Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Improper neutralization of arguments in freediskspace CVE-2020-7775, GHSA-4gfq-6m28-m5mg | Critical | 1.3% | 02 Feb, 2021 | npm freediskspace |
SQL Injection in thinkjs CVE-2020-21176, GHSA-q5mq-6fjg-4mw8 | Critical | 1.5% | 01 Feb, 2021 | npm thinkjs |
Command injection in launchpad CVE-2021-23330, GHSA-7h8x-wmq2-7mff, SNYK-JS-LAUNCHPAD-1044065 | Critical | 5.3% | 01 Feb, 2021 | npm launchpad |
Malicious npm package: an0n-chat-lib GHSA-7xcv-wvr7-4h6p | Critical | Not scored | 29 Jan, 2021 | npm an0n-chat-lib |
Malicious npm package: discord-fix GHSA-qv2g-99x4-45x6 | Critical | Not scored | 29 Jan, 2021 | npm discord-fix |
Malicious npm package: sonatype GHSA-w8fh-pvq2-x8c4 | Critical | Not scored | 29 Jan, 2021 | npm sonatype |
Risk of code injection CVE-2021-21278, GHSA-pgjj-866w-fc5c | Critical | 1.6% | 26 Jan, 2021 | npm rsshub |
OS Command Injection in async-git CVE-2021-3190, GHSA-6c3f-p5wp-34mh | Critical | 5.4% | 26 Jan, 2021 | npm async-git |
Prototype pollution in JointJS CVE-2020-28480, GHSA-qwp9-52h8-xgg8 | Critical | 1.4% | 19 Jan, 2021 | npm jointjs |
Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader CVE-2020-28472, GHSA-rrc9-gqf8-8rwg | Critical | 2.2% | 19 Jan, 2021 | npm @aws-sdk/shared-ini-file-loader npm aws-sdk |
Command injection in buns CVE-2020-7794, GHSA-487w-pqcm-63hq | Critical | 1.6% | 08 Jan, 2021 | npm buns |
Command injection in ts-process-promises CVE-2020-7784, GHSA-ww4j-c2rq-47q8 | Critical | 1.4% | 08 Jan, 2021 | npm ts-process-promises |
Prototype Pollution in asciitable.js CVE-2020-7771, GHSA-5pxj-mhwj-x5gv, SNYK-JS-ASCIITABLEJS-1039799 | Critical | 2.0% | 04 Jan, 2021 | npm asciitable.js |
Arbitrary code execution in djv CVE-2020-28464, GHSA-4hv7-3q38-97m8 | Critical | 3.0% | 04 Jan, 2021 | npm djv |
Prototype pollution vulnerability in 'libnested' CVE-2020-28283, GHSA-3r9x-mjrm-2725 | Critical | 3.4% | 29 Dec, 2020 | npm libnested |
Prototype pollution in getobject CVE-2020-28282, GHSA-957j-59c2-j692 | Critical | 4.2% | 29 Dec, 2020 | npm getobject |
Prototype pollution in set-object-value CVE-2020-28281, GHSA-4jj4-m52p-8rx3 | Critical | 3.7% | 29 Dec, 2020 | npm set-object-value |
Prototype pollution vulnerability in 'predefine' CVE-2020-28280, GHSA-mx3x-ghqm-r43h | Critical | 3.1% | 29 Dec, 2020 | npm predefine |
flattenizer vulnerable to prototype pollution CVE-2020-28279, GHSA-vq33-26pr-r4h6 | Critical | 3.1% | 29 Dec, 2020 | npm flattenizer |
shvl vulnerable to prototype pollution CVE-2020-28278, GHSA-pqwc-3vhw-qcvq | Critical | 3.1% | 29 Dec, 2020 | npm shvl |
dset vulnerable to prototype pollution CVE-2020-28277, GHSA-q4xc-7cw8-cgfj | Critical | 3.1% | 29 Dec, 2020 | npm dset |
Prototype pollution vulnerability in 'deep-set' CVE-2020-28276, GHSA-wgxm-rg53-h2c6 | Critical | 3.1% | 29 Dec, 2020 | npm deep-set |
Prototype Pollution in multi-ini CVE-2020-28448, GHSA-g78f-549w-c354 | Critical | 1.5% | 22 Dec, 2020 | npm multi-ini |
Command injection in connection-tester CVE-2020-7781, GHSA-w5mp-8p8w-mhh8, SNYK-JS-CONNECTIONTESTER-1048337 | Critical | 2.0% | 16 Dec, 2020 | npm connection-tester |
Prototype Pollution in js-data CVE-2020-28442, GHSA-mqgv-67vx-g4m5 | Critical | 2.0% | 15 Dec, 2020 | npm js-data |
