Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Payload's SQLite adapter Session Fixation vulnerability CVE-2025-4644, GHSA-26rv-h2hf-3fw4 | Medium | 0.4% | 29 Aug, 2025 | npm @payloadcms/graphql npm @payloadcms/next npm payload |
Payload does not invalidate JWTs after log out CVE-2025-4643, GHSA-5v66-m237-hwf7 | Medium | 0.4% | 29 Aug, 2025 | npm @payloadcms/graphql npm @payloadcms/next npm payload |
GraphQL Armor Max-Depth Plugin Bypass via fragment caching GHSA-224p-v68g-5g8f | Medium | Not scored | 26 Aug, 2025 | npm @escape.tech/graphql-armor-max-depth |
GraphQL Armor Max-Depth Plugin Bypass via Introspection Query Obfuscation GHSA-hmfr-rx46-4jx2 | Medium | Not scored | 26 Aug, 2025 | npm @escape.tech/graphql-armor-max-depth |
request-filtering-agent SSRF Bypass via HTTPS Requests to 127.0.0.1 CVE-2025-57814, GHSA-pw25-c82r-75mm | Medium | 0.5% | 25 Aug, 2025 | npm request-filtering-agent |
Liferay Portal Reflected XSS in CKeditor 4.21.0 endpoint CVE-2025-43761, GHSA-3h7r-4xxj-3mfm | Medium | 0.2% | 22 Aug, 2025 | Maven com.liferay:com.liferay.frontend.editor.ckeditor.web Maven com.liferay:com.liferay.frontend.js.dependencies.web npm liferay-ckeditor |
vite-plugin-static-copy files not included in `src` are possible to access with a crafted request CVE-2025-57753, GHSA-pp7p-q8fx-2968 | Medium | 0.4% | 21 Aug, 2025 | npm vite-plugin-static-copy |
n8n symlink traversal vulnerability in "Read/Write File" node allows access to restricted files CVE-2025-57749, GHSA-ggjm-f3g4-rwmm | Medium | 0.5% | 20 Aug, 2025 | npm n8n |
elysia-cors Origin Validation Error CVE-2025-50864, GHSA-f9qj-4c5x-cpcw | Medium | 0.5% | 20 Aug, 2025 | npm @elysiajs/cors |
Mermaid improperly sanitizes sequence diagram labels leading to XSS CVE-2025-54881, GHSA-7rqq-prvp-x9jh | Medium | 0.8% | 19 Aug, 2025 | npm mermaid |
Mermaid does not properly sanitize architecture diagram iconText leading to XSS CVE-2025-54880, GHSA-8gwm-58g9-j8pw | Medium | 0.4% | 19 Aug, 2025 | npm mermaid |
Astro allows unauthorized third-party images in _image endpoint CVE-2025-55303, GHSA-xf8x-j4p2-f749 | Medium | 0.6% | 19 Aug, 2025 | npm @astrojs/node npm astro |
ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/apps.js CVE-2025-9096, GHSA-xfp8-x3j6-h67v | Medium | 0.3% | 18 Aug, 2025 | npm express-gateway |
ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/users.js CVE-2025-9095, GHSA-q4rg-7cjj-5r86 | Medium | 0.3% | 17 Aug, 2025 | npm express-gateway |
@astrojs/node's trailing slash handling causes open redirect issue CVE-2025-55207, GHSA-9x9c-ghc5-jhw9 | Medium | 0.6% | 15 Aug, 2025 | npm @astrojs/node |
Oak Server has ReDoS in x-forwarded-proto and x-forwarded-for headers CVE-2025-55152, GHSA-r3v7-pc4g-7xp9 | Medium | 0.4% | 09 Aug, 2025 | npm @oakserver/oak |
Astros's duplicate trailing slash feature leads to an open redirection security issue CVE-2025-54793, GHSA-cq8c-xv66-36gw | Medium | 0.7% | 07 Aug, 2025 | npm astro |
The Thinbus Javascript Secure Remote Password (SRP) Client Generates Fewer Bits of Entropy Than Intended CVE-2025-54885, GHSA-8q6v-474h-whgg | Medium | 0.4% | 06 Aug, 2025 | npm thinbus-srp |
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter CVE-2025-54798, GHSA-52f5-9888-hmc6 | Medium | 0.4% | 06 Aug, 2025 | npm tmp |
IPX Allows Path Traversal via Prefix Matching Bypass CVE-2025-54387, GHSA-mm3p-j368-7jcr | Medium | 0.7% | 04 Aug, 2025 | npm ipx |
webfinger.js Blind SSRF Vulnerability CVE-2025-54590, GHSA-8xq3-w9fx-74rv | Medium | 0.7% | 28 Jul, 2025 | npm webfinger.js |
HAX CMS application pages vulnerable to clickjacking CVE-2025-54139, GHSA-54vw-f4xf-f92j | Medium | 0.4% | 21 Jul, 2025 | Packagist elmsln/haxcms npm @haxtheweb/haxcms-nodejs |
OpenZeppelin Contracts Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers CVE-2025-54070, GHSA-9rcw-c2f9-2j55 | Medium | 0.4% | 17 Jul, 2025 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
DiracX-Web is vulnerable to attack through an Open Redirect on its login page CVE-2025-54066, GHSA-hfj7-542q-8fvv | Medium | 0.4% | 17 Jul, 2025 | npm @dirac-grid/diracx-web-components |
