Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
node-tar has a race condition leading to uninitialized memory exposure CVE-2025-64118, GHSA-29xp-372q-xqph | Medium | 0.1% | 30 Oct, 2025 | npm tar |
NextAuthjs Email misdelivery Vulnerability GHSA-5jpx-9hw9-2fx4 | Medium | Not scored | 29 Oct, 2025 | npm next-auth |
Hono vulnerable to Vary Header Injection leading to potential CORS Bypass CVE-2025-71381, GHSA-q7jf-gf43-6x6p | Medium | 0.3% | 24 Oct, 2025 | npm hono |
rollbar vulnerable to Prototype Pollution in merge() CVE-2025-62517, GHSA-xcg2-9pp4-j82x | Medium | 0.4% | 23 Oct, 2025 | npm rollbar |
Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic CVE-2025-62595, GHSA-g8mr-fgfg-5qpc | Medium | 0.3% | 21 Oct, 2025 | npm koa |
Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read GHSA-vffh-c9pq-4crh | Medium | Not scored | 20 Oct, 2025 | npm uptime-kuma |
vite allows server.fs.deny bypass via backslash on Windows CVE-2025-62522, GHSA-93m4-6634-74q7 | Medium | 1.1% | 20 Oct, 2025 | npm vite |
Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers GHSA-xvp7-8vm8-xfxx | Medium | Not scored | 20 Oct, 2025 | npm @actual-app/sync-server |
Mammoth is vulnerable to Directory Traversal CVE-2025-11849, GHSA-rmjr-87wv-gf87, PYSEC-2026-1603 | Medium | 1.1% | 17 Oct, 2025 | Maven org.zwobble.mammoth:mammoth NuGet Mammoth PyPI mammoth npm mammoth |
Strapi Password Hashing is Missing Maximum Password Length Validation CVE-2025-25298, GHSA-2cjv-6wg9-f4f3 | Medium | 0.4% | 16 Oct, 2025 | npm @strapi/core |
Strapi is vulnerable to Insufficient Session Expiration CVE-2025-3930, GHSA-4r8w-3jww-m2rp | Medium | 0.7% | 16 Oct, 2025 | npm @strapi/strapi |
Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs CVE-2025-62374, GHSA-9f2h-7v79-mxw3 | Medium | 0.4% | 14 Oct, 2025 | npm parse |
CommandKit has incorrect command name exposure in context object for message command aliases CVE-2025-62378, GHSA-fhwm-pc6r-4h2f | Medium | 0.2% | 13 Oct, 2025 | npm commandkit |
QGIS QWC2 Cross-Site Scripting vulnerability CVE-2025-11183, GHSA-gxp8-m5rq-3m38 | Medium | 0.4% | 13 Oct, 2025 | npm qwc2 |
Astro's `X-Forwarded-Host` is reflected without validation CVE-2025-61925, GHSA-5ff5-9fcw-vg88 | Medium | 0.4% | 10 Oct, 2025 | npm astro |
MCPHub has an Improper Authorization vulnerability via its handleSseConnection function CVE-2025-11287, GHSA-v7c4-33vf-cqqq | Medium | 0.6% | 05 Oct, 2025 | npm @samanhappy/mcphub |
Flowise Stored XSS vulnerability through logs in chatbot CVE-2025-29192, GHSA-7r4h-vmj9-wg42 | Medium | 0.4% | 03 Oct, 2025 | npm flowise |
Flowise vulnerable to XSS CVE-2025-71331, GHSA-4fr9-3x69-36wv | Medium | 0.3% | 03 Oct, 2025 | npm flowise |
Fiora chat user avatar is vulnerable to XSS via SVG files CVE-2025-56514, GHSA-hg3j-6pmh-mvjr | Medium | 0.3% | 01 Oct, 2025 | npm fiora |
validator.js has a URL validation bypass vulnerability in its isURL function CVE-2025-56200, GHSA-9965-vmph-33xx | Medium | 0.3% | 30 Sep, 2025 | npm validator |
lobe-chat has an Open Redirect CVE-2025-59426, GHSA-xph5-278p-26qx | Medium | 0.3% | 24 Sep, 2025 | npm @lobehub/chat |
parse is vulnerable to prototype pollution CVE-2025-57324, GHSA-9g8m-v378-pcg3 | Medium | 0.4% | 24 Sep, 2025 | npm parse |
json-schema-editor-visual vulnerable to prototype pollution CVE-2025-57320, GHSA-3c3p-xh4f-pfh7 | Medium | 0.3% | 24 Sep, 2025 | npm json-schema-editor-visual |
Mastra Docs MCP Server `@mastra/mcp-docs-server` Leads to Information Exposure CVE-2025-61685, GHSA-xh92-rqrq-227v | Medium | 0.6% | 24 Sep, 2025 | npm @mastra/mcp-docs-server |
ts-fns has prototype pollution vulnerability CVE-2025-57351, GHSA-g7wq-wggw-vmhg | Medium | 0.4% | 24 Sep, 2025 | npm ts-fns |
