Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Prototype Pollution in jointjs CVE-2021-23444, GHSA-f3pp-32qc-36w4 | Critical | 1.9% | 21 Sep, 2021 | npm jointjs |
OS Command Injection in ssh2 CVE-2020-26301, GHSA-652h-xwhf-q4h6 | Critical | 3.8% | 20 Sep, 2021 | npm ssh2 |
Prototype Pollution in the merge and clone helper methods CVE-2021-39227, GHSA-fhv8-fx5f-7fxf | Critical | 1.3% | 17 Sep, 2021 | npm zrender |
Prototype Pollution in cookiex/deep CVE-2021-23442, GHSA-92v9-xh2q-fq9f, SNYK-JS-COOKIEXDEEP-1582793 | Critical | 1.6% | 17 Sep, 2021 | npm @cookiex/deep |
UUPSUpgradeable vulnerability in @openzeppelin/contracts CVE-2021-41264, GHSA-5vp3-v4hc-gx76 | Critical | 1.5% | 15 Sep, 2021 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable GHSA-q4h9-46xg-m3x9 | Critical | Not scored | 15 Sep, 2021 | npm @openzeppelin/contracts-upgradeable |
body-parser-xml vulnerable to Prototype Pollution CVE-2021-3666, GHSA-2ghc-6v89-pw9j | Critical | 1.3% | 13 Sep, 2021 | npm body-parser-xml |
Prototype Pollution in set-value CVE-2021-23440, GHSA-4jqc-8m5r-9rpr | Critical | 2.2% | 12 Sep, 2021 | NuGet set-value-nuget npm set-value |
merge vulnerable to Prototype Pollution CVE-2021-3645, GHSA-cqqh-49mx-fq63 | Critical | 1.4% | 10 Sep, 2021 | npm @viking04/merge |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ZMarkdown GHSA-2c83-wfv3-q25f | Critical | Not scored | 07 Sep, 2021 | npm rebber |
Incorrect version tags linked to external repository BIT-parse-2021-47986, BIT-parse-2021-47987, CVE-2021-47986, CVE-2021-47987, GHSA-593v-wcqx-hq2w | Critical | 0.2% | 07 Sep, 2021 | npm parse-server |
Unsafe defaults in `remark-html` CVE-2021-39199, GHSA-9q5w-79cv-947m | Critical | 1.1% | 07 Sep, 2021 | npm remark-html |
objection.js Prototype Pollution vulnerability CVE-2021-3766, GHSA-r659-8xfp-j327 | Critical | 1.5% | 06 Sep, 2021 | npm objection |
Prototype Pollution in immer CVE-2021-3757, GHSA-c36v-fmgq-m8hx | Critical | 1.7% | 02 Sep, 2021 | npm immer |
Type confusion in mpath CVE-2021-23438, GHSA-p92x-r36w-9395 | Critical | 1.7% | 01 Sep, 2021 | npm mpath |
Prototype Pollution in immer CVE-2021-23436, GHSA-33f9-j839-rf8h | Critical | 1.8% | 01 Sep, 2021 | npm immer |
TimelockController vulnerability in OpenZeppelin Contracts CVE-2021-39168, GHSA-vrw4-w73r-6mm8 | Critical | 1.6% | 27 Aug, 2021 | npm @openzeppelin/contracts-upgradeable |
TimelockController vulnerability in OpenZeppelin Contracts CVE-2021-39167, GHSA-fg47-3c2x-m2wr | Critical | 1.6% | 27 Aug, 2021 | npm @openzeppelin/contracts |
Prototype Pollution in mootools CVE-2021-23432, GHSA-x6hx-7gh3-3q98 | Critical | 0.9% | 24 Aug, 2021 | npm mootools |
Code Injection in pac-resolver CVE-2021-23406, GHSA-9j49-mfvp-vmhm | Critical | 2.9% | 24 Aug, 2021 | npm degenerator npm pac-resolver |
Prototype Pollution in merge-change CVE-2021-23421, GHSA-f9cv-665r-275h | Critical | 1.1% | 11 Aug, 2021 | npm merge-change |
Incorrect Authorization in serverless-offline CVE-2021-38384, GHSA-h97f-5258-5593 | Critical | 1.5% | 10 Aug, 2021 | npm serverless-offline |
Prototype Pollution in open-graph CVE-2021-23419, GHSA-g452-6rfc-vrvx, SNYK-JS-OPENGRAPH-1536747 | Critical | 1.1% | 08 Aug, 2021 | npm open-graph |
Obsidian does not require user confirmation for non-http/https URLs. CVE-2021-38148, GHSA-45mx-g85m-wwm3 | Critical | 1.2% | 07 Aug, 2021 | npm obsidian |
