Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
easy-static-server vulnerable to Directory Traversal CVE-2022-25931, GHSA-wcwm-c3mr-pxcr | High | 1.4% | 20 Dec, 2022 | npm easy-static-server |
Knex.js has a limited SQL injection vulnerability CVE-2016-20018, GHSA-4jv9-3563-23j3 | High | 1.1% | 19 Dec, 2022 | npm knex |
Authentication Bypass for passport-wsfed-saml2 CVE-2022-23505, GHSA-ppjq-qxhx-m25f | High | 0.8% | 13 Dec, 2022 | npm passport-wsfed-saml2 |
@cubejs-backend/api-gateway row level security bypass CVE-2022-23510, GHSA-6jqm-3c9g-pch7 | High | 1.0% | 09 Dec, 2022 | npm @cubejs-backend/api-gateway |
libp2p DoS vulnerability from lack of resource management CVE-2022-23487, GHSA-f44q-634c-jvwv | High | 0.7% | 07 Dec, 2022 | npm libp2p |
nadesiko3 allows remote attacker to inject invalid value to decodeURIComponent of nako3edit CVE-2022-41777, GHSA-x2jx-w3wm-9p3p | High | 1.6% | 05 Dec, 2022 | npm nadesiko3 |
snyk Code Injection vulnerability CVE-2022-24441, GHSA-4vrv-93c7-m92j | High | 0.8% | 30 Nov, 2022 | npm snyk |
static-dev-server vulnerable to path traversal CVE-2022-25848, GHSA-7fxm-c848-89q8 | High | 1.0% | 29 Nov, 2022 | npm static-dev-server |
ghost vulnerable to unauthorized newsletter modification via improper access controls BIT-ghost-2022-41654, CVE-2022-41654, GHSA-9gh8-wp53-ccc6 | High | 18.9% | 28 Nov, 2022 | npm ghost |
muhammara and hummus vulnerable to Unchecked Return Value to NULL Pointer Dereference CVE-2022-41957, GHSA-2r7v-cmch-5x26 | High | 1.1% | 28 Nov, 2022 | npm hummus npm muhammara |
decode-uri-component vulnerable to Denial of Service (DoS) CVE-2022-38900, GHSA-w573-4hg7-7wgq | High | 23.6% | 28 Nov, 2022 | npm decode-uri-component |
qs vulnerable to Prototype Pollution CVE-2022-24999, GHSA-hrpp-h998-j3pp | High | 15.7% | 26 Nov, 2022 | npm qs |
Fastify: Incorrect Content-Type parsing can lead to CSRF attack CVE-2022-41919, GHSA-3fjj-p79j-c9hh | High | 0.4% | 21 Nov, 2022 | npm fastify |
Redwood is vulnerable to account takeover via dbAuth "forgot-password" GHSA-3qmc-2r76-4rqp | High | Not scored | 10 Nov, 2022 | npm @redwoodjs/api |
fastify/websocket vulnerable to uncaught exception via crash on malformed packet CVE-2022-39386, GHSA-4pcg-wr6c-h9cq | High | 0.8% | 07 Nov, 2022 | npm @fastify/websocket npm fastify-websocket |
Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp CVE-2022-39381, GHSA-rcrx-fpjp-mfrw | High | 0.9% | 02 Nov, 2022 | npm hummus npm muhammara |
muhammara and hummus vulnerable to denial of service by NULL pointer dereference CVE-2022-25892, GHSA-9cv5-4wqv-9w94 | High | 1.4% | 01 Nov, 2022 | npm hummus npm muhammara |
muhammara and hummus vulnerable to null pointer dereference on bad response object CVE-2022-25885, GHSA-frp9-2v6r-gj97 | High | 1.5% | 01 Nov, 2022 | npm hummus npm muhammara |
kangax html-minifier REDoS vulnerability CVE-2022-37620, GHSA-pfq8-rq6v-vf5m | High | 1.4% | 31 Oct, 2022 | npm html-minifier |
Inefficient Regular Expression Complexity in shescape CVE-2022-25918, GHSA-cr84-xvw4-qx3c | High | 1.6% | 25 Oct, 2022 | npm shescape |
Markdownify subject to Remote Code Execution via malicious markdown file CVE-2022-41709, GHSA-c942-mfmp-p4fh | High | 0.5% | 19 Oct, 2022 | npm electron-markdownify |
parse-server crashes when receiving file download request with invalid byte range BIT-parse-2022-39313, CVE-2022-39313, GHSA-h423-w6qv-2wj3 | High | 0.8% | 18 Oct, 2022 | npm parse-server |
minimatch ReDoS vulnerability CVE-2022-3517, GHSA-f8q6-p94x-37v3 | High | 2.3% | 17 Oct, 2022 | npm minimatch |
loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable CVE-2022-37603, GHSA-3rfm-jhwj-7488 | High | 2.7% | 14 Oct, 2022 | npm loader-utils |
Signature bypass via multiple root elements CVE-2022-39300, GHSA-5p8w-2mvw-38pv | High | 0.8% | 12 Oct, 2022 | npm node-saml |