node-cube vulnerable to prototype pollution CVE-2025-57348, GHSA-8v65-5fw5-23wj | Medium | 0.4% | 24 Sep, 2025 | npm node-cube |
counterpart vulnerable to prototype pollution CVE-2025-57354, GHSA-2488-w585-72ch | Medium | 0.5% | 24 Sep, 2025 | npm counterpart |
messageformat prototype pollution vulnerability CVE-2025-57353, GHSA-6xv4-9cqp-92rh | Medium | 0.3% | 24 Sep, 2025 | npm @messageformat/runtime |
min-document vulnerable to prototype pollution CVE-2025-57352, GHSA-rx8g-88g5-qh64 | Medium | 0.4% | 24 Sep, 2025 | npm min-document |
Mailgen: HTML injection vulnerability in plaintext e-mails CVE-2025-59526, GHSA-j2xj-h7w5-r7vp | Medium | 0.4% | 22 Sep, 2025 | npm mailgen |
@conventional-changelog/git-client has Argument Injection vulnerability CVE-2025-59433, GHSA-vh25-5764-9wcr | Medium | 0.2% | 22 Sep, 2025 | npm @conventional-changelog/git-client |
Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages CVE-2025-59417, GHSA-m79r-r765-5f9j | Medium | 0.4% | 18 Sep, 2025 | npm @lobehub/chat |
@sequa-ai/sequa-mcp has Command Injection vulnerability CVE-2025-10619, GHSA-9pw5-wx67-q964 | Medium | 1.8% | 17 Sep, 2025 | npm @sequa-ai/sequa-mcp |
Parcel has an Origin Validation Error vulnerability CVE-2025-56648, GHSA-qm9p-f9j5-w83w | Medium | 0.2% | 17 Sep, 2025 | npm @parcel/reporter-dev-server |
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another CVE-2025-59160, GHSA-mp7c-m3rh-r56v | Medium | 0.2% | 16 Sep, 2025 | npm matrix-js-sdk |
Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark BIT-ghost-2025-9862, CVE-2025-9862, GHSA-f7qg-xj45-w956 | Medium | 0.5% | 15 Sep, 2025 | npm ghost |
HackMD MCP Server has Server-Side Request Forgery (SSRF) vulnerability CVE-2025-59155, GHSA-g5cg-6c7v-mmpw | Medium | 0.4% | 15 Sep, 2025 | npm hackmd-mcp |
Stored XSS in n8n LangChain Chat Trigger Node via initialMessages Parameter CVE-2025-58177, GHSA-mvh4-2cm2-6hpg | Medium | 0.2% | 15 Sep, 2025 | npm n8n |
MetaMask SDK indirectly exposed via malicious debug@4.4.2 dependency GHSA-qj3p-xc97-xw74 | Medium | Not scored | 15 Sep, 2025 | npm @metamask/sdk npm @metamask/sdk-communication-layer npm @metamask/sdk-react |
express-xss-sanitizer has an unbounded recursion depth CVE-2025-59364, GHSA-hvq2-wf92-j4f3 | Medium | 0.4% | 14 Sep, 2025 | npm express-xss-sanitizer |
Hono has Body Limit Middleware Bypass CVE-2025-59139, GHSA-92vj-g62v-jqhh | Medium | 0.4% | 12 Sep, 2025 | npm hono |
jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin CVE-2025-9910, GHSA-33vc-wfww-vjfv | Medium | 0.3% | 11 Sep, 2025 | npm jsondiffpatch |
Decap CMS Cross Site Scripting (XSS) vulnerability CVE-2025-57520, GHSA-xp8g-32qh-mv28 | Medium | 0.3% | 10 Sep, 2025 | npm decap-cms |
Element Plus Link component (el-link) implements insufficient input validation for the href attribute CVE-2025-57665, GHSA-5m5x-9j46-h678 | Medium | 0.2% | 09 Sep, 2025 | npm element-plus |
SimStudioAI: A function in route.ts is vulnerable to Code Injection CVE-2025-10097, GHSA-g4c9-f287-64xg | Medium | 0.8% | 08 Sep, 2025 | npm simstudio |
sanitize-html is vulnerable to XSS through incomprehensive sanitization CVE-2019-25225, GHSA-qhxp-v273-g94h | Medium | 0.3% | 08 Sep, 2025 | npm sanitize-html |
Electron has ASAR Integrity Bypass via resource modification CVE-2025-55305, GHSA-vmqv-hx8q-j7mg | Medium | 0.3% | 03 Sep, 2025 | npm electron |
Next.js Affected by Cache Key Confusion for Image Optimization API Routes CVE-2025-57752, GHSA-g5qg-72qw-gw5v | Medium | 0.3% | 29 Aug, 2025 | npm next |
Next.js Content Injection Vulnerability for Image Optimization CVE-2025-55173, GHSA-xv57-4mr9-wg8v | Medium | 0.6% | 29 Aug, 2025 | npm next |
AiondaDotCom mcp-ssh command injection vulnerability in SSH operations CVE-2025-9654, GHSA-694p-3fxc-m92h | Medium | 1.2% | 29 Aug, 2025 | npm @aiondadotcom/mcp-ssh |