Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Unauthorized Access to Private Fields in User Registration API CVE-2023-39345, GHSA-gc7p-j5xm-xxh2 | High | 0.6% | 03 Nov, 2023 | npm @strapi/plugin-users-permissions npm @strapi/strapi |
generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character CVE-2015-20110, GHSA-4gpm-r23h-gprw | High | 0.7% | 31 Oct, 2023 | npm generator-jhipster |
browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack CVE-2023-46234, GHSA-x9w5-v3q2-3rhw | High | 0.6% | 26 Oct, 2023 | npm browserify-sign |
Inefficient Regular Expression Complexity in node-email-check CVE-2023-39619, GHSA-9242-6p36-6256 | High | 1.3% | 25 Oct, 2023 | npm node-email-check |
Parse Server may crash when uploading file without extension BIT-parse-2023-46119, CVE-2023-46119, GHSA-792q-q67h-w579 | High | 1.3% | 24 Oct, 2023 | npm parse-server |
Next.js missing cache-control header may lead to CDN caching empty reply CVE-2023-46298, GHSA-c59h-r6p8-q9wc | High | 1.6% | 22 Oct, 2023 | npm next |
Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables CVE-2023-46115, GHSA-2rcp-jvr4-r259 | High | 0.2% | 20 Oct, 2023 | crates.io tauri-cli npm @tauri-apps/cli |
Directus crashes on invalid WebSocket message CVE-2023-45820, GHSA-hmgw-9jrg-hf2m | High | 0.8% | 19 Oct, 2023 | npm directus |
Synchrony deobfuscator prototype pollution vulnerability leading to arbitrary code execution CVE-2023-45811, GHSA-jg82-xh3w-rhxx | High | 0.4% | 17 Oct, 2023 | npm deobfuscator |
Improper Input Validation in vriteio/vrite CVE-2023-5571, GHSA-44ff-9w4f-99w6 | High | 0.8% | 13 Oct, 2023 | npm @vrite/sdk |
Uptime Kuma has Persistentent User Sessions CVE-2023-44400, GHSA-g9v2-wqcj-j99g | High | 0.3% | 09 Oct, 2023 | npm uptime-kuma |
Prototype Pollution in NASA Open MCT CVE-2023-45282, GHSA-4xcx-cwrq-w792 | High | 1.2% | 06 Oct, 2023 | npm openmct |
Zod denial of service vulnerability during email validation GHSA-mvrp-3cvx-c325 | High | Not scored | 04 Oct, 2023 | npm express-zod-api |
static-server Path Traversal vulnerability CVE-2023-26152, GHSA-v834-rhv4-65m3 | High | 1.4% | 03 Oct, 2023 | npm static-server |
Zod denial of service vulnerability CVE-2023-4316, GHSA-m95q-7qp3-xv42 | High | 0.9% | 28 Sep, 2023 | npm zod |
Electron affected by libvpx's heap buffer overflow in vp8 encoding CVE-2023-5217, GHSA-qqvq-6xgj-jw8g | HighExploited | 49.0% | 28 Sep, 2023 | npm electron |
@napi-rs/image affected by libwebp CVE GHSA-4vjr-crvh-383h | High | Not scored | 27 Sep, 2023 | npm @napi-rs/image |
Chaijs/get-func-name vulnerable to ReDoS CVE-2023-43646, GHSA-4q6p-r6v2-jvc5 | High | 1.4% | 27 Sep, 2023 | npm get-func-name |
FUXA local file inclusion vulnerability CVE-2023-31718, GHSA-wwfj-h843-3hrq | High | 1.7% | 22 Sep, 2023 | npm fuxa-server |
FUXA SQL Injection vulnerability CVE-2023-31717, GHSA-v9q5-9crp-92f9 | High | 1.8% | 22 Sep, 2023 | npm fuxa-server |
FUXA vulnerable to Local File Inclusion CVE-2023-31716, GHSA-45c3-c4c3-8rqg | High | 1.4% | 22 Sep, 2023 | npm @frangoteam/fuxa |
Directus affected by VM2 sandbox escape vulnerability GHSA-22rr-f3p8-5gf8 | High | Not scored | 15 Sep, 2023 | npm directus |
libwebp: OOB write in BuildHuffmanTable A-299477569, ASB-A-299477569, CVE-2023-4863, CVE-2023-5129, GHSA-j7hp-h8jx-5ppr, PYSEC-2026-1794, RUSTSEC-2023-0060, RUSTSEC-2023-0061 | HighExploited | 100.0% | 12 Sep, 2023 | Go github.com/chai2010/webp NuGet SkiaSharp NuGet magick.net-q16-anycpu NuGet magick.net-q16-hdri-anycpu +10 more |
Hexo `include_code` has a path traversal CVE-2023-39584, GHSA-x2jc-989c-47q4 | High | 34.5% | 08 Sep, 2023 | npm hexo |
Electron context isolation bypass via nested unserializable return value CVE-2023-29198, GHSA-p7v2-p9m8-qqg7 | High | 0.6% | 06 Sep, 2023 | npm electron |
Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer BIT-parse-2023-41058, CVE-2023-41058, GHSA-fcv6-fg5r-jm9q | High | 0.8% | 04 Sep, 2023 | npm parse-server |
Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client CVE-2023-41049, GHSA-vp4f-wxgw-7x8x | High | 0.5% | 01 Sep, 2023 | npm @dcl/single-sign-on-client |
MathJax Regular expression Denial of Service (ReDoS) CVE-2023-39663, GHSA-v638-q856-grg8 | High | 0.8% | 29 Aug, 2023 | npm mathjax |
MongoDB Driver may publish events containing authentication-related data CVE-2021-32050, GHSA-vxvm-qww3-2fh7 | High | 0.6% | 29 Aug, 2023 | Packagist mongodb/mongodb SwiftURL github.com/mongodb/mongo-swift-driver npm mongodb |
webui-aria2 Path Traversal vulnerability CVE-2023-39141, GHSA-crv8-r5wq-gv2w | High | 3.4% | 22 Aug, 2023 | npm webui-aria2 |
Shescape on Windows escaping may be bypassed in threaded context CVE-2023-40185, GHSA-j55r-787p-m549 | High | 0.7% | 22 Aug, 2023 | npm shescape |
Unsanitized user controlled input in module generation GHSA-f8pq-3926-8gx5 | High | Not scored | 09 Aug, 2023 | npm @opentelemetry/instrumentation |
Angular critical CSS inlining Cross-site Scripting Vulnerability Advisory GHSA-r3hf-q8q7-fv2p | High | Not scored | 09 Aug, 2023 | npm @nguniversal/common |
underscore-keypath vulnerable to Prototype Pollution CVE-2023-26139, GHSA-gpvc-mx6g-cchv | High | 0.9% | 01 Aug, 2023 | npm underscore-keypath |
Unsafe plugins can be installed via pack import by tenant admins GHSA-wxf3-4fvj-vqqx | High | Not scored | 27 Jul, 2023 | npm @saltcorn/cli |
DoS vulnerability for apps with sockets enabled CVE-2023-38504, GHSA-gpw9-fwm8-7rx7 | High | 0.9% | 27 Jul, 2023 | npm sails |
Leaking sensitive user information still possible by filtering on private with prefix fields CVE-2023-34235, GHSA-9xg4-3qfm-9w8f | High | 1.1% | 25 Jul, 2023 | npm @strapi/database npm @strapi/utils |
Making all attributes on a content-type public without noticing it CVE-2023-34093, GHSA-chmr-rg2f-9jmf | High | 0.7% | 25 Jul, 2023 | npm @strapi/database npm @strapi/strapi npm @strapi/utils |
Feathers socket handler allows abusing implicit toString CVE-2023-37899, GHSA-hhr9-rh25-hvf9 | High | 1.2% | 19 Jul, 2023 | npm @feathersjs/socketio npm @feathersjs/transport-commons |
webmention.js Cross-site Scripting vulnerability CVE-2023-3672, GHSA-r54g-4qq6-chxg | High | 0.5% | 14 Jul, 2023 | npm webmention.js |
Uptime Kuma's authenticated path traversal via plugin repository name may lead to unavailability or data loss CVE-2023-36822, GHSA-vr8x-74pm-6vj7 | High | 1.2% | 05 Jul, 2023 | npm uptime-kuma |
Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation CVE-2023-36821, GHSA-7grx-f945-mj96 | High | 2.0% | 05 Jul, 2023 | npm uptime-kuma |
@fastify/oauth2 vulnerable to Cross Site Request Forgery due to reused Oauth2 state CVE-2023-31999, GHSA-g8x5-p9qc-cf95 | High | 0.7% | 04 Jul, 2023 | npm @fastify/oauth2 |
llhttp vulnerable to HTTP request smuggling BIT-node-2023-30589, BIT-node-min-2023-30589, CVE-2023-30589, GHSA-cggh-pq45-6h9x | High | 3.9% | 01 Jul, 2023 | npm llhttp |
word-wrap vulnerable to Regular Expression Denial of Service CVE-2023-26115, GHSA-j8xg-fqg3-53r7 | High | 1.7% | 22 Jun, 2023 | npm word-wrap |
passport-wsfed-saml2 Signature Bypass vulnerability GHSA-5wrg-8fxp-cx9r | High | Not scored | 21 Jun, 2023 | npm passport-wsfed-saml2 |
semver vulnerable to Regular Expression Denial of Service CVE-2022-25883, GHSA-c2qf-rxjj-qqgw | High | 2.8% | 21 Jun, 2023 | npm semver |
AWS CDK EKS overly permissive trust policies CVE-2023-35165, GHSA-rx28-r23p-2qc3 | High | 0.9% | 19 Jun, 2023 | npm @aws-cdk/aws-eks npm aws-cdk-lib |
dottie vulnerable to Prototype Pollution CVE-2023-26132, GHSA-4gxf-g5gf-22h4 | High | 1.1% | 10 Jun, 2023 | npm dottie |
@udecode/plate-link does not sanitize URLs to prevent use of the `javascript:` scheme CVE-2023-34245, GHSA-4882-hxpr-hrvm | High | 0.4% | 09 Jun, 2023 | npm @udecode/plate-link |