Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
express-param vulnerable to Improper Handling of Extra Parameters CVE-2017-20160, GHSA-fr54-72wr-cqvq | Critical | 0.9% | 31 Dec, 2022 | npm express-param |
json-pointer vulnerable to Prototype Pollution CVE-2022-4742, GHSA-6xrf-q977-5vgc | Critical | 1.1% | 26 Dec, 2022 | npm json-pointer |
Starcounter-Jack JSON-Patch Prototype Pollution vulnerability CVE-2021-4279, GHSA-8gh8-hqwg-xf34 | Critical | 1.2% | 25 Dec, 2022 | npm fast-json-patch |
flat vulnerable to Prototype Pollution CVE-2020-36632, GHSA-2j2x-2gpw-g8fm | Critical | 1.2% | 25 Dec, 2022 | npm flat |
vm2 vulnerable to Arbitrary Code Execution CVE-2022-25893, GHSA-4w2j-2rg4-5mjw | Critical | 1.5% | 21 Dec, 2022 | npm vm2 |
abacus-ext-cmdline vulnerable to Command Injection CVE-2022-24431, GHSA-m5v8-wpw4-rj3x | Critical | 1.3% | 21 Dec, 2022 | npm abacus-ext-cmdline |
safe-eval vulnerable to Prototype Pollution CVE-2022-25904, GHSA-33vh-7x8q-mg35 | Critical | 0.9% | 20 Dec, 2022 | npm safe-eval |
p4 vulnerable to Command Injection due to improper input sanitization CVE-2022-25171, GHSA-jfm8-hwhg-r6gg | Critical | 2.5% | 20 Dec, 2022 | npm p4 |
FurqanSoftware/node-whois vulnerable to Prototype Pollution CVE-2020-36618, GHSA-97jv-c342-5xhc | Critical | 1.0% | 19 Dec, 2022 | npm whois |
npm package rfc6902 vulnerable to Prototype Pollution CVE-2021-4245, GHSA-p495-jxh2-wrfg | Critical | 1.4% | 15 Dec, 2022 | npm rfc6902 |
replicator vulnerable to Deserialization of Untrusted Data CVE-2021-33420, GHSA-hw46-vg6w-88fj | Critical | 1.7% | 15 Dec, 2022 | npm replicator |
cycle-import-check vulnerable to Command Injection CVE-2022-24377, GHSA-995x-33wq-8gc9 | Critical | 2.4% | 14 Dec, 2022 | npm cycle-import-check |
simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol CVE-2022-25912, GHSA-9p95-fxvg-qgq2 | Critical | 3.1% | 06 Dec, 2022 | npm simple-git |
NodeBB vulnerable to account takeover via prototype vulnerability CVE-2022-46164, GHSA-rf3g-v8p5-p675 | Critical | 47.4% | 05 Dec, 2022 | npm nodebb |
nadesiko3 vulnerable to OS Command Injection CVE-2022-42496, GHSA-7249-8x22-4rg4 | Critical | 2.1% | 05 Dec, 2022 | npm nadesiko3 |
Nadesiko3 OS Command Injection vulnerability CVE-2022-41642, GHSA-m8r5-7wf4-63mw | Critical | 2.1% | 05 Dec, 2022 | npm nadesiko3 |
Heap buffer overflow in GPU CVE-2022-4135, GHSA-995f-9x5r-2rcj | CriticalExploited | 31.9% | 25 Nov, 2022 | npm electron |
Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks BIT-parse-2022-41879, CVE-2022-41879, GHSA-93vw-8fm5-p2jf | Critical | 0.9% | 10 Nov, 2022 | npm parse-server |
Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers BIT-parse-2022-41878, CVE-2022-41878, GHSA-xprv-wvh7-qqqx | Critical | 1.0% | 09 Nov, 2022 | npm parse-server |
Remote code execution via MongoDB BSON parser through prototype pollution BIT-parse-2022-39396, CVE-2022-39396, GHSA-prm5-8g2m-24gg | Critical | 38.7% | 08 Nov, 2022 | npm parse-server |
@keystone-6/core's NODE_ENV defaults to development with esbuild CVE-2022-39382, GHSA-25mx-2mxm-6343 | Critical | 1.7% | 03 Nov, 2022 | npm @keystone-6/core |
xmldom allows multiple root nodes in a DOM CVE-2022-39353, GHSA-crh6-fp67-6883 | Critical | 1.3% | 01 Nov, 2022 | npm @xmldom/xmldom npm xmldom |
thlorenz browserify-shim vulnerable to prototype pollution CVE-2022-37623, GHSA-cfgr-75jx-h88g | Critical | 1.5% | 31 Oct, 2022 | npm browserify-shim |
thlorenz browserify-shim vulnerable to prototype pollution CVE-2022-37621, GHSA-r737-347m-wqc7 | Critical | 1.4% | 28 Oct, 2022 | npm browserify-shim |
feathers-sequelize contains improper input validation leading to SQL injection CVE-2022-2422, GHSA-qpv8-4pjq-qqh7 | Critical | 0.9% | 26 Oct, 2022 | npm feathers-sequelize |
