Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Directus Allows Single Sign-On User Enumeration CVE-2024-39896, GHSA-jgf4-vwc3-r46v | High | 0.5% | 08 Jul, 2024 | npm directus |
Directus GraphQL Field Duplication Denial of Service (DoS) CVE-2024-39895, GHSA-7hmh-pfrp-vcx4 | High | 0.8% | 08 Jul, 2024 | npm @directus/env |
Directus incorrectly handles `_in` filter CVE-2024-39701, GHSA-hxgm-ghmv-xjjm | High | 0.4% | 08 Jul, 2024 | npm directus |
Server Side Request Forgery (SSRF) attack in Fedify CVE-2024-39687, GHSA-p9cg-vqcc-grcx | High | 0.6% | 05 Jul, 2024 | npm @fedify/fedify |
rejetto HFS vulnerable to OS Command Execution by remote authenticated users CVE-2024-39943, GHSA-5f4x-hwv2-w9w2 | High | 39.5% | 04 Jul, 2024 | npm hfs |
Flowise Cors Misconfiguration in packages/server/src/index.ts CVE-2024-36421, GHSA-66f2-xxgm-f6xp | High | 8.5% | 01 Jul, 2024 | npm flowise |
Flowise Path Injection at /api/v1/openai-assistants-file CVE-2024-36420, GHSA-h997-3fxj-p5j8 | High | 1.8% | 01 Jul, 2024 | npm flowise |
@amoy/common v was discovered to contain a prototype pollution via the function extend CVE-2024-38994, GHSA-w58v-r3cp-qr93 | High | 0.5% | 01 Jul, 2024 | npm @amoy/common |
frappejs was discovered to contain a prototype pollution via the function registerView CVE-2024-38992, GHSA-gc7m-596h-x57r | High | 0.8% | 01 Jul, 2024 | npm @airvertco/frappejs |
akbr patch-into was discovered to contain a prototype pollution via the function patchInto CVE-2024-38991, GHSA-gh4x-qv3p-m9pm | High | 0.8% | 01 Jul, 2024 | npm @akbr/patch-into |
Strapi Server-Side Request Forgery (SSRF) CVE-2024-37818, GHSA-p9ff-j98v-p435 | High | 0.6% | 20 Jun, 2024 | npm @strapi/strapi |
socket.io has an unhandled 'error' event CVE-2024-38355, GHSA-25hc-qcg6-38wj | High | 0.8% | 19 Jun, 2024 | npm socket.io |
ws affected by a DoS when handling a request with many HTTP headers CVE-2024-37890, GHSA-3h5v-q93c-6h6q | High | 1.4% | 17 Jun, 2024 | npm ws |
Object Resolver Prototype Pollution CVE-2024-36577, GHSA-qj86-v6m7-4qv2 | High | 0.4% | 17 Jun, 2024 | npm @apphp/object-resolver |
Badger Database Prototype Pollution CVE-2024-36581, GHSA-69r2-2fg7-7hf9 | High | 0.5% | 17 Jun, 2024 | npm @abw/badger-database |
@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass CVE-2024-34065, GHSA-wrvh-rcmr-9qfc | High | 0.7% | 12 Jun, 2024 | npm @strapi/plugin-users-permissions |
ghtml Cross-Site Scripting (XSS) vulnerability CVE-2024-37166, GHSA-vvhj-v88f-5gxr | High | 0.4% | 10 Jun, 2024 | npm ghtml |
lunary-ai/lunary Access Control Vulnerability in Prompt Variation Management CVE-2024-5389, GHSA-3mwc-2cj7-gx8c | High | 0.4% | 09 Jun, 2024 | npm lunary |
Withdrawn Advisory: lunary-ai/lunary XSS in SAML metadata endpoint CVE-2024-5478, GHSA-rpx8-fg6w-rm6x | High | 0.3% | 06 Jun, 2024 | npm lunary |
Jan path traversal vulnerability CVE-2024-36857, GHSA-5jqc-qj57-4hrc | High | 2.1% | 04 Jun, 2024 | npm @janhq/core |
Directus is soft-locked by providing a string value to random string util CVE-2024-36128, GHSA-632p-p495-25m5 | High | 0.6% | 03 Jun, 2024 | npm directus |
javascript-deobfuscator crafted payload can lead to code execution CVE-2024-36120, GHSA-9p6p-8v9r-8c9m | High | 0.3% | 31 May, 2024 | npm js-deobfuscator |
mysql2 vulnerable to Prototype Pollution CVE-2024-21512, GHSA-pmh2-wpjm-fj45 | High | 3.1% | 29 May, 2024 | npm mysql2 |
ip SSRF improper categorization in isPublic CVE-2024-29415, GHSA-2p57-rm9w-gvfp | High | 8.3% | 27 May, 2024 | npm ip |
Ghost allows CSV Injection during member CSV export BIT-ghost-2024-34448, CVE-2024-34448, GHSA-xgwh-cgv9-783v | High | 0.7% | 22 May, 2024 | npm @tryghost/members-csv |
