Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious Package in another-date-picker GHSA-2p62-c4rm-mr72 | Critical | Not scored | 01 Sep, 2020 | npm another-date-picker |
Malicious Package in angular-material-sidenav-rnd GHSA-qmxf-fxq7-w59f | Critical | Not scored | 01 Sep, 2020 | npm angular-material-sidenav-rnd |
Malicious Package in angular-bmap GHSA-w8hg-mxvh-9h57 | Critical | Not scored | 01 Sep, 2020 | npm angular-bmap |
Malicious Package in @impala/bmap GHSA-c82c-8pjw-6829 | Critical | Not scored | 01 Sep, 2020 | npm @impala/bmap |
Command Injection in pidusage CVE-2017-16034, GHSA-hfq9-rfpv-j8r8 | Critical | Not scored | 01 Sep, 2020 | npm pidusage |
Cross-Site Scripting in swagger-ui GHSA-g336-c7wv-8hp3 | Critical | Not scored | 01 Sep, 2020 | npm swagger-ui |
Cross-Site Scripting in swagger-ui CVE-2016-1000226, GHSA-7f59-x49p-v8mq | Critical | Not scored | 01 Sep, 2020 | npm swagger-ui |
SQL Injection via GeoJSON in sequelize CVE-2016-1000225, GHSA-5v9h-q3gj-c32x | Critical | Not scored | 01 Sep, 2020 | npm sequelize |
Command Injection in gm CVE-2015-7982, GHSA-pjh3-jv7w-9jpr | Critical | Not scored | 01 Sep, 2020 | npm gm |
Prototype Pollution in gedi CVE-2020-7727, GHSA-jh2m-j8pp-55rc | Critical | 1.9% | 01 Sep, 2020 | npm gedi |
Prototype Pollution in safe-object2 CVE-2020-7726, GHSA-jpq3-xf27-5jf2 | Critical | 1.9% | 01 Sep, 2020 | npm safe-object2 |
Prototype Pollution in worksmith CVE-2020-7725, GHSA-9829-jj5p-j6hf | Critical | 1.9% | 01 Sep, 2020 | npm worksmith |
Prototype Pollution in tiny-conf CVE-2020-7724, GHSA-4q97-fh3f-j294 | Critical | 1.9% | 01 Sep, 2020 | npm tiny-conf |
Prototype Pollution in promisehelpers CVE-2020-7723, GHSA-rj5f-7c8x-gjg4 | Critical | 1.9% | 01 Sep, 2020 | npm promisehelpers |
Prototype Pollution in nodee-utils CVE-2020-7722, GHSA-p6jh-p7q8-pcrg | Critical | 1.9% | 01 Sep, 2020 | npm nodee-utils |
Prototype Pollution in node-oojs CVE-2020-7721, GHSA-j4rw-x3vg-c8r7 | Critical | 1.9% | 01 Sep, 2020 | npm node-oojs |
Prototype Pollution in locutus CVE-2020-7719, GHSA-f98m-q3hr-p5wq, SNYK-JS-LOCUTUS-598675 | Critical | 2.8% | 01 Sep, 2020 | npm locutus |
Prototype Pollution in gammautils CVE-2020-7718, GHSA-pgmg-gf5p-54j8 | Critical | 1.9% | 01 Sep, 2020 | npm gammautils |
Prototype Pollution in dot-notes CVE-2020-7717, GHSA-qr4m-jcvc-3382 | Critical | 1.9% | 01 Sep, 2020 | npm dot-notes |
Prototype Pollution in deeps CVE-2020-7716, GHSA-rgfv-v3jh-7ffp | Critical | 1.9% | 01 Sep, 2020 | npm deeps |
Prototype Pollution in deep-get-set CVE-2020-7715, GHSA-85cp-p426-42f5 | Critical | 2.0% | 01 Sep, 2020 | npm deep-get-set |
Prototype Pollution in confucious CVE-2020-7714, GHSA-fmrr-mx6j-h3h5 | Critical | 1.9% | 01 Sep, 2020 | npm confucious |
Prototype Pollution in arr-flatten-unflatten CVE-2020-7713, GHSA-w8f3-pvx4-4c3h | Critical | 1.9% | 01 Sep, 2020 | npm arr-flatten-unflatten |
Command Injection in ungit CVE-2015-4130, GHSA-vjfr-p6hp-jqqw | Critical | Not scored | 31 Aug, 2020 | npm ungit |
Server secret was included in static assets and served to clients GHSA-r587-7jh2-4qr3 | Critical | Not scored | 26 Aug, 2020 | npm flood |
Expo on iOS is insecure due incorrect security attribute application CVE-2020-24653, GHSA-rwx9-wqj8-vr77 | Critical | 1.2% | 26 Aug, 2020 | npm expo |
