Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OS Command Injection in proctree CVE-2021-34082, GHSA-cv76-rv4h-4mqc | Critical | 4.8% | 02 Jun, 2022 | npm proctree |
OS Command injection in ssl-utils CVE-2021-34080, GHSA-552j-pv39-f3jf | Critical | 3.3% | 02 Jun, 2022 | npm ssl-utils |
Command injection in docker-tester CVE-2021-34079, GHSA-rj88-4777-828h | Critical | 4.1% | 02 Jun, 2022 | npm docker-tester |
Server-Side Template Injection in formio CVE-2020-28246, GHSA-52vj-mr2j-f8jh | Critical | 2.4% | 02 Jun, 2022 | npm formio |
Formidable arbitrary file upload CVE-2022-29622, GHSA-8cp3-66vr-3r4c | Critical | 3.4% | 16 May, 2022 | npm formidable |
Withdrawn: Code execution via SVG file upload in tiddlywiki CVE-2022-29351, GHSA-cr9c-rhq6-vh53 | Critical | 2.7% | 16 May, 2022 | npm tiddlywiki |
Command injection in workspace-tools CVE-2022-25865, GHSA-5875-m6jq-vf78, SNYK-JS-WORKSPACETOOLS-2421201 | Critical | 6.7% | 13 May, 2022 | npm workspace-tools |
Prototype Pollution in convict CVE-2022-21190, GHSA-jjf5-wx3j-3fv7, SNYK-JS-CONVICT-2774757 | Critical | 4.0% | 13 May, 2022 | npm convict |
Exposure of Sensitive Information in eventsource CVE-2022-1650, GHSA-6h5x-7c5m-7cr7 | Critical | 1.9% | 12 May, 2022 | npm eventsource |
RCE in SiteServer CMS CVE-2022-28118, GHSA-q469-j32f-h7vm | Critical | 2.8% | 03 May, 2022 | npm siteserver |
Prototype Pollution in jsgui-lang-essentials CVE-2022-25301, GHSA-p3pg-64pv-v7jg | Critical | 1.2% | 01 May, 2022 | npm jsgui-lang-essentials |
OS Command Injection in git-pull-or-clone CVE-2022-24437, GHSA-3x62-x456-q2vm, SNYK-JS-GITPULLORCLONE-2434307 | Critical | 3.7% | 01 May, 2022 | npm git-pull-or-clone |
Privilege Issues in jailed CVE-2022-23923, GHSA-77m7-9wvw-87fx | Critical | 1.3% | 01 May, 2022 | npm jailed |
Prototype Pollution in Dexie CVE-2022-21189, GHSA-3xgx-r9j4-qw9w | Critical | 1.7% | 01 May, 2022 | npm dexie |
ejs template injection vulnerability CVE-2022-29078, GHSA-phwq-j96m-2c2q | Critical | 32.8% | 25 Apr, 2022 | npm ejs |
Command injection in git-interface CVE-2022-1440, GHSA-qffw-8wg7-h665 | Critical | 3.7% | 22 Apr, 2022 | npm git-interface |
Prototype Pollution in convict CVE-2022-22143, GHSA-x2w5-725j-gf2g, SNYK-JS-CONVICT-2340604 | Critical | 2.2% | 20 Apr, 2022 | npm convict |
Arbitrary file upload in Ghost BIT-ghost-2022-28397, CVE-2022-28397, GHSA-ffhq-g856-9f2p | Critical | 3.5% | 12 Apr, 2022 | npm ghost |
Unrestricted Upload of File with Dangerous Type in Payload CVE-2022-27952, GHSA-w8xh-93qh-35vw | Critical | 2.3% | 12 Apr, 2022 | npm payload |
Unrestricted Upload of File with Dangerous Type in Strapi CVE-2022-27263, GHSA-9qgm-w87q-hx89 | Critical | 3.2% | 12 Apr, 2022 | npm strapi |
Unrestricted Upload of File with Dangerous Type in ButterCMS CVE-2022-27260, GHSA-3v5x-qjrp-q2hq | Critical | 3.1% | 12 Apr, 2022 | npm buttercms |
Arbitrary file upload in Ghost BIT-ghost-2022-27139, CVE-2022-27139, GHSA-fvc6-qjp7-m4g4 | Critical | 4.0% | 12 Apr, 2022 | npm ghost |
Command injection in npm-dependency-versions CVE-2022-29080, GHSA-m7xq-8jp8-rj2c | Critical | 2.2% | 12 Apr, 2022 | npm npm-dependency-versions |
Prototype Pollution in fullpage.js CVE-2022-1295, GHSA-vpgw-ffh3-648h | Critical | 1.3% | 11 Apr, 2022 | npm fullpage.js |
Insecure default value for CORS configuration CVE-2022-26969, GHSA-g27j-74fp-xfpr | Critical | 1.0% | 05 Apr, 2022 | npm directus |
