Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
JSONPath Plus allows Remote Code Execution CVE-2025-1302, GHSA-hw8r-x6gr-5gjp | High | 10.4% | 15 Feb, 2025 | npm jsonpath-plus |
parse-duration has a Regex Denial of Service that results in event loop delay and out of memory CVE-2025-25283, GHSA-hcrg-fc28-fcg5 | High | 0.8% | 12 Feb, 2025 | npm parse-duration |
Authentication bypass in @sap/approuter CVE-2025-24876, GHSA-cpfx-964w-4jvp | High | 0.5% | 11 Feb, 2025 | npm @sap/approuter |
CouchAuth has a Server-Side Template Injection vulnerability in its email functionality CVE-2024-57177, GHSA-r385-c5fc-x56c | High | 0.3% | 10 Feb, 2025 | npm @perfood/couch-auth |
Unknown vulnerability in Coinbase Wallet SDK GHSA-8rgj-285w-qcq4 | High | Not scored | 10 Feb, 2025 | npm @coinbase/wallet-sdk |
node-opcua-alarm-condition prototype pollution vulnerability CVE-2024-57086, GHSA-gvwq-6fmx-28xm | High | 0.4% | 05 Feb, 2025 | npm node-opcua-alarm-condition |
@stryker-mutator/util vulnerable to Prototype Pollution CVE-2024-57085, GHSA-9j5q-479x-43g2 | High | 0.4% | 05 Feb, 2025 | npm @stryker-mutator/util |
@rpldy/uploader prototype pollution CVE-2024-57082, GHSA-pc47-g7gv-4gpw | High | 0.3% | 05 Feb, 2025 | npm @rpldy/uploader |
vxe-table prototype pollution CVE-2024-57080, GHSA-89fp-f5mx-748x | High | 0.4% | 05 Feb, 2025 | npm vxe-table |
@zag-js/core prototype pollution CVE-2024-57079, GHSA-fg4m-w35q-vfg2 | High | 0.4% | 05 Feb, 2025 | npm @zag-js/core |
eazy-logger prototype pollution CVE-2024-57075, GHSA-r7jx-5m6m-cpg9 | High | 0.6% | 05 Feb, 2025 | npm eazy-logger |
module-from-string prototype pollution CVE-2024-57072, GHSA-q5j8-9m9g-x2jh | High | 0.6% | 05 Feb, 2025 | npm module-from-string |
@tanstack/form-core prototype pollution CVE-2024-57068, GHSA-ggv3-vmgw-xv2q | High | 0.4% | 05 Feb, 2025 | npm @tanstack/form-core |
@ndhoule/defaults prototype pollution CVE-2024-57066, GHSA-79h2-v6hh-wq23 | High | 0.5% | 05 Feb, 2025 | npm @ndhoule/defaults |
Vitest browser mode serves arbitrary files CVE-2025-24963, GHSA-8gvc-j273-4wm5 | High | 2.4% | 04 Feb, 2025 | npm @vitest/browser |
Unlimited consumption of resources in @fastify/multipart CVE-2025-24033, GHSA-27c6-mcxv-x3fh | High | 0.6% | 23 Jan, 2025 | npm @fastify/multipart |
KaTeX \htmlData does not validate attribute names CVE-2025-23207, GHSA-cg87-wmx4-v546 | High | 0.4% | 17 Jan, 2025 | npm katex |
Eugeny Tabby Sends Password Despite Host Key Verification Failure CVE-2024-48460, GHSA-8vq4-8hfp-29xh | High | 0.4% | 16 Jan, 2025 | npm tabby-ssh |
Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint CVE-2024-56734, GHSA-8jhw-6pjj-8723 | High | 0.4% | 30 Dec, 2024 | npm better-auth |
Systeminformation has command injection vulnerability in getWindowsIEEE8021x (SSID) CVE-2024-56334, GHSA-cvv5-9h9w-qp2m | High | 0.7% | 20 Dec, 2024 | npm systeminformation |
Astro's server source code is exposed to the public if sourcemaps are enabled CVE-2024-56159, GHSA-49w6-73cw-chjr | High | 1.5% | 19 Dec, 2024 | npm astro |
Next.js authorization bypass vulnerability CVE-2024-51479, GHSA-7gfc-8cq8-jh5f | High | 4.0% | 17 Dec, 2024 | npm next |
Avenwu Whistle Cross-Site Request Forgery (CSRF) CVE-2024-55500, GHSA-gg6x-448q-pqqm | High | 0.4% | 10 Dec, 2024 | npm whistle |
Directus allows unauthenticated access to WebSocket events and operations CVE-2024-54151, GHSA-849r-qrwj-8rv4 | High | 0.7% | 09 Dec, 2024 | npm @directus/api npm directus |
path-to-regexp contains a ReDoS CVE-2024-52798, GHSA-rhx6-c78j-4q9w | High | 0.8% | 05 Dec, 2024 | npm path-to-regexp |
Modified package published to npm, containing malware that exfiltrates private key material CVE-2024-54134, GHSA-jcxm-7wvp-g6p5 | High | 0.5% | 04 Dec, 2024 | npm @solana/web3.js |