Sandbox Breakout / Arbitrary Code Execution in safe-eval CVE-2020-7710, GHSA-hrpq-r399-whgw | Critical | 1.4% | 21 Aug, 2020 | npm safe-eval |
Prototype Pollution in irrelon-path and @irrelon/path CVE-2020-7708, GHSA-j7cg-h9v9-6vqp | Critical | 2.8% | 18 Aug, 2020 | npm @irrelon/path npm irrelon-path |
Prototype Pollution in property-expr CVE-2020-7707, GHSA-6fw4-hr69-g3rv | Critical | 3.4% | 18 Aug, 2020 | npm property-expr |
Prototype Pollution in connie-lang CVE-2020-7706, GHSA-8vv3-jxm8-f4vf, SNYK-JS-CONNIELANG-598853 | Critical | 2.8% | 18 Aug, 2020 | npm connie-lang |
Server-Side Request Forgery in ftp-srv CVE-2020-15152, GHSA-jw37-5gqr-cf9j | Critical | 1.9% | 17 Aug, 2020 | npm ftp-srv |
linux-cmdline is vulnerable to Prototype Pollution via the constructor CVE-2020-7704, GHSA-2c29-wc65-4cx9, SNYK-JS-LINUXCMDLINE-598674 | Critical | 2.7% | 17 Aug, 2020 | npm linux-cmdline |
Prototype Pollution in nis-utils CVE-2020-7703, GHSA-gr58-j5wh-m333 | Critical | 1.9% | 17 Aug, 2020 | npm nis-utils |
Prototype Pollution in templ8 CVE-2020-7702, GHSA-c7m7-4257-h698 | Critical | 1.9% | 17 Aug, 2020 | npm templ8 |
Prototype Pollution in madlib-object-utils CVE-2020-7701, GHSA-jvf5-q4h5-2jmj, SNYK-JS-MADLIBOBJECTUTILS-598676 | Critical | 2.0% | 14 Aug, 2020 | npm madlib-object-utils |
Prototype Pollution in phpjs CVE-2020-7700, GHSA-m428-jqc4-2p5j | Critical | 1.9% | 14 Aug, 2020 | npm phpjs |
Validation bypass in jpv CVE-2020-17479, GHSA-vh6r-g38f-q3w8 | Critical | 2.5% | 10 Aug, 2020 | npm jpv |
False-positive validity for NFT1 genesis transactions CVE-2020-15131, GHSA-6jmr-jfh7-xg3h | Critical | 1.0% | 30 Jul, 2020 | npm slp-validate |
False-positive validity for NFT1 genesis transactions in SLPJS CVE-2020-15130, GHSA-cc2p-4jhr-xhhx | Critical | 1.0% | 30 Jul, 2020 | npm slpjs |
Prototype Pollution in express-fileupload CVE-2020-7699, GHSA-9wcg-jrwf-8gg7, SNYK-JS-EXPRESSFILEUPLOAD-595969 | Critical | 4.8% | 30 Jul, 2020 | npm express-fileupload |
Code injection in mock2easy CVE-2020-7697, GHSA-g4xj-wcq6-qwx5 | Critical | 2.0% | 29 Jul, 2020 | npm mock2easy |
Command injection in codecov (npm package) CVE-2020-15123, GHSA-xp63-6vf5-xf3v | Critical | 3.8% | 20 Jul, 2020 | npm codecov |
Path traversal in rollup-plugin-serve CVE-2020-7684, GHSA-4j46-mp85-mv8c | Critical | 1.5% | 17 Jul, 2020 | npm rollup-plugin-serve |
Remote Code Execution in scratch-vm CVE-2020-14000, GHSA-vc9j-fhvv-8vrf | Critical | 2.8% | 16 Jul, 2020 | npm scratch-vm |
Command Injection in jison CVE-2020-8178, GHSA-vr9x-mm65-2438 | Critical | 3.6% | 15 Jul, 2020 | npm jison |
Injection and Command Injection in devcert CVE-2020-8186, GHSA-4228-7qvx-f4rq | Critical | 2.8% | 10 Jul, 2020 | npm devcert |
Context isolation bypass via contextBridge in Electron CVE-2020-4077, GHSA-h9jc-284h-533g | Critical | 1.0% | 07 Jul, 2020 | npm electron |
Context isolation bypass via leaked cross-context objects in Electron CVE-2020-4076, GHSA-m93v-9qjc-3g79 | Critical | 0.4% | 07 Jul, 2020 | npm electron |
OS Command Injection in Locutus CVE-2020-13619, GHSA-h86x-mv66-gr5q | Critical | 2.9% | 01 Jul, 2020 | npm locutus |
Authorization bypass in express-jwt CVE-2020-15084, GHSA-6g6m-m6h5-w9gf | Critical | 1.2% | 30 Jun, 2020 | npm express-jwt |