Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer CVE-2025-6638, GHSA-59p9-h35m-wg4g, PYSEC-2026-1981 | High | 0.6% | 12 Sep, 2025 | PyPI transformers |
Axios is vulnerable to DoS attack through lack of data size check CVE-2025-58754, GHSA-4hjh-wcwx-xvwj | High | 1.2% | 11 Sep, 2025 | npm axios |
Neo4j Cypher MCP server is vulnerable to DNS rebinding CVE-2025-10193, GHSA-vcqx-v2mg-7chx, PYSEC-2026-1620 | High | 0.2% | 11 Sep, 2025 | PyPI mcp-neo4j-cypher |
Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage CVE-2025-59052, GHSA-68x2-mx4q-78m7 | High | 0.4% | 10 Sep, 2025 | npm @angular/platform-server npm @angular/ssr npm @nguniversal/common |
Shopware: Reflective Cross Site-Scripting (XSS) in CMS components GHSA-9v82-vcjx-m76j | High | Not scored | 10 Sep, 2025 | Packagist shopware/core Packagist shopware/shopware |
xml2rfc is vulnerable to arbitrary file reads through prepped files CVE-2025-11059, GHSA-9mv7-3c64-mmqw, PYSEC-2026-2057 | High | Not scored | 10 Sep, 2025 | PyPI xml2rfc |
WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled CVE-2025-54376, GHSA-jxmr-2h4q-rhxp, GO-2025-3945 | High | 0.7% | 10 Sep, 2025 | Go github.com/SpectoLabs/hoverfly |
Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email CVE-2025-59041, GHSA-j4h9-wv2m-wrf7 | High | 0.5% | 10 Sep, 2025 | npm @anthropic-ai/claude-code |
Claude Code rg vulnerability does not protect against approval prompt bypass CVE-2025-58764, GHSA-qxfv-fcpc-w36x | High | 0.5% | 10 Sep, 2025 | npm @anthropic-ai/claude-code |
PyInstaller has local privilege escalation vulnerability CVE-2025-59042, GHSA-p2xp-xx3r-mffc, PYSEC-2026-1813 | High | 0.1% | 09 Sep, 2025 | PyPI pyinstaller |
Webrecorder packages are vulnerable to XSS through 404 error handling logic CVE-2025-58765, GHSA-w765-jm6w-4hhj | High | 0.3% | 09 Sep, 2025 | npm @webrecorder/archivewebpage npm @webrecorder/wabac npm replaywebpage |
listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover CVE-2025-58430, GHSA-rf24-wg77-gq7w, GO-2025-3943 | High | 0.1% | 09 Sep, 2025 | Go github.com/knadh/listmonk |
TinyEnv: Missing .env file not required — may cause unexpected behavior CVE-2025-58758, GHSA-3j7m-5g4q-gfpc | High | 0.2% | 09 Sep, 2025 | Packagist datahihi1/tiny-env |
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload CVE-2025-58180, GHSA-49mj-x8jp-qvfc, PYSEC-2026-1712 | High | 22.1% | 09 Sep, 2025 | PyPI octoprint |
CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion CVE-2025-58063, GHSA-93mf-426m-g6x9, GO-2025-3942 | High | 0.5% | 09 Sep, 2025 | Go github.com/coredns/coredns |
Malicious release: Prebid.js NPM package briefly compromised CVE-2025-59038, GHSA-jwq7-6j4r-2f92, MAL-2025-46990 | MaliciousHigh | 0.4% | 09 Sep, 2025 | npm prebid.js |
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware CVE-2025-59037, GHSA-w62p-hx95-gf2c | High | 0.4% | 09 Sep, 2025 | npm @duckdb/duckdb-wasm npm @duckdb/node-api npm @duckdb/node-bindings npm duckdb |
