Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
auth0/node-jws Improperly Verifies HMAC Signature CVE-2025-65945, GHSA-869p-cjfg-cm3x | High | 0.2% | 04 Dec, 2025 | npm jws |
mcp-server-kubernetes has potential security issue in exec_in_pod tool CVE-2025-66404, GHSA-wvxp-jp4w-w8wg | High | 1.5% | 03 Dec, 2025 | npm mcp-server-kubernetes |
Claude Code Command Validation Bypass Allows Arbitrary Code Execution CVE-2025-66032, GHSA-xq4m-mc3c-vvg3 | High | 0.7% | 03 Dec, 2025 | npm @anthropic-ai/claude-code |
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default CVE-2025-66414, GHSA-w48q-cv73-mx4w | High | 0.5% | 02 Dec, 2025 | npm @modelcontextprotocol/sdk |
Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes CVE-2025-66412, GHSA-v4hv-rgfq-gp49 | High | 0.4% | 01 Dec, 2025 | npm @angular/compiler |
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls CVE-2025-14874, GHSA-rcmh-qjqh-p98v | High | 0.6% | 01 Dec, 2025 | Maven org.webjars.npm:nodemailer npm nodemailer |
Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements CVE-2025-12758, GHSA-vghf-hv5q-vc2g | High | 0.6% | 27 Nov, 2025 | npm validator |
Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client CVE-2025-66035, GHSA-58c5-g7wp-6w37 | High | 0.7% | 26 Nov, 2025 | npm @angular/common |
node-forge has ASN.1 Unbounded Recursion CVE-2025-66031, GHSA-554w-wpv2-vw27 | High | 0.4% | 26 Nov, 2025 | npm node-forge |
OneUptime Unauthorized User Creation via API CVE-2025-65966, GHSA-m449-vh5f-574g | High | 0.3% | 26 Nov, 2025 | npm @oneuptime/common |
Valibot has a ReDoS vulnerability in `EMOJI_REGEX` CVE-2025-66020, GHSA-vqpr-j7v3-hqw9 | High | 0.4% | 26 Nov, 2025 | npm valibot |
Better Auth Passkey Plugin allows passkey deletion through IDOR CVE-2025-71400, GHSA-4vcf-q4xf-f48m | High | 0.4% | 25 Nov, 2025 | npm @better-auth/passkey |
node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization CVE-2025-12816, GHSA-5gfm-wpxj-wjgq | High | 0.6% | 25 Nov, 2025 | npm node-forge |
authkit-nextjs may let session cookies be cached in CDNs CVE-2025-64762, GHSA-p8pf-44ff-93gf | High | 0.4% | 20 Nov, 2025 | npm @workos-inc/authkit-nextjs |
@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes CVE-2025-64755, GHSA-7mv8-j34q-vp7q | High | 0.6% | 20 Nov, 2025 | npm @anthropic-ai/claude-code |
Claude Code vulnerable to command execution prior to startup trust dialog CVE-2025-65099, GHSA-5hhx-v7f6-x7gv | High | 0.5% | 19 Nov, 2025 | npm @anthropic-ai/claude-code |
Astro vulnerable to reflected XSS via the server islands feature CVE-2025-64764, GHSA-wrwg-2hg8-v723 | High | 0.5% | 19 Nov, 2025 | npm astro |
glob CLI: Command injection via -c/--cmd executes matches with shell:true CVE-2025-64756, GHSA-5j98-mcp5-4vw2 | High | 3.1% | 17 Nov, 2025 | npm glob |
Apollo Federation has Improper Enforcement of Access Control on Transitive Fields GHSA-m8jr-fxqx-8xx6 | High | Not scored | 14 Nov, 2025 | npm @apollo/composition |
Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change CVE-2025-71328, GHSA-fjh6-8679-9pch | High | 0.5% | 14 Nov, 2025 | npm flowise-ui |
Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials) CVE-2025-71337, GHSA-x39m-3393-3qp4 | High | 0.4% | 14 Nov, 2025 | npm flowise-ui |
Flowise Fails to Invalidate Existing Sessions After Password Changes CVE-2025-71335, GHSA-x7rp-qj2h-ghgw | High | 0.4% | 14 Nov, 2025 | npm flowise |
@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields CVE-2025-64530, GHSA-mx7m-j9xf-62hw | High | 0.4% | 13 Nov, 2025 | npm @apollo/composition |
AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance GHSA-8wj8-cfxr-9374 | High | Not scored | 13 Nov, 2025 | npm aws-advanced-nodejs-wrapper |
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable CVE-2025-59840, GHSA-7f2v-3qq3-vvjf | High | 0.4% | 13 Nov, 2025 | npm vega npm vega-expression npm vega-interpreter |
Cloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand CVE-2025-12613, GHSA-g4mf-96x5-5m2c | High | 0.4% | 10 Nov, 2025 | npm cloudinary |
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events CVE-2025-64496, GHSA-cm35-v4vp-5xvx, PYSEC-2026-1729 | High | 7.2% | 07 Nov, 2025 | PyPI open-webui npm open-webui |
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE CVE-2025-64495, GHSA-w7xj-8fx7-wfch, PYSEC-2026-1741 | High | 0.5% | 07 Nov, 2025 | PyPI open-webui npm open-webui |
Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format BIT-parse-2025-64430, CVE-2025-64430, GHSA-x4qj-2f4q-r4rx | High | 0.6% | 05 Nov, 2025 | npm parse-server |
n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook CVE-2025-62726, GHSA-xgp7-7qjq-vg47 | High | 0.8% | 30 Oct, 2025 | npm n8n |
TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update CVE-2025-60542, GHSA-q2pj-6v73-8rgj | High | 0.3% | 29 Oct, 2025 | npm typeorm |
Astro's bypass of image proxy domain validation leads to SSRF and potential XSS CVE-2025-59837, GHSA-qcpr-679q-rhm2 | High | 0.4% | 28 Oct, 2025 | npm astro |
Kottster app reinitialization can be re-triggered allowing command injection in development mode CVE-2025-62713, GHSA-j3w7-9qc3-g96p | High | 0.6% | 23 Oct, 2025 | npm @kottster/server |
Hono Improper Authorization vulnerability CVE-2025-62610, GHSA-m732-5p4w-x69g | High | 0.4% | 22 Oct, 2025 | npm hono |
Angular SSR has a Server-Side Request Forgery (SSRF) flaw CVE-2025-62427, GHSA-q63q-pgmf-mxhr | High | 0.4% | 16 Oct, 2025 | npm @angular/ssr |
Strapi core vulnerable to sensitive data exposure via CORS misconfiguration CVE-2025-53092, GHSA-9329-mxxw-qwf8 | High | 0.3% | 16 Oct, 2025 | npm @strapi/core |
Strapi Allows Unauthorized Access to Private Fields via parms.lookup CVE-2024-56143, GHSA-495j-h493-42q2 | High | 0.4% | 16 Oct, 2025 | npm @strapi/core |
`sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js` CVE-2025-62381, GHSA-hwmc-4c8j-xxj7 | High | 0.7% | 15 Oct, 2025 | npm sveltekit-superforms |
Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages CVE-2025-34267, GHSA-5w3r-f6gm-c25w, GHSA-r4hh-pcgx-j5r2 | High | 6.6% | 14 Oct, 2025 | npm flowise |
Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate CVE-2025-59288, GHSA-7mvr-c777-76hp | High | 0.2% | 14 Oct, 2025 | npm playwright |
Flowise is vulnerable to arbitrary file exposure through its ReadFileTool GHSA-j44m-5v8f-gc9c | High | Not scored | 10 Oct, 2025 | npm flowise npm flowise-components |
n8n: Execute Command Node Allows Authenticated Users to Run Arbitrary Commands on Host CVE-2025-71380, GHSA-365g-vjw2-grx8 | High | 0.6% | 09 Oct, 2025 | npm n8n npm n8n-nodes-base |
Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict CVE-2025-13033, GHSA-mm7p-fcc7-pg87 | High | 0.6% | 07 Oct, 2025 | npm nodemailer |
pdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embedding CVE-2025-11362, GHSA-rj3r-r7hh-jxfq | High | 0.4% | 07 Oct, 2025 | npm pdfmake |
FlowiseAI/Flosise has File Upload vulnerability CVE-2025-61687, GHSA-35g6-rrw3-v6xc | High | 11.8% | 06 Oct, 2025 | npm flowise |
Claude Code can execute commands prior to the startup trust dialog CVE-2025-59536, GHSA-4fgq-fpq9-mr3g | High | 24.9% | 03 Oct, 2025 | npm @anthropic-ai/claude-code |
Fiora chat group avatar is vulnerable to XSS via SVG files CVE-2025-56515, GHSA-2c6j-vw6r-mfch | High | 0.5% | 01 Oct, 2025 | npm fiora |
@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user CVE-2025-61668, GHSA-m8rj-ppph-mj33 | High | 0.4% | 01 Oct, 2025 | npm @plone/volto |
figma-developer-mcp vulnerable to command injection in get_figma_data tool CVE-2025-15061, CVE-2025-53967, GHSA-gxw4-4fc5-9gr5 | High | 6.1% | 30 Sep, 2025 | npm figma-developer-mcp |
Finance.js vulnerable to DoS via the seekZero() parameter CVE-2025-56572, GHSA-5q7q-p8pc-782h | High | 0.5% | 30 Sep, 2025 | npm financejs |