Command Injection in corenlp-js-interface CVE-2020-28440, GHSA-ffxg-xm4w-3wg9 | Critical | 2.0% | 11 Dec, 2020 | npm corenlp-js-interface |
Command injection in corenlp-js-prefab CVE-2020-28439, GHSA-h73g-8g27-xxcx | Critical | 1.6% | 11 Dec, 2020 | npm corenlp-js-prefab |
ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse CVE-2020-7788, GHSA-qqgx-2p2h-9c37, SNYK-JS-INI-1048974 | Critical | 3.7% | 10 Dec, 2020 | npm ini |
Prototype pollution vulnerability in 'deepref' CVE-2020-28274, GHSA-7c7g-72q7-4xhm | Critical | 2.3% | 08 Dec, 2020 | npm deepref |
Prototype pollution in set-in CVE-2020-28273, GHSA-qr4p-c9wr-phr6 | Critical | 4.0% | 02 Dec, 2020 | npm set-in |
keyget vulnerable to prototype pollution CVE-2020-28272, GHSA-8mp8-28xh-r486 | Critical | 3.4% | 02 Dec, 2020 | npm keyget |
Prototype Pollution in systeminformation CVE-2020-26245, GHSA-4v2w-h9jm-mqjg | Critical | 2.2% | 27 Nov, 2020 | npm systeminformation |
Server-Side Request Forgery in private-ip CVE-2020-28360, GHSA-43ch-2h55-2vj7 | Critical | 3.1% | 23 Nov, 2020 | npm private-ip |
Prototype Pollution in y18n CVE-2020-7774, GHSA-c4w7-xm78-47vh | Critical | 69.6% | 17 Nov, 2020 | npm y18n |
Prototype Pollution in doc-path CVE-2020-7772, GHSA-gm8g-xhh8-rmwr, SNYK-JS-DOCPATH-1011952 | Critical | 2.8% | 15 Nov, 2020 | npm doc-path |
Prototype Pollution in deephas CVE-2020-28271, GHSA-4fr2-j4g9-mppf | Critical | 3.4% | 12 Nov, 2020 | npm deephas |
Prototype pollution in object-hierarchy-access CVE-2020-28270, GHSA-fxwf-45c7-4ppr | Critical | 3.8% | 12 Nov, 2020 | npm object-hierarchy-access |
Prototype Pollution in field CVE-2020-28269, GHSA-hm82-qr45-h7mw | Critical | 4.2% | 12 Nov, 2020 | npm field |
Prototype pollution in json8 CVE-2020-7770, GHSA-7h43-gx24-p529, SNYK-JS-JSON8-1017116 | Critical | 1.9% | 12 Nov, 2020 | npm json8 |
Command injection in nodemailer CVE-2020-7769, GHSA-48ww-j4fc-435p | Critical | 2.3% | 12 Nov, 2020 | npm nodemailer |
Prototype pollution in grpc and @grpc/grpc-js CVE-2020-7768, GHSA-pp75-xfpw-37g9 | Critical | 4.0% | 11 Nov, 2020 | npm @grpc/grpc-js npm grpc |
Arbitrary Code Execution in json-ptr CVE-2020-7766, GHSA-x5r6-x823-9848 | Critical | 1.9% | 10 Nov, 2020 | npm json-ptr |
Prototype pollution in chart.js CVE-2020-7746, GHSA-h68q-55jf-x68w | Critical | 4.7% | 29 Oct, 2020 | npm chart.js |
Command Injection in systeminformation CVE-2020-26300, GHSA-fj59-f6c3-3vw4 | Critical | 1.4% | 27 Oct, 2020 | npm systeminformation |
Authorization bypass in Strapi CVE-2020-27664, GHSA-7frv-9phw-vrvr | Critical | 2.3% | 22 Oct, 2020 | npm strapi |
Cross-Site Scripting in scratch-svg-renderer CVE-2020-7750, GHSA-j977-g5vj-j27g, SNYK-JS-SCRATCHSVGRENDERER-1020497 | Critical | 6.1% | 21 Oct, 2020 | npm scratch-svg-renderer |
Prototype pollution in object-path CVE-2020-15256, GHSA-cwx2-736x-mf6w | Critical | 1.5% | 19 Oct, 2020 | npm object-path |
Always-Incorrect Control Flow Implementation in Facebook Hermes CVE-2020-1914, GHSA-327c-qx3v-h673 | Critical | 2.5% | 08 Oct, 2020 | npm hermes-engine |
XSS in hello.js CVE-2020-7741, GHSA-7jh9-6cpf-h4m7, SNYK-JS-HELLOJS-1014546 | Critical | 1.5% | 06 Oct, 2020 | npm hellojs |
Prototype Pollution in safetydance CVE-2020-7737, GHSA-6m85-wvcr-pgw3 | Critical | 1.4% | 02 Oct, 2020 | npm safetydance |