TYPO3 Workspaces Module Information Disclosure CVE-2025-59018, GHSA-w2pf-7q5w-2cgw | High | 0.3% | 09 Sep, 2025 | Packagist typo3/cms-workspaces |
Monai: Unsafe use of Pickle deserialization may lead to RCE CVE-2025-58757, GHSA-p8cm-mm2v-gwjm, PYSEC-2025-142 | High | 0.6% | 09 Sep, 2025 | PyPI monai |
MONAI: Unsafe torch usage may lead to arbitrary code execution CVE-2025-58756, GHSA-6vm5-6jv9-rjpj, PYSEC-2025-141 | High | 0.8% | 09 Sep, 2025 | PyPI monai |
MONAI does not prevent path traversal, potentially leading to arbitrary file writes CVE-2025-58755, GHSA-x6ww-pf9m-m73m, PYSEC-2025-140 | High | 0.6% | 09 Sep, 2025 | PyPI monai |
Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity CVE-2025-58451, GHSA-455v-w7r9-3vv9 | High | 0.3% | 08 Sep, 2025 | npm cattown |
Maho is Vulnerable to Authenticated Remote Code Execution via File Upload CVE-2025-58449, GHSA-vgmm-27fc-vmgp | High | 0.3% | 08 Sep, 2025 | Packagist mahocommerce/maho |
MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server CVE-2025-58444, GHSA-g9hg-qhmf-q45m | High | 0.7% | 08 Sep, 2025 | npm @modelcontextprotocol/inspector |
Malicious release: color@5.0.1 contains malware after npm account takeover CVE-2025-59143, GHSA-j8fv-6x8p-p766, GHSA-qrmh-qg46-72pp, MAL-2025-46985 | MaliciousHigh | 0.4% | 08 Sep, 2025 | npm color |
Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation CVE-2025-57817, GHSA-hjfh-p8f5-24wr, PYSEC-2026-1343 | High | 0.4% | 08 Sep, 2025 | PyPI ethyca-fides |
N8N's Chat Trigger component is vulnerable to XSS CVE-2025-56265, GHSA-v2x8-97xq-8xrr | High | 0.6% | 08 Sep, 2025 | npm @n8n/n8n-nodes-langchain |
Malicious release: color-convert@3.1.1 contains malware after npm account takeover CVE-2025-59162, GHSA-ch7m-m9rf-8gvv, GHSA-pxx3-g568-hxr4, MAL-2025-46971 | MaliciousHigh | 0.4% | 08 Sep, 2025 | npm color-convert |
Malicious release: color-string@2.1.1 contains malware after npm account takeover CVE-2025-59142, GHSA-286p-vc9p-p5qv, GHSA-3q87-f72r-3gm6, MAL-2025-46973 | MaliciousHigh | 0.4% | 08 Sep, 2025 | npm color-string |
Malicious release: backslash@0.2.1 contains malware after npm account takeover CVE-2025-59140, GHSA-53mq-f4w3-f7qv, GHSA-m2xf-jp99-f298, MAL-2025-46968 | MaliciousHigh | 0.4% | 08 Sep, 2025 | npm backslash |
Malicious release: is-arrayish@0.3.3 contains malware after npm account takeover CVE-2025-59331, GHSA-frh7-2f84-v9mw, GHSA-hfm8-9jrf-7g9w, MAL-2025-46977 | MaliciousHigh | 0.4% | 08 Sep, 2025 | npm is-arrayish |
Malicious release: simple-swizzle@0.2.3 contains malware after npm account takeover CVE-2025-59141, GHSA-9g9j-rggx-7fmg, GHSA-wwpx-h6g5-c7x6, MAL-2025-46978 | MaliciousHigh | 0.4% | 08 Sep, 2025 | npm simple-swizzle |
Malicious release: color-name@2.0.1 contains malware after npm account takeover CVE-2025-59145, GHSA-5fvm-p68v-5wmh, GHSA-m99c-cfww-cxqx, MAL-2025-46972 | MaliciousHigh | 0.6% | 08 Sep, 2025 | npm color-name |