Signature bypass via multiple root elements CVE-2022-39299, GHSA-m974-647v-whv7 | High | 4.5% | 12 Oct, 2022 | npm @node-saml/node-saml npm @node-saml/passport-saml npm node-saml npm passport-saml |
loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) CVE-2022-37599, GHSA-hhq3-ff78-jv3g | High | 2.8% | 11 Oct, 2022 | npm loader-utils |
fastify vulnerable to denial of service via malicious Content-Type CVE-2022-39288, GHSA-455w-c45v-86rg | High | 59.2% | 10 Oct, 2022 | npm fastify |
tiny-csrf has openly visible CSRF tokens CVE-2022-39287, GHSA-pj2c-h76w-vv6f | High | 0.5% | 07 Oct, 2022 | npm tiny-csrf |
generator-jhipster vulnerable to login check Regular Expression Denial of Service GHSA-8w7w-67mw-r5p7 | High | Not scored | 06 Oct, 2022 | npm generator-jhipster |
Snyk CLI affected by Command Injection vulnerability CVE-2022-40764, GHSA-hpqj-7cj6-hfj8 | High | 0.6% | 03 Oct, 2022 | npm snyk npm snyk-go-plugin |
Joplin Remote Code Execution CVE-2022-40277, GHSA-mjr5-v9c9-mm7g | High | 0.5% | 30 Sep, 2022 | npm joplin |
react-native-reanimated vulnerable to ReDoS CVE-2022-24373, GHSA-2j79-8pqc-r7x6 | High | 1.6% | 30 Sep, 2022 | npm react-native-reanimated |
css-what vulnerable to ReDoS due to use of insecure regular expression CVE-2022-21222, GHSA-p28h-cc7q-c4fg | High | 1.9% | 30 Sep, 2022 | npm css-what |
d3-color vulnerable to ReDoS GHSA-36jr-mh4h-2g58 | High | Not scored | 29 Sep, 2022 | npm d3-color |
matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification CVE-2022-39250, GHSA-5w8r-8pgj-5jmf | High | 1.2% | 29 Sep, 2022 | npm matrix-js-sdk |
Upstash Adapter missing token verification CVE-2022-39263, GHSA-4rxr-27mm-mxq9 | High | 0.7% | 28 Sep, 2022 | npm @next-auth/upstash-redis-adapter |
matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion CVE-2022-39251, GHSA-r48r-j8fx-mq2c | High | 1.2% | 28 Sep, 2022 | npm matrix-js-sdk |
matrix-js-sdk subject to impersonated messages due to permissive key forwarding CVE-2022-39249, GHSA-6263-x97c-c4gg | High | 1.3% | 28 Sep, 2022 | npm matrix-js-sdk |
Strapi mishandles hidden attributes within admin API responses CVE-2022-31367, GHSA-4phg-hpqm-c3j4 | High | 1.7% | 27 Sep, 2022 | npm @strapi/strapi npm strapi |
secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery CVE-2022-41340, GHSA-q3f4-9h4p-vgr3 | High | 0.7% | 24 Sep, 2022 | npm @lionello/secp256k1-js |
hoek subject to prototype pollution via the clone function. CVE-2020-36604, GHSA-c429-5p7v-vgjp | High | 1.2% | 23 Sep, 2022 | npm @hapi/hoek npm hoek |
Fastly Compute@Edge JS Runtime has fixed random number seed during compilation CVE-2022-39218, GHSA-cmr8-5w4c-44v8 | High | 0.9% | 20 Sep, 2022 | npm @fastly/js-compute |
steal Inefficient Regular Expression Complexity vulnerability via string variable CVE-2022-37259, GHSA-rgqx-226f-2xp4 | High | 1.3% | 20 Sep, 2022 | npm steal |
steal vulnerable to Regular Expression Denial of Service via input variable CVE-2022-37260, GHSA-7f3x-2wcx-hww8 | High | 1.3% | 15 Sep, 2022 | npm steal |
steal vulnerable to Regular Expression Denial of Service via source and sourceWithComments CVE-2022-37262, GHSA-28v4-jf82-jvj8 | High | 1.4% | 15 Sep, 2022 | npm steal |
Parsing issue in matrix-org/node-irc leading to room takeovers CVE-2022-39203, GHSA-xvqg-mv25-rwvw | High | 0.9% | 13 Sep, 2022 | npm matrix-appservice-irc |
Parse Server vulnerable to brute force guessing of user sensitive data via search patterns BIT-parse-2022-36079, CVE-2022-36079, GHSA-2m6g-crv8-p3c6 | High | 1.3% | 07 Sep, 2022 | npm parse-server |
Blink1Control2 uses weak password encryption CVE-2022-35513, GHSA-jqhq-pfg3-fg5p | High | 6.2% | 07 Sep, 2022 | npm Blink1Control2 |
NodeBB account takeover via SSO plugins CVE-2022-36076, GHSA-xmgg-fx9p-prq6 | High | 0.6% | 02 Sep, 2022 | npm nodebb |