Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Budibase affected by VM2 Constructor Escape Vulnerability GHSA-4g2x-vq5p-5vj6 | Critical | Not scored | 01 Mar, 2024 | npm @budibase/server |
ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection BIT-parse-2024-27298, CVE-2024-27298, GHSA-6927-3vr9-fxf2 | Critical | 1.0% | 01 Mar, 2024 | npm parse-server |
Nteract Remote Code Execution vulnerability CVE-2024-22891, GHSA-6jvg-hp25-42f6 | Critical | 1.7% | 01 Mar, 2024 | npm nteract |
@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys GHSA-84c3-j8r2-mcm8 | Critical | Not scored | 26 Feb, 2024 | npm @nfid/embed |
agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate` CVE-2024-1631, GHSA-c9vv-fhgv-cjc3 | Critical | 0.9% | 21 Feb, 2024 | npm @dfinity/auth-client npm @dfinity/identity |
Ghost has possible Cross-site Scripting issue BIT-ghost-2024-23724, CVE-2024-23724, GHSA-99vc-xw8j-phjm | Critical | 3.5% | 11 Feb, 2024 | npm ghost |
NPM IP package incorrectly identifies some private IP addresses as public CVE-2023-42282, GHSA-78xj-cgh5-2h22 | Critical | 1.6% | 08 Feb, 2024 | npm ip |
Stimulsoft Dashboard.JS directory traversal vulnerability CVE-2024-24398, GHSA-gfqf-9w98-7jmx | Critical | 2.0% | 06 Feb, 2024 | npm stimulsoft-dashboards-js |
network Arbitrary Command Injection vulnerability CVE-2024-21488, GHSA-vvh2-82c7-ppfg | Critical | 3.3% | 30 Jan, 2024 | npm network |
Ylianst MeshCentral Missing SSL Certificate Validation CVE-2023-51837, GHSA-8xw6-9h78-c89j | Critical | 0.5% | 30 Jan, 2024 | npm meshcentral |
DeviceFarmer stf uses DES-ECB CVE-2023-51839, GHSA-7xm8-wjq7-88r5 | Critical | 0.4% | 29 Jan, 2024 | npm @devicefarmer/stf |
EverShop at risk to unauthorized access via weak HMAC secret CVE-2023-46943, GHSA-32r3-57hp-cgfw | Critical | 0.5% | 13 Jan, 2024 | npm @evershop/evershop |
@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR) CVE-2024-22206, GHSA-q6w5-jg5q-47vg | Critical | 0.7% | 12 Jan, 2024 | npm @clerk/nextjs |
CouchAuth host header injection vulnerability leaks the password reset token CVE-2023-39655, GHSA-fqh6-6h6c-366m | Critical | 0.5% | 03 Jan, 2024 | npm @perfood/couch-auth |
plotly.js prototype pollution vulnerability CVE-2023-46308, GHSA-wjc4-73q6-gv3m | Critical | 0.9% | 03 Jan, 2024 | Packagist plotly/plotly.js npm plotly.js |
Arbitrary remote code execution within `wrangler dev` Workers sandbox CVE-2023-7080, GHSA-f8mp-x433-5wpf | Critical | 0.6% | 29 Dec, 2023 | npm wrangler |
bsock uses weak hashing algorithms CVE-2023-50475, GHSA-jj93-39pf-7mcf | Critical | 0.5% | 21 Dec, 2023 | npm bsock |
Pedroetb TTS-API OS Command Injection CVE-2019-25158, GHSA-jx6q-fq9h-6g7q | Critical | 2.1% | 19 Dec, 2023 | npm tts-api |
Cross-site Scripting in @spscommerce/ds-react GHSA-cfxh-frx4-9gjg | Critical | Not scored | 15 Dec, 2023 | npm @spscommerce/ds-react |
Escalation of privileges in @sap/xssec CVE-2023-49583, GHSA-p2vx-qj66-88q3 | Critical | 1.1% | 12 Dec, 2023 | npm @sap/xssec |
Code execution in evershop CVE-2023-46498, GHSA-5mmr-9qx3-3pf9 | Critical | 1.3% | 08 Dec, 2023 | npm @evershop/evershop |
openssl npm package vulnerable to command execution CVE-2023-49210, GHSA-75w2-qv55-x7fv | Critical | 1.9% | 23 Nov, 2023 | npm openssl |
Prototype Pollution(PP) vulnerability in setByPath CVE-2023-45827, GHSA-9w5f-mw3p-pj47 | Critical | 1.2% | 03 Nov, 2023 | npm @clickbar/dot-diver |
crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard CVE-2023-46233, GHSA-xwcq-pm8m-c4vf | Critical | 0.6% | 25 Oct, 2023 | npm crypto-js |
crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard CVE-2023-46133, GHSA-mpj8-q39x-wq5h | Critical | 0.5% | 25 Oct, 2023 | npm crypto-es |
