Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Finance.js vulnerable to DoS via the IRR function’s depth parameter CVE-2025-56571, GHSA-f8r4-mf27-rf7m | High | 0.4% | 30 Sep, 2025 | npm financejs |
@nubosoftware/node-static failure to catch exception can result in server crash CVE-2025-11149, GHSA-27w5-gj5q-82fv | High | 0.5% | 30 Sep, 2025 | npm @nubosoftware/node-static |
algoliasearch-helper is vulnerable to Prototype Pollution in _merge() CVE-2025-3193, GHSA-529q-4j3p-7c5r | High | 0.5% | 27 Sep, 2025 | npm algoliasearch-helper |
Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass CVE-2025-59845, GHSA-w87v-7w53-wwxv | High | 0.2% | 26 Sep, 2025 | npm @apollo/explorer npm @apollo/sandbox |
apidoc-core is vulnerable to prototype pollution CVE-2025-57317, GHSA-5q53-78f2-6gf8 | High | 0.4% | 25 Sep, 2025 | npm apidoc-core |
dref is vulnerable to prototype pollution CVE-2025-26278, GHSA-76g8-235f-gj6p | High | 0.4% | 25 Sep, 2025 | npm dref |
Withdrawn Advisory: fast-redact vulnerable to prototype pollution CVE-2025-57319, GHSA-ffrw-9mx8-89p8 | High | 0.4% | 24 Sep, 2025 | npm fast-redact |
csvjson vulnerable to prototype injection CVE-2025-57318, GHSA-xq4f-3jxp-qv6m | High | 0.4% | 24 Sep, 2025 | npm csvjson |
web3-core-method is vulnerable to prototype pollution CVE-2025-57329, GHSA-2j4c-9qqq-896r | High | 0.4% | 24 Sep, 2025 | npm web3-core-method |
toggle-array vulnerable to prototype pollution CVE-2025-57328, GHSA-34q3-8x9v-j957 | High | 0.4% | 24 Sep, 2025 | npm toggle-array |
spmrc vulnerable to prototype pollution CVE-2025-57327, GHSA-r2rv-8pp3-65xw | High | 0.4% | 24 Sep, 2025 | npm spmrc |
sassdoc-extras vulnerable to prototype pollution CVE-2025-57326, GHSA-3mpm-jx38-9m8w | High | 0.4% | 24 Sep, 2025 | npm sassdoc-extras |
rollbar vulnerable to prototype pollution CVE-2025-57325, GHSA-r8c2-2qwq-94p6 | High | 0.4% | 24 Sep, 2025 | npm rollbar |
mpregular vulnerable to prototype pollution CVE-2025-57323, GHSA-xx4g-r65p-3qf2 | High | 0.4% | 24 Sep, 2025 | npm mpregular |
messageformat has a prototype pollution vulnerability CVE-2025-57349, GHSA-xfqm-j7pc-xrfc | High | 0.4% | 24 Sep, 2025 | npm messageformat |
web3-core-subscriptions has a Prototype Pollution vulnerability CVE-2025-57330, GHSA-hhf6-3xpg-pggx | High | 0.4% | 24 Sep, 2025 | npm web3-core-subscriptions |
Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions CVE-2025-59828, GHSA-2jjv-qf24-vfm4 | High | 0.4% | 24 Sep, 2025 | npm @anthropic-ai/claude-code |
tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball CVE-2025-59343, GHSA-vj76-c3g6-qr5v | High | 0.6% | 24 Sep, 2025 | npm tar-fs |
CSVTOJSON has a prototype pollution vulnerability CVE-2025-57350, GHSA-vrw9-g62v-7fmf | High | 0.3% | 24 Sep, 2025 | npm csvtojson |
Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink CVE-2025-59430, GHSA-vh3f-qppr-j97f | High | 0.4% | 22 Sep, 2025 | npm @meshconnect/web-link-sdk |
`git-comiters` Command Injection vulnerability CVE-2025-59831, GHSA-g38c-wxjf-xrh6 | High | 4.2% | 22 Sep, 2025 | npm git-commiters |
Codex has sandbox bypass due to bug in path configuration logic CVE-2025-59532, GHSA-w5fx-fh39-j5rw | High | 0.9% | 19 Sep, 2025 | npm @openai/codex |
@executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode CVE-2025-59333, GHSA-65hm-pwj5-73pw | High | 0.4% | 16 Sep, 2025 | npm @executeautomation/database-server |
FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability CVE-2025-59527, GHSA-hr92-4q35-4j3m | High | 5.5% | 15 Sep, 2025 | npm flowise |
Axios is vulnerable to DoS attack through lack of data size check CVE-2025-58754, GHSA-4hjh-wcwx-xvwj | High | 1.2% | 11 Sep, 2025 | npm axios |
Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage CVE-2025-59052, GHSA-68x2-mx4q-78m7 | High | 0.4% | 10 Sep, 2025 | npm @angular/platform-server npm @angular/ssr npm @nguniversal/common |
Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email CVE-2025-59041, GHSA-j4h9-wv2m-wrf7 | High | 0.5% | 10 Sep, 2025 | npm @anthropic-ai/claude-code |
