Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
React Editable Json Tree vulnerable to arbitrary code execution via function parsing CVE-2022-36010, GHSA-j3rv-w43q-f9x2 | Critical | 1.5% | 15 Aug, 2022 | npm react-editable-json-tree |
`undici.request` vulnerable to SSRF using absolute URL on `pathname` CVE-2022-35949, GHSA-8qr4-xgw6-wmr3 | Critical | 1.9% | 12 Aug, 2022 | npm undici |
loopback-connector-postgresql Vulnerable to Improper Sanitization of `contains` Filter CVE-2022-35942, GHSA-j259-6c58-9m58 | Critical | 0.7% | 11 Aug, 2022 | npm loopback-connector-postgresql |
ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution CVE-2022-25907, GHSA-7qqq-gh2f-wq76 | Critical | 1.9% | 09 Aug, 2022 | npm ts-deepmerge |
@acrontum/filesystem-template vulnerable to Command Injection due to fetchRepo API missing sanitization CVE-2022-21186, GHSA-m2fc-9h5m-29cm | Critical | 26.1% | 05 Aug, 2022 | npm @acrontum/filesystem-template |
Raneto v0.17.0 employs weak password complexity requirements CVE-2022-35143, GHSA-7942-2fx8-qhpf | Critical | 1.7% | 04 Aug, 2022 | npm raneto |
NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails CVE-2022-35924, GHSA-xv97-c62v-4587 | Critical | 1.5% | 02 Aug, 2022 | npm next-auth |
get-npm-package-version Command Injection vulnerability CVE-2020-7795, GHSA-4h66-vghf-xg5x | Critical | 4.0% | 02 Aug, 2022 | npm get-npm-package-version |
npos-tesseract Command Injection vulnerability CVE-2020-28453, GHSA-mpwp-pf96-9g4r | Critical | 1.3% | 02 Aug, 2022 | npm npos-tesseract |
image-tiler susceptible to command injection CVE-2020-28451, GHSA-mrxv-pr4h-963q | Critical | 1.5% | 02 Aug, 2022 | npm image-tiler |
heroku-env susceptible to command injection CVE-2020-28437, GHSA-jp45-65jw-94mj | Critical | 1.3% | 02 Aug, 2022 | npm heroku-env |
gitblame susceptible to command injection CVE-2020-28434, GHSA-3486-rvxc-hrrj | Critical | 1.3% | 02 Aug, 2022 | npm gitblame |
node-latex-pdf is susceptible to command injection CVE-2020-28433, GHSA-32fw-9wq8-9x9c | Critical | 0.9% | 02 Aug, 2022 | npm node-latex-pdf |
curljs Command Injection vulnerability CVE-2020-28425, GHSA-cqfc-9452-r36j | Critical | 0.9% | 02 Aug, 2022 | npm curljs |
monorepo-build Command Injection vulnerability CVE-2020-28423, GHSA-5vrc-7jfr-4642 | Critical | 1.3% | 02 Aug, 2022 | npm monorepo-build |
automattic/mongoose vulnerable to Prototype pollution via Schema.path BIT-mongoose-2022-2564, CVE-2022-2564, GHSA-f825-f98c-gj3g | Critical | 31.3% | 28 Jul, 2022 | npm mongoose |
Joplin is vulnerable to arbitrary code execution CVE-2022-35131, GHSA-ww2v-frv5-pj5x | Critical | 2.3% | 25 Jul, 2022 | npm joplin |
otp-generator before v3.0.0 insecurely generates random one-time passwords CVE-2021-23451, GHSA-6x93-h9g3-9phr | Critical | 0.9% | 25 Jul, 2022 | npm otp-generator |
@ianwalter/merge Prototype Pollution via `merge` function CVE-2021-23397, GHSA-42m6-g935-5vmq | Critical | 0.8% | 25 Jul, 2022 | npm @ianwalter/merge |
set-deep-prop Prototype Pollution CVE-2021-23373, GHSA-v42q-78w8-8fcc | Critical | 1.2% | 25 Jul, 2022 | npm set-deep-prop |
node-import `params` argument can be controlled by users without any sanitization CVE-2020-7678, GHSA-pc62-cq5x-3j5g | Critical | 1.2% | 25 Jul, 2022 | npm node-import |
ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse` CVE-2020-28462, GHSA-7vrv-5m2h-rjw9 | Critical | 0.9% | 25 Jul, 2022 | npm ion-parser |
js-ini Prorotype Pollution when malicious INI files submitted to an application that parses it with `parse` CVE-2020-28461, GHSA-m939-vrfp-9v8p | Critical | 1.2% | 25 Jul, 2022 | npm js-ini |
xopen is vulnerable to OS Command Injection in Exported Function xopen(filepath) CVE-2020-28447, GHSA-74wf-cwjg-9cf2 | Critical | 1.3% | 25 Jul, 2022 | npm xopen |
