Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
@udecode/plate-link does not sanitize URLs to prevent use of the `javascript:` scheme CVE-2023-34245, GHSA-4882-hxpr-hrvm | High | 0.4% | 09 Jun, 2023 | npm @udecode/plate-link |
Snowflake NodeJS Driver vulnerable to Command Injection CVE-2023-34232, GHSA-h53w-7qw7-vh5c | High | 1.9% | 08 Jun, 2023 | npm snowflake-sdk |
fast-xml-parser vulnerable to Regex Injection via Doctype Entities CVE-2023-34104, GHSA-6w63-h3fj-q4vw | High | 1.1% | 06 Jun, 2023 | npm fast-xml-parser |
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) CVE-2023-34092, GHSA-353f-5xf4-qw67 | High | 3.2% | 01 Jun, 2023 | npm vite |
proxy denial of service vulnerability CVE-2023-2968, GHSA-mj6p-3pc9-wf5m | High | 1.5% | 30 May, 2023 | npm proxy |
bwm-ng vulnerable to command injection CVE-2023-26129, GHSA-8vw3-vxmj-h43w | High | 1.0% | 27 May, 2023 | npm bwm-ng |
keep-module-latest vulnerable to Command Injection due to missing input sanitization CVE-2023-26128, GHSA-wxrx-pc44-rcgc | High | 1.2% | 27 May, 2023 | npm keep-module-latest |
n158 vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function CVE-2023-26127, GHSA-549h-r7g9-2qpf | High | 0.9% | 27 May, 2023 | npm n158 |
Insufficient validation when decoding a Socket.IO packet CVE-2023-32695, GHSA-cqmj-92xf-r6r9 | High | 1.1% | 23 May, 2023 | npm socket.io-parser |
Invalid push request payload crashes Parse Server CVE-2023-32688, GHSA-mxhg-rvwx-x993 | High | 0.9% | 22 May, 2023 | npm parse-server-push-adapter |
Double spend in snarkjs CVE-2023-33252, GHSA-xp5g-jhg3-3rg2 | High | 0.6% | 21 May, 2023 | npm snarkjs |
Buffer under-read in workerd CVE-2023-2512, GHSA-8vx6-69vg-c46f | High | 0.6% | 12 May, 2023 | npm workerd |
n8n Information Disclosure vulnerability CVE-2023-27564, GHSA-r9xw-p7wj-w792 | High | 1.2% | 10 May, 2023 | npm n8n |
n8n Privilege Escalation vulnerability CVE-2023-27563, GHSA-97cp-mr4m-9mcf | High | 1.2% | 10 May, 2023 | npm n8n |
m.static Directory Traversal vulnerability CVE-2023-26126, GHSA-vcxh-qvgr-9fw9 | High | 1.0% | 10 May, 2023 | npm m.static |
Path Traversal in Ghost BIT-ghost-2023-32235, CVE-2023-32235, GHSA-wf7x-fh6w-34r6 | High | 39.1% | 05 May, 2023 | npm ghost |
Ghost vulnerable to information disclosure of private API fields BIT-ghost-2023-31133, CVE-2023-31133, GHSA-r97q-ghch-82j9 | High | 45.7% | 03 May, 2023 | npm ghost |
Hidden fields can be leaked on readable collections in Payload CVE-2023-30843, GHSA-35jj-vqcf-f2jf | High | 0.6% | 26 Apr, 2023 | npm payload |
HTML injection in search results via plaintext message highlighting CVE-2023-30609, GHSA-xv83-x443-7rmw | High | 0.6% | 25 Apr, 2023 | npm matrix-react-sdk |
Uncaught Exception in yaml CVE-2023-2251, GHSA-f9xv-q969-pqx4 | High | 1.1% | 24 Apr, 2023 | npm yaml |
Prototype Pollution in sheetJS CVE-2023-30533, GHSA-4r6h-8v6p-xvw6 | High | 1.0% | 24 Apr, 2023 | npm xlsx |
Session fixation in fastify-passport CVE-2023-29019, GHSA-4m3m-ppvx-xgw9 | High | 0.8% | 21 Apr, 2023 | npm @fastify/passport |
Strapi leaking sensitive user information by filtering on private fields CVE-2023-22894, GHSA-jjqf-j4w7-92w8 | HighExploited | 4.1% | 19 Apr, 2023 | npm @strapi/strapi |
Strapi does not verify the access or ID tokens issued during the OAuth flow CVE-2023-22893, GHSA-583x-23h9-f5w7 | High | 4.1% | 19 Apr, 2023 | npm @strapi/plugin-users-permissions |
Authentication Bypass in @strapi/plugin-users-permissions GHSA-xv3q-jrmm-4fxv | High | Not scored | 18 Apr, 2023 | npm @strapi/plugin-users-permissions |
