Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
devalue prototype pollution vulnerability CVE-2025-57820, GHSA-vj54-72f3-p5jv | High | 0.4% | 26 Aug, 2025 | npm devalue |
jsPDF Denial of Service (DoS) CVE-2025-57810, GHSA-8mvj-3j78-4qmw | High | 0.7% | 26 Aug, 2025 | npm jspdf |
@musistudio/claude-code-router has improper CORS configuration CVE-2025-57755, GHSA-8hmm-4crw-vm2c | High | 0.3% | 21 Aug, 2025 | npm @musistudio/claude-code-router |
x402 SDK vulnerable in outdated versions in resource servers for builders GHSA-3j63-5h8p-gf7c | High | Not scored | 20 Aug, 2025 | npm x402 npm x402-express npm x402-hono npm x402-next |
Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source CVE-2025-52478, GHSA-hfmv-hhh3-43f2 | High | 0.4% | 19 Aug, 2025 | npm n8n |
Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude Code CVE-2025-55284, GHSA-x5gv-jw7f-j6xj | High | 0.6% | 16 Aug, 2025 | npm @anthropic-ai/claude-code |
content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE CVE-2025-55164, GHSA-w2cq-g8g3-gm83 | High | 0.4% | 12 Aug, 2025 | npm content-security-policy-parser |
The AuthKit Remix Library renders sensitive auth data in HTML CVE-2025-55009, GHSA-v3gr-w9gf-23cx | High | 0.4% | 08 Aug, 2025 | npm @workos-inc/authkit-remix |
The AuthKit React Router Library rendered sensitive auth data in HTML CVE-2025-55008, GHSA-vqvc-9q8x-vmq6 | High | 0.4% | 08 Aug, 2025 | npm @workos-inc/authkit-react-router |
@fedify/fedify has Improper Authentication and Incorrect Authorization CVE-2025-54888, GHSA-6jcc-xgcr-q3h4 | High | 0.6% | 08 Aug, 2025 | npm @fedify/fedify |
js-toml Prototype Pollution Vulnerability CVE-2025-54803, GHSA-65fc-cr5f-v7r2 | High | 0.5% | 04 Aug, 2025 | npm js-toml |
Claude Code echo command allowed bypass of user approval prompt for command execution CVE-2025-54795, GHSA-x56v-x2h6-7j34 | High | 1.0% | 04 Aug, 2025 | npm @anthropic-ai/claude-code |
Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access CVE-2025-54794, GHSA-pmw4-pwvc-3hx2 | High | 1.4% | 04 Aug, 2025 | npm @anthropic-ai/claude-code |
@nyariv/sandboxjs has Prototype Pollution vulnerability that may lead to RCE CVE-2025-34146, GHSA-9qm3-6qrr-c76m | High | 0.2% | 31 Jul, 2025 | npm @nyariv/sandboxjs |
GitProxy Hidden Commits Injection CVE-2025-54586, GHSA-v98g-8rqx-g93g | High | 0.4% | 30 Jul, 2025 | npm @finos/git-proxy |
GitProxy New Branch Approval Exploit CVE-2025-54585, GHSA-39p2-8hq9-fwj6 | High | 0.4% | 30 Jul, 2025 | npm @finos/git-proxy |
GitProxy Backfile Parsing Exploit CVE-2025-54584, GHSA-xxmh-rf63-qwjv | High | 0.6% | 30 Jul, 2025 | npm @finos/git-proxy |
GitProxy Approval Bypass When Pushing Multiple Branches CVE-2025-54583, GHSA-qr93-8wwf-22g4 | High | 0.5% | 30 Jul, 2025 | npm @finos/git-proxy |
ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as Invalid CVE-2025-8267, GHSA-p4hc-9pjh-55c8 | High | 0.5% | 28 Jul, 2025 | npm ssrfcheck |
Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS) CVE-2025-8101, GHSA-95jq-xph2-cx9h | High | 0.6% | 25 Jul, 2025 | npm linkifyjs |
HAX CMS API Lacks Authorization Checks CVE-2025-54378, GHSA-9jr9-8ff3-m894 | High | 0.6% | 25 Jul, 2025 | Packagist elmsln/haxcms npm @haxtheweb/haxcms-nodejs |
Withdrawn Advisory: bun vulnerable to OS Command Injection CVE-2025-8022, GHSA-4j66-8f4r-3pjx | High | Not scored | 23 Jul, 2025 | npm bun |
files-bucket-server vulnerable to Directory Traversal CVE-2025-8021, GHSA-3r3j-4vrw-884j | High | 0.8% | 23 Jul, 2025 | npm files-bucket-server |
private-ip vulnerable to Server-Side Request Forgery CVE-2025-8020, GHSA-9h3q-32c7-r533 | High | 0.4% | 23 Jul, 2025 | npm private-ip |
NodeJS version of the HAX CMS application is distributed with Default Secrets CVE-2025-54137, GHSA-5fpv-5qvh-7cf3 | High | 0.4% | 21 Jul, 2025 | npm @haxtheweb/haxcms-nodejs |
HAX CMS NodeJS Application Has Improper Error Handling That Leads to Denial of Service CVE-2025-54134, GHSA-pjj3-j5j6-qj27 | High | 0.5% | 21 Jul, 2025 | npm @haxtheweb/haxcms-nodejs |
NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting CVE-2025-54128, GHSA-59g8-h59f-8hjp | High | 0.2% | 21 Jul, 2025 | npm @haxtheweb/haxcms-nodejs |
Alchemy Non-SMA and Webauthn Account Security Advisory GHSA-56r6-ccm5-8hg3 | High | Not scored | 21 Jul, 2025 | npm @account-kit/smart-contracts |
@translated/lara-mcp vulnerable to command injection in import_tmx tool CVE-2025-53832, GHSA-xj5p-8h7g-76m7 | High | 10.9% | 21 Jul, 2025 | npm @translated/lara-mcp |
eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code CVE-2025-54313, GHSA-f29h-pxvx-f335 | HighExploited | 5.1% | 19 Jul, 2025 | npm @pkgr/core npm eslint-config-prettier npm eslint-plugin-prettier npm got-fetch +2 more |
Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering CVE-2025-54075, GHSA-cj6r-rrr9-fg82 | High | 0.3% | 18 Jul, 2025 | npm @nuxtjs/mdc |
mcp-package-docs vulnerable to command injection in several tools CVE-2025-54073, GHSA-vf9j-h32g-2764 | High | 11.3% | 18 Jul, 2025 | npm mcp-package-docs |
Multer vulnerable to Denial of Service via unhandled exception from malformed request CVE-2025-7338, GHSA-fjgf-rc76-4x9p | High | 0.8% | 17 Jul, 2025 | npm multer |
GitHub Kanban MCP Server vulnerable to Command Injection CVE-2025-53818, GHSA-6jx8-rcjx-vmwf | High | 1.4% | 14 Jul, 2025 | npm @sunwood-ai-labs/github-kanban-mcp-server |
@clerk/backend Performs Insufficient Verification of Data Authenticity CVE-2025-53548, GHSA-9mp4-77wg-rwx9 | High | 0.2% | 09 Jul, 2025 | npm @clerk/astro npm @clerk/backend npm @clerk/express npm @clerk/fastify +5 more |
MCP Server Kubernetes vulnerable to command injection in several tools CVE-2025-53355, GHSA-gjv4-ghm7-q58q | High | 2.2% | 08 Jul, 2025 | npm mcp-server-kubernetes |
Node.js Sandbox MCP Server vulnerability can lead to Sandbox Escape via Command Injection CVE-2025-53372, GHSA-5w57-2ccq-8w95 | High | 1.0% | 08 Jul, 2025 | npm node-code-sandbox-mcp |
Next.JS vulnerability can lead to DoS via cache poisoning CVE-2025-49826, GHSA-67rr-84xm-4c7r | High | 1.1% | 03 Jul, 2025 | npm next |
@modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix CVE-2025-53110, GHSA-hc55-p739-j48w | High | 0.6% | 01 Jul, 2025 | npm @modelcontextprotocol/server-filesystem |
@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling CVE-2025-53109, GHSA-q66q-fx2p-7w4m | High | 0.8% | 01 Jul, 2025 | npm @modelcontextprotocol/server-filesystem |
@cyanheads/git-mcp-server vulnerable to command injection in several tools CVE-2025-53107, GHSA-3q26-f695-pp76 | High | 24.5% | 30 Jun, 2025 | npm @cyanheads/git-mcp-server |
electron ASAR Integrity bypass by just modifying the content CVE-2024-46992, GHSA-xw5q-g62x-2qjc | High | 0.1% | 30 Jun, 2025 | npm electron |
tiny-secp256k1 allows for verify() bypass when running in bundled environment CVE-2024-49365, GHSA-5vhg-9xg4-cv9m | High | 0.2% | 30 Jun, 2025 | npm tiny-secp256k1 |
tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment CVE-2024-49364, GHSA-7mc2-6phr-23xc | High | 0.4% | 30 Jun, 2025 | npm tiny-secp256k1 |
string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS) CVE-2025-45143, GHSA-994j-5c83-r424 | High | 0.4% | 30 Jun, 2025 | npm string-math |
Claude Code Improper Authorization via websocket connections from arbitrary origins CVE-2025-52882, GHSA-9f65-56v6-gxw7 | High | 0.4% | 23 Jun, 2025 | npm @anthropic-ai/claude-code |
opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass CVE-2025-6087, CVE-2026-3125, GHSA-c7mq-gh6q-6q7c, GHSA-rvpw-p7vw-wj3m | High | 1.0% | 16 Jun, 2025 | npm @opennextjs/cloudflare |
Erxes Path Traversal vulnerability CVE-2024-57186, GHSA-rq9r-qvwg-829q | High | 0.4% | 10 Jun, 2025 | npm erxes |
HaxCMS-PHP Command Injection Vulnerability CVE-2025-49141, GHSA-g4cf-pp4x-hqgw | High | 1.5% | 09 Jun, 2025 | npm @haxtheweb/haxcms-nodejs |
react-native-keys insecurely stores encryption cipher and Base64 chunks CVE-2025-45001, GHSA-fj44-h6xw-896g | High | 0.2% | 09 Jun, 2025 | npm react-native-keys |