Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Prototype Pollution in mixme CVE-2021-28860, CVE-2021-29491, GHSA-79jw-6wg7-r9g4, GHSA-r5cq-9537-9rpf | Critical | 1.8% | 03 May, 2021 | npm mixme |
Prototype pollution in safe-obj CVE-2021-25928, GHSA-wpgh-hmv4-r3v5 | Critical | 3.4% | 26 Apr, 2021 | npm safe-obj |
Prototype pollution in safe-flat CVE-2021-25927, GHSA-33rv-m2gp-mm2r | Critical | 3.3% | 26 Apr, 2021 | npm safe-flat |
Improper Certificate Validation in xmlhttprequest-ssl CVE-2021-31597, GHSA-72mh-269x-7mh5 | Critical | 2.0% | 23 Apr, 2021 | npm xmlhttprequest-ssl |
Command Injection in killing CVE-2021-23381, GHSA-cq77-8jpx-892g | Critical | 1.3% | 18 Apr, 2021 | npm killing |
Command injection in portkiller CVE-2021-23379, GHSA-r6fw-8m27-43c9 | Critical | 1.3% | 18 Apr, 2021 | npm portkiller |
Command Injection in picotts CVE-2021-23378, GHSA-wq7q-5v6j-xfv6 | Critical | 1.9% | 18 Apr, 2021 | npm picotts |
Command Injection in onion-oled-js CVE-2021-23377, GHSA-rhwp-9vm9-547q | Critical | 3.0% | 18 Apr, 2021 | npm onion-oled-js |
Command Injection in ffmpegdotjs CVE-2021-23376, GHSA-f39r-cpmj-whcg | Critical | 2.0% | 18 Apr, 2021 | npm ffmpegdotjs |
Command Injection in psnode CVE-2021-23375, GHSA-m8fm-mv5w-33pv | Critical | 1.3% | 18 Apr, 2021 | npm psnode |
Command Injection in ps-visitor CVE-2021-23374, GHSA-v2jv-33gh-xx29 | Critical | 1.3% | 18 Apr, 2021 | npm ps-visitor |
Prototype Pollution in swiper CVE-2021-23370, GHSA-p3hc-fv2j-rp68 | Critical | 2.2% | 12 Apr, 2021 | npm swiper |
Remote code execution in handlebars when compiling templates CVE-2021-23369, GHSA-f2jv-r9rf-7988 | Critical | 7.0% | 12 Apr, 2021 | Maven org.webjars.bowergithub.wycats:handlebars.js Maven org.webjars.npm:handlebars Maven org.webjars:handlebars npm handlebars |
RSA signature validation vulnerability on maleable encoded message in jsrsasign CVE-2021-30246, GHSA-27fj-mc8w-j9wg | Critical | 1.0% | 07 Apr, 2021 | npm jsrsasign |
Client TLS credentials sent raw to server in npm package nats GHSA-prmc-5v5w-c465 | Critical | Not scored | 06 Apr, 2021 | npm nats |
Command Injection Vulnerability in systeminformation CVE-2021-21388, GHSA-jff2-qjw8-5476 | Critical | 1.9% | 06 Apr, 2021 | npm systeminformation |
Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolate CVE-2021-21413, GHSA-mmhj-4w6j-76h7 | Critical | 0.7% | 30 Mar, 2021 | npm isolated-vm |
Remote code execution in mongo-express CVE-2020-24391, GHSA-hxmg-hm46-cf62 | Critical | 74.5% | 30 Mar, 2021 | npm mongodb-query-parser |
netmask npm package mishandles octal input data CVE-2021-28918, CVE-2021-29418, GHSA-4c7m-wxvm-r7gc, GHSA-pch5-whg9-qr2r | Critical | 15.0% | 29 Mar, 2021 | npm netmask |
Arbitrary Code Execution in underscore CVE-2021-23358, GHSA-cf4h-3jhx-xvhq | Critical | 4.2% | 29 Mar, 2021 | npm underscore |
Prototype Pollution in copy-props CVE-2020-28503, GHSA-897m-rjf5-jp39 | Critical | 1.7% | 23 Mar, 2021 | npm copy-props |
Resource Exhaustion Denial of Service in http-proxy-agent CVE-2019-10196, GHSA-86wf-436m-h424 | Critical | 1.4% | 19 Mar, 2021 | npm http-proxy-agent |
Command injection in eslint-fixer CVE-2021-26275, GHSA-45w5-pvr8-4rh5 | Critical | 3.0% | 19 Mar, 2021 | npm eslint-fixer |
Prototype pollution vulnerability in 'patchmerge' CVE-2021-25916, GHSA-84g3-cv89-m9gm | Critical | 3.5% | 16 Mar, 2021 | npm patchmerge |
