Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
pandora-doomsday is malware CVE-2017-16127, GHSA-428f-mh7w-6w2x | Critical | 1.4% | 07 Jun, 2018 | npm pandora-doomsday |
Command Injection in dns-sync CVE-2017-16100, GHSA-jcw8-r9xm-32c6 | Critical | 5.1% | 07 Jun, 2018 | npm dns-sync |
Sandbox Breakout in safe-eval CVE-2017-16088, GHSA-ww6v-677g-p656 | Critical | 3.4% | 07 Jun, 2018 | npm safe-eval |
Remote Code Execution in pg CVE-2017-16082, GHSA-wc9v-mj63-m9g5 | Critical | 10.4% | 07 Jun, 2018 | npm pg |
Growl before 1.10.0 vulnerable to Command Injection CVE-2017-16042, GHSA-qh2h-chj9-jffq | Critical | 4.6% | 04 Jun, 2018 | npm growl |
Unsafe eval() in summit allows arbitrary code execution CVE-2017-16020, GHSA-cwcp-6c48-fm7m | Critical | 2.5% | 04 Jun, 2018 | npm summit |
Command Injection in pdf-image CVE-2018-3757, GHSA-5gwh-g79j-vh4q | Critical | 4.6% | 01 Jun, 2018 | npm pdf-image |
Command Injection in pdfinfojs CVE-2018-3746, GHSA-3pxp-6963-46r9 | Critical | 4.9% | 01 Jun, 2018 | npm pdfinfojs |
Forgeable Public/Private Tokens in jwt-simple CVE-2016-10555, GHSA-vgrx-w6rg-8fqf | Critical | 4.8% | 31 May, 2018 | npm jwt-simple |
SQL Injection in sequelize CVE-2016-10554, GHSA-x2jc-pwfj-h9p3 | Critical | 1.9% | 31 May, 2018 | npm sequelize |
Potential SQL Injection in sequelize CVE-2016-10553, GHSA-2v7q-2xqx-f4q5 | Critical | 1.3% | 31 May, 2018 | npm sequelize |
SQL Injection in sequelize CVE-2016-10550, GHSA-98pq-pmw9-4gpm | Critical | 1.9% | 31 May, 2018 | npm sequelize |
Arbitrary Code Injection in reduce-css-calc CVE-2016-10548, GHSA-4662-j96g-mv46 | Critical | 1.2% | 31 May, 2018 | npm reduce-css-calc |
Arbitrary Code Injection in pouchdb CVE-2016-10546, GHSA-cgqv-x5cx-xvqh | Critical | 2.6% | 31 May, 2018 | npm pouchdb |
Potential Command Injection in shell-quote CVE-2016-10541, GHSA-qg8p-v9q4-gh34 | Critical | 2.2% | 31 May, 2018 | npm shell-quote |
Authentication Bypass in console-io CVE-2016-10532, GHSA-q52j-4q2q-hcj6 | Critical | 2.3% | 31 May, 2018 | npm console-io |
Out-of-bounds Read in atob CVE-2018-3745, GHSA-8w4h-3cm3-2pm2 | Critical | 2.1% | 29 May, 2018 | npm atob |
Path Traversal in html-pages CVE-2018-3744, GHSA-fm87-46vv-jqrr | Critical | 2.2% | 29 May, 2018 | npm html-pages |
SQL Injection in waterline-sequel CVE-2016-10551, GHSA-cgpp-wm2h-6hqx | Critical | 1.8% | 29 May, 2018 | npm waterline-sequel |
Authentication Bypass in hapi-auth-jwt2 CVE-2016-10525, GHSA-mg8r-9g6j-hwv9 | Critical | 2.5% | 29 May, 2018 | npm hapi-auth-jwt2 |
SQL Injection in mysql CVE-2015-9244, GHSA-fvq6-55gv-jx9f | Critical | 2.4% | 29 May, 2018 | npm mysql |
Verification Bypass in jsonwebtoken CVE-2015-9235, GHSA-c7hr-j4mj-j2w6 | Critical | 8.5% | 29 May, 2018 | npm jsonwebtoken |
mxGraph vulnerable to XXE attacks CVE-2017-18197, GHSA-wvpv-8524-wg6x | Critical | 2.9% | 24 Feb, 2018 | npm mxgraph |
Etherpad Lite Access Restriction Bypass CVE-2018-6835, GHSA-mvmv-rq2j-97p2 | Critical | 2.3% | 08 Feb, 2018 | npm ep_etherpad-lite |
Arbitrary Code Execution in mathjs CVE-2017-1001003, GHSA-pv8x-p9hq-j328 | Critical | 1.7% | 27 Nov, 2017 | npm mathjs |
Arbitrary Code Execution in mathjs CVE-2017-1001002, GHSA-vx5c-87qx-cv6c | Critical | 2.4% | 27 Nov, 2017 | npm mathjs |
ejs is vulnerable to remote code execution due to weak input validation CVE-2017-1000228, GHSA-3w5v-p54c-f74x | Critical | 6.3% | 17 Nov, 2017 | npm ejs |
PIDUsage Enables OS Command Injection CVE-2017-1000220, GHSA-h2p3-h48h-9jj7 | Critical | 5.1% | 17 Nov, 2017 | npm pidusage |
Command Execution in windows-cpu CVE-2017-1000219, GHSA-63m4-fhf2-cmf7 | Critical | 4.2% | 17 Nov, 2017 | npm windows-cpu |
Potential Command Injection in printer CVE-2014-3741, GHSA-5c8j-xr24-2665 | Critical | 3.8% | 23 Oct, 2017 | npm printer |
keycloak-connect and keycloak-js improperly handle invalid tokens CVE-2017-7474, GHSA-mw35-24gh-f82w | Critical | 2.5% | 12 May, 2017 | npm keycloak-connect npm keycloak-js |
Cross-Site Scripting in swagger-ui CVE-2016-5682, GHSA-p239-93f7-h6xf | Critical | 1.0% | 10 Apr, 2017 | npm swagger-ui |
Code Execution Through IIFE in serialize-to-js CVE-2017-5954, GHSA-mm62-wxc8-cf7m | Critical | 4.5% | 10 Feb, 2017 | npm serialize-to-js |
Code Execution through IIFE in node-serialize CVE-2017-5941, GHSA-q4v7-4rhw-9hqm | Critical | 61.0% | 09 Feb, 2017 | npm node-serialize |
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js CVE-2015-8857, GHSA-34r7-q49f-h37c | Critical | 3.6% | 23 Jan, 2017 | RubyGems uglifier npm uglify-js |
dns-sync command injection vulnerability CVE-2014-9682, GHSA-q5pq-pgrv-fh89 | Critical | 2.8% | 28 Feb, 2015 | npm dns-sync |
Arbitrary JavaScript Execution in bassmaster CVE-2014-7205, GHSA-5j3g-jfq3-7jwx | Critical | 78.6% | 08 Oct, 2014 | npm bassmaster |
API Admin Auth Weakness in tomato CVE-2013-7379, GHSA-9vxc-g2jx-qj3p | Critical | 2.5% | 16 May, 2014 | npm tomato |
Heap Based Buffer Overflow in libyaml CVE-2013-6393, GHSA-m75h-cghq-c8h5 | Critical | 7.4% | 06 Feb, 2014 | npm libyaml |
Deserialization Code Execution in js-yaml CVE-2013-4660, GHSA-xxvw-45rp-3mj2 | Critical | 17.3% | 28 Jun, 2013 | npm js-yaml |