Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State CVE-2026-22814, GHSA-g5gc-h5hp-555f | High | 0.5% | 13 Jan, 2026 | npm @adonisjs/lucid |
Renovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repository CVE-2026-76229, GHSA-xv56-3wq5-9997 | High | 1.0% | 13 Jan, 2026 | npm renovate |
Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl` CVE-2026-76228, GHSA-pfq2-hh62-7m96 | High | 1.0% | 13 Jan, 2026 | npm renovate |
OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution CVE-2026-22812, GHSA-vxw4-wv6m-9hhh | High | 16.5% | 12 Jan, 2026 | npm opencode-ai |
HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover CVE-2026-22704, GHSA-3fm2-xfq7-7778 | High | 1.0% | 10 Jan, 2026 | npm @haxtheweb/haxcms-nodejs |
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes CVE-2026-22610, GHSA-jrmj-c5cx-3cw6 | High | 0.4% | 09 Jan, 2026 | npm @angular/compiler npm @angular/core |
Ghost has SQL Injection in Members Activity Feed BIT-ghost-2026-22596, CVE-2026-22596, GHSA-gjrp-xgmh-x9qq | High | 0.5% | 08 Jan, 2026 | npm ghost |
Ghost has Staff Token permission bypass BIT-ghost-2026-22595, CVE-2026-22595, GHSA-9xg7-mwmp-xmjx | High | 0.5% | 08 Jan, 2026 | npm ghost |
Ghost has Staff 2FA bypass BIT-ghost-2026-22594, CVE-2026-22594, GHSA-5fp7-g646-ccf4 | High | 1.3% | 08 Jan, 2026 | npm ghost |
Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles GHSA-96qw-h329-v5rg | High | Not scored | 08 Jan, 2026 | RubyGems shakapacker npm shakapacker |
React Router vulnerable to XSS via Open Redirects CVE-2026-22029, GHSA-2w69-qvjg-hvjx | High | 0.9% | 08 Jan, 2026 | npm @remix-run/router npm react-router |
React Router SSR XSS in ScrollRestoration CVE-2026-21884, GHSA-8v8x-cx79-35w7 | High | 0.5% | 08 Jan, 2026 | npm @remix-run/react npm react-router |
React Router has XSS Vulnerability CVE-2025-59057, GHSA-3cgp-3xvw-98x8 | High | 0.5% | 08 Jan, 2026 | npm @remix-run/react npm react-router |
Preact has JSON VNode Injection issue CVE-2026-22028, GHSA-36hm-qxxp-pg3m | High | 0.3% | 07 Jan, 2026 | npm preact |
pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies CVE-2025-69263, GHSA-7vhp-vf5g-r2fw | High | 0.5% | 07 Jan, 2026 | npm pnpm |
pnpm vulnerable to Command Injection via environment variable substitution CVE-2025-69262, GHSA-2phv-j68v-wwqx | High | 1.0% | 07 Jan, 2026 | npm pnpm |
fast-filesystem-mcp has a Path Traversal vulnerability CVE-2025-67364, GHSA-j893-m93w-jwjw | High | 0.6% | 07 Jan, 2026 | npm fast-filesystem-mcp |
Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools CVE-2025-9611, GHSA-6fg3-hvw7-2fwq, GHSA-8rgw-6xp9-2fg3 | High | 1.2% | 07 Jan, 2026 | npm @playwright/mcp |
`vega-functions` vulnerable to Cross-site Scripting via `setdata` function CVE-2025-66648, GHSA-m9rg-mr6g-75gm | High | 0.2% | 05 Jan, 2026 | npm vega-functions |
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability CVE-2026-0621, GHSA-8r9q-7v3j-jr4g | High | 0.4% | 05 Jan, 2026 | npm @modelcontextprotocol/sdk |
evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API CVE-2025-67419, GHSA-m2q5-xhqg-92r2 | High | 0.3% | 05 Jan, 2026 | npm @evershop/evershop |
Signal K Server Vulnerable to Access Request Spoofing CVE-2025-69203, GHSA-vfrf-vcj7-wvr8 | High | 0.3% | 01 Jan, 2026 | npm signalk-server |
Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package CVE-2025-68619, GHSA-93jc-vqqc-vvvh | High | 0.7% | 01 Jan, 2026 | npm signalk-server |
Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding CVE-2025-68272, GHSA-7rqc-ff8m-7j23 | High | 0.6% | 01 Jan, 2026 | npm signalk-server |
PsiTransfer has Zip Slip Path Traversal via TAR Archive Download GHSA-xphh-5v4r-r3rx | High | Not scored | 30 Dec, 2025 | npm psitransfer |
serverless MCP Server vulnerable to Command Injection in list-projects tool CVE-2025-69256, GHSA-rwc2-f344-q6w6 | High | 2.4% | 30 Dec, 2025 | npm serverless |
