Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Content-Security-Policy header generation in middleware could be compromised by malicious injections CVE-2024-29896, GHSA-w387-5qqw-7g8m | High | 0.6% | 28 Mar, 2024 | npm @kindspells/astro-shield |
domain-suffix RegEx Denial of Service CVE-2024-25354, GHSA-cqfh-c4c5-c2hg | High | 0.6% | 27 Mar, 2024 | npm domain-suffix |
web3-utils Prototype Pollution vulnerability CVE-2024-21505, GHSA-2g4c-8fpm-c46v | High | 0.7% | 25 Mar, 2024 | npm web3-utils |
OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation CVE-2024-29194, GHSA-246p-xmg8-wmcq | High | 0.7% | 24 Mar, 2024 | npm @oneuptime/common-server npm @oneuptime/model |
Path traversal in webpack-dev-middleware CVE-2024-29180, GHSA-wr3j-pwj9-hqq6 | High | 1.2% | 21 Mar, 2024 | npm webpack-dev-middleware |
TurboBoost Commands vulnerable to arbitrary method invocation CVE-2024-28181, GHSA-mp76-7w5v-pr75 | High | 0.8% | 14 Mar, 2024 | RubyGems turbo_boost-commands npm @turbo-boost/commands |
StimulusReflex arbitrary method call CVE-2024-28121, GHSA-f78j-4w3g-4q65 | High | 1.6% | 12 Mar, 2024 | RubyGems stimulus_reflex npm stimulus_reflex |
electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only) CVE-2024-27303, GHSA-r4pf-3v7r-hh55 | High | 0.3% | 04 Mar, 2024 | npm app-builder-lib |
Directus has MySQL accent insensitive email matching CVE-2024-27295, GHSA-qw9g-7549-7wg5 | High | 0.7% | 01 Mar, 2024 | npm directus |
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory CVE-2024-27094, GHSA-9vx6-7xxf-x967 | High | 0.8% | 29 Feb, 2024 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
`@backstage/backend-common` vulnerable to path traversal through symlinks CVE-2024-26150, GHSA-2fc9-xpp8-2g9h | High | 0.8% | 23 Feb, 2024 | npm @backstage/backend-common |
MeshCentral cross-site websocket hijacking (CSWSH) vulnerability CVE-2024-26135, GHSA-cp68-qrhr-g9h8 | High | 0.5% | 20 Feb, 2024 | npm meshcentral |
Cross-site Scripting in electron-pdf CVE-2024-1648, GHSA-3jcv-5f9p-2f2p | High | 0.7% | 20 Feb, 2024 | npm electron-pdf |
GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219` GHSA-w4hv-vmv9-hgcr | High | Not scored | 16 Feb, 2024 | npm @scrypted/core npm @scrypted/server |
React Native Document Picker Directory Traversal vulnerability CVE-2024-25466, GHSA-pmgm-h3cc-m4hj | High | 0.5% | 16 Feb, 2024 | npm react-native-document-picker |
mapshaper Path Traversal vulnerability CVE-2024-1163, GHSA-8m36-62rw-9mxw | High | 0.4% | 13 Feb, 2024 | npm mapshaper |
angular vulnerable to super-linear runtime due to backtracking CVE-2024-21490, GHSA-4w4v-5hc9-xrr2 | High | 1.9% | 10 Feb, 2024 | Maven org.webjars.bower:angular Maven org.webjars.npm:angular npm angular |
Pkg Local Privilege Escalation CVE-2024-24828, GHSA-22r3-9w55-cj54 | High | 0.2% | 09 Feb, 2024 | npm pkg |
Yarn untrusted search path vulnerability CVE-2021-4435, GHSA-mpwj-fcr6-x34c | High | 0.3% | 04 Feb, 2024 | npm yarn |
Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm. CVE-2023-51838, GHSA-v269-rrr6-cx6r | High | 0.5% | 02 Feb, 2024 | npm meshcentral |
react-query-streamed-hydration Cross-site Scripting vulnerability CVE-2024-24558, GHSA-997g-27x8-43rf | High | 0.4% | 30 Jan, 2024 | npm @tanstack/react-query-next-experimental |
@urql/next Cross-site Scripting vulnerability CVE-2024-24556, GHSA-qhjf-hm5j-335w | High | 0.4% | 30 Jan, 2024 | npm @urql/next |
@apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability CVE-2024-23841, GHSA-rv8p-rr2h-fgpg | High | 0.4% | 30 Jan, 2024 | npm @apollo/experimental-nextjs-app-support |
MeshCentral algorithm-downgrade issue CVE-2023-51842, GHSA-wpxw-5xfm-x22v | High | 0.8% | 29 Jan, 2024 | npm meshcentral |
