Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies CVE-2025-48947, GHSA-f3fg-mf2q-fj3f | High | 0.4% | 04 Jun, 2025 | npm @auth0/nextjs-auth0 |
Multer vulnerable to Denial of Service via unhandled exception CVE-2025-48997, GHSA-g5hg-p3ph-g8qg | High | 0.5% | 03 Jun, 2025 | npm multer |
tar-fs can extract outside the specified dir with a specific tarball CVE-2025-48387, GHSA-8cj5-5rvv-wf4v | High | 0.6% | 02 Jun, 2025 | npm tar-fs |
Strapi allows Server-Side Request Forgery in Webhook function CVE-2024-52588, GHSA-v8wj-f5c7-pvxf | High | 0.6% | 27 May, 2025 | npm @strapi/admin |
Multer vulnerable to Denial of Service from maliciously crafted requests CVE-2025-47944, GHSA-4pg4-qvpc-4q3h | High | 0.8% | 19 May, 2025 | npm multer |
Multer vulnerable to Denial of Service via memory leaks from unclosed streams CVE-2025-47935, GHSA-44fp-w29j-9vj5 | High | 0.8% | 19 May, 2025 | npm multer |
OpenPGP.js's message signature verification can be spoofed CVE-2025-47934, GHSA-8qff-qr5q-5pr8 | High | 0.6% | 19 May, 2025 | npm openpgp |
Cocotais Bot has builtin .echo command injection CVE-2025-47948, GHSA-mj2c-8hxf-ffvq | High | 0.4% | 17 May, 2025 | npm cocotais-bot |
code-server's session cookie can be extracted by having user visit specially crafted proxy URL CVE-2025-47269, GHSA-p483-wpfp-42cj | High | 56.3% | 09 May, 2025 | npm code-server |
Passport-wsfed-saml2 allows SAML Authentication Bypass via Attribute Smuggling CVE-2025-46573, GHSA-8gqj-226h-gm8r | High | 0.4% | 06 May, 2025 | npm passport-wsfed-saml2 |
Homograph attack allows Unicode lookalike characters to bypass validation. CVE-2025-27611, GHSA-xq7p-g2vc-g82p | High | 0.5% | 30 Apr, 2025 | npm base-x |
NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file CVE-2025-46328, GHSA-wmjq-jrm2-9wfr | High | 0.2% | 28 Apr, 2025 | npm snowflake-sdk |
React Router allows pre-render data spoofing on React-Router framework mode CVE-2025-43865, GHSA-cpj6-fhp6-mr6j | High | 0.8% | 24 Apr, 2025 | npm react-router |
React Router allows a DoS via cache poisoning by forcing SPA mode CVE-2025-43864, GHSA-f46r-rw29-r322 | High | 20.5% | 24 Apr, 2025 | npm react-router |
tRPC 11 WebSocket DoS Vulnerability CVE-2025-43855, GHSA-pj3v-9cm8-gvj8 | High | 0.4% | 24 Apr, 2025 | npm @trpc/server |
PostHog Plugin Server SQL Injection Vulnerability CVE-2025-1520, GHSA-v64v-fq96-c5wv | High | 0.5% | 23 Apr, 2025 | npm @posthog/plugin-server |
ses's global contour bindings leak into Compartment lexical scope CVE-2025-32792, GHSA-h9w6-f932-gq62 | High | 0.6% | 18 Apr, 2025 | npm ses |
Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header CVE-2025-32442, CVE-2026-33806, GHSA-247c-9743-5963, GHSA-mg2h-6x62-wpwc | High | 0.7% | 18 Apr, 2025 | npm fastify |
Flowise Vulnerable to SQL Injection via `tableName` Parameter CVE-2025-29189, GHSA-gjx9-wg9x-7gvp | High | 0.3% | 09 Apr, 2025 | npm flowise-components |
Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass CVE-2025-32031, GHSA-p2q6-pwh5-m6jr | High | 0.6% | 07 Apr, 2025 | npm @apollo/gateway |
Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion CVE-2025-32030, GHSA-q2f9-x4p4-7xmh | High | 0.5% | 07 Apr, 2025 | npm @apollo/gateway |
FlowiseDB vulnerable to SQL Injection by authenticated users CVE-2025-71332, GHSA-9c4c-g95m-c8cp | High | 0.5% | 07 Apr, 2025 | npm flowise |
js-object-utilities Vulnerable to Prototype Pollution CVE-2025-28269, GHSA-hpqf-m68j-2pfx | High | Not scored | 07 Apr, 2025 | npm js-object-utilities |
bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function CVE-2025-3194, GHSA-3gc7-fjrx-p6mg | High | 0.7% | 04 Apr, 2025 | npm bigint-buffer |
generator-jhipster-entity-audit vulnerable to Unsafe Reflection when having Javers selected as Entity Audit Framework CVE-2025-31119, GHSA-7rmp-3g9f-cvq8 | High | 0.5% | 03 Apr, 2025 | npm generator-jhipster-entity-audit |
