Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys CVE-2026-45321, GHSA-g7cv-rxg3-hmpx | CriticalExploited | 3.3% | 12 May, 2026 | npm @tanstack/arktype-adapter npm @tanstack/eslint-plugin-router npm @tanstack/eslint-plugin-start npm @tanstack/history +38 more |
n8n Vulnerable to Remote Code Execution via Expression Injection CVE-2025-68613, GHSA-v98v-ff95-f3cp | CriticalExploited | 99.0% | 19 Dec, 2025 | npm n8n |
React Server Components are Vulnerable to RCE CVE-2025-55182, GHSA-fv66-9v8q-g76r | CriticalExploited | 99.8% | 03 Dec, 2025 | npm react-server-dom-parcel npm react-server-dom-turbopack npm react-server-dom-webpack |
@react-native-community/cli has arbitrary OS command injection CVE-2025-11953, GHSA-399j-vxmf-hjvr | CriticalExploited | 94.0% | 03 Nov, 2025 | npm @react-native-community/cli npm @react-native-community/cli-server-api |
eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code CVE-2025-54313, GHSA-f29h-pxvx-f335 | HighExploited | 5.1% | 19 Jul, 2025 | npm @pkgr/core npm eslint-config-prettier npm eslint-plugin-prettier npm got-fetch +2 more |
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query CVE-2025-31125, GHSA-4r4m-qw57-chr8 | HighExploited | 65.8% | 31 Mar, 2025 | npm vite |
Electron affected by libvpx's heap buffer overflow in vp8 encoding CVE-2023-5217, GHSA-qqvq-6xgj-jw8g | HighExploited | 49.0% | 28 Sep, 2023 | npm electron |
libwebp: OOB write in BuildHuffmanTable A-299477569, ASB-A-299477569, CVE-2023-4863, CVE-2023-5129, GHSA-j7hp-h8jx-5ppr, PYSEC-2026-1794, RUSTSEC-2023-0060, RUSTSEC-2023-0061 | HighExploited | 100.0% | 12 Sep, 2023 | Go github.com/chai2010/webp NuGet SkiaSharp NuGet magick.net-q16-anycpu NuGet magick.net-q16-hdri-anycpu +10 more |
Strapi leaking sensitive user information by filtering on private fields CVE-2023-22894, GHSA-jjqf-j4w7-92w8 | HighExploited | 4.1% | 19 Apr, 2023 | npm @strapi/strapi |
Heap buffer overflow in GPU CVE-2022-4135, GHSA-995f-9x5r-2rcj | CriticalExploited | 31.9% | 25 Nov, 2022 | npm electron |
Command Injection Vulnerability CVE-2021-21315, GHSA-2m8v-572m-ff2v | HighExploited | 90.7% | 16 Feb, 2021 | npm systeminformation |
Potential XSS vulnerability in jQuery BIT-drupal-2020-11023, CVE-2020-11023, GHSA-jpcq-cgw6-v4j6 | MediumExploited | 84.9% | 29 Apr, 2020 | Maven org.webjars.npm:jquery NuGet jQuery Packagist components/jquery RubyGems jquery-rails +1 more |
Remote Code Execution Vulnerability in NPM mongo-express CVE-2019-10758, GHSA-h47j-hc6x-h3qq, SNYK-JS-MONGOEXPRESS-473215 | CriticalExploited | 84.7% | 24 Dec, 2019 | npm mongo-express |
Use-After-Free in puppeteer CVE-2019-5786, GHSA-c2gp-86p4-5935 | MediumExploited | 61.1% | 27 Jun, 2019 | npm puppeteer |