Claude Code rg vulnerability does not protect against approval prompt bypass CVE-2025-58764, GHSA-qxfv-fcpc-w36x | High | 0.5% | 10 Sep, 2025 | npm @anthropic-ai/claude-code |
Webrecorder packages are vulnerable to XSS through 404 error handling logic CVE-2025-58765, GHSA-w765-jm6w-4hhj | High | 0.3% | 09 Sep, 2025 | npm @webrecorder/archivewebpage npm @webrecorder/wabac npm replaywebpage |
Malicious release: Prebid.js NPM package briefly compromised CVE-2025-59038, GHSA-jwq7-6j4r-2f92, MAL-2025-46990 | MaliciousHigh | 0.4% | 09 Sep, 2025 | npm prebid.js |
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware CVE-2025-59037, GHSA-w62p-hx95-gf2c | High | 0.4% | 09 Sep, 2025 | npm @duckdb/duckdb-wasm npm @duckdb/node-api npm @duckdb/node-bindings npm duckdb |
Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity CVE-2025-58451, GHSA-455v-w7r9-3vv9 | High | 0.3% | 08 Sep, 2025 | npm cattown |
MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server CVE-2025-58444, GHSA-g9hg-qhmf-q45m | High | 0.7% | 08 Sep, 2025 | npm @modelcontextprotocol/inspector |
Malicious release: color@5.0.1 contains malware after npm account takeover CVE-2025-59143, GHSA-j8fv-6x8p-p766, GHSA-qrmh-qg46-72pp, MAL-2025-46985 | MaliciousHigh | 0.4% | 08 Sep, 2025 | npm color |
N8N's Chat Trigger component is vulnerable to XSS CVE-2025-56265, GHSA-v2x8-97xq-8xrr | High | 0.6% | 08 Sep, 2025 | npm @n8n/n8n-nodes-langchain |
Malicious release: color-convert@3.1.1 contains malware after npm account takeover CVE-2025-59162, GHSA-ch7m-m9rf-8gvv, GHSA-pxx3-g568-hxr4, MAL-2025-46971 | MaliciousHigh | 0.4% | 08 Sep, 2025 | npm color-convert |
Malicious release: color-string@2.1.1 contains malware after npm account takeover CVE-2025-59142, GHSA-286p-vc9p-p5qv, GHSA-3q87-f72r-3gm6, MAL-2025-46973 | MaliciousHigh | 0.4% | 08 Sep, 2025 | npm color-string |
Malicious release: backslash@0.2.1 contains malware after npm account takeover CVE-2025-59140, GHSA-53mq-f4w3-f7qv, GHSA-m2xf-jp99-f298, MAL-2025-46968 | MaliciousHigh | 0.4% | 08 Sep, 2025 | npm backslash |
Malicious release: is-arrayish@0.3.3 contains malware after npm account takeover CVE-2025-59331, GHSA-frh7-2f84-v9mw, GHSA-hfm8-9jrf-7g9w, MAL-2025-46977 | MaliciousHigh | 0.4% | 08 Sep, 2025 | npm is-arrayish |
Malicious release: simple-swizzle@0.2.3 contains malware after npm account takeover CVE-2025-59141, GHSA-9g9j-rggx-7fmg, GHSA-wwpx-h6g5-c7x6, MAL-2025-46978 | MaliciousHigh | 0.4% | 08 Sep, 2025 | npm simple-swizzle |
Malicious release: color-name@2.0.1 contains malware after npm account takeover CVE-2025-59145, GHSA-5fvm-p68v-5wmh, GHSA-m99c-cfww-cxqx, MAL-2025-46972 | MaliciousHigh | 0.6% | 08 Sep, 2025 | npm color-name |
Malicious release: error-ex@1.3.3 contains malware after npm account takeover CVE-2025-59330, GHSA-5g7q-qh7p-jjvm, GHSA-6jp5-hh4c-8c5h, MAL-2025-46975 | MaliciousHigh | 0.4% | 08 Sep, 2025 | npm error-ex |
Malicious release: debug@4.4.2 contains malware after npm account takeover CVE-2025-59144, GHSA-4x49-vf9v-38px, GHSA-8mgj-vmr8-frr6, MAL-2025-46974 | MaliciousHigh | 0.5% | 08 Sep, 2025 | npm debug |
Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter CVE-2025-58179, GHSA-qpr4-c339-7vq8 | High | 0.9% | 04 Sep, 2025 | npm @astrojs/cloudflare |
Hono's flaw in URL path parsing could cause path confusion CVE-2025-58362, GHSA-9hp6-4448-45g2 | High | 0.6% | 03 Sep, 2025 | npm hono |
Claude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup Warning GHSA-ph6w-f82w-28w6 | High | Not scored | 03 Sep, 2025 | npm @anthropic-ai/claude-code |
mcp-markdownify-server vulnerable to command injection in pptx-to-markdown tool CVE-2025-58358, GHSA-45qj-4xq3-3c45 | High | 1.0% | 02 Sep, 2025 | npm mcp-markdownify-server |
Next.js Improper Middleware Redirect Handling Leads to SSRF CVE-2025-57822, GHSA-4342-x723-ch2f | High | 2.6% | 29 Aug, 2025 | npm next |
Volto affected by possible DoS by invoking specific URL by anonymous user CVE-2025-58047, GHSA-xjhf-7833-3pm5 | High | 0.7% | 28 Aug, 2025 | npm @plone/volto |
NodeBB SQL Injection vulnerability CVE-2025-50979, GHSA-rfh2-8vxq-jqr8 | High | 10.6% | 27 Aug, 2025 | npm nodebb |