Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Prototype Pollution in putil-merge CVE-2021-23470, GHSA-4g77-cvgw-grvw, SNYK-JS-PUTILMERGE-2391487 | Critical | 1.3% | 04 Feb, 2022 | npm putil-merge |
Path Traversal in w-zip CVE-2022-0401, GHSA-fr6q-jv7j-35g3 | Critical | 1.6% | 01 Feb, 2022 | npm w-zip |
Prototype Pollution in keyget CVE-2021-23760, GHSA-9fp7-4fjm-q3mf | Critical | 1.7% | 28 Jan, 2022 | npm keyget |
Prototype Pollution in bmoor CVE-2021-23558, GHSA-4m8h-h59m-m34j, SNYK-JS-BMOOR-2342622 | Critical | 1.6% | 28 Jan, 2022 | npm bmoor |
Exposure of Resource to Wrong Sphere in Zip-Local CVE-2021-23484, GHSA-wxj7-97fp-j53j, SNYK-JS-ZIPLOCAL-2327477 | Critical | 2.1% | 28 Jan, 2022 | npm zip-local |
Prototype Pollution in cached-path-relative CVE-2021-23518, GHSA-wg6g-ppvx-927h | Critical | 1.9% | 21 Jan, 2022 | npm cached-path-relative |
Access of Resource Using Incompatible Type in Hermes CVE-2021-24044, GHSA-7mhc-prgv-r3q4 | Critical | 1.3% | 15 Jan, 2022 | npm hermes-engine |
Zalgo-like output that crashes the server GHSA-2w8g-m5j8-7m87 | Critical | Not scored | 12 Jan, 2022 | npm @soketi/soketi |
Prototype Pollution in realms-shim CVE-2021-23594, GHSA-pwm7-qr6j-3vjg | Critical | 1.8% | 10 Jan, 2022 | npm realms-shim |
Prototype Pollution in extend2 CVE-2021-23568, GHSA-gjm5-83cw-p3p2, SNYK-JS-EXTEND2-2320315 | Critical | 1.5% | 10 Jan, 2022 | npm extend2 |
Prototype Pollution in realms-shim CVE-2021-23543, GHSA-q4j7-v27r-fgcx | Critical | 1.8% | 10 Jan, 2022 | npm realms-shim |
uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) CVE-2022-0086, GHSA-x8rq-rc7x-5fg5 | Critical | 1.2% | 04 Jan, 2022 | npm @uppy/companion |
Prototype Pollution in js-data CVE-2021-23574, GHSA-c6h4-gc3f-hgjq | Critical | 2.2% | 24 Dec, 2021 | npm js-data |
Command Injection in node-windows CVE-2021-45459, GHSA-53xv-c2hx-5w6q | Critical | 4.1% | 22 Dec, 2021 | npm node-windows |
Remote Code Execution in npm-groovy-lint GHSA-qc22-qwm9-j8rx | Critical | Not scored | 20 Dec, 2021 | npm npm-groovy-lint |
Path Traversal in http-server-node CVE-2021-23797, GHSA-hj3m-v758-jwx5 | Critical | 1.8% | 17 Dec, 2021 | npm http-server-node |
Prototype Pollution in dojo CVE-2021-23450, GHSA-m8gw-hjpr-rjv7 | Critical | 30.4% | 17 Dec, 2021 | npm dojo |
Prototype Pollution in merge-deep2. CVE-2021-23700, GHSA-j28q-p8ww-cp87 | Critical | 1.2% | 10 Dec, 2021 | npm merge-deep2 |
Prototype Pollution in sey CVE-2021-23663, GHSA-wjpc-cgvw-xx23 | Critical | 1.2% | 10 Dec, 2021 | npm sey |
Code Injection in md-to-pdf. CVE-2021-23639, GHSA-x949-7cm6-fm6p, SNYK-JS-MDTOPDF-1657880 | Critical | 5.4% | 10 Dec, 2021 | npm md-to-pdf |
Prototype Pollution in comb CVE-2021-23561, GHSA-vxr4-rxw7-g7v6 | Critical | 1.2% | 10 Dec, 2021 | npm comb |
Prototype Pollution in @fabiocaccamo/utils.js CVE-2021-3815, GHSA-3xph-cp8f-2229 | Critical | 0.9% | 08 Dec, 2021 | npm @fabiocaccamo/utils.js |
Command injection in git-it-electron CVE-2021-44685, GHSA-wjqc-j537-j9gj | Critical | 3.5% | 07 Dec, 2021 | npm git-it-electron |
Command injection in github-todos CVE-2021-44684, GHSA-792j-9wj3-j634 | Critical | 2.6% | 07 Dec, 2021 | npm github-todos |
XSS via prototype pollution in NodeBB CVE-2021-43787, GHSA-wx69-rvg3-x7fc | Critical | 1.3% | 29 Nov, 2021 | npm nodebb |
API token verification can be bypassed in NodeBB CVE-2021-43786, GHSA-hf2m-j98r-4fqw | Critical | 2.4% | 29 Nov, 2021 | npm nodebb |
OS Command injection in docker-cli-js CVE-2021-23732, GHSA-ff45-7prw-58vj | Critical | 1.9% | 22 Nov, 2021 | npm docker-cli-js |
