Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
React Router has CSRF issue in Action/Server Action Request Processing CVE-2026-22030, GHSA-h5cw-625j-3rxh | Medium | 0.2% | 08 Jan, 2026 | npm @remix-run/server-runtime npm react-router |
React Router has unexpected external redirect via untrusted paths CVE-2025-68470, GHSA-9jcx-v3wj-wh4m | Medium | 0.5% | 08 Jan, 2026 | npm react-router |
n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks CVE-2026-21894, GHSA-jf52-3f2h-h9j5 | Medium | 0.5% | 07 Jan, 2026 | npm n8n |
Directus has open redirect in SAML CVE-2026-22032, GHSA-3573-4c68-g8cc | Medium | 0.2% | 06 Jan, 2026 | npm @directus/api npm directus |
evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API CVE-2025-67427, GHSA-vp8w-wj4m-3r7j | Medium | 0.2% | 05 Jan, 2026 | npm @evershop/evershop |
ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds. CVE-2026-73645, GHSA-hqf9-8xv5-x8xw | Medium | 0.5% | 05 Jan, 2026 | npm @openzeppelin/confidential-contracts |
Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints CVE-2025-68273, GHSA-fpf5-w967-rr2m | Medium | 0.8% | 01 Jan, 2026 | npm signalk-server |
Trix has a stored XSS vulnerability through its attachment attribute GHSA-g9jg-w8vm-g96v | Medium | Not scored | 31 Dec, 2025 | RubyGems action_text-trix npm trix |
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion CVE-2025-15284, GHSA-6rw7-vpxm-498p | Medium | 0.4% | 29 Dec, 2025 | npm qs |
axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header CVE-2025-69202, GHSA-x4m5-4cw8-vc44 | Medium | 0.3% | 29 Dec, 2025 | npm axios-cache-interceptor |
Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU) CVE-2025-69211, GHSA-8wpr-639p-ccrj | Medium | 0.4% | 29 Dec, 2025 | npm @nestjs/platform-fastify |
hemmelig allows SSRF Filter bypass via Secret Request functionality CVE-2025-69206, GHSA-vvxf-wj5w-6gj5 | Medium | 0.2% | 29 Dec, 2025 | npm hemmelig |
Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables BIT-parse-2025-68115, CVE-2025-68115, GHSA-jhgf-2h8h-ggxv | Medium | 0.2% | 16 Dec, 2025 | npm parse-server |
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay CVE-2025-68113, GHSA-6gvq-jcmp-8959, GO-2025-4239, PYSEC-2026-1115 | Medium | 0.5% | 16 Dec, 2025 | Go github.com/altcha-org/altcha-lib-go Hex altcha Maven org.altcha:altcha Packagist altcha-org/altcha +3 more |
Misskey has a login rate limit bypass via spoofed X-Forwarded-For header CVE-2025-66482, GHSA-wwrj-3hvj-prpm | Medium | 0.3% | 15 Dec, 2025 | npm misskey-js |
MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827 CVE-2025-67898, GHSA-45h5-66jx-r2wf | Medium | 0.3% | 14 Dec, 2025 | npm mjml |
Vuetify has a Cross-site Scripting (XSS) vulnerability in the VDatePicker component CVE-2025-8082, GHSA-9w3x-85mw-4fwm | Medium | 0.2% | 12 Dec, 2025 | npm vuetify |
Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components GHSA-c6m7-q6pr-c64r | Medium | Not scored | 12 Dec, 2025 | npm @vitejs/plugin-rsc |
Next Server Actions Source Code Exposure GHSA-w37m-7fhw-fmv9 | Medium | Not scored | 11 Dec, 2025 | npm next |
Source Code Exposure Vulnerability in React Server Components CVE-2025-55183, GHSA-925w-6v3x-g4j4 | Medium | 64.2% | 11 Dec, 2025 | npm react-server-dom-parcel npm react-server-dom-turbopack npm react-server-dom-webpack |
Improper Validation of Query Parameters in Auth0 Next.js SDK CVE-2025-67716, GHSA-mr6f-h57v-rpj5 | Medium | 0.3% | 10 Dec, 2025 | npm @auth0/nextjs-auth0 |
Improper Request Caching Lookup in the Auth0 Next.js SDK CVE-2025-67490, GHSA-wcgj-f865-c7j7 | Medium | 0.2% | 10 Dec, 2025 | npm @auth0/nextjs-auth0 |
Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 CVE-2025-66202, GHSA-whqg-ppgf-wp8c | Medium | 0.3% | 08 Dec, 2025 | npm astro |
Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments CVE-2025-13877, GHSA-mv7p-34fv-4874 | Medium | 0.3% | 02 Dec, 2025 | npm @nocobase/auth |
