not scored | 28 Aug, 2026 | npm tabbables |
Malicious release: Malicious code in jsb-adapter (npm) GHSA-69pf-x798-g22x, MAL-2026-15512 | Malicious | Not scored | 28 Aug, 2026 | npm jsb-adapter |
Malicious release: Malicious code in alimama-minisite (npm) GHSA-q5h9-9fg7-xg2g, MAL-2026-15495 | Malicious | Not scored | 28 Aug, 2026 | npm alimama-minisite |
Malicious release: Malicious code in one-intuit-help-system-utils (npm) GHSA-93c7-v93p-97cw, MAL-2026-15517 | Malicious | Not scored | 28 Aug, 2026 | npm one-intuit-help-system-utils |
Malicious release: Malicious code in npm-extension (npm) GHSA-f2fx-3q3p-v293, MAL-2026-15515 | Malicious | Not scored | 28 Aug, 2026 | npm npm-extension |
Malicious release: Malicious code in mintel-taskbar (npm) GHSA-x2qj-v4rx-3phv, MAL-2026-15514 | Malicious | Not scored | 28 Aug, 2026 | npm mintel-taskbar |
Malicious release: Malicious code in amplitude-session-replay (npm) GHSA-jvwx-f8cc-jjj8, MAL-2026-15497 | Malicious | Not scored | 28 Aug, 2026 | npm amplitude-session-replay |
Malicious release: Malicious code in integration-amplitude (npm) GHSA-m5fj-7mm7-mg9p, MAL-2026-15510 | Malicious | Not scored | 28 Aug, 2026 | npm integration-amplitude |
Malicious release: Malicious code in aws-blog (npm) GHSA-q8ww-mqrw-jq9q, MAL-2026-15498 | Malicious | Not scored | 28 Aug, 2026 | npm aws-blog |
Malicious release: Malicious code in intuit-authz (npm) GHSA-vp52-xxhf-m857, MAL-2026-15511 | Malicious | Not scored | 28 Aug, 2026 | npm intuit-authz |
Malicious release: Malicious code in amplitude-experiment (npm) GHSA-4qr2-j5wh-f48g, MAL-2026-15496 | Malicious | Not scored | 28 Aug, 2026 | npm amplitude-experiment |
Malicious release: Malicious code in search-reservation (npm) GHSA-j5xq-g44w-jh7c, MAL-2026-15521 | Malicious | Not scored | 28 Aug, 2026 | npm search-reservation |
Malicious release: Malicious code in sycm-vendors (npm) GHSA-7h72-24vr-wrf6, MAL-2026-15523 | Malicious | Not scored | 28 Aug, 2026 | npm sycm-vendors |
Malicious release: Malicious code in nx-app (npm) GHSA-h9j7-rx3x-rwhc, GHSA-vmrp-3pwx-mj42, MAL-2026-15516 | Malicious | Not scored | 28 Aug, 2026 | npm nx-app |
Malicious release: Malicious code in grafeno-utils (npm) MAL-2026-15509 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-utils |
Malicious release: Malicious code in grafeno-sdk (npm) MAL-2026-15508 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-sdk |
Malicious release: Malicious code in grafeno-config (npm) MAL-2026-15504 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-config |
Malicious release: Malicious code in grafeno-api (npm) MAL-2026-15501 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-api |
Malicious release: Malicious code in grafeno-client (npm) MAL-2026-15503 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-client |
Malicious release: Malicious code in grafeno-auth (npm) MAL-2026-15502 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-auth |
Malicious release: Malicious code in grafeno-logger (npm) MAL-2026-15506 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-logger |
Malicious release: Malicious code in spc-grafeno (npm) MAL-2026-15522 | Malicious | Not scored | 28 Aug, 2026 | npm spc-grafeno |
Malicious release: Malicious code in grafeno-core (npm) MAL-2026-15505 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-core |
Malicious release: Malicious code in grafeno-pix (npm) MAL-2026-15507 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-pix |
