Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
vm2 Sandbox Escape vulnerability CVE-2023-37903, GHSA-g644-9gfx-q4q4 | Critical | 4.2% | 13 Jul, 2023 | npm vm2 |
protobufjs Prototype Pollution vulnerability CVE-2023-36665, GHSA-h755-8qp9-cq85 | Critical | 1.7% | 05 Jul, 2023 | npm protobufjs |
tough-cookie Prototype Pollution vulnerability CVE-2023-26136, GHSA-72xf-g2v4-qvf3 | Critical | 2.6% | 01 Jul, 2023 | npm tough-cookie |
flatnest Prototype Pollution vulnerability CVE-2023-26135, GHSA-7px2-3c2p-q4v4 | Critical | 0.9% | 30 Jun, 2023 | npm flatnest |
Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution BIT-parse-2023-36475, CVE-2023-36475, GHSA-462x-c3jw-7vr6 | Critical | 3.2% | 28 Jun, 2023 | npm parse-server |
git-commit-info vulnerable to Command Injection CVE-2023-26134, GHSA-h42j-mrmp-9369 | Critical | 3.6% | 28 Jun, 2023 | npm git-commit-info |
Backstage Scaffolder plugin has insecure sandbox CVE-2023-35926, GHSA-wg6p-jmpc-xjmr | Critical | 1.9% | 21 Jun, 2023 | npm @backstage/plugin-scaffolder-backend |
nuxt Code Injection vulnerability CVE-2023-3224, GHSA-gc34-5v43-h7v8 | Critical | 58.6% | 13 Jun, 2023 | npm nuxt |
progressbar.js vulnerable to Prototype Pollution CVE-2023-26133, GHSA-89qm-hm2x-mxm3 | Critical | 1.3% | 12 Jun, 2023 | npm progressbar.js |
antfu/utils vulnerable to prototype pollution CVE-2023-2972, GHSA-p2fh-2h23-6grg | Critical | 1.0% | 30 May, 2023 | npm @antfu/utils |
Malware in pre-build binaries of bignum GHSA-7cgc-fjv4-52x6 | Critical | Not scored | 24 May, 2023 | npm bignum |
vm2 Sandbox Escape vulnerability CVE-2023-32314, GHSA-whpj-8f3w-67p5 | Critical | 8.1% | 15 May, 2023 | npm vm2 |
jsreport vulnerable to code injection CVE-2023-2583, GHSA-g7rj-q722-245g | Critical | 1.1% | 08 May, 2023 | npm jsreport |
appium-desktop OS Command Injection vulnerability CVE-2023-2479, GHSA-xq6j-x8pq-g3gr | Critical | 22.0% | 02 May, 2023 | npm appium-desktop |
Potential leak of authentication data to 3rd parties CVE-2023-30846, GHSA-558p-m34m-vpmq | Critical | 2.2% | 26 Apr, 2023 | npm typed-rest-client |
Prototype Pollution in vConsole CVE-2023-30363, GHSA-f737-3fh6-jf6w | Critical | 1.0% | 26 Apr, 2023 | npm vconsole |
Remote code execution in dawnsparks-node-tesseract CVE-2023-29566, GHSA-88qf-5f3v-pm6m | Critical | 2.2% | 24 Apr, 2023 | npm dawnsparks-node-tesseract |
Remote code execution in broccoli-compass CVE-2023-27848, GHSA-wq8f-xmq3-5vq9 | Critical | 1.9% | 24 Apr, 2023 | npm broccoli-compass |
Expo SDK has an OAuth vulnerability CVE-2023-28131, GHSA-wr5g-q49g-548w | Critical | 23.2% | 24 Apr, 2023 | npm expo |
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin CVE-2023-22621, GHSA-2h87-4q2w-v4hf | Critical | 70.6% | 19 Apr, 2023 | npm @strapi/plugin-email npm @strapi/plugin-users-permissions |
@nuxtlabs/github-module made Use of Hard-coded Credentials CVE-2023-2138, GHSA-fp2w-g92g-fgq4 | Critical | 0.7% | 18 Apr, 2023 | npm @nuxtlabs/github-module |
vm2 Sandbox Escape vulnerability CVE-2023-30547, GHSA-ch3r-j5x3-6q2m | Critical | 73.0% | 17 Apr, 2023 | npm vm2 |
vm2 Sandbox Escape vulnerability CVE-2023-29199, GHSA-xj72-wvfv-8985 | Critical | 3.9% | 12 Apr, 2023 | npm vm2 |
safe-eval vulnerable to Sandbox Bypass due to improper input sanitization CVE-2023-26122, GHSA-79xf-67r4-q2jj | Critical | 2.1% | 11 Apr, 2023 | npm safe-eval |
safe-eval vulnerable to Prototype Pollution via the safeEval function CVE-2023-26121, GHSA-hcg3-56jf-x4vh | Critical | 1.1% | 11 Apr, 2023 | npm safe-eval |
