Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Denial of service due to unlimited number of parts CVE-2023-25576, GHSA-hpp2-2cr5-pf6g | High | 1.5% | 14 Feb, 2023 | npm @fastify/multipart |
Regular Expression Denial of Service in simple-markdown CVE-2019-25103, GHSA-gpvj-gp8c-c7p2 | High | 0.9% | 12 Feb, 2023 | npm simple-markdown |
Regular Expression Denial of Service in simple-markdown CVE-2019-25102, GHSA-j533-2g8v-pmpg | High | 1.1% | 12 Feb, 2023 | npm simple-markdown |
Sensitive Information leak via Script File in TinaCMS CVE-2023-25164, GHSA-pc2q-jcxq-rjrr | High | 0.7% | 08 Feb, 2023 | npm @tinacms/cli |
create-choo-app3 is vulnerable to Command Injection via the devInstall function CVE-2022-25855, GHSA-rj7m-2p3g-fjxg | High | 1.0% | 06 Feb, 2023 | npm create-choo-app3 |
semver-tags is vulnerable to Command Injection via the getGitTagsRemote function CVE-2022-25853, GHSA-8h3g-hcwp-6hxq | High | 1.1% | 06 Feb, 2023 | npm semver-tags |
is-url Inefficient Regular Expression Complexity vulnerability CVE-2018-25079, GHSA-p9w8-2mpq-49h9 | High | 1.0% | 04 Feb, 2023 | npm is-url |
Switcher Client contains Regular Expression Denial of Service (ReDoS) CVE-2023-23925, GHSA-wqxw-8h5g-hq56 | High | 0.5% | 02 Feb, 2023 | npm switcher-client |
mt7688-wiscan is vulnerable to Command Injection due to improper input sanitization CVE-2022-25916, GHSA-5h8c-8ccp-8gmh | High | 1.1% | 01 Feb, 2023 | npm mt7688-wiscan |
is-http2 vulnerable to Improper Input Validation CVE-2022-25906, GHSA-2275-rpf5-xv8h | High | 1.1% | 01 Feb, 2023 | npm is-http2 |
XSS Attack with Express API CVE-2023-23630, GHSA-xrh7-m5pp-39r6 | High | 0.6% | 31 Jan, 2023 | npm eta |
Parse Server option `masterKeyIps` vulnerability to IP spoofing BIT-parse-2023-22474, CVE-2023-22474, GHSA-vm5r-c87r-pf6x | High | 0.7% | 31 Jan, 2023 | npm parse-server |
http-cache-semantics vulnerable to Regular Expression Denial of Service CVE-2022-25881, GHSA-rc47-6667-2j5j | High | 1.6% | 31 Jan, 2023 | Maven org.webjars.npm:http-cache-semantics npm http-cache-semantics |
Eta vulnerable to Code Injection via templates rendered with user-defined data CVE-2022-25967, GHSA-mf6x-hrgr-658f | High | 2.0% | 30 Jan, 2023 | npm eta |
Servst vulnerable to Path Traversal CVE-2022-25936, GHSA-88v8-v46g-6c9w | High | 1.3% | 30 Jan, 2023 | npm servst |
JSZip contains Path Traversal via loadAsync CVE-2022-48285, GHSA-36fh-84j7-cv5h | High | 1.4% | 29 Jan, 2023 | npm jszip |
Command Injection in puppet-facter CVE-2022-25350, GHSA-g5qr-xgg7-8q2w | High | 1.2% | 26 Jan, 2023 | npm puppet-facter |
Command injection in smartctl CVE-2022-21810, GHSA-69f2-4375-qv9h | High | 1.2% | 26 Jan, 2023 | npm smartctl |
Directory Traversal vulnerability in serve-lite CVE-2022-21192, GHSA-5qq4-m6c3-xxmf | High | 1.3% | 26 Jan, 2023 | npm serve-lite |
ReDoS Vulnerability in ua-parser-js version CVE-2022-25927, GHSA-fhg7-m89q-25r3 | High | 1.7% | 24 Jan, 2023 | npm ua-parser-js |
cookiejar Regular Expression Denial of Service via Cookie.parse function CVE-2022-25901, GHSA-h452-7996-h45h | High | 1.6% | 18 Jan, 2023 | Maven org.webjars.npm:cookiejar npm cookiejar |
Path Traversal in web-node-server CVE-2020-36651, GHSA-3fwq-qv5v-2wxf | High | 0.9% | 18 Jan, 2023 | npm web-node-server |
mel-spintax has Inefficient Regular Expression Complexity CVE-2018-25077, GHSA-qjm7-55vv-3c5f | High | 0.9% | 18 Jan, 2023 | npm mel-spintax |
RSSHub SSRF vulnerability CVE-2023-22493, GHSA-64wp-jh9p-5cg2 | High | 0.8% | 11 Jan, 2023 | npm rsshub |
gatsby-transformer-remark has possible unsanitized JavaScript code injection CVE-2023-22491, GHSA-7ch4-rr99-cqcw | High | 0.6% | 11 Jan, 2023 | npm gatsby-transformer-remark |