Sending a GET or HEAD request with a body crashes SvelteKit CVE-2024-23641, GHSA-g5m6-hxpp-fc49 | High | 0.8% | 24 Jan, 2024 | npm @sveltejs/adapter-node npm @sveltejs/kit |
SPV Merkle proof malleability allows the maintainer to prove invalid transactions GHSA-wg2x-rv86-mmpx | High | Not scored | 19 Jan, 2024 | npm @keep-network/tbtc-v2 |
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem CVE-2024-23331, GHSA-c24v-8rfc-w8vw | High | 0.8% | 19 Jan, 2024 | npm vite |
Marvin Attack of RSA and RSAOAEP decryption in jsrsasign CVE-2024-21484, GHSA-rh63-9qcf-83gf | High | 1.0% | 19 Jan, 2024 | npm jsrsasign |
EverShop vulnerable to improper authorization in GraphQL endpoints CVE-2023-46942, GHSA-ggpm-9qfx-mhwg | High | 0.7% | 13 Jan, 2024 | npm @evershop/evershop |
@fastify/reply-from JSON Content-Type parsing confusion CVE-2023-51701, GHSA-v2v2-hph8-q5xp | High | 0.5% | 08 Jan, 2024 | npm @fastify/reply-from |
@backstage/backend-app-api leaks GitLab access tokens CVE-2023-6944, GHSA-86rg-pf4c-5grg | High | 0.6% | 04 Jan, 2024 | npm @backstage/backend-app-api |
Miniflare vulnerable to Server-Side Request Forgery (SSRF) CVE-2023-7078, GHSA-fwvg-2739-22v7 | High | 0.6% | 29 Dec, 2023 | npm miniflare |
msgpackr's conversion of property names to strings can trigger infinite recursion CVE-2023-52079, GHSA-7hpj-7hhx-2fgx | High | 0.7% | 28 Dec, 2023 | npm msgpackr |
blinksocks has weak encryption algorithms CVE-2023-50481, GHSA-pqj5-37xf-x5gc | High | 0.3% | 21 Dec, 2023 | npm blinksocks |
Sentry's Astro SDK vulnerable to ReDoS CVE-2023-50249, GHSA-x3v3-8xg8-8v72 | High | 0.8% | 18 Dec, 2023 | npm @sentry/astro |
Unauthenticated Denial of Service in the octokit/webhooks library CVE-2023-50728, GHSA-pwfr-8pq7-x9qv | High | 0.9% | 15 Dec, 2023 | npm @octokit/app npm @octokit/webhooks npm octokit npm probot |
Cube API denial of service attack CVE-2023-50709, GHSA-9759-3276-g2pm | High | 0.7% | 13 Dec, 2023 | npm @cubejs-backend/api-gateway |
Password Change Vulnerability CVE-2023-49804, GHSA-88j4-pcx8-q4q3 | High | 0.3% | 11 Dec, 2023 | npm uptime-kuma |
Overly permissive origin policy CVE-2023-49803, GHSA-qxrj-hx23-xp82 | High | 0.3% | 11 Dec, 2023 | npm @koa/cors |
DOS by abusing `fetchOptions.retry`. CVE-2023-49800, GHSA-q6hx-3m4p-749h | High | 0.8% | 09 Dec, 2023 | npm nuxt-api-party |
SSRF & Credentials Leak CVE-2023-49799, GHSA-3wfp-253j-5jxv | High | 0.8% | 09 Dec, 2023 | npm nuxt-api-party |
OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4 CVE-2023-49798, GHSA-699g-q6qh-q4v8 | High | 0.5% | 09 Dec, 2023 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
Directory Traversal in evershop CVE-2023-46496, GHSA-rwf3-w4jq-f4cm | High | 1.2% | 08 Dec, 2023 | npm @evershop/evershop |
mockjs vulnerable to Prototype Pollution via the Util.extend function CVE-2023-26158, GHSA-mh8j-9jvh-gjf6 | High | 0.8% | 08 Dec, 2023 | npm mockjs |
ASAR Integrity bypass via filetype confusion in electron CVE-2023-44402, GHSA-7m48-wc93-9g85 | High | 0.2% | 01 Dec, 2023 | npm electron |
@adobe/css-tools Improper Input Validation and Inefficient Regular Expression Complexity CVE-2023-48631, GHSA-prr3-c3m5-p7q2 | High | 1.1% | 30 Nov, 2023 | npm @adobe/css-tools |
sequelize-typescript Prototype Pollution vulnerability CVE-2023-6293, GHSA-7pvx-4585-hqww | High | 0.6% | 24 Nov, 2023 | npm sequelize-typescript |
json-web-token library is vulnerable to a JWT algorithm confusion attack CVE-2023-48238, GHSA-4xw9-cx39-r355 | High | 0.3% | 17 Nov, 2023 | npm json-web-token |
sharp vulnerability in libwebp dependency CVE-2023-4863 GHSA-54xq-cgqr-rpm3 | High | Not scored | 16 Nov, 2023 | npm sharp |
chromedriver Command Injection vulnerability CVE-2023-26156, GHSA-hm92-vgmw-qfmx | High | 2.2% | 09 Nov, 2023 | npm chromedriver |