Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
carbone Code Injection vulnerability CVE-2024-14020, GHSA-6rcw-ww3x-xqwm | Low | 0.3% | 07 Jan, 2026 | npm carbone |
Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature GHSA-24v3-254g-jv85 | Low | Not scored | 19 Dec, 2025 | npm @tutao/tutanota-utils |
Orejime has executable code in HTML attributes CVE-2025-68457, GHSA-72mh-hgpm-6384 | Low | 0.2% | 19 Dec, 2025 | npm orejime |
Mattermost Desktop App exposes sensitive information in its application logs CVE-2025-13321, GHSA-g6qx-wq5w-wr8v | Low | 0.1% | 17 Dec, 2025 | npm mattermost-desktop |
@tiptap/extension-link vulnerable to Cross-site Scripting (XSS) CVE-2025-14284, GHSA-vhrc-hgrq-x75r | Low | 0.4% | 09 Dec, 2025 | npm @tiptap/extension-link |
Anthropic Sandbox Runtime Incorrectly Implemented Network Sandboxing CVE-2025-66479, GHSA-9gqj-5w7c-vx47 | Low | 0.2% | 04 Dec, 2025 | npm @anthropic-ai/sandbox-runtime |
Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions CVE-2025-71402, GHSA-wmjr-v86c-m9jj | Low | 0.3% | 26 Nov, 2025 | npm better-auth |
Astro Development Server has Arbitrary Local File Read CVE-2025-64757, GHSA-x3h8-62x9-952g | Low | 0.4% | 19 Nov, 2025 | npm astro |
EverShop is vulnerable to Unauthorized Order Information Access (IDOR) CVE-2025-12919, GHSA-c73g-mx2w-cc93 | Low | 0.5% | 09 Nov, 2025 | npm @evershop/evershop |
Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module CVE-2025-62505, GHSA-fgx4-p8xf-qhp9 | Low | 0.3% | 17 Oct, 2025 | npm @lobehub/chat |
Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails CVE-2025-62380, GHSA-q4w9-x3rv-4c8j | Low | 0.5% | 15 Oct, 2025 | npm mailgen |
Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails CVE-2025-62366, GHSA-xw6r-chmh-vpmj | Low | 0.4% | 14 Oct, 2025 | npm mailgen |
MCPHub's ServerController is vulnerable to Command Injection CVE-2025-11285, GHSA-5q2p-3jg8-2m98 | Low | 7.9% | 05 Oct, 2025 | npm @samanhappy/mcphub |
Claude Code permission deny bypass through symlink CVE-2025-59829, GHSA-66m2-gx93-v996 | Low | 0.4% | 03 Oct, 2025 | npm @anthropic-ai/claude-code |
Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival CVE-2025-59414, GHSA-p6jq-8vc4-79f6 | Low | 0.4% | 17 Sep, 2025 | npm nuxt |
Vite's `server.fs` settings were not applied to HTML files CVE-2025-58752, GHSA-jqfw-vq24-v9c3 | Low | 0.6% | 08 Sep, 2025 | npm vite |
Vite middleware may serve files starting with the same name with the public directory CVE-2025-58751, GHSA-g4jq-h2w9-997c | Low | 1.2% | 08 Sep, 2025 | npm vite |
CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package CVE-2025-58064, GHSA-x9gp-vjh6-3wv6 | Low | 0.4% | 03 Sep, 2025 | npm @ckeditor/ckeditor5-clipboard npm ckeditor5 |
wong2 mcp-cli Command Injection Vulnerability CVE-2025-9262, GHSA-p6rm-483j-37jf | Low | 4.3% | 20 Aug, 2025 | npm @wong2/mcp-cli |
Template Secret leakage in logs in Scaffolder when using `fetch:template` CVE-2025-55285, GHSA-3x3q-ghcp-whf7 | Low | 0.2% | 15 Aug, 2025 | npm @backstage/plugin-scaffolder-backend |
HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit GHSA-xcxh-6cv4-q8p8 | Low | Not scored | 12 Aug, 2025 | npm hfs |
Withdrawn Advisory: JHipster allows privilege escalation via a modified authorities parameter CVE-2025-43712, GHSA-cmm8-gw4m-26cw | Low | 0.3% | 25 Jul, 2025 | npm generator-jhipster |
Koa Open Redirect via Referrer Header (User-Controlled) CVE-2025-8129, GHSA-jgmv-j7ww-jx2x | Low | 0.3% | 25 Jul, 2025 | npm koa |
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser GHSA-xffm-g5w8-qvg7 | Low | Not scored | 18 Jul, 2025 | npm @eslint/plugin-kit |
on-headers is vulnerable to http response header manipulation CVE-2025-7339, GHSA-76c9-3jph-rj3q | Low | 0.2% | 17 Jul, 2025 | npm on-headers |
Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes CVE-2025-53535, GHSA-36rg-gfq2-3h56 | Low | 0.4% | 07 Jul, 2025 | npm better-auth |
Next.js has a Cache poisoning vulnerability due to omission of the Vary header CVE-2025-49005, GHSA-r2fc-ccr8-96c4 | Low | 0.5% | 03 Jul, 2025 | npm next |
Taylor has race condition in /get-patch that allows purchase token replay GHSA-vh5j-5fhq-9xwg | Low | Not scored | 27 Jun, 2025 | npm taylored |
Snyk CLI Insertion of Sensitive Information into Log File allowed in DEBUG or DEBUG/TRACE mode CVE-2025-6624, GHSA-6hwc-9h8r-3vmf, GO-2025-3789 | Low | 0.2% | 26 Jun, 2025 | Go github.com/snyk/go-application-framework npm snyk |
Withdrawn Advisory: microlight allows a denial of service CVE-2025-45526, GHSA-wgc6-9f6w-h8hx | Low | 0.1% | 17 Jun, 2025 | npm microlight |
Withdrawn Advisory: microlight.js has a null pointer dereference vulnerability CVE-2025-45525, GHSA-64x7-m7rh-9m83 | Low | 0.1% | 17 Jun, 2025 | npm microlight |
pm2 Regular Expression Denial of Service vulnerability CVE-2025-5891, GHSA-x5gf-qvw8-r2rm | Low | 0.7% | 09 Jun, 2025 | npm pm2 |
brace-expansion Regular Expression Denial of Service vulnerability CVE-2025-5889, GHSA-v6h2-p8h4-qcjw | Low | 0.6% | 09 Jun, 2025 | npm brace-expansion |
Information exposure in Next.js dev server due to lack of origin verification CVE-2025-48068, GHSA-3h52-269p-cp9r | Low | 0.2% | 28 May, 2025 | npm next |
auth-js Vulnerable to Insecure Path Routing from Malformed User Input CVE-2025-48370, GHSA-8r88-6cj9-9fh5 | Low | 0.9% | 27 May, 2025 | npm @supabase/auth-js |
undici Denial of Service attack via bad certificate data CVE-2025-47279, GHSA-cxrh-j4jr-qwg3 | Low | 0.3% | 15 May, 2025 | npm undici |
Next.js Race Condition to Cache Poisoning CVE-2025-32421, GHSA-qpjv-v59x-3qc4 | Low | 0.8% | 14 May, 2025 | npm next |
Trix vulnerable to Cross-site Scripting on copy & paste CVE-2025-46812, GHSA-mcrw-746g-9q8h | Low | 0.7% | 08 May, 2025 | npm trix |
@misskey-dev/summaly Redirect Filter Bypass CVE-2025-46553, GHSA-7899-w6c4-vqc4 | Low | 0.3% | 05 May, 2025 | npm @misskey-dev/summaly |
Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content CVE-2025-46653, GHSA-75v8-2h7p-7m2m | Low | 0.4% | 26 Apr, 2025 | npm formidable |
aws-cdk-lib's aspect order change causes different Permissions Boundary assigned to Role GHSA-qc59-cxj2-c2w4 | Low | Not scored | 15 Apr, 2025 | npm aws-cdk-lib |
React Draft Wysiwyg Cross-Site Scripting (XSS) via the Embedded Button CVE-2025-3191, GHSA-fq5x-7292-2p5r | Low | 0.2% | 04 Apr, 2025 | npm react-draft-wysiwyg |
Next.js may leak x-middleware-subrequest-id to external hosts CVE-2025-30218, GHSA-223j-4rm8-mrmf | Low | 0.4% | 02 Apr, 2025 | npm next |
@mozilla/readability Denial of Service through Regex CVE-2025-2792, GHSA-3p6v-hrg8-8qj7 | Low | Not scored | 26 Mar, 2025 | npm @mozilla/readability |
Shescape has potential environment variable exposure on Windows with CMD CVE-2025-30222, GHSA-66pp-5p9w-q87j | Low | 0.2% | 25 Mar, 2025 | npm shescape |
AWS CDK CodePipeline: trusted entities are too broad GHSA-5pq3-h73f-66hr | Low | Not scored | 24 Mar, 2025 | npm aws-cdk-lib |
Mattermost Desktop App allows the bypass of Transparency, Consent, and Control (TCC) via code injection CVE-2025-1398, GHSA-xmvv-w44w-j8wx | Low | 0.2% | 17 Mar, 2025 | npm mattermost-desktop |
tarteaucitron Cross-site Scripting (XSS) CVE-2025-1467, GHSA-8wp9-x25p-8794 | Low | 0.3% | 23 Feb, 2025 | npm tarteaucitronjs |
Potential DoS when using ContextLines integration GHSA-r5w7-f542-q2j4 | Low | Not scored | 28 Jan, 2025 | npm @sentry/astro npm @sentry/aws-serverless npm @sentry/bun npm @sentry/google-cloud-serverless +7 more |
AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider CVE-2025-23206, GHSA-v4mq-x674-ff73 | Low | 0.3% | 17 Jan, 2025 | npm aws-cdk-lib |