image-size Denial of Service via Infinite Loop during Image Processing CVE-2025-71319, GHSA-m5qc-5hw7-8vg7 | High | 0.7% | 02 Apr, 2025 | npm image-size |
Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers CVE-2025-31137, GHSA-4q56-crqp-v477 | High | 1.2% | 01 Apr, 2025 | npm @react-router/express npm @remix-run/express |
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query CVE-2025-31125, GHSA-4r4m-qw57-chr8 | HighExploited | 74.9% | 31 Mar, 2025 | npm vite |
Redoc Prototype Pollution via `Module.mergeObjects` Component CVE-2024-57083, GHSA-9rhg-254w-fh9x | High | 0.6% | 28 Mar, 2025 | npm redoc |
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File CVE-2024-12905, GHSA-pq67-2wwv-3xjx | High | 2.3% | 27 Mar, 2025 | npm tar-fs |
Directus's webhook trigger flows can leak sensitive data CVE-2025-30353, GHSA-fm3h-p9wm-h74h | High | 0.5% | 26 Mar, 2025 | npm directus |
Vite bypasses server.fs.deny when using ?raw?? CVE-2025-30208, GHSA-x574-m823-4x7w | High | 74.8% | 24 Mar, 2025 | npm vite |
nossrf Server-Side Request Forgery (SSRF) CVE-2025-2691, GHSA-vm77-mr48-27wj | High | 0.4% | 23 Mar, 2025 | npm nossrf |
Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability GHSA-5ccf-884p-4jjq | High | Not scored | 20 Mar, 2025 | PyPI open-webui npm open-webui |
Open WebUI Uncontrolled Resource Consumption vulnerability CVE-2024-12534, GHSA-g3mx-83mp-3rwc, PYSEC-2026-1733 | High | Not scored | 20 Mar, 2025 | PyPI open-webui npm open-webui |
Open WebUI Uncontrolled Resource Consumption vulnerability CVE-2024-12537, GHSA-chf7-q7m5-fq92, PYSEC-2026-1728 | High | Not scored | 20 Mar, 2025 | PyPI open-webui npm open-webui |
Nuxt allows DOS via cache poisoning with payload rendering response CVE-2025-27415, GHSA-jvhm-gjrh-3h93 | High | 0.4% | 19 Mar, 2025 | npm nuxt |
jsPDF Bypass Regular Expression Denial of Service (ReDoS) CVE-2025-29907, GHSA-w532-jxjh-hjhj | High | 0.7% | 18 Mar, 2025 | npm jspdf |
In Azle, calling `setTimer` causes infinite loop of timers CVE-2025-29776, GHSA-xc76-5pf9-mx8m | High | 0.4% | 14 Mar, 2025 | npm azle |
Prototype Pollution Vulnerability in parse-git-config CVE-2025-25975, GHSA-8g77-54rh-46hx | High | 0.5% | 12 Mar, 2025 | npm parse-git-config |
Mockoon has a Path Traversal and LFI in the static file serving endpoint CVE-2025-59049, GHSA-w7f9-wqc4-3wxr | High | 1.8% | 11 Mar, 2025 | npm @mockoon/cli npm @mockoon/commons-server |
Vue I18n Allows Prototype Pollution in `handleFlatJson` CVE-2025-27597, GHSA-p2ph-7g93-hw3m | High | 0.6% | 07 Mar, 2025 | npm @intlify/core npm @intlify/core-base npm @intlify/message-resolver npm @intlify/vue-i18n-core +2 more |
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL CVE-2025-27152, GHSA-jr5f-v2jv-69x6 | High | 0.8% | 07 Mar, 2025 | npm axios |
mavo DOM Clobbering vulnerability CVE-2024-53388, GHSA-3mf5-r4hg-hfx9 | High | 0.6% | 03 Mar, 2025 | npm mavo |
mongosh vulnerable to local privilege escalation CVE-2025-1756, GHSA-f5w3-73h4-jpcm | High | 0.2% | 27 Feb, 2025 | npm mongosh |
MongoDB Shell may be susceptible to control character injection via pasting CVE-2025-1692, GHSA-973h-3x6p-qg37 | High | 0.3% | 27 Feb, 2025 | npm mongosh |
MongoDB Shell may be susceptible to Control Character Injection via autocomplete CVE-2025-1691, GHSA-43g5-2wr2-q7vj | High | 0.4% | 27 Feb, 2025 | npm mongosh |
Better Auth allows bypassing the trustedOrigins Protection which leads to ATO CVE-2025-71403, GHSA-vp58-j275-797x | High | 0.3% | 24 Feb, 2025 | npm better-auth |
Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS) CVE-2025-27109, GHSA-3qxh-p7jc-5xh6 | High | 0.3% | 21 Feb, 2025 | npm solid-js |
DOM Expressions has a Cross-Site Scripting (XSS) vulnerability due to improper use of string.replace CVE-2025-27108, GHSA-hw62-58pr-7wc5 | High | 0.3% | 21 Feb, 2025 | npm dom-expressions |