fastify-reply-from affected by bypass of reply forwarding CVE-2025-66415, GHSA-2q7r-29rg-6m5h | Medium | 0.2% | 01 Dec, 2025 | npm @fastify/reply-from |
Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host CVE-2025-66405, GHSA-hhh5-2cvx-vmfp | Medium | 0.4% | 01 Dec, 2025 | npm @portkey-ai/gateway |
mdast-util-to-hast has unsanitized class attribute CVE-2025-66400, GHSA-4fh9-h7wg-q85m | Medium | 0.3% | 01 Dec, 2025 | npm mdast-util-to-hast |
Tryton sao allows XSS because it does not escape completion values CVE-2025-66421, GHSA-6qj9-2g9m-29x9 | Medium | 0.2% | 30 Nov, 2025 | npm tryton-sao |
Tryton sao allows XSS via an HTML attachment CVE-2025-66420, GHSA-xhgv-99mj-8m2x | Medium | 0.2% | 30 Nov, 2025 | npm tryton-sao |
willitmerge has a Command Injection vulnerability CVE-2025-66219, GHSA-j9wj-m24m-7jj6 | Medium | 2.7% | 26 Nov, 2025 | npm willitmerge |
node-forge is vulnerable to ASN.1 OID Integer Truncation CVE-2025-66030, GHSA-65ch-62r8-g69g | Medium | 0.3% | 26 Nov, 2025 | npm node-forge |
OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation CVE-2025-66028, GHSA-675q-66gf-gqg8 | Medium | 0.3% | 25 Nov, 2025 | npm @oneuptime/common |
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` CVE-2025-65944, GHSA-6465-jgvq-jhgp | Medium | 0.4% | 24 Nov, 2025 | npm @sentry/astro npm @sentry/aws-serverless npm @sentry/bun npm @sentry/google-cloud-serverless +8 more |
body-parser is vulnerable to denial of service when url encoding is used CVE-2025-13466, GHSA-wqch-xfxh-vrr4 | Medium | 0.4% | 24 Nov, 2025 | npm body-parser |
Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage CVE-2025-63700, GHSA-3mm3-wfpv-q85g | Medium | Not scored | 20 Nov, 2025 | npm @clerk/clerk-js |
zx Uses Incorrectly-Resolved Name or Reference CVE-2025-13437, GHSA-w87r-vg9q-crqm | Medium | 0.1% | 20 Nov, 2025 | npm zx |
@perfood/couch-auth may expose session tokens, passwords CVE-2025-60794, GHSA-62vx-hpcr-m9ch | Medium | 0.2% | 20 Nov, 2025 | npm @perfood/couch-auth |
Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint CVE-2025-65019, GHSA-fvmw-cj7j-j39q | Medium | 0.3% | 19 Nov, 2025 | npm astro |
Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values CVE-2025-64765, GHSA-ggxq-hp9w-j794 | Medium | 0.5% | 19 Nov, 2025 | npm astro |
@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message CVE-2025-64758, GHSA-7xvh-c266-cfr5 | Medium | 0.2% | 17 Nov, 2025 | npm @dependencytrack/frontend |
Directus Vulnerable to Information Leakage in Existing Collections CVE-2025-64749, GHSA-cph6-524f-3hgr | Medium | 0.3% | 13 Nov, 2025 | npm @directus/api npm directus |
Directus's conceal fields are searchable if read permissions enabled CVE-2025-64748, GHSA-8jpw-gpr4-8cmh | Medium | 0.3% | 13 Nov, 2025 | npm @directus/api npm directus |
Directus is Vulnerable to Stored Cross-site Scripting CVE-2025-64747, GHSA-vv2v-pw69-8crf | Medium | 0.3% | 13 Nov, 2025 | npm directus |
Directus has Improper Permission Handling on Deleted Fields CVE-2025-64746, GHSA-9x5g-62gj-wqf2 | Medium | 0.2% | 13 Nov, 2025 | npm directus |
Astro development server error page is vulnerable to reflected Cross-site Scripting CVE-2025-64745, GHSA-w2vj-39qv-7vh7 | Medium | 0.3% | 13 Nov, 2025 | npm astro |
js-yaml has prototype pollution in merge (<<) CVE-2025-64718, GHSA-mh29-5h37-fv8m | Medium | 0.4% | 13 Nov, 2025 | npm js-yaml |
Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass CVE-2025-64525, GHSA-hr2q-hp5q-x767 | Medium | 1.2% | 13 Nov, 2025 | npm astro |
Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details BIT-parse-2025-64502, CVE-2025-64502, GHSA-7cx5-254x-cgrq | Medium | 0.4% | 10 Nov, 2025 | npm parse-server |
Nuxt DevTools vulnerable to cross-site scripting (XSS) CVE-2025-52662, GHSA-xmq3-q5pm-rp26 | Medium | 0.3% | 07 Nov, 2025 | npm @nuxt/devtools |
Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files CVE-2025-48985, GHSA-rwvc-j5jr-mgvh | Medium | 0.3% | 07 Nov, 2025 | npm ai |