Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain CVE-2026-22686, GHSA-7qm7-455j-5p63 | Critical | 0.8% | 14 Jan, 2026 | npm enclave-vm |
Malicious website can execute commands on the local system through XSS in the OpenCode web UI CVE-2026-22813, GHSA-c83v-7274-4vgp | Critical | 0.9% | 12 Jan, 2026 | npm opencode-ai |
orval MCP client is vulnerable to a code injection attack. CVE-2026-22785, GHSA-mwr6-3gp8-9jmj | Critical | 0.8% | 12 Jan, 2026 | npm @orval/mcp |
React Router has Path Traversal in File Session Storage CVE-2025-61686, GHSA-9583-h5hc-x8cw | Critical | 17.3% | 08 Jan, 2026 | npm @react-router/node npm @remix-run/deno npm @remix-run/node |
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling CVE-2026-21858, GHSA-v4pr-fm98-w9pg | Critical | 78.2% | 07 Jan, 2026 | npm n8n |
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default" CVE-2025-69264, GHSA-379q-355j-w6rj | Critical | 1.0% | 07 Jan, 2026 | npm pnpm |
n8n Vulnerable to RCE via Arbitrary File Write CVE-2026-21877, GHSA-v364-rw7m-3263 | Critical | 5.4% | 06 Jan, 2026 | npm n8n |
Vega XSS via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope CVE-2025-65110, GHSA-829q-m3qg-ph8r | Critical | 0.5% | 05 Jan, 2026 | npm vega-selections |
jsPDF has Local File Inclusion/Path Traversal vulnerability CVE-2025-68428, GHSA-f8cm-6447-x5h2 | Critical | 2.2% | 05 Jan, 2026 | npm jspdf |
AdonisJS Path Traversal in Multipart File Handling CVE-2026-21440, GHSA-gvq6-hvvp-h34h | Critical | 1.0% | 02 Jan, 2026 | npm @adonisjs/bodyparser |
Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling CVE-2025-68620, GHSA-fq56-hvg6-wvm5 | Critical | 0.5% | 01 Jan, 2026 | npm signalk-server |
Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) CVE-2025-66398, GHSA-w3x5-7c4c-66p9 | Critical | 19.9% | 01 Jan, 2026 | npm signalk-server |
n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node CVE-2025-68668, GHSA-62r4-hw23-cc8v | Critical | 13.2% | 26 Dec, 2025 | npm n8n |
apidoc-core has a prototype pollution vulnerability CVE-2025-13158, GHSA-6vj3-p34w-xxjp | Critical | 0.5% | 26 Dec, 2025 | npm apidoc-core |
LangChain serialization injection vulnerability enables secret extraction CVE-2025-68665, GHSA-r399-636x-v7f6 | Critical | 0.8% | 23 Dec, 2025 | npm @langchain/core npm langchain |
n8n Vulnerable to Remote Code Execution via Expression Injection CVE-2025-68613, GHSA-v98v-ff95-f3cp | CriticalExploited | 99.0% | 19 Dec, 2025 | npm n8n |
Elysia vulnerable to prototype pollution with multiple standalone schema validation CVE-2025-66456, GHSA-hxj9-33pp-j2cc | Critical | 0.6% | 09 Dec, 2025 | npm elysia |
@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server CVE-2025-67489, GHSA-j76j-5p5g-9wfr | Critical | 0.8% | 08 Dec, 2025 | npm @vitejs/plugin-rsc |
n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook CVE-2025-65964, GHSA-wpqc-h9wp-chmq | Critical | 0.7% | 08 Dec, 2025 | npm n8n |
Altcha Proof-of-Work obfuscation mode cryptanalytic break CVE-2025-65849, GHSA-mpmc-qchh-r9q8 | Critical | 0.2% | 08 Dec, 2025 | npm altcha |
React Server Components are Vulnerable to RCE GHSA-fmh4-wr37-44fp | Critical | Not scored | 03 Dec, 2025 | npm @vitejs/plugin-rsc |
Next.js is vulnerable to RCE in React flight protocol GHSA-9qr9-h5gf-34mp | Critical | Not scored | 03 Dec, 2025 | npm next |
React Server Components are Vulnerable to RCE CVE-2025-55182, GHSA-fv66-9v8q-g76r | CriticalExploited | 99.8% | 03 Dec, 2025 | npm react-server-dom-parcel npm react-server-dom-turbopack npm react-server-dom-webpack |
MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL CVE-2025-66401, GHSA-27m7-ffhq-jqrm | Critical | 2.2% | 01 Dec, 2025 | npm mcp-watch |
Better Auth affected by external request basePath modification DoS CVE-2025-71401, GHSA-569q-mpph-wgww | Critical | 0.5% | 01 Dec, 2025 | npm better-auth |