Command injection in simple-git CVE-2022-24066, GHSA-28xr-mwxg-3qc8 | Critical | 3.9% | 01 Apr, 2022 | npm simple-git |
Prototype Pollution in deepmerge-ts CVE-2022-24802, GHSA-r9w3-g83q-m6hq | Critical | 1.7% | 01 Apr, 2022 | npm deepmerge-ts |
Prototype Pollution in simple-plist CVE-2022-26260, GHSA-gff7-g5r8-mg8m | Critical | 1.3% | 22 Mar, 2022 | npm simple-plist |
Prototype Pollution in minimist CVE-2021-44906, GHSA-xvch-5gv4-984h | Critical | 4.6% | 17 Mar, 2022 | npm minimist |
Code injection in accesslog CVE-2022-25760, GHSA-8m2f-74r2-x3f2 | Critical | 1.6% | 17 Mar, 2022 | npm accesslog |
Prototype Pollution in set-in CVE-2022-25354, GHSA-6956-83fg-5wc5, SNYK-JS-SETIN-2388571 | Critical | 1.9% | 17 Mar, 2022 | npm set-in |
Prototype Pollution in libnested CVE-2022-25352, GHSA-x5m8-2r8v-8f97, SNYK-JS-LIBNESTED-2342117 | Critical | 2.1% | 17 Mar, 2022 | npm libnested |
Arbitrary code execution in post-loader CVE-2022-0748, GHSA-66ww-999q-mffq, SNYK-JS-POSTLOADER-2403737 | Critical | 2.1% | 17 Mar, 2022 | npm post-loader |
Prototype Pollution in Sails.js CVE-2021-44908, GHSA-8v3j-jfg3-v3fv | Critical | 1.8% | 17 Mar, 2022 | npm sails |
Code injection in npm git CVE-2021-23632, GHSA-9gqr-xp86-f87h, SNYK-JS-GIT-1568518 | Critical | 2.4% | 17 Mar, 2022 | npm git |
Embedded Malicious Code in node-ipc CVE-2022-23812, GHSA-97m3-w2cp-4xx6 | Critical | 4.2% | 16 Mar, 2022 | npm node-ipc |
Command injection in Parse Server through prototype pollution BIT-parse-2022-24760, CVE-2022-24760, GHSA-p6h4-93qp-jhcm | Critical | 49.4% | 11 Mar, 2022 | npm parse-server |
Command injection in simple-git CVE-2022-24433, GHSA-3f95-r44v-8mrg | Critical | 3.7% | 11 Mar, 2022 | npm simple-git |
OS Command Injection in GenieACS CVE-2021-46704, GHSA-2877-693q-pj33 | Critical | 21.9% | 06 Mar, 2022 | npm genieacs |
OS Command injection in npm-lockfile CVE-2022-0841, GHSA-cr6m-62pq-hmqh | Critical | 2.5% | 03 Mar, 2022 | npm npm-lockfile |
url-parse incorrectly parses hostname / protocol due to unstripped leading control characters. CVE-2022-0691, GHSA-jf5r-8hm2-f872 | Critical | 2.2% | 21 Feb, 2022 | npm url-parse |
Authorization Bypass Through User-Controlled Key in url-parse CVE-2022-0686, GHSA-hgjh-723h-mx2j | Critical | 1.8% | 20 Feb, 2022 | npm url-parse |
Prototype Pollution in object-extend CVE-2021-23702, GHSA-m639-9whg-fw97 | Critical | 1.4% | 18 Feb, 2022 | npm object-extend |
Prototype pollution in Plist before 3.0.5 can cause denial of service CVE-2022-22912, GHSA-4cpg-3vgw-4877 | Critical | 2.6% | 17 Feb, 2022 | npm plist |
Prototype Pollution in litespeed.js and appwrite/server-ce CVE-2021-23682, GHSA-v9p9-535w-4285 | Critical | 2.1% | 16 Feb, 2022 | Packagist appwrite/server-ce npm litespeed.js |
Sandbox bypass in vm2 CVE-2021-23555, GHSA-6pw2-5hjv-9pf7, SNYK-JS-VM2-2309905 | Critical | 2.9% | 11 Feb, 2022 | npm vm2 |
Prototype Pollution leading to Remote Code Execution in superjson CVE-2022-23631, GHSA-5888-ffcr-r425 | Critical | 2.7% | 09 Feb, 2022 | npm blitz npm superjson |
Joplin Vulnerable to Code Injection CVE-2022-23340, GHSA-8478-53pv-jxvm | Critical | 1.5% | 08 Feb, 2022 | npm joplin |
Prototype Pollution in object-path-set CVE-2021-23507, GHSA-h6pr-c536-6rjg, SNYK-JS-OBJECTPATHSET-2388576 | Critical | 2.1% | 04 Feb, 2022 | npm object-path-set |
Prototype Pollution in @strikeentco/set CVE-2021-23497, GHSA-39qv-prmh-x37f, SNYK-JS-STRIKEENTCOSET-2385945 | Critical | 3.7% | 04 Feb, 2022 | npm @strikeentco/set |