vm2 vulnerable to sandbox escape CVE-2023-29017, GHSA-7jxr-cg7f-gpgv | Critical | 63.2% | 06 Apr, 2023 | npm vm2 |
angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend CVE-2023-28444, GHSA-gwvm-vrp4-4pp5 | Critical | 0.8% | 24 Mar, 2023 | npm angular-server-side-configuration |
code-server vulnerable to Missing Origin Validation in WebSockets CVE-2023-26114, GHSA-frjg-g767-7363 | Critical | 0.3% | 23 Mar, 2023 | npm code-server |
sqlite vulnerable to code execution due to Object coercion CVE-2022-43441, GHSA-jqv5-7xpx-qj74 | Critical | 2.4% | 13 Mar, 2023 | npm sqlite3 |
Cross-realm object access in Webpack 5 CVE-2023-28154, GHSA-hc6q-2mpp-qw7j | Critical | 1.4% | 13 Mar, 2023 | npm webpack |
stoqey/gnuplot is vulnerable to command injection CVE-2021-33360, GHSA-795w-7426-m94j | Critical | 1.1% | 10 Mar, 2023 | npm @stoqey/gnuplot |
node-bluetooth is vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation CVE-2023-26110, GHSA-cxx3-36qc-m6qm | Critical | 0.9% | 09 Mar, 2023 | npm node-bluetooth |
node-bluetooth-serial-port is vulnerable to Buffer Overflow via the findSerialPortChannel CVE-2023-26109, GHSA-9jh3-4pc9-hq29 | Critical | 0.7% | 09 Mar, 2023 | npm node-bluetooth-serial-port |
builderio/qwik is vulnerable to code injection CVE-2023-1283, GHSA-9wf9-qvvp-2929 | Critical | 1.1% | 08 Mar, 2023 | npm @builder.io/qwik |
json-logic-js Command Injection vulnerability CVE-2021-4329, GHSA-67j4-2mh6-8627 | Critical | 2.2% | 05 Mar, 2023 | npm json-logic-js |
Sequelize vulnerable to SQL Injection via replacements CVE-2023-25813, GHSA-wrh9-cjv3-2hpw | Critical | 1.4% | 22 Feb, 2023 | npm sequelize |
Erxes vulnerable to Cross-site Scripting CVE-2021-32853, GHSA-g9ph-r9hc-34r8 | Critical | 3.1% | 20 Feb, 2023 | npm erxes |
Versionn Command Injection Vulnerability CVE-2023-25805, GHSA-fj78-2vc5-f6cm | Critical | 1.6% | 20 Feb, 2023 | npm versionn |
Unsafe fall-through in getWhereConditions CVE-2023-22579, GHSA-vqfx-gj96-3w95 | Critical | 0.8% | 16 Feb, 2023 | npm @sequelize/core npm sequelize |
Sequelize - Default support for “raw attributes” when using parentheses CVE-2023-22578, GHSA-f598-mfpv-gmfx | Critical | 0.8% | 16 Feb, 2023 | npm @sequelize/core npm sequelize |
nemo-appium vulnerable to OS Command Injection CVE-2022-21129, GHSA-c6rx-gxqv-vr5j | Critical | 2.8% | 31 Jan, 2023 | npm nemo-appium |
Command injection in vagrant.js CVE-2022-25962, GHSA-54jw-jqr9-6cj9 | Critical | 1.0% | 26 Jan, 2023 | npm vagrant.js |
Command Injection in create-choo-electron CVE-2022-25908, GHSA-j8wr-fwf2-vvr9 | Critical | 1.5% | 26 Jan, 2023 | npm create-choo-electron |
Remote code execution in simple-git CVE-2022-25860, GHSA-9w5j-4mwv-2wj8 | Critical | 2.7% | 26 Jan, 2023 | npm simple-git |
electerm allows unauthorized users to execute arbitrary commands CVE-2020-23256, GHSA-x73w-g8hx-v7rp | Critical | 0.9% | 20 Jan, 2023 | npm electerm |
global-modules-path Command Injection vulnerability CVE-2022-21191, GHSA-vvj3-85vf-fgmw | Critical | 1.5% | 13 Jan, 2023 | npm global-modules-path |
wifey vulnerable to Command Injection due to improper input sanitization CVE-2022-25890, GHSA-xj9v-6q2f-vqhx | Critical | 1.3% | 09 Jan, 2023 | npm wifey |
Baobab vulnerable to Prototype Pollution CVE-2021-4307, GHSA-wvr2-q86m-6whp | Critical | 1.3% | 07 Jan, 2023 | npm baobab |
nodebatis SQL Injection vulnerability CVE-2018-25066, GHSA-8ph8-9q2j-c3rq | Critical | 0.7% | 06 Jan, 2023 | npm nodebatis |
exec-local-bin vulnerable to Command Injection CVE-2022-25923, GHSA-f259-h6m8-hm8m | Critical | 2.6% | 06 Jan, 2023 | npm exec-local-bin |