Malicious release: Malicious code in @7nohe/openapi-react-query-codegen (npm) GHSA-rg27-qr39-ch6w, MAL-2026-15494 | Malicious | Not scored | 28 Aug, 2026 | npm @7nohe/openapi-react-query-codegen |
MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets BIT-mariadb-2026-55855, BIT-mariadb-min-2026-55855, BIT-mysql-client-2026-55855, CVE-2026-55855, GHSA-g5xc-5w98-jfvm | Medium | 0.7% | 28 Aug, 2026 | npm mariadb |
free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA CVE-2026-55785, GHSA-fp46-6vfw-gc9c, GO-2026-6328 | Low | Not scored | 28 Aug, 2026 | Go github.com/free5gc/ausf |
free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI CVE-2026-55784, GHSA-334q-h5g3-fpxv, GO-2026-6326 | High | Not scored | 28 Aug, 2026 | Go github.com/free5gc/ausf |
Malicious release: Malicious code in grafeno-actions (npm) MAL-2026-15596 | Malicious | Not scored | 28 Aug, 2026 | npm grafeno-actions |
silverstripe/versioned has XSS in archive admin restore CVE-2026-55779, GHSA-m4g4-86qc-v8w7 | Medium | 0.3% | 28 Aug, 2026 | Packagist silverstripe/versioned |
SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read BIT-seaweedfs-2026-55874, CVE-2026-55874, GHSA-56wq-x3wv-3ff4, GO-2026-6327 | High | Not scored | 28 Aug, 2026 | Go github.com/seaweedfs/seaweedfs |
multer vulnerable to Denial of Service via oversized array index in field names CVE-2026-82333, GHSA-535w-7cp7-47q4 | High | 0.4% | 28 Aug, 2026 | npm multer |
multer vulnerable to Denial of Service via crafted multipart field names CVE-2026-77078, GHSA-wc9g-mqfw-jrwm | High | 0.5% | 28 Aug, 2026 | npm multer |
multer vulnerable to file size limit bypass via async fileFilter race condition CVE-2026-77063, GHSA-qvfw-j98x-7q72 | Low | 0.2% | 28 Aug, 2026 | npm multer |
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads CVE-2026-77037, GHSA-qfvm-cv95-jqjf | High | 0.5% | 28 Aug, 2026 | npm multer |
SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets BIT-seaweedfs-2026-55873, CVE-2026-55873, GHSA-hgpf-8634-g44c, GO-2026-6329 | Medium | Not scored | 28 Aug, 2026 | Go github.com/seaweedfs/seaweedfs |
klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply CVE-2026-55764, GHSA-mrpp-v6pg-p54x, GO-2026-6330 | High | Not scored | 28 Aug, 2026 | Go github.com/klever-io/klever-go |
MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials BIT-mariadb-2026-55854, BIT-mariadb-min-2026-55854, BIT-mysql-client-2026-55854, CVE-2026-55854, GHSA-42r5-vhpq-m858 | Medium | 0.4% | 28 Aug, 2026 | npm mariadb |
arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset CVE-2026-55678, GHSA-p378-jp5r-gpgw, GO-2026-6322 | Medium | Not scored | 28 Aug, 2026 | Go github.com/basekick-labs/arc |
Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances CVE-2026-55761, GHSA-x626-fcwx-f5pc, GO-2026-6324 | High | Not scored | 28 Aug, 2026 | Go github.com/portainer/portainer |
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits CVE-2026-55763, GHSA-v358-wf77-39xv, GO-2026-6323 | High | Not scored | 28 Aug, 2026 | Go github.com/klever-io/klever-go |
PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI CVE-2026-55891, GHSA-xrjc-c68j-hp7w | Low | 0.5% | 28 Aug, 2026 | Packagist privatebin/privatebin |
PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction CVE-2026-55696, GHSA-f2xf-7x3g-4272 | Medium | 0.4% | 28 Aug, 2026 | Packagist privatebin/privatebin |
JFrog Artifactory Improper Authentication Vulnerability CVE-2026-82329 | CriticalExploited | 14.4% | 28 Aug, 2026 | |
AIIR verification and policy gates could report success without enforcing the control (fail-open) GHSA-73p9-6hrp-8qhr | Medium | Not scored | 28 Aug, 2026 | PyPI aiir |