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes CVE-2025-53892, GHSA-x8qp-wqqm-57ph | Medium | 0.8% | 16 Jul, 2025 | npm @intlify/core npm @intlify/core-base npm @intlify/vue-i18n-core npm petite-vue-i18n +1 more |
Directus' insufficient permission checks can enable unauthenticated users to manually trigger Flows CVE-2025-53889, GHSA-7cvf-pxgp-42fc | Medium | 0.5% | 15 Jul, 2025 | npm directus |
Directus' exact version number is exposed by the OpenAPI Spec CVE-2025-53887, GHSA-rmjh-cf9q-pv7q | Medium | 1.0% | 15 Jul, 2025 | npm directus |
Directus tokens are not redacted in flow logs, exposing session credentials to all admin CVE-2025-53886, GHSA-f24x-rm6g-3w5v | Medium | 0.5% | 15 Jul, 2025 | npm directus |
Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged CVE-2025-53885, GHSA-x3vm-88hf-gpxp | Medium | 0.2% | 15 Jul, 2025 | npm directus |
Better Call routing bug can lead to Cache Deception GHSA-hq75-xg7r-rx6c | Medium | Not scored | 11 Jul, 2025 | npm better-call |
@pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation CVE-2025-53626, GHSA-54xv-94qv-2gfg | Medium | 0.3% | 10 Jul, 2025 | npm @pdfme/common |
Parse Server exposes the data schema via GraphQL API BIT-parse-2025-53364, CVE-2025-53364, GHSA-48q3-prgv-gm4w | Medium | 1.0% | 10 Jul, 2025 | npm parse-server |
Cloudflare Vite plugin exposes secrets over the built-in dev server CVE-2025-59427, GHSA-4pfg-2mw5-f8jx | Medium | 0.4% | 08 Jul, 2025 | npm @cloudflare/vite-plugin |
n8n is vulnerable to Improper Authorization through its `/stop` endpoint CVE-2025-52554, GHSA-gq57-v332-7666 | Medium | 0.4% | 03 Jul, 2025 | npm n8n |
tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript CVE-2025-48939, GHSA-q43x-79jr-cq98 | Medium | 0.2% | 03 Jul, 2025 | npm tarteaucitronjs |
n8n Vulnerable to Denial of Service via Malformed Binary Data Requests CVE-2025-49595, GHSA-pr9r-gxgp-9rm8 | Medium | 0.5% | 03 Jul, 2025 | npm n8n |
Electron vulnerable to Heap Buffer Overflow in NativeImage CVE-2024-46993, GHSA-6r2x-8pq8-9489 | Medium | 0.2% | 30 Jun, 2025 | npm electron |
n8n allows open redirects via the /signin endpoint CVE-2025-49592, GHSA-5vj6-wjr7-5v9f | Medium | 0.2% | 26 Jun, 2025 | npm n8n |
iOS Simulator MCP Command Injection allowed via exec API CVE-2025-52573, GHSA-6f6r-m9pv-67jw | Medium | 0.6% | 26 Jun, 2025 | npm ios-simulator-mcp |
OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer CVE-2025-50183, GHSA-2hw3-h8qx-hqqp | Medium | 0.3% | 18 Jun, 2025 | npm @openlist-frontend/openlist-frontend |
pg-promise SQL Injection vulnerability CVE-2025-29744, GHSA-ff9h-848c-4xfj | Medium | 0.2% | 12 Jun, 2025 | npm pg-promise |
Erxes Path Traversal vulnerability CVE-2024-57189, GHSA-2977-5php-6789 | Medium | 0.4% | 10 Jun, 2025 | npm erxes |
@vue/cli-plugin-pwa Regular Expression Denial of Service vulnerability CVE-2025-5897, GHSA-79vf-hf9f-j9q8 | Medium | 0.6% | 09 Jun, 2025 | npm @vue/cli-plugin-pwa |
taro-css-to-react-native Regular Expression Denial of Service vulnerability CVE-2025-5896, GHSA-f5xg-cfpj-2mw6 | Medium | 0.6% | 09 Jun, 2025 | npm taro-css-to-react-native |
@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability CVE-2025-49139, GHSA-v3ph-2q5q-cg88 | Medium | 0.4% | 09 Jun, 2025 | npm @haxtheweb/haxcms-nodejs |
AngularJS Incomplete Filtering of Special Elements vulnerability CVE-2025-2336, GHSA-4p4w-6hg8-63wx | Medium | 0.3% | 04 Jun, 2025 | npm angular-sanitize |
webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser CVE-2025-30360, GHSA-9jgg-88mc-972h | Medium | 0.3% | 03 Jun, 2025 | npm webpack-dev-server |
webpack-dev-server users' source code may be stolen when they access a malicious web site CVE-2025-30359, GHSA-4v9v-hfq4-rm2v | Medium | 0.6% | 03 Jun, 2025 | npm webpack-dev-server |
Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint CVE-2025-48996, GHSA-fvx2-x7ff-fc56 | Medium | 0.4% | 02 Jun, 2025 | npm @haxtheweb/open-apis |
Markdownify MCP Server allows Server-Side Request Forgery (SSRF) via the Markdownify.get() function CVE-2025-5276, GHSA-frq9-3hp2-xvxg | Medium | 0.4% | 29 May, 2025 | npm mcp-markdownify-server |