gry vulnerable to Command Injection CVE-2020-36650, GHSA-w5mw-f2hq-5fw8 | High | 2.2% | 11 Jan, 2023 | npm gry |
skeemas Inefficient Regular Expression Complexity vulnerability CVE-2018-25074, GHSA-qv66-f876-vjvr | High | 1.0% | 11 Jan, 2023 | npm skeemas |
convict vulnerable to Prototype Pollution CVE-2023-0163, GHSA-4jrm-c32x-w4jf | High | 0.3% | 10 Jan, 2023 | npm convict |
mercurius has Uncaught Exception when using subscriptions CVE-2023-22477, GHSA-cm8h-q92v-xcfc | High | 1.1% | 09 Jan, 2023 | npm mercurius |
debug Inefficient Regular Expression Complexity vulnerability CVE-2017-20165, GHSA-9vvw-cc9w-f27h | High | 2.1% | 09 Jan, 2023 | npm debug |
terminal-kit Inefficient Regular Expression Complexity vulnerability CVE-2021-4306, GHSA-wxgh-8gmr-3qh3 | High | 1.0% | 07 Jan, 2023 | npm terminal-kit |
robots-txt-guard Inefficient Regular Expression Complexity vulnerability CVE-2021-4305, GHSA-6g33-8w2q-4hxv | High | 1.0% | 05 Jan, 2023 | npm robots-txt-guard |
Luxon Inefficient Regular Expression Complexity vulnerability CVE-2023-22467, GHSA-3xq5-wjfh-ppjc | High | 1.8% | 04 Jan, 2023 | npm luxon |
window-control vulnerable to Command Injection due to improper input sanitization CVE-2022-25926, GHSA-9mjx-wfqp-j5ph | High | 1.2% | 04 Jan, 2023 | npm window-control |
Uniswap Universal Router Incorrect Authorization vulnerability CVE-2022-48216, GHSA-7m37-cx35-qgmr | High | 0.8% | 04 Jan, 2023 | npm @uniswap/universal-router |
@mattkrick/sanitize-svg vulnerable to Cross-Site Scripting (XSS) CVE-2023-22461, GHSA-h857-2g56-468g | High | 0.6% | 04 Jan, 2023 | npm @mattkrick/sanitize-svg |
MooTools Regular Expression Denial of Service CVE-2021-32821, GHSA-v63q-hgqc-qvpg | High | 0.7% | 03 Jan, 2023 | npm mootools |
string-kit Inefficient Regular Expression Complexity vulnerability CVE-2021-4299, GHSA-pfrm-4rjw-g9q5 | High | 1.0% | 02 Jan, 2023 | npm string-kit |
rgb2hex vulnerable to inefficient regular expression complexity CVE-2018-25061, GHSA-7599-fqgm-v84p | High | 1.0% | 31 Dec, 2022 | npm rgb2hex |
email-existence Inefficient Regular Expression Complexity vulnerability CVE-2018-25049, GHSA-p27h-4cpf-fw48 | High | 0.8% | 27 Dec, 2022 | npm email-existence |
markdown-it vulnerable to Inefficient Regular Expression Complexity CVE-2015-10005, GHSA-j5p7-jf4q-742q | High | 1.0% | 27 Dec, 2022 | npm markdown-it |
tree-kit vulnerable to Prototype Pollution CVE-2021-4278, GHSA-mw4x-g2x8-qcvf | High | 0.4% | 25 Dec, 2022 | npm tree-kit |
SimbCo httpster vulnerable to Path Traversal CVE-2020-36629, GHSA-p8j8-wxvp-h695 | High | 0.9% | 25 Dec, 2022 | npm httpster |
Prototype Pollution in JSON5 via Parse Method CVE-2022-46175, GHSA-9c47-m6qq-7p4h | High | 9.7% | 24 Dec, 2022 | npm json5 |
is_js vulnerable to Regular Expression Denial of Service CVE-2020-26302, GHSA-pvrw-g6fx-mcx2 | High | 0.9% | 22 Dec, 2022 | npm is_js |
jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() CVE-2022-23540, GHSA-qwph-4952-7xr6 | High | 0.6% | 22 Dec, 2022 | npm jsonwebtoken |
jsonwebtoken unrestricted key type could lead to legacy keys usage CVE-2022-23539, GHSA-8cf7-32gw-wr33 | High | 0.5% | 22 Dec, 2022 | npm jsonwebtoken |
dustjs-linkedin vulnerable to Prototype Pollution CVE-2021-4264, GHSA-c6rp-wrp9-qr4q | High | 1.2% | 21 Dec, 2022 | npm dustjs-linkedin |
lite-dev-server vulnerable to Directory Traversal CVE-2022-25895, GHSA-pppv-ch8p-rp2w | High | 1.4% | 21 Dec, 2022 | npm lite-dev-server |
lite-server vulnerable to Denial of Service CVE-2022-25940, GHSA-89w7-5q45-r53w | High | 1.2% | 20 Dec, 2022 | Maven org.webjars.npm:lite-server npm lite-server |