@lobehub/chat Server Side Request Forgery vulnerability CVE-2024-32965, GHSA-2xcc-vm3f-m8rw | High | 26.1% | 26 Nov, 2024 | npm @lobehub/chat |
@dapperduckling/keycloak-connector-server has Reflected XSS Vulnerability in Authentication Flow URL Handling CVE-2024-53843, GHSA-w5rq-g9r6-vrcg | High | 0.5% | 26 Nov, 2024 | npm @dapperduckling/keycloak-connector-server |
Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit CVE-2024-21539, GHSA-7q7g-4xm8-89cq | High | 0.5% | 15 Nov, 2024 | npm @eslint/plugin-kit |
Regular Expression Denial of Service (ReDoS) in cross-spawn CVE-2024-21538, GHSA-3xgq-45jj-v275 | High | 0.9% | 08 Nov, 2024 | npm cross-spawn |
Path traversal in oak allows transfer of hidden files within the served root directory CVE-2024-49770, GHSA-qm92-93fv-vh7m | High | 0.7% | 01 Nov, 2024 | npm @oakserver/oak |
lilconfig Code Injection vulnerability CVE-2024-21537, GHSA-fq9m-v26v-2m4f | High | 1.1% | 31 Oct, 2024 | npm lilconfig |
CycloneDX cdxgen may execute code contained within build-related files CVE-2024-50611, GHSA-hxf3-vgpm-fv9p | High | 0.8% | 27 Oct, 2024 | npm @cyclonedx/cdxgen |
useragent Regular Expression Denial of Service vulnerability CVE-2020-26311, GHSA-mgfv-m47x-4wqp | High | 0.5% | 26 Oct, 2024 | npm useragent |
nope-validator Regular Expression Denial of Service vulnerability CVE-2020-26309, GHSA-3phv-83cj-p8p7 | High | 0.5% | 26 Oct, 2024 | npm nope-validator |
validate.js Regular Expression Denial of Service vulnerability CVE-2020-26308, GHSA-rv73-9c8w-jp4c | High | 0.5% | 26 Oct, 2024 | npm validate.js |
Knwl.js Regular Expression Denial of Service vulnerability CVE-2020-26306, GHSA-68qg-g787-3rp5 | High | 0.5% | 26 Oct, 2024 | npm knwl.js |
CommonRegexJS Regular Expression Denial of Service vulnerability CVE-2020-26305, GHSA-pmvv-57rg-5g86 | High | 0.5% | 26 Oct, 2024 | npm commonregex |
Foundation Regular Expression Denial of Service vulnerability CVE-2020-26304, GHSA-p8pc-3f7w-jr5q | High | 0.5% | 26 Oct, 2024 | npm foundation-sites |
insane vulnerable to Regular Expression Denial of Service CVE-2020-26303, GHSA-w455-mfq9-hf74 | High | 0.5% | 26 Oct, 2024 | npm insane |
OS Command Injection in Snyk gradle plugin CVE-2024-48964, GHSA-qqqw-gm93-qf6m | High | 0.5% | 23 Oct, 2024 | npm snyk-gradle-plugin |
OS Command Injection in Snyk php plugin CVE-2024-48963, GHSA-69f9-h8f9-7vjf | High | 0.5% | 23 Oct, 2024 | npm snyk-php-plugin |
Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify GHSA-m4gq-x24j-jpmf | High | Not scored | 22 Oct, 2024 | npm mermaid |
Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section CVE-2024-47819, GHSA-c5g6-6xf7-qxp3 | High | 0.4% | 22 Oct, 2024 | NuGet Umbraco.Cms.StaticAssets npm @umbraco-cms/backoffice |
secp256k1-node allows private key extraction over ECDH CVE-2024-48930, GHSA-584q-6j8j-r5pm | High | 0.4% | 21 Oct, 2024 | npm secp256k1 |
Denial of service in http-proxy-middleware CVE-2024-21536, GHSA-c7qv-q95q-8v27 | High | 1.0% | 19 Oct, 2024 | npm http-proxy-middleware |
Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room CVE-2024-47824, GHSA-qcvh-p9jq-wp8v | High | 0.7% | 15 Oct, 2024 | npm matrix-react-sdk |
Matrix JavaScript SDK's key history sharing could share keys to malicious devices CVE-2024-47080, GHSA-4jf8-g8wp-cx7c | High | 0.7% | 15 Oct, 2024 | npm matrix-js-sdk |
Denial of Service condition in Next.js image optimization CVE-2024-47831, GHSA-g77x-44xx-532m | High | 0.7% | 14 Oct, 2024 | npm next |
DOMpurify has a nesting-based mXSS CVE-2024-47875, GHSA-gx9m-whjm-85jf | High | 1.1% | 11 Oct, 2024 | npm dompurify |