Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code CVE-2025-54313, GHSA-f29h-pxvx-f335 | HighExploited | 5.1% | 19 Jul, 2025 | npm @pkgr/core npm eslint-config-prettier npm eslint-plugin-prettier npm got-fetch +2 more |
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query CVE-2025-31125, GHSA-4r4m-qw57-chr8 | HighExploited | 65.8% | 31 Mar, 2025 | npm vite |
Electron affected by libvpx's heap buffer overflow in vp8 encoding CVE-2023-5217, GHSA-qqvq-6xgj-jw8g | HighExploited | 49.0% | 28 Sep, 2023 | npm electron |
libwebp: OOB write in BuildHuffmanTable A-299477569, ASB-A-299477569, CVE-2023-4863, CVE-2023-5129, GHSA-j7hp-h8jx-5ppr, PYSEC-2026-1794, RUSTSEC-2023-0060, RUSTSEC-2023-0061 | HighExploited | 100.0% | 12 Sep, 2023 | Go github.com/chai2010/webp NuGet SkiaSharp NuGet magick.net-q16-anycpu NuGet magick.net-q16-hdri-anycpu +10 more |
Strapi leaking sensitive user information by filtering on private fields CVE-2023-22894, GHSA-jjqf-j4w7-92w8 | HighExploited | 4.1% | 19 Apr, 2023 | npm @strapi/strapi |
Command Injection Vulnerability CVE-2021-21315, GHSA-2m8v-572m-ff2v | HighExploited | 90.7% | 16 Feb, 2021 | npm systeminformation |