Prototype Pollution in ali-security/mongoose GHSA-rc4v-99cr-pjcm | Critical | Not scored | 17 Oct, 2023 | npm @seal-security/mongoose-fixed |
node-qpdf vulnerable to command injection CVE-2023-26155, GHSA-fpr8-4wvx-j9q3 | Critical | 2.2% | 14 Oct, 2023 | npm node-qpdf |
Server-Side Request Forgery (SSRF) in vriteio/vrite CVE-2023-5572, GHSA-w35p-wxwj-rcm9 | Critical | 1.0% | 13 Oct, 2023 | npm @vrite/sdk |
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code CVE-2023-45133, GHSA-67hx-6x53-jw92 | Critical | 0.5% | 12 Oct, 2023 | npm @babel/traverse npm babel-traverse |
Code injection in fsevents CVE-2023-45311, GHSA-8r6j-v8pm-fqw3 | Critical | 1.7% | 06 Oct, 2023 | npm fsevents |
FUXA SQL Injection vulnerability CVE-2023-31719, GHSA-p46g-8c3q-89p2 | Critical | 26.0% | 22 Sep, 2023 | npm fuxa-server |
systeminformation SSID Command Injection Vulnerability CVE-2023-42810, GHSA-gx6r-qc2v-3p3v | Critical | 2.2% | 21 Sep, 2023 | npm systeminformation |
blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API CVE-2023-26143, GHSA-6f9p-g466-f8v8 | Critical | 1.1% | 19 Sep, 2023 | npm blamer |
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA CVE-2023-33831, GHSA-r87q-fq37-pvr6 | Critical | 26.0% | 18 Sep, 2023 | npm @frangoteam/fuxa |
Strapi Improper Rate Limiting vulnerability CVE-2023-38507, GHSA-24q2-59hm-rh9r | Critical | 1.0% | 13 Sep, 2023 | npm @strapi/admin npm @strapi/plugin-users-permissions |
Electron's Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled CVE-2023-23623, GHSA-gxh7-wv9q-fwfr | Critical | 0.7% | 06 Sep, 2023 | npm electron |
Command Injection Vulnerability in find-exec CVE-2023-40582, GHSA-95rp-6gqp-6622 | Critical | 1.8% | 30 Aug, 2023 | npm find-exec |
tree-kit Prototype Pollution vulnerability CVE-2023-38894, GHSA-5p42-m6f3-hpmj | Critical | 1.7% | 16 Aug, 2023 | npm tree-kit |
external-svg-loader Cross-site Scripting vulnerability CVE-2023-40013, GHSA-xc2r-jf2x-gjr8 | Critical | 0.6% | 14 Aug, 2023 | npm external-svg-loader |
MrSwitch hello.js vulnerable to prototype pollution CVE-2021-26505, GHSA-g3vf-47fv-8f3c | Critical | 1.1% | 11 Aug, 2023 | npm hellojs |
SES's dynamic import and spread operator provides possible path to arbitrary exfiltration and execution CVE-2023-39532, GHSA-9c4h-3f7h-322r | Critical | 1.3% | 08 Aug, 2023 | npm ses |
import-in-the-middle has unsanitized user controlled input in module generation CVE-2023-38704, GHSA-5r27-rw8r-7967 | Critical | 1.0% | 07 Aug, 2023 | npm import-in-the-middle |
matrix-appservice-irc IRC command injection via admin commands containing newlines CVE-2023-38690, GHSA-3pmj-jqqp-2mj3 | Critical | 0.9% | 04 Aug, 2023 | npm matrix-appservice-irc |
Soketi was exposed to Sandbox Escape vulnerability via vm2 GHSA-g6w6-h933-4rc5 | Critical | Not scored | 03 Aug, 2023 | npm @soketi/soketi |
pnpm incorrectly parses tar archives relative to specification CVE-2023-37478, GHSA-5r98-f33j-g8h7 | Critical | 1.2% | 01 Aug, 2023 | npm @pnpm/cafs npm @pnpm/exe npm @pnpm/linux-arm64 npm @pnpm/linux-x64 +5 more |
Anyone with a share link can RESET all website data in Umami GHSA-8www-cffh-4q98 | Critical | Not scored | 28 Jul, 2023 | npm umami |
Path traversal and code execution via prototype vulnerability CVE-2023-26045, GHSA-vh2g-6c4x-5hmp | Critical | 1.0% | 24 Jul, 2023 | npm nodebb |
Mongoose Prototype Pollution vulnerability BIT-mongoose-2023-3696, CVE-2023-3696, GHSA-9m93-w8w6-76hh | Critical | 1.2% | 17 Jul, 2023 | npm mongoose |
CleverTap Cordova plugin vulnerable to Cross-site Scripting CVE-2023-2507, GHSA-x2ph-qqwm-9cc6 | Critical | 0.9% | 15 Jul, 2023 | npm clevertap-cordova |
vm2 Sandbox Escape vulnerability CVE-2023-37466, GHSA-cchq-frgv-rjh5 | Critical | 3.9% | 13 Jul, 2023 | npm vm2 |