Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
@akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through `exec` API CVE-2025-54994, GHSA-3ch2-jxxc-v4xf | Critical | 1.3% | 08 Sep, 2025 | npm @akoskm/create-mcp-server-stdio |
CodeceptJS's incomprehensive sanitation can lead to Command Injection CVE-2025-57285, GHSA-34w8-mcwr-vg29 | Critical | 2.2% | 08 Sep, 2025 | npm codeceptjs |
Malicious release: Malicious versions of Nx were published CVE-2025-10894, GHSA-cxm3-wv7p-598c, MAL-2025-41436, MAL-2025-41437, MAL-2025-41438, MAL-2025-41439, MAL-2025-41440, MAL-2025-41441, MAL-2025-41442, MAL-2025-41443 | MaliciousCritical | 0.6% | 27 Aug, 2025 | npm @nx/devkit npm @nx/enterprise-cloud npm @nx/eslint npm @nx/js +4 more |
sha.js is missing type checks leading to hash rewind and passing on crafted data CVE-2025-9288, GHSA-95m3-7q98-8xr5 | Critical | 0.7% | 20 Aug, 2025 | npm sha.js |
cipher-base is missing type checks, leading to hash rewind and passing on crafted data CVE-2025-9287, GHSA-cpq7-6gpm-g9rc | Critical | 0.5% | 20 Aug, 2025 | npm cipher-base |
Directus allows unauthenticated file upload and file modification due to lacking input sanitization CVE-2025-55746, GHSA-mv33-9f6j-pfmc | Critical | 1.4% | 20 Aug, 2025 | npm @directus/api npm directus |
screenshot-desktop vulnerable to command Injection via `format` option CVE-2025-55294, GHSA-gjx4-2c7g-fm94 | Critical | 1.4% | 19 Aug, 2025 | npm screenshot-desktop |
Flowise OS command remote code execution CVE-2025-8943, GHSA-2vv2-3x8x-4gv7 | Critical | 75.2% | 14 Aug, 2025 | npm flowise |
Flowise vulnerable to RCE via Dynamic function constructor injection CVE-2025-55346, GHSA-hmgh-466j-fx4c | Critical | 22.5% | 14 Aug, 2025 | npm flowise |
@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers CVE-2025-54782, GHSA-85cg-cmq5-qjm7 | Critical | 53.3% | 01 Aug, 2025 | npm @nestjs/devtools-integration |
Node-SAML SAML Signature Verification Vulnerability CVE-2025-54419, GHSA-4mxg-3p6v-xgq3 | Critical | 0.4% | 28 Jul, 2025 | npm @node-saml/node-saml npm @node-saml/passport-saml npm passport-saml |
Node-SAML SAML Authentication Bypass CVE-2025-54369, GHSA-m837-g268-mmv7 | Critical | 0.5% | 24 Jul, 2025 | npm @node-saml/node-saml npm node-saml |
NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access CVE-2025-54127, GHSA-f38f-jvqj-mfg6 | Critical | 0.5% | 21 Jul, 2025 | npm @haxtheweb/haxcms-nodejs |
form-data uses unsafe random function in form-data for choosing boundary CVE-2025-7783, GHSA-fjxv-7rqg-78g4 | Critical | 1.8% | 18 Jul, 2025 | npm form-data |
docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token CVE-2025-53624, GHSA-qf34-qpr4-5pph | Critical | 2.0% | 09 Jul, 2025 | npm docusaurus-plugin-content-gists |
Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests CVE-2025-53620, GHSA-qr9h-j6xg-2j72 | Critical | 0.4% | 09 Jul, 2025 | npm @builder.io/qwik-city |
mcp-remote exposed to OS command injection via untrusted MCP server connections CVE-2025-6514, GHSA-6xpm-ggf7-wc3p | Critical | 77.0% | 09 Jul, 2025 | npm mcp-remote |
pbkdf2 silently disregards Uint8Array input, returning static keys CVE-2025-6547, GHSA-v62p-rq8g-8h59 | Critical | 0.5% | 23 Jun, 2025 | npm pbkdf2 |
pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos CVE-2025-6545, GHSA-h7cp-r72f-jxh6 | Critical | 0.4% | 23 Jun, 2025 | npm pbkdf2 |
Taylored webhook validation vulnerabilities GHSA-8g98-m4j9-qww5 | Critical | Not scored | 18 Jun, 2025 | npm taylored |
MCP Inspector proxy server lacks authentication between the Inspector client and proxy CVE-2025-49596, GHSA-7f8r-222p-6f5g | Critical | 44.5% | 13 Jun, 2025 | npm @modelcontextprotocol/inspector |
@nx/azure-cache Vulnerable to Build Cache Poisoning via Untrusted Pull Requests CVE-2025-36852, GHSA-rrr2-jcr8-7q3x | Critical | 0.2% | 10 Jun, 2025 | npm @nx/azure-cache |
Erxes Incorrect Access Control vulnerability CVE-2024-57190, GHSA-7rhv-xm4q-wh42 | Critical | 0.6% | 10 Jun, 2025 | npm erxes |