ntesseract vulnerable to Command Injection CVE-2020-28446, GHSA-w868-4576-rv24 | Critical | 3.5% | 25 Jul, 2022 | npm ntesseract |
sonar-wrapper Command Injection vulnerability CVE-2020-28443, GHSA-wr4v-3f2h-6hhh | Critical | 1.3% | 25 Jul, 2022 | npm sonar-wrapper |
conf-cfg-ini Prototype Pollution via malicious INI file before v1.2.2 CVE-2020-28441, GHSA-m6mg-jvjf-w44x | Critical | 1.2% | 25 Jul, 2022 | npm conf-cfg-ini |
deferred-exec Command Injection vulnerability CVE-2020-28438, GHSA-54w4-2f2p-f48h | Critical | 1.3% | 25 Jul, 2022 | npm deferred-exec |
google-cloudstorage-commands Command Injection vulnerability CVE-2020-28436, GHSA-6367-p3v8-7mgw | Critical | 1.0% | 25 Jul, 2022 | npm google-cloudstorage-commands |
ffmpeg-sdk vulnerable to OS Command Injection CVE-2020-28435, GHSA-rwvf-c3wm-qm6w | Critical | 1.4% | 25 Jul, 2022 | npm ffmpeg-sdk |
convert-svg-core vulnerable to remote code injection CVE-2022-25759, GHSA-5gxc-fxcr-9326 | Critical | 11.5% | 22 Jul, 2022 | npm convert-svg-core |
Properties-Reader before v2.2.0 vulnerable to prototype pollution CVE-2020-28471, GHSA-jxvf-m3x5-mxwq | Critical | 1.5% | 19 Jul, 2022 | npm properties-reader |
thenify before 3.3.1 made use of unsafe calls to `eval`. CVE-2020-7677, GHSA-29xr-v42j-r956 | Critical | 2.1% | 18 Jul, 2022 | Maven org.webjars.npm:thenify npm thenify |
Shescape vulnerable to insufficient escaping of whitespace CVE-2022-31180, GHSA-44vr-rwwj-p88h | Critical | 2.0% | 15 Jul, 2022 | npm shescape |
Shescape prior to 1.5.8 vulnerable to insufficient escaping of line feeds for CMD CVE-2022-31179, GHSA-jjc5-fp7p-6f8w | Critical | 1.4% | 15 Jul, 2022 | npm shescape |
llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields BIT-node-2022-32214, BIT-node-min-2022-32214, CVE-2022-32214, GHSA-q5vx-44v4-gch4 | Critical | 81.8% | 14 Jul, 2022 | npm llhttp |
llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding BIT-node-2022-32213, BIT-node-min-2022-32213, CVE-2022-32213, GHSA-5689-v88g-g6rv | Critical | 44.8% | 14 Jul, 2022 | npm llhttp |
SQL injection in typeORM CVE-2022-33171, GHSA-fx4w-v43j-vc45 | Critical | 21.4% | 04 Jul, 2022 | npm typeorm |
Command injection in git-clone CVE-2022-25900, GHSA-8jmw-wjr8-2x66 | Critical | 3.5% | 01 Jul, 2022 | npm git-clone |
Prototype Pollution in deep.assign CVE-2021-40663, GHSA-3829-mgmw-jcg4 | Critical | 1.8% | 30 Jun, 2022 | npm deep.assign |
Server-Side Request Forgery in parse-url CVE-2022-2216, GHSA-7f3x-x4pr-wqhj | Critical | 1.7% | 27 Jun, 2022 | npm parse-url |
JWS and JWT signature validation vulnerability with special characters CVE-2022-25898, GHSA-3fvg-4v2m-98jf | Critical | 1.2% | 25 Jun, 2022 | npm jsrsasign |
Prototype Pollution in deep-get-set CVE-2022-21231, GHSA-mjjj-6p43-vhhv | Critical | 1.4% | 24 Jun, 2022 | npm deep-get-set |
Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled CVE-2022-29247, GHSA-mq8j-3h7h-p8g7 | Critical | 1.0% | 13 Jun, 2022 | npm electron |
OS Command Injection in git-promise CVE-2022-24376, GHSA-chj3-f7xw-367m | Critical | 3.1% | 10 Jun, 2022 | npm git-promise |
Directory traversal in convert-svg-core CVE-2022-24278, GHSA-5f47-rcg5-9m24, SNYK-JS-CONVERTSVGCORE-2859830 | Critical | 2.2% | 10 Jun, 2022 | npm convert-svg-core |
Server-Side Request Forgery in kityminder CVE-2022-31830, GHSA-q56h-x9h5-q53c | Critical | 16.2% | 09 Jun, 2022 | npm kityminder |
Code Injection in metacalc CVE-2022-21122, GHSA-5gc4-cx9x-9c43, SNYK-JS-METACALC-2826197 | Critical | 2.7% | 08 Jun, 2022 | npm metacalc |
Unsanitized JavaScript code injection possible in gatsby-plugin-mdx CVE-2022-25863, GHSA-mj46-r4gr-5x83, SNYK-JS-GATSBYPLUGINMDX-2405699 | Critical | 2.0% | 03 Jun, 2022 | npm gatsby-plugin-mdx |
OS Command Injection in s3-uploader CVE-2021-34084, GHSA-gwp3-f7mr-qpfv | Critical | 3.1% | 02 Jun, 2022 | npm s3-uploader |