Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
hull.js Code Injection Vulnerability GHSA-q849-wxrc-vqrp | Critical | Not scored | 02 Dec, 2024 | npm hull.js |
Flowise OverrideConfig security vulnerability CVE-2024-58351, GHSA-5cph-wvm9-45gj | Critical | 0.9% | 21 Nov, 2024 | npm flowise |
Remote Code Execution on click of <a> Link in markdown preview CVE-2024-49362, GHSA-hff8-hjwv-j9q7 | Critical | 1.1% | 14 Nov, 2024 | npm joplin |
happy-dom allows for server side code to be executed by a <script> tag CVE-2024-51757, GHSA-96g7-g7g9-jxw8 | Critical | 0.8% | 06 Nov, 2024 | npm happy-dom |
Glossarizer Cross-site Scripting vulnerability CVE-2024-42515, GHSA-hhhv-ggjx-q9j2 | Critical | 0.5% | 31 Oct, 2024 | npm glossarizer |
DOMPurify vulnerable to tampering by prototype polution CVE-2024-48910, GHSA-p3vf-v8qc-cwcr | Critical | 1.2% | 31 Oct, 2024 | npm dompurify |
Langchain Path Traversal vulnerability CVE-2024-7774, GHSA-hc5w-c9f8-9cc4 | Critical | 0.6% | 29 Oct, 2024 | npm langchain |
@langchain/community SQL Injection vulnerability CVE-2024-7042, GHSA-6m59-8fmv-m5f9 | Critical | 0.3% | 29 Oct, 2024 | npm @langchain/community |
Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy CVE-2024-48914, GHSA-r9mq-3c9r-fmjq | Critical | 60.4% | 15 Oct, 2024 | npm @vendure/asset-server-plugin |
angular-base64-upload vulnerable to unauthenticated remote code execution CVE-2024-42640, GHSA-vgxq-6rcf-qwrw | Critical | 40.2% | 11 Oct, 2024 | npm angular-base64-upload |
JSONPath Plus Remote Code Execution (RCE) Vulnerability CVE-2024-21534, GHSA-pppg-cpfq-h7wr | Critical | 9.0% | 11 Oct, 2024 | Maven org.webjars.npm:jsonpath-plus npm jsonpath-plus |
Elliptic's verify function omits uniqueness validation CVE-2024-48949, GHSA-434g-2637-qmqr | Critical | 0.5% | 10 Oct, 2024 | npm elliptic |
Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal CVE-2024-47169, GHSA-mpch-89gm-hm83 | Critical | 0.8% | 26 Sep, 2024 | npm agnai |
@blakeembrey/template vulnerable to code injection when attacker controls template input CVE-2024-45390, GHSA-q765-wm9j-66qj | Critical | 0.4% | 03 Sep, 2024 | npm @blakeembrey/template |
squirrelly Code Injection vulnerability CVE-2024-40453, GHSA-w5pw-gmcw-rfc8 | Critical | 1.1% | 21 Aug, 2024 | npm squirrelly |
Prototype pollution in izatop bunt CVE-2024-38989, GHSA-p734-xg27-8cfq | Critical | 1.1% | 12 Aug, 2024 | npm @bunt/app |
Nuxt vulnerable to remote code execution via the browser when running the test locally CVE-2024-34344, GHSA-v784-fjjh-f8r4 | Critical | 0.8% | 05 Aug, 2024 | npm nuxt |
Elliptic allows BER-encoded signatures CVE-2024-42461, GHSA-49q7-c7j4-3p7m | Critical | 0.6% | 02 Aug, 2024 | npm elliptic |
@75lb/deep-merge Prototype Pollution vulnerability CVE-2024-38986, GHSA-28mc-g557-92m7 | Critical | 1.0% | 30 Jul, 2024 | npm @75lb/deep-merge |
node-stringbuilder vulnerable to Out-of-bounds Read CVE-2024-21524, GHSA-g533-xq5w-jmf3 | Critical | 0.9% | 10 Jul, 2024 | npm node-stringbuilder |
ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability BIT-parse-2024-39309, CVE-2024-39309, GHSA-c2hr-cqg6-8j6r | Critical | 20.2% | 01 Jul, 2024 | npm parse-server |
ejson shell parser in MongoDB Compass maybe bypassed CVE-2024-6376, GHSA-jxr4-4prv-mh83 | Critical | 0.5% | 01 Jul, 2024 | npm @mongodb-js/connection-form |
robinweser fast-loops vulnerable to prototype pollution CVE-2024-39008, GHSA-3q56-9cc2-46j4 | Critical | 0.9% | 01 Jul, 2024 | npm fast-loops |
jrburke requirejs vulnerable to prototype pollution CVE-2024-38999, GHSA-x3m3-4wpv-5vgc | Critical | 0.8% | 01 Jul, 2024 | npm requirejs |
Prototype pollution in ag-grid-community via the _.mergeDeep function CVE-2024-38996, GHSA-876p-c77m-x2hc | Critical | 1.2% | 01 Jul, 2024 | npm ag-grid-community npm ag-grid-enterprise |