billboard.js allows prototype pollution via the function generate CVE-2025-49223, GHSA-65p9-j6pg-72hj | Critical | 0.8% | 04 Jun, 2025 | npm billboard.js |
samlify SAML Signature Wrapping attack CVE-2025-47949, GHSA-r683-v43c-6xqv | Critical | 0.5% | 19 May, 2025 | npm samlify |
Passport-wsfed-saml2 allows SAML Authentication Bypass via Signature Wrapping CVE-2025-46572, GHSA-wjmp-wphq-jvqf | Critical | 0.4% | 06 May, 2025 | npm passport-wsfed-saml2 |
AWS Amplify Studio UI Component Properties Has an Input Validation Issue CVE-2025-4318, GHSA-hf3j-86p7-mfw8 | Critical | 1.0% | 05 May, 2025 | npm @aws-amplify/codegen-ui-react |
Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2 CVE-2025-32965, GHSA-33qr-m49q-rxfx | Critical | 0.9% | 22 Apr, 2025 | npm xrpl |
crud-query-parser SQL Injection vulnerability CVE-2025-32020, GHSA-9r25-rp3p-h2w4 | Critical | 0.4% | 08 Apr, 2025 | npm crud-query-parser |
Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell` CVE-2025-31477, GHSA-c9pr-q8gx-3mgp | Critical | 1.0% | 02 Apr, 2025 | crates.io tauri-plugin-shell npm @tauri-apps/plugin-shell |
@alizeait/unflatto Prototype Pollution CVE-2024-38988, GHSA-q8jq-4rm5-4hm5 | Critical | 0.9% | 28 Mar, 2025 | npm @alizeait/unflatto |
depath and cool-path vulnerable to Prototype Pollution via `set()` Method CVE-2024-38985, GHSA-4h4x-4m75-47j4 | Critical | 0.8% | 28 Mar, 2025 | npm cool-path npm depath |
Authorization Bypass in Next.js Middleware CVE-2025-29927, GHSA-f82v-jwr5-mffw | Critical | 99.2% | 21 Mar, 2025 | npm next |
Flowise allows arbitrary file write to RCE CVE-2025-71338, GHSA-8vvx-qvq9-5948 | Critical | 1.2% | 14 Mar, 2025 | npm flowise |
xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment CVE-2025-29775, GHSA-x3m8-899r-f7c3 | Critical | 10.1% | 14 Mar, 2025 | npm xml-crypto |
xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References CVE-2025-29774, GHSA-9p8x-f768-wp2g | Critical | 9.1% | 14 Mar, 2025 | npm xml-crypto |
Flowise Pre-auth Arbitrary File Upload CVE-2025-71333, GHSA-h42x-xx2q-6v6g | Critical | 0.9% | 13 Mar, 2025 | npm flowise |
canvg Prototype Pollution vulnerability CVE-2025-25977, GHSA-v2mw-5mch-w8c5 | Critical | 0.7% | 10 Mar, 2025 | npm canvg |
FlowiseAI Flowise arbitrary file upload vulnerability CVE-2025-26319, GHSA-69jq-qr7w-j7qh | Critical | 55.9% | 04 Mar, 2025 | npm flowise |
DocsGPT Allows Remote Code Execution CVE-2025-0868, GHSA-9gff-5v8w-x922 | Critical | 17.1% | 20 Feb, 2025 | npm docsgpt |
Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) GHSA-vjh7-7g9h-fjfh | Critical | Not scored | 12 Feb, 2025 | npm elliptic |
Inefficient Regular Expression Complexity in koa CVE-2025-25200, GHSA-593f-38f6-jp5m | Critical | 0.8% | 12 Feb, 2025 | npm koa |
Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc CVE-2025-24981, GHSA-j82m-pc2v-2484 | Critical | 0.7% | 06 Feb, 2025 | npm @nuxtjs/mdc |
utils-extend Prototype Pollution CVE-2024-57077, GHSA-7qgg-vw88-cc99 | Critical | 0.5% | 05 Feb, 2025 | npm utils-extend |
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening CVE-2025-24964, GHSA-9crc-q9x8-hgqq | Critical | 0.7% | 04 Feb, 2025 | npm vitest |
Mongoose search injection vulnerability BIT-mongoose-2025-23061, CVE-2025-23061, GHSA-vg7j-7cwx-8wgw | Critical | 7.2% | 15 Jan, 2025 | npm mongoose |
path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability CVE-2024-56198, GHSA-94p5-r7cc-3rpr | Critical | 0.7% | 31 Dec, 2024 | npm path-sanitizer |
Angular Expressions - Remote Code Execution when using locals CVE-2024-54152, GHSA-5462-4vcx-jh7j | Critical | 2.2% | 10 Dec, 2024 | npm angular-expressions |
Bit flip attack vulnerability in cookie-encrypter CVE-2024-53441, GHSA-h63v-hw6g-x8hp | Critical | 0.3% | 09 Dec, 2024 | npm cookie-encrypter |
Mongoose search injection vulnerability BIT-mongoose-2024-53900, CVE-2024-53900, GHSA-m7xq-9374-9rvx | Critical | 4.0% | 02 Dec, 2024 | npm mongoose |