Prototype Pollution in algoliasearch-helper CVE-2021-23433, GHSA-vpf5-82c8-9v36, SNYK-JS-ALGOLIASEARCHHELPER-1570421 | Critical | 1.6% | 19 Nov, 2021 | npm algoliasearch-helper |
json-schema is vulnerable to Prototype Pollution CVE-2021-3918, GHSA-896r-f27r-55mw | Critical | 3.8% | 13 Nov, 2021 | npm json-schema |
Improper Verification of Cryptographic Signature in starkbank-ecdsa CVE-2021-43571, GHSA-q9q6-f556-gpm7 | Critical | 1.0% | 09 Nov, 2021 | npm starkbank-ecdsa |
Apostrophe CMS Insufficient Session Expiration vulnerability CVE-2021-25979, GHSA-9j9m-8wjc-ff96 | Critical | 1.1% | 08 Nov, 2021 | npm apostrophe |
Embedded malware in rc GHSA-g2q5-5433-rhrf | Critical | Not scored | 04 Nov, 2021 | npm rc |
Embedded malware in coa GHSA-73qr-pfmq-6rp8 | Critical | Not scored | 04 Nov, 2021 | npm coa |
Prototype Pollution in json-pointer CVE-2021-23820, GHSA-v5vg-g7rq-363w | Critical | 1.9% | 03 Nov, 2021 | npm json-pointer |
Prototype Pollution in node-jsonpointer CVE-2021-23807, GHSA-282f-qqgm-c34q | Critical | 2.8% | 03 Nov, 2021 | npm jsonpointer npm org.webjars.npm:json-pointer |
Prototype Pollution in dotty CVE-2021-23624, GHSA-6g47-63mv-qpgh, SNYK-JS-DOTTY-1577292 | Critical | 1.3% | 03 Nov, 2021 | npm dotty |
Prototype Pollution in json-ptr CVE-2021-23509, GHSA-8gwj-8hxc-285w | Critical | 1.8% | 03 Nov, 2021 | npm json-ptr |
Vulnerability in singleCrunch function leads to arbitrary code execution via filePath parameters CVE-2020-36381, GHSA-7fw7-gh23-f832 | Critical | 1.9% | 31 Oct, 2021 | npm aaptjs |
Vulnerability in crunch function leads to arbitrary code execution via filePath parameters CVE-2020-36380, GHSA-m7p2-ghfh-pjvx | Critical | 2.2% | 31 Oct, 2021 | npm aaptjs |
Vulnerability in remove function leads to arbitrary code execution via filePath parameters CVE-2020-36379, GHSA-9cq3-fj2h-ggj5 | Critical | 1.9% | 31 Oct, 2021 | npm aaptjs |
Vulnerability in packageCmd function leads to arbitrary code execution via filePath parameters CVE-2020-36378, GHSA-4qwq-q4pr-rr7r | Critical | 1.9% | 31 Oct, 2021 | npm aaptjs |
Vulnerability in dump function leads to arbitrary code execution via filePath parameters CVE-2020-36377, GHSA-r496-7hgp-53wf | Critical | 1.9% | 31 Oct, 2021 | npm aaptjs |
Vulnerability in list function leads to arbitrary code execution via filePath parameters CVE-2020-36376, GHSA-4g7x-7vgq-3j28 | Critical | 1.9% | 31 Oct, 2021 | npm aaptjs |
Improper Neutralization of Special Elements used in a Command in Shell-quote CVE-2021-42740, GHSA-g4rg-993r-mgx7 | Critical | 4.2% | 21 Oct, 2021 | npm shell-quote |
Prototype Pollution in x-assign CVE-2021-23452, GHSA-4mvj-rq4v-2fxw | Critical | 1.6% | 20 Oct, 2021 | npm x-assign |
Prototype Pollution in vm2 CVE-2021-23449, GHSA-rjf2-j2r6-q8gr, SNYK-JS-VM2-1585918 | Critical | 3.6% | 18 Oct, 2021 | npm vm2 |
Prototype Pollution in config-handler CVE-2021-23448, GHSA-2w3f-9w3q-qw77, SNYK-JS-CONFIGHANDLER-1564947 | Critical | 1.2% | 11 Oct, 2021 | npm config-handler |
Insecure random number generation in keypair CVE-2021-41117, GHSA-3f99-hvg4-qjwj | Critical | 3.1% | 11 Oct, 2021 | npm keypair |
Prototype pollution in aurelia-path CVE-2021-41097, GHSA-3c9c-2p65-qvwv | Critical | 4.9% | 27 Sep, 2021 | npm aurelia-path |
Improper Control of Generation of Code ('Code Injection') in @asyncapi/modelina CVE-2023-23619, GHSA-4jg2-84c2-pj95 | Critical | 1.1% | 21 Sep, 2021 | npm @asyncapi/modelina |