jsonic was discovered to contain a prototype pollution via the function empty. CVE-2024-38993, GHSA-4wm9-3qmv-gvxj | Critical | 0.9% | 01 Jul, 2024 | npm jsonic |
obx Prototype Pollution CVE-2024-36573, GHSA-jj58-488v-4rgf | Critical | 0.7% | 17 Jun, 2024 | npm @almela/obx |
object-deep-assign Prototype Pollution CVE-2024-36582, GHSA-4xg3-7w7q-856q | Critical | 0.6% | 17 Jun, 2024 | npm @alexbinary/object-deep-assign |
@cdr0/sg Prototype Pollution CVE-2024-36580, GHSA-fg52-5jjj-28h7 | Critical | 0.8% | 17 Jun, 2024 | npm @cdr0/sg |
lunary-ai/lunary allows users unauthorized access to projects CVE-2024-4146, GHSA-w5xm-mx47-v7c8 | Critical | 0.5% | 08 Jun, 2024 | npm lunary |
Jan path traversal vulnerability CVE-2024-37273, GHSA-878h-rqcq-mv3x | Critical | 1.0% | 04 Jun, 2024 | npm @janhq/core |
Jan path traversal vulnerability CVE-2024-36858, GHSA-qfjh-mvq6-c5p8 | Critical | 3.0% | 04 Jun, 2024 | npm @janhq/core |
Blackprint @blackprint/engine Prototype Pollution issue CVE-2024-24294, GHSA-g3q2-vcjq-rgrc | Critical | 0.8% | 20 May, 2024 | npm @blackprint/engine |
@valtimo/components exposes access token to form.io CVE-2024-34706, GHSA-xcp4-62vj-cq3r | Critical | 1.1% | 13 May, 2024 | npm @valtimo/components |
lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability CVE-2024-32964, GHSA-mxhq-xw3g-rphc | Critical | 53.0% | 10 May, 2024 | npm @lobehub/chat |
libxmljs2 vulnerable to type confusion when parsing specially crafted XML CVE-2024-34394, GHSA-78h3-pg4x-j8cv | Critical | 1.0% | 02 May, 2024 | npm libxmljs2 |
libxmljs2 type confusion vulnerability when parsing specially crafted XML CVE-2024-34393, GHSA-mjr4-7xg5-pfvh | Critical | 1.0% | 02 May, 2024 | npm libxmljs2 |
libxmljs vulnerable to type confusion when parsing specially crafted XML CVE-2024-34392, GHSA-mg49-jqgw-gcj6 | Critical | 1.1% | 02 May, 2024 | npm libxmljs |
libxmljs vulnerable to type confusion when parsing specially crafted XML CVE-2024-34391, GHSA-6433-x5p4-8jc7 | Critical | 1.1% | 02 May, 2024 | npm libxmljs |
xml-crypto vulnerable to XML signature verification bypass due improper verification of signature/signature spoofing CVE-2024-32962, GHSA-2xp3-57p7-qf4v | Critical | 0.8% | 01 May, 2024 | npm xml-crypto |
MySQL2 for Node Arbitrary Code Injection CVE-2024-21511, GHSA-4rch-2fh8-94vw | Critical | 1.0% | 23 Apr, 2024 | npm mysql2 |
@andrei-tatar/nora-firebase-common Prototype Pollution vulnerability CVE-2024-30564, GHSA-jjff-q3q4-5hh8 | Critical | 1.2% | 18 Apr, 2024 | npm @andrei-tatar/nora-firebase-common |
AWS Amplify CLI has incorrect trust policy management CVE-2024-28056, GHSA-846g-p7hm-f54r | Critical | 1.7% | 15 Apr, 2024 | npm @aws-amplify/cli |
mysql2 Remote Code Execution (RCE) via the readCodeFor function CVE-2024-21508, GHSA-fpw7-j2hg-69v5 | Critical | 2.6% | 11 Apr, 2024 | npm mysql2 |
MailDev Remote Code Execution CVE-2024-27448, GHSA-vc6q-ccj9-9r89 | Critical | 0.9% | 05 Apr, 2024 | npm maildev |
@thi.ng/paths Prototype Pollution vulnerability CVE-2024-29650, GHSA-8ppr-www8-hfjx | Critical | 1.4% | 25 Mar, 2024 | npm @thi.ng/paths |
Server crashes on invalid Cloud Function or Cloud Job name BIT-parse-2024-29027, CVE-2024-29027, GHSA-6hh7-46r2-vf29 | Critical | 1.2% | 19 Mar, 2024 | npm parse-server |
NextChat has full-read SSRF and XSS vulnerability in /api/cors endpoint CVE-2023-49785, GHSA-qf3q-9f3h-cjp9 | Critical | 83.2% | 12 Mar, 2024 | npm nextchat |
HTTP Handling Vulnerability in the Bare server CVE-2024-27922, GHSA-86fc-f9gr-v533 | Critical | 0.8% | 05 Mar, 2024 | npm @tomphttp/bare-server-node |
JSONata expression can pollute the "Object" prototype CVE-2024-27307, GHSA-fqg8-vfv7-8fj8 | Critical | 1.4% | 04 Mar, 2024 | npm jsonata |