Self-hosted n8n has Legacy Code node that enables arbitrary file read/write CVE-2025-68697, GHSA-j4p8-h8mh-rh8q | High | 0.3% | 26 Dec, 2025 | npm n8n |
n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox CVE-2025-61914, GHSA-58jc-rcg5-95f3 | High | 0.2% | 26 Dec, 2025 | npm n8n |
libxmljs has segmentation fault, potentially leading to a denial-of-service (DoS) CVE-2025-25341, GHSA-jv72-59wq-8rxm | High | 0.4% | 26 Dec, 2025 | npm libxmljs |
Fedify has ReDoS Vulnerability in HTML Parsing Regex CVE-2025-68475, GHSA-rchf-xwx2-hm93 | High | 0.6% | 22 Dec, 2025 | npm @fedify/fedify |
tinacms is vulnerable to arbitrary code execution CVE-2025-68278, GHSA-529f-9qwm-9628 | High | 0.5% | 18 Dec, 2025 | npm @tinacms/cli npm @tinacms/graphql npm tinacms |
Storybook manager bundle may expose environment variables during build CVE-2025-68429, GHSA-8452-54wp-rmv6 | High | 0.3% | 17 Dec, 2025 | npm storybook |
Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits CVE-2025-71399, GHSA-x732-6j76-qmhm | High | 0.5% | 16 Dec, 2025 | npm better-auth |
@vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint CVE-2025-68155, GHSA-g239-q96q-x4qm | High | 0.5% | 16 Dec, 2025 | npm @vitejs/plugin-rsc |
systeminformation has a Command Injection vulnerability in fsSize() function on Windows CVE-2025-68154, GHSA-wphj-fx3q-84ch | High | 13.0% | 16 Dec, 2025 | npm systeminformation |
Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter BIT-parse-2025-68150, CVE-2025-68150, GHSA-3f5f-xgrj-97pf | High | 0.3% | 16 Dec, 2025 | npm parse-server |
tRPC has possible prototype pollution in `experimental_nextAppDirCaller` CVE-2025-68130, GHSA-43p4-m455-4f4j | High | 0.4% | 16 Dec, 2025 | npm @trpc/server |
misskey.js's export data contains private post data CVE-2025-66402, GHSA-496g-mmpw-j9x3 | High | 0.3% | 15 Dec, 2025 | npm misskey-js |
Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule CVE-2025-67750, GHSA-55jh-84jv-8mx8 | High | 0.2% | 12 Dec, 2025 | npm lightning-flow-scanner |
Vuetify has a Prototype Pollution vulnerability CVE-2025-8083, GHSA-3jp5-5f8r-q2wg | High | 0.3% | 12 Dec, 2025 | npm vuetify |
Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up GHSA-5j59-xgg2-r9c4 | High | Not scored | 12 Dec, 2025 | npm next |
Vite Plugin React has a Denial of Service Vulnerability in React Server Components GHSA-cpqf-f22c-r95x | High | Not scored | 12 Dec, 2025 | npm @vitejs/plugin-rsc |
Denial of Service Vulnerability in React Server Components CVE-2025-67779, GHSA-7gmr-mq3h-m5h9 | High | 20.0% | 12 Dec, 2025 | npm react-server-dom-parcel npm react-server-dom-turbopack npm react-server-dom-webpack |
Next Vulnerable to Denial of Service with Server Components GHSA-mwv6-3258-q52c | High | Not scored | 11 Dec, 2025 | npm next |
Denial of Service Vulnerability in React Server Components CVE-2025-55184, GHSA-2m3v-v2m8-q956 | High | 66.6% | 11 Dec, 2025 | npm react-server-dom-parcel npm react-server-dom-turbopack npm react-server-dom-webpack |
Servify-express rate limit issue CVE-2025-67731, GHSA-qgc4-8p88-4w7m | High | 0.4% | 11 Dec, 2025 | npm servify-express |
Formio improperly authorized permission elevation through specially crafted request path CVE-2025-67718, GHSA-m654-769v-qjv7 | High | 0.3% | 10 Dec, 2025 | npm formio |
Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability CVE-2025-65513, GHSA-8fxj-2g9q-8fjw | High | 0.4% | 09 Dec, 2025 | npm mcp-fetch-server |
Elysia affected by arbitrary code injection through cookie config CVE-2025-66457, GHSA-8vch-m3f4-q8jf | High | 0.8% | 09 Dec, 2025 | npm elysia |
Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF' CVE-2025-65959, GHSA-8wvc-869r-xfqf | High | 0.2% | 04 Dec, 2025 | npm open-webui |