Prototype Pollution in deepmergefn CVE-2021-23417, GHSA-vj72-mwrj-m2xq | Critical | 1.1% | 28 Jul, 2021 | npm deepmergefn |
Command injection in gitlogplus CVE-2021-23412, GHSA-3fxp-vwxm-2r5p | Critical | 4.0% | 23 Jul, 2021 | npm gitlogplus |
Prototype Pollution in putil-merge CVE-2021-25953, GHSA-9x7m-9hpg-xxmw | Critical | 3.0% | 14 Jul, 2021 | npm putil-merge |
Code Injection in total4 CVE-2021-23390, GHSA-g7mq-rfj2-25wq, SNYK-JS-TOTAL4-1130527 | Critical | 3.0% | 12 Jul, 2021 | npm total4 |
Code Injection in total.js CVE-2021-23389, GHSA-7fm6-gxqg-2pwr, SNYK-JS-TOTALJS-1088607 | Critical | 3.6% | 12 Jul, 2021 | npm total.js |
Prototype polluation in just-safe-set CVE-2021-25952, GHSA-v26w-gcxh-v4r7 | Critical | 3.3% | 07 Jul, 2021 | npm just-safe-set |
Prototype Pollution in ts-nodash CVE-2021-23403, GHSA-5xjx-4xcm-hpcm | Critical | 1.3% | 02 Jul, 2021 | npm ts-nodash |
Prototype Pollution in record-like-deep-assign CVE-2021-23402, GHSA-7qm6-9v49-38m9 | Critical | 1.2% | 02 Jul, 2021 | npm record-like-deep-assign |
Arbitrary Command Injection CVE-2021-23399, GHSA-v85c-hgq5-7pfw | Critical | 1.3% | 28 Jun, 2021 | npm wincred |
Prototype Pollution in lutils CVE-2021-23396, GHSA-3r8w-mphv-2f3f | Critical | 1.0% | 17 Jun, 2021 | npm lutils |
Auto-merging Person Records Compromised CVE-2021-32691, GHSA-r578-pj6f-r4ff | Critical | 1.5% | 16 Jun, 2021 | npm @apollosproject/data-connector-rock |
Improper Verification of Cryptographic Signature CVE-2021-32685, GHSA-7r96-8g3x-g36m | Critical | 0.7% | 16 Jun, 2021 | npm tenvoy |
Use After Free in Hermes CVE-2021-24037, GHSA-mph8-6787-r8hw | Critical | 1.8% | 15 Jun, 2021 | npm hermes-engine |
set-getter Prototype Pollution Vulnerability CVE-2021-25949, GHSA-jv35-xqg7-f92r | Critical | 3.3% | 10 Jun, 2021 | npm set-getter |
Prototype Pollution CVE-2021-25948, GHSA-x3wr-v4wx-5qpc | Critical | 3.3% | 10 Jun, 2021 | npm expand-hash |
Remote Command Execution in reg-keygen-git-hash-plugin CVE-2021-32673, GHSA-49q3-8867-5wmp | Critical | 1.9% | 08 Jun, 2021 | npm reg-keygen-git-hash-plugin |
Prototype pollution in nestie CVE-2021-25947, GHSA-m7rg-8wvq-846v | Critical | 3.0% | 03 Jun, 2021 | npm nestie |
Prototype pollution in Merge-deep CVE-2021-26707, GHSA-r6rj-9ch6-g264 | Critical | 1.9% | 02 Jun, 2021 | npm merge-deep |
Prototype pollution vulnerability in js-extend CVE-2021-25945, GHSA-mh82-55cm-6gfh | Critical | 3.0% | 26 May, 2021 | npm js-extend |
Prototype pollution in nconf-toml CVE-2021-25946, GHSA-hx7j-43w2-7rj7 | Critical | 3.3% | 25 May, 2021 | npm nconf-toml |
deep-defaults vulnerable to prototype pollution CVE-2021-25944, GHSA-h6xg-rg33-9mf4 | Critical | 3.0% | 25 May, 2021 | npm deep-defaults |
Command Injection in @ronomon/opened CVE-2021-29300, GHSA-fg5w-w99f-rj6w | Critical | 4.5% | 24 May, 2021 | npm @ronomon/opened |
Prototype pollution in 101 CVE-2021-25943, GHSA-cwcx-rxgc-cmw3 | Critical | 3.3% | 14 May, 2021 | npm 101 |
Prototype Pollution in deep-override CVE-2021-25941, GHSA-v659-54cx-g4qr | Critical | 3.3% | 14 May, 2021 | npm deep-override |
Prototype Pollution in handlebars CVE-2021-23383, GHSA-765h-qjxv-5f44 | Critical | 4.5% | 04 May, 2021 | npm handlebars |
Code injection in @rkesters/gnuplot CVE-2021-29369, GHSA-f2jw-pr2c-9x96 | Critical | 1.8% | 03 May, 2021 | npm @rkesters/gnuplot |