Code injection in kill-process-by-name CVE-2021-23356, GHSA-qc65-cgvr-93p6 | Critical | 1.1% | 15 Mar, 2021 | npm kill-process-by-name |
Command Injection in ps-kill CVE-2021-23355, GHSA-7qmm-q394-fmch | Critical | 1.2% | 15 Mar, 2021 | npm ps-kill |
Code injection in nobelprizeparser GHSA-4wv4-mgfq-598v | Critical | Not scored | 12 Mar, 2021 | npm nobelprizeparser |
Madge vulnerable to command injection CVE-2021-23352, GHSA-753c-phhg-cj29, SNYK-JS-MADGE-1082875 | Critical | 2.1% | 09 Mar, 2021 | npm madge |
Changeset vulnerable to prototype pollution CVE-2021-25915, GHSA-2gqw-q9r9-7f79 | Critical | 3.5% | 09 Mar, 2021 | npm changeset |
xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection CVE-2020-28502, GHSA-h4j5-c7cj-74xg | Critical | 4.6% | 05 Mar, 2021 | npm xmlhttprequest npm xmlhttprequest-ssl |
Command injection in fs-path CVE-2020-8298, GHSA-8mrf-64fw-2x75 | Critical | 11.2% | 04 Mar, 2021 | npm fs-path |
total.js Remote Code Execution Vulnerability CVE-2021-23344, GHSA-3wj8-vp9h-rm6m, SNYK-JS-TOTALJS-1077069 | Critical | 4.9% | 04 Mar, 2021 | npm total.js |
Remote code execution via the `pretty` option. CVE-2021-21353, GHSA-p493-635q-r6gr | Critical | 4.3% | 03 Mar, 2021 | npm pug npm pug-code-gen |
Prefix escape CVE-2021-21322, GHSA-c4qr-gmr9-v23w | Critical | 1.6% | 02 Mar, 2021 | npm fastify-http-proxy |
Prefix escape CVE-2021-21321, GHSA-qmw8-3v4g-gwj4 | Critical | 1.8% | 02 Mar, 2021 | npm fastify-reply-from |
Prototype Pollution Vulnerability in object-collider CVE-2021-25914, GHSA-85g2-29m8-qf2p | Critical | 3.7% | 01 Mar, 2021 | npm object-collider |
Remote code execution in vscode-npm-script CVE-2021-26700, GHSA-r84v-qff8-jv5g | Critical | 6.0% | 25 Feb, 2021 | npm vscode-npm-script |
Cross-site Scripting (XSS) in Eclipse Theia CVE-2020-27224, GHSA-gcm9-cc3r-c6vj | Critical | 2.6% | 24 Feb, 2021 | npm @theia/preview |
Command Injection in geojson2kml CVE-2020-28429, GHSA-w83x-fp72-p9qc | Critical | 63.3% | 23 Feb, 2021 | npm geojson2kml |
Prototype Pollution in merge CVE-2020-28499, GHSA-7wpw-2hjm-89gp | Critical | 1.4% | 18 Feb, 2021 | npm merge |
Command Injection in async-git CVE-2020-28490, GHSA-6qpr-9mc5-7gch, SNYK-JS-ASYNCGIT-1064877 | Critical | 2.5% | 18 Feb, 2021 | npm async-git |
Command injection in samba-client CVE-2021-27185, GHSA-r3j7-x2g5-9gx6 | Critical | 4.8% | 10 Feb, 2021 | npm samba-client |
File System Bounds Escape CVE-2020-26299, GHSA-pmw4-jgxx-pcq9 | Critical | 1.9% | 10 Feb, 2021 | npm ftp-srv |
Prototype Pollution in set-or-get CVE-2021-25913, GHSA-6rv4-4qv6-88g2 | Critical | 4.2% | 08 Feb, 2021 | npm set-or-get |
Command Injection in macfromip CVE-2020-7786, GHSA-vh8f-xw5v-8993 | Critical | 2.0% | 08 Feb, 2021 | npm macfromip |
Command injection in node-ps CVE-2020-7785, GHSA-4rv9-5vc4-88cg | Critical | 2.5% | 08 Feb, 2021 | npm node-ps |
Command injection in spritesheet-js CVE-2020-7782, GHSA-333x-qr3v-g4xx | Critical | 2.5% | 08 Feb, 2021 | npm spritesheet-js |
Prototype Pollution in Dynamoose CVE-2021-21304, GHSA-rrqm-p222-8ph2 | Critical | 1.9% | 08 Feb, 2021 | npm dynamoose |
Command injection in gitlog CVE-2021-26541, GHSA-67mm-m3wx-j7fr | Critical | 5.4% | 08 Feb, 2021 | npm gitlog |
Prototype pollution in dotty CVE-2021-25912, GHSA-f5c9-x9j6-87qp | Critical | 3.5% | 02 Feb, 2021 | npm dotty |