GovernorCompatibilityBravo may trim proposal calldata CVE-2023-30542, GHSA-93hq-5wgc-jc82 | High | 0.6% | 16 Apr, 2023 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
SvelteKit framework has Insufficient CSRF protection for CORS requests CVE-2023-29008, GHSA-gv7g-x59x-wf8f | High | 0.4% | 06 Apr, 2023 | npm @sveltejs/kit |
markdown-pdf vulnerable to local file read via server side cross-site scripting (XSS) CVE-2023-0835, GHSA-qghr-877h-f9jh | High | 0.6% | 04 Apr, 2023 | npm markdown-pdf |
SvelteKit vulnerable to Cross-Site Request Forgery CVE-2023-29003, GHSA-5p75-vc5g-8rv2 | High | 0.6% | 04 Apr, 2023 | npm @sveltejs/kit |
Prototype pollution in matrix-js-sdk (part 2) CVE-2023-28427, GHSA-mwq8-fjpf-c2gr | High | 1.2% | 28 Mar, 2023 | npm matrix-js-sdk |
Prototype pollution in matrix-react-sdk CVE-2023-28103, GHSA-6g43-88cp-w5gv | High | 0.7% | 28 Mar, 2023 | npm matrix-react-sdk |
matrix-react-sdk Prototype pollution vulnerability CVE-2022-36060, GHSA-2x9c-qwgf-94xr | High | 0.9% | 28 Mar, 2023 | npm matrix-react-sdk |
matrix-js-sdk Prototype Pollution vulnerability CVE-2022-36059, GHSA-rfv9-x7hh-xc32 | High | 0.9% | 28 Mar, 2023 | npm matrix-js-sdk |
Collection.js vulnerable to Prototype Pollution CVE-2023-26113, GHSA-47pj-q2vm-46xc | High | 1.2% | 18 Mar, 2023 | npm collection.js |
Arbitrary local file read vulnerability during template rendering CVE-2023-25345, GHSA-2rq5-699j-x7p6 | High | 1.1% | 15 Mar, 2023 | npm swig npm swig-templates |
Missing proper state, nonce and PKCE checks for OAuth authentication CVE-2023-27490, GHSA-7r7x-4c4q-c4qf | High | 0.5% | 09 Mar, 2023 | npm next-auth |
directus vulnerable to HTML Injection in Password Reset email to custom Reset URL CVE-2023-27474, GHSA-4hmq-ggrm-qfc6 | High | 0.5% | 06 Mar, 2023 | npm directus |
node-static and @nubosoftware/node-static vulnerable to Directory Traversal CVE-2023-26111, GHSA-5g97-whc9-8g7j | High | 1.4% | 06 Mar, 2023 | npm @nubosoftware/node-static npm node-static |
SketchSVG Arbitrary Code Injection vulnerability CVE-2023-26107, GHSA-6722-xvq8-3254 | High | 0.4% | 06 Mar, 2023 | npm sketchsvg |
dot-lens vulnerable to Prototype Pollution CVE-2023-26106, GHSA-rmhg-2cvv-q7vx | High | 0.9% | 06 Mar, 2023 | npm dot-lens |
Directus vulnerable to Server-Side Request Forgery On File Import CVE-2023-26492, GHSA-j3rg-3rgm-537h | High | 1.0% | 03 Mar, 2023 | npm directus |
Imperative CLI vulnerable to Command Injection CVE-2021-4326, GHSA-6q8m-42qq-64r7 | High | 0.3% | 01 Mar, 2023 | npm @zowe/imperative |
mde utilities contains Prototype Pollution CVE-2023-26105, GHSA-wxfj-84xf-7gxv | High | 1.3% | 28 Feb, 2023 | npm utilities |
Denial of Service vulnerability in lite-web-server CVE-2023-26104, GHSA-8237-3q5g-99fv | High | 1.2% | 25 Feb, 2023 | npm lite-web-server |
ecdh vulnerable to Exposure of Resource to Wrong Sphere CVE-2022-44310, GHSA-p2hp-3wv3-4w74 | High | 0.7% | 24 Feb, 2023 | npm ecdh |
rangy vulnerable to Prototype Pollution CVE-2023-26102, GHSA-65rp-mhqf-8gj3 | High | 0.8% | 24 Feb, 2023 | npm rangy |
Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS) CVE-2023-25653, GHSA-5h4j-qrvg-9xhw | High | 0.6% | 16 Feb, 2023 | npm node-jose |
Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler CVE-2025-27098, GHSA-j2wh-wrv3-4x4g | High | 0.4% | 16 Feb, 2023 | npm @graphql-mesh/cli npm @graphql-mesh/http |
Regular Expression Denial of Service in Headers CVE-2023-24807, GHSA-r6ch-mqf9-qc9w | High | 1.3% | 16 Feb, 2023 | npm undici |
Sequelize information disclosure vulnerability CVE-2023-22580, GHSA-8c25-f3mj-v6h8 | High | 0.6% | 16 Feb, 2023 | npm @sequelize/core npm sequelize |