@fastify/session reuses destroyed session cookie CVE-2024-35220, GHSA-pj27-2xvp-4qxg | High | 0.4% | 21 May, 2024 | npm @fastify/session |
json-schema-ref-parser Prototype Pollution issue CVE-2024-29651, GHSA-5f97-h2c2-826q | High | 0.8% | 20 May, 2024 | npm @apidevtools/json-schema-ref-parser |
MiguelCastillo @bit/loader Prototype Pollution issue CVE-2024-24293, GHSA-8vr4-h4rr-8ph6 | High | 0.7% | 20 May, 2024 | npm @bit/loader |
njwt Prototype Pollution vulnerability CVE-2024-34273, GHSA-3hvj-2783-34x2 | High | 0.5% | 16 May, 2024 | npm njwt |
Uncontrolled resource consumption in braces CVE-2024-4068, GHSA-grv7-fg5c-xmjg | High | 1.5% | 14 May, 2024 | npm braces |
NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue CVE-2023-49781, GHSA-h6r4-xvw6-jc5h | High | 0.6% | 13 May, 2024 | npm nocodb |
Next.js Server-Side Request Forgery in Server Actions CVE-2024-34351, GHSA-fr5h-rqp8-mj6g | High | 5.5% | 09 May, 2024 | npm next |
Next.js Vulnerable to HTTP Request Smuggling CVE-2024-34350, GHSA-77r5-gw3j-2mpf | High | 1.2% | 09 May, 2024 | npm next |
@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability CVE-2024-34345, GHSA-38gf-rh2w-gmj7 | High | 0.9% | 08 May, 2024 | npm @cyclonedx/cyclonedx-library |
react-pdf vulnerable to arbitrary JavaScript execution upon opening a malicious PDF with PDF.js CVE-2024-34342, GHSA-87hq-q4gp-9wr4 | High | 1.1% | 07 May, 2024 | npm react-pdf |
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF CVE-2024-4367, GHSA-wgrm-67xf-hhpq | High | 70.7% | 07 May, 2024 | npm pdfjs-dist |
s3-url-parser vulnerable to Denial of Service via regexes component CVE-2024-25355, GHSA-r4q9-xx5g-j24p | High | 0.6% | 01 May, 2024 | npm s3-url-parser |
Flowise vulnerable to code injection via api/v1 CVE-2024-31621, GHSA-6wp6-22x5-rr3w | High | 59.9% | 29 Apr, 2024 | npm flowise |
Conform contains a Prototype Pollution Vulnerability in `parseWith...` function CVE-2024-32866, GHSA-624g-8qjg-8qxf | High | 0.7% | 23 Apr, 2024 | npm @conform-to/dom npm @conform-to/yup npm @conform-to/zod |
Renovate vulnerable to arbitrary command injection via helmv3 manager and registryAliases CVE-2024-58376, GHSA-rqgv-292v-5qgr | High | 0.7% | 23 Apr, 2024 | npm renovate |
@hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE CVE-2024-34347, GHSA-qmmm-73r2-f8xr | High | 0.6% | 22 Apr, 2024 | npm @hoppscotch/cli |
@hono/node-server has Denial of Service risk when receiving Host header that cannot be parsed CVE-2024-32652, GHSA-hgxw-5xg3-69jx | High | 0.9% | 19 Apr, 2024 | npm @hono/node-server |
Handling untrusted input can result in a crash, leading to loss of availability / denial of service CVE-2024-30253, GHSA-8m45-2rjm-j347 | High | 0.6% | 17 Apr, 2024 | npm @solana/web3.js |
Summernote vulnerable to cross-site scripting CVE-2024-29504, GHSA-4wh3-3wf2-39m9 | High | 0.7% | 10 Apr, 2024 | npm summernote |
@fastify/secure-session: Reuse of destroyed secure session cookie CVE-2024-31999, GHSA-9wwp-q7wq-jx35 | High | 0.6% | 10 Apr, 2024 | npm @fastify/secure-session |
SheetJS Regular Expression Denial of Service (ReDoS) CVE-2024-22363, GHSA-5pgg-2g8v-p4x9 | High | 0.8% | 05 Apr, 2024 | npm xlsx |
dectalk-tts Uses Unencrypted HTTP Request CVE-2024-31206, GHSA-6cf6-8hvr-r68w | High | 0.3% | 04 Apr, 2024 | npm dectalk-tts |
In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists CVE-2024-30250, GHSA-c4gr-q97g-ppwc | High | 0.3% | 01 Apr, 2024 | npm @kindspells/astro-shield |
@workos-inc/authkit-nextjs session replay vulnerability CVE-2024-29901, GHSA-35w3-6qhc-474v | High | 0.7% | 29 Mar, 2024 | npm @workos-inc/authkit-nextjs |
@electron/packager's build process memory potentially leaked into final executable CVE-2024-29900, GHSA-34h3-8mw4-qw57 | High | 0.6% | 29 Mar, 2024 | npm @electron/packager |