md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter CVE-2025-65108, GHSA-547r-qmjm-8hvw | Critical | 1.0% | 20 Nov, 2025 | npm md-to-pdf |
@hpke/core reuses AEAD nonces CVE-2025-64767, GHSA-73g8-5h73-26h4 | Critical | 0.2% | 20 Nov, 2025 | npm @hpke/core |
Flowise has Authentication Bypass Using Unprotected Registration Endpoint (/register) CVE-2025-71327, GHSA-v5w9-prxf-w882 | Critical | 0.7% | 17 Nov, 2025 | npm flowise |
expr-eval does not restrict functions passed to the evaluate function CVE-2025-12735, GHSA-jc85-fpwf-qm7x | Critical | 1.8% | 05 Nov, 2025 | npm expr-eval npm expr-eval-fork |
@react-native-community/cli has arbitrary OS command injection CVE-2025-11953, GHSA-399j-vxmf-hjvr | CriticalExploited | 94.0% | 03 Nov, 2025 | npm @react-native-community/cli npm @react-native-community/cli-server-api |
happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript CVE-2025-62410, GHSA-qpm2-6cq5-7pq5 | Critical | 0.4% | 15 Oct, 2025 | npm happy-dom |
Happy DOM: VM Context Escape can lead to Remote Code Execution CVE-2025-61927, GHSA-37j7-fg3j-429f | Critical | 0.6% | 10 Oct, 2025 | npm happy-dom |
Better Auth: Unauthenticated API key creation through api-key plugin CVE-2025-61928, GHSA-99h5-pjcv-gr6v | Critical | 19.7% | 09 Oct, 2025 | npm better-auth |
Flowise is vulnerable to arbitrary file write through its WriteFileTool CVE-2025-61913, GHSA-jv9m-vf54-chjj | Critical | 13.9% | 08 Oct, 2025 | npm Flowise npm flowise npm flowise-components |
SillyTavern Web Interface Vulnerable DNS Rebinding CVE-2025-59159, GHSA-7cxj-w27x-x78q | Critical | 0.3% | 06 Oct, 2025 | npm sillytavern |
Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel CVE-2025-50538, GHSA-964p-j4gg-mhwc | Critical | 14.7% | 03 Oct, 2025 | npm flowise |
check-branches is vulnerable to command Injection CVE-2025-11148, GHSA-9c4g-fp4r-prrv | Critical | 1.4% | 30 Sep, 2025 | npm check-branches |
get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass CVE-2025-59936, GHSA-qc2q-qhf3-235m | Critical | 0.4% | 26 Sep, 2025 | npm get-jwks |
cors-anywhere vulnerable to server-side request forgery CVE-2020-36851, GHSA-r3jv-xfgx-gj24 | Critical | 0.8% | 25 Sep, 2025 | npm cors-anywhere |
magix-combine-ex vulnerable to prototype pollution CVE-2025-57321, GHSA-cr7h-93fh-whwm | Critical | 0.4% | 24 Sep, 2025 | npm magix-combine-ex |
Command Injection in adb-mcp MCP Server CVE-2025-59834, GHSA-54j7-grvr-9xwg | Critical | 2.5% | 24 Sep, 2025 | npm adb-mcp |
@digitalocean/do-markdownit has Type Confusion vulnerability CVE-2025-59717, GHSA-2h8j-8r9p-849f | Critical | 0.4% | 19 Sep, 2025 | npm @digitalocean/do-markdownit |
Flowise has unsandboxed remote code execution via Custom MCP CVE-2025-71336, GHSA-6933-jpx5-q87q | Critical | 1.1% | 15 Sep, 2025 | npm flowise |
Flowise has arbitrary file access due to missing chat flow id validation CVE-2025-71334, GHSA-q67q-549q-p849 | Critical | 4.4% | 15 Sep, 2025 | npm flowise |
Flowise has an Arbitrary File Read CVE-2025-71324, GHSA-99pg-hqvx-r4gf | Critical | 1.6% | 15 Sep, 2025 | npm flowise |
Flowise has Remote Code Execution vulnerability CVE-2025-59528, GHSA-3gcm-f6qx-ff7p | Critical | 86.2% | 15 Sep, 2025 | npm flowise |
FlowiseAI Pre-Auth Arbitrary Code Execution CVE-2025-57164, GHSA-7944-7c6r-55vv | Critical | 0.6% | 15 Sep, 2025 | npm flowise |
Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover CVE-2025-58434, GHSA-wgpv-6j63-x5ph | Critical | 76.4% | 12 Sep, 2025 | npm flowise |
interactive-git-checkout has a Command Injection vulnerability CVE-2025-59046, GHSA-4wcm-7hjf-6xw5 | Critical | 1.1% | 09 Sep, 2025 | npm interactive-git-checkout |
Prebid-universal-creative latest on npm briefly compromised CVE-2025-59039, GHSA-m662-56rj-8fmm | Critical | 0.3% | 09 Sep, 2025 | npm prebid-universal-creative |