Malicious release: error-ex@1.3.3 contains malware after npm account takeover CVE-2025-59330, GHSA-5g7q-qh7p-jjvm, GHSA-6jp5-hh4c-8c5h, MAL-2025-46975 | MaliciousHigh | 0.4% | 08 Sep, 2025 | npm error-ex |
Malicious release: debug@4.4.2 contains malware after npm account takeover CVE-2025-59144, GHSA-4x49-vf9v-38px, GHSA-8mgj-vmr8-frr6, MAL-2025-46974 | MaliciousHigh | 0.5% | 08 Sep, 2025 | npm debug |
Coder vulnerable to privilege escalation could lead to a cross workspace compromise CVE-2025-58437, GHSA-j6xf-jwrj-v5qp, GO-2025-3938 | High | 0.4% | 05 Sep, 2025 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
TkEasyGUI Affected by Uncontrolled Search Path Element Issue CVE-2025-55671, GHSA-ph2w-cx28-vhrq, PYSEC-2026-1968 | High | 0.2% | 05 Sep, 2025 | PyPI TkEasyGUI PyPI tkeasygui |
podman kube play symlink traversal vulnerability CVE-2025-9566, GHSA-wp3j-xq48-xpjw, GO-2025-3935 | High | 1.2% | 04 Sep, 2025 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 +1 more |
Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter CVE-2025-58179, GHSA-qpr4-c339-7vq8 | High | 0.9% | 04 Sep, 2025 | npm @astrojs/cloudflare |
Android Runtime Use-After-Free Vulnerability CVE-2025-48543 | HighExploited | 0.7% | 04 Sep, 2025 | |
pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability CVE-2025-9636, GHSA-6859-2qxq-ffv2, PYSEC-2026-1769 | High | 0.2% | 04 Sep, 2025 | PyPI pgadmin4 |
Langchain Community Vulnerable to XML External Entity (XXE) Attacks CVE-2025-6984, GHSA-pc6w-59fv-rh23, PYSEC-2026-1515 | High | 1.6% | 04 Sep, 2025 | PyPI langchain-community |
Hono's flaw in URL path parsing could cause path confusion CVE-2025-58362, GHSA-9hp6-4448-45g2 | High | 0.6% | 03 Sep, 2025 | npm hono |
Django is subject to SQL injection through its column aliases BIT-django-2025-57833, CVE-2025-57833, GHSA-6w2r-r2m5-xq5w, PYSEC-2025-105 | High | 28.3% | 03 Sep, 2025 | PyPI Django PyPI django |
Claude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup Warning GHSA-ph6w-f82w-28w6 | High | Not scored | 03 Sep, 2025 | npm @anthropic-ai/claude-code |
Drupal Acquia DAM allows Forceful Browsing CVE-2025-9954, DRUPAL-CONTRIB-2025-105, GHSA-x957-32v9-m7vg | High | 0.3% | 03 Sep, 2025 | Packagist drupal/acquia_dam Packagist:https://packages.drupal.org/8 drupal/acquia_dam |
Soft Serve vulnerable to arbitrary file writing through SSH API CVE-2025-58355, GHSA-33pr-m977-5w97, GO-2025-3930 | High | 0.3% | 02 Sep, 2025 | Go github.com/charmbracelet/soft-serve |
mcp-markdownify-server vulnerable to command injection in pptx-to-markdown tool CVE-2025-58358, GHSA-45qj-4xq3-3c45 | High | 1.0% | 02 Sep, 2025 | npm mcp-markdownify-server |
PocketMine-MP `ResourcePackDataInfoPacket` amplification vulnerability due to lack of resource pack sequence status checking CVE-2025-71417, GHSA-fqqv-56h5-f57g | High | 0.4% | 02 Sep, 2025 | Packagist pocketmine/pocketmine-mp |
ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header CVE-2025-57808, GHSA-mxh2-ccgj-8635, PYSEC-2026-1330 | High | 1.5% | 02 Sep, 2025 | PyPI esphome |