Insufficient validation when decoding a Socket.IO packet CVE-2022-2421, GHSA-qm95-pgcg-qqfq | Critical | 1.6% | 26 Oct, 2022 | npm socket.io-parser |
Feather-Sequelize cleanQuery method vulnerable to Prototype Pollution CVE-2022-29823, GHSA-p5m3-27vh-52j4 | Critical | 1.8% | 26 Oct, 2022 | npm feathers-sequelize |
feathers-sequelize vulnerable to SQL injection due to improper parameter filtering CVE-2022-29822, GHSA-5hq7-j5wq-p227 | Critical | 0.9% | 26 Oct, 2022 | npm feathers-sequelize |
Field-level access-control bypass for multiselect field CVE-2022-39322, GHSA-6mhr-52mv-6v6f | Critical | 1.5% | 18 Oct, 2022 | npm @keystone-6/core |
Grunt-karma vulnerable to prototype pollution CVE-2022-37602, GHSA-hcj4-xf6x-63wj | Critical | 2.1% | 14 Oct, 2022 | npm grunt-karma |
Prototype pollution in webpack loader-utils CVE-2022-37601, GHSA-76p3-8jx3-jpfq | Critical | 3.5% | 12 Oct, 2022 | npm loader-utils |
mockery is vulnerable to prototype pollution CVE-2022-37614, GHSA-gmwp-3pwc-3j3g | Critical | 1.6% | 12 Oct, 2022 | npm mockery |
tschaub gh-pages vulnerable to prototype pollution CVE-2022-37611, GHSA-8mmm-9v2q-x3f9 | Critical | 1.4% | 12 Oct, 2022 | npm gh-pages |
thlorenz browserify-shim vulnerable to prototype pollution CVE-2022-37617, GHSA-866w-wm4h-95c6 | Critical | 1.5% | 11 Oct, 2022 | npm browserify-shim |
Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom CVE-2022-37616, GHSA-9pgh-qqpf-7wqj | Critical | 2.1% | 11 Oct, 2022 | npm @xmldom/xmldom npm xmldom |
isolated-vm has vulnerable CachedDataOptions in API CVE-2022-39266, GHSA-2jjq-x548-rhpv | Critical | 1.3% | 29 Sep, 2022 | npm isolated-vm |
steal vulnerable to Prototype Pollution via alias variable CVE-2022-37265, GHSA-wc4x-qmr2-rj8h | Critical | 1.6% | 20 Sep, 2022 | npm steal |
Valine code injection vulnerability CVE-2022-38545, GHSA-mcvg-g9wx-v5vx | Critical | 34.1% | 19 Sep, 2022 | npm valine |
steal vulnerable to Prototype Pollution CVE-2022-37258, GHSA-gvjw-8mmr-8f6g | Critical | 1.6% | 16 Sep, 2022 | npm steal |
steal vulnerable to Prototype Pollution via optionName variable CVE-2022-37264, GHSA-8f8g-9j73-7p82 | Critical | 1.5% | 15 Sep, 2022 | npm steal |
steal vulnerable to Prototype Pollution via key variable in babel.js CVE-2022-37266, GHSA-vwhq-pm3r-fjm9 | Critical | 1.4% | 15 Sep, 2022 | npm steal |
steal vulnerable to Prototype Pollution via requestedVersion variable CVE-2022-37257, GHSA-93q5-3xpc-8vg3 | Critical | 1.4% | 15 Sep, 2022 | npm steal |
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url CVE-2022-2900, GHSA-j9fq-vwqv-2fm2 | Critical | 1.2% | 14 Sep, 2022 | npm parse-url |
cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch CVE-2022-36084, GHSA-qm4w-4995-vg7f | Critical | 1.5% | 08 Sep, 2022 | npm cruddl |
vm2 vulnerable to Sandbox Escape resulting in Remote Code Execution on host CVE-2022-36067, GHSA-mrgp-mrhc-5jrq | Critical | 47.9% | 06 Sep, 2022 | npm vm2 |
Cryptographically weak PRNG in `utils.generateUUID` CVE-2022-36045, GHSA-p4cc-w597-6cpm | Critical | 1.3% | 30 Aug, 2022 | npm nodebb |
morgan-json vulnerable to Arbitrary Code Execution CVE-2022-25921, GHSA-fwv4-6mxc-x5h3 | Critical | 1.4% | 29 Aug, 2022 | npm morgan-json |
@pendo324/get-process-by-name are vulnerable to Arbitrary Code Execution CVE-2022-25644, GHSA-qhxv-296x-hjv7 | Critical | 1.6% | 29 Aug, 2022 | npm @pendo324/get-process-by-name |
Font-Converter Vulnerable to Arbitrary Command Injection CVE-2022-21165, GHSA-g2c3-vwff-m3xr | Critical | 3.1% | 29 Aug, 2022 | npm font-converter |
Mongoose Vulnerable to Prototype Pollution in Schema Object CVE-2022-24304, GHSA-h8hf-x3f4-xwgp | Critical | Not scored | 27 Aug, 2022 | npm mongoose |