Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Sanitize-html Vulnerable To REDoS Attacks CVE-2022-25887, GHSA-cgfm-xwp7-2cvr | High | 1.6% | 30 Aug, 2022 | npm sanitize-html |
oauth2-server through 3.1.1 vulnerable to Open Redirect CVE-2020-26938, GHSA-4rg6-fm25-gc34 | High | 1.0% | 29 Aug, 2022 | npm oauth2-server |
Improper Control of Generation of Code ('Code Injection') in mdx-mermaid CVE-2022-36036, GHSA-rvgm-35jw-q628 | High | 0.4% | 29 Aug, 2022 | npm mdx-mermaid |
Polynomial regular expression used on uncontrolled data in nitrado.js CVE-2022-36034, GHSA-vqc4-v8hc-h2jg | High | 0.9% | 29 Aug, 2022 | npm nitrado.js |
uri-template-lite Regular Expression Denial of Service CVE-2021-43309, GHSA-chw2-6c7r-37p7 | High | 1.0% | 24 Aug, 2022 | npm uri-template-lite |
node-opcua DoS when bypassing limitations for excessive memory consumption CVE-2022-24375, GHSA-vh4f-fgpp-x8x2 | High | 1.7% | 24 Aug, 2022 | npm node-opcua |
node-opcua DoS vulnerability via message with memory allocation that exceeds v8's memory limit CVE-2022-25231, GHSA-qpgc-xh7j-52q8 | High | 1.3% | 23 Aug, 2022 | npm node-opcua |
Uncontrolled Resource Consumption in node-opcua CVE-2022-21208, GHSA-4hr4-pjjh-2q2w | High | 1.5% | 23 Aug, 2022 | npm node-opcua |
Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service CVE-2022-35204, GHSA-mv48-hcvh-8jj8 | High | 1.3% | 18 Aug, 2022 | npm vite |
OpenZeppelin Contracts vulnerable to ECDSA signature malleability CVE-2022-35961, GHSA-4h98-2769-gh6h | High | 0.5% | 15 Aug, 2022 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
mc-kill-port vulnerable to Arbitrary Command Execution via kill function CVE-2022-25973, GHSA-2cg4-7q4x-7rr2 | High | 0.5% | 10 Aug, 2022 | npm mc-kill-port |
Raneto Denial of Service via crafted payload injected into `Search` parameter CVE-2022-35142, GHSA-xxc2-j7jj-6g5m | High | 1.6% | 04 Aug, 2022 | npm raneto |
v8n vulnerable to Inefficient Regular Expression Complexity CVE-2022-35923, GHSA-xrx9-gj26-5wx9 | High | 1.8% | 02 Aug, 2022 | npm v8n |
OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals CVE-2022-31198, GHSA-xrc4-737v-9q75 | High | 0.8% | 01 Aug, 2022 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
git-archive vulnerable to Command Injection via exports function CVE-2020-28422, GHSA-vqgr-mfxm-47f3 | High | 0.4% | 25 Jul, 2022 | npm git-archive |
OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers CVE-2022-31172, GHSA-4g63-c64m-25w9 | High | 0.5% | 21 Jul, 2022 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
OpenZeppelin Contracts's ERC165Checker may revert instead of returning false CVE-2022-31170, GHSA-qh9x-gcfh-pcrw | High | 0.8% | 21 Jul, 2022 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
file-type vulnerable to Infinite Loop via malformed MKV file CVE-2022-36313, GHSA-mhxj-85r3-2x55 | High | 0.4% | 21 Jul, 2022 | npm file-type |
glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service BIT-gulp-2021-35065, CVE-2021-35065, GHSA-cj88-88mr-972w | High | 1.7% | 18 Jul, 2022 | npm glob-parent |
Apache SkyWalking NodeJS Agent can lose availability if header includes illegal SkyWalking header CVE-2022-36127, GHSA-8gpg-466c-5cpj | High | 1.9% | 18 Jul, 2022 | npm skywalking-backend-js |
grunt-util-property 0.0.2 function call can add/modify properties of Object.prototype using a __proto__ payload CVE-2020-7641, GHSA-4hq8-jgr8-mw9j | High | 0.4% | 17 Jul, 2022 | npm grunt-util-property |
Terser insecure use of regular expressions leads to ReDoS CVE-2022-25858, GHSA-4wf5-vphf-c2xc | High | 3.3% | 15 Jul, 2022 | npm terser |
fastify-bearer-auth vulnerable to Timing Attack Vector CVE-2022-31142, GHSA-376v-xgjx-7mfr | High | 1.5% | 14 Jul, 2022 | npm @fastify/bearer-auth npm fastify-bearer-auth |
Strapi 4.1.12 Cross-site Scripting via crafted file CVE-2022-32114, GHSA-4vm8-j95f-j6v5 | High | 2.0% | 13 Jul, 2022 | npm @strapi/strapi |
vm2 before 3.6.11 vulnerable to sandbox escape CVE-2019-10761, GHSA-wf5x-cr3r-xr77, SNYK-JS-VM2-473188 | High | 1.3% | 13 Jul, 2022 | npm vm2 |
Moment.js vulnerable to Inefficient Regular Expression Complexity CVE-2022-31129, GHSA-wc69-rhjr-hc9g | High | 5.6% | 06 Jul, 2022 | NuGet Moment.js npm moment |
Improper handling of email input CVE-2022-31127, GHSA-pgjx-7f9g-9463 | High | 1.1% | 06 Jul, 2022 | npm next-auth |
jquery-validation Regular Expression Denial of Service due to arbitrary input to url2 method CVE-2022-31147, GHSA-ffmh-x56j-9rc3 | High | 2.2% | 05 Jul, 2022 | npm jquery-validation |
Regular expression denial of service in scss-tokenizer CVE-2022-25758, GHSA-7mwh-4pqv-wmr8 | High | 2.1% | 01 Jul, 2022 | npm scss-tokenizer |
Protected fields exposed via LiveQuery BIT-parse-2022-31112, CVE-2022-31112, GHSA-crrq-vr9j-fxxh | High | 1.3% | 30 Jun, 2022 | npm parse-server |
Authorization Bypass in parse-path CVE-2022-0624, GHSA-3j8f-xvm3-ffx4 | High | 0.9% | 28 Jun, 2022 | npm parse-path |
Hostname confusion in parse-url CVE-2022-0722, GHSA-4p35-cfcx-8653 | High | 1.2% | 27 Jun, 2022 | npm parse-url |
Improper handling of CSS at-rules in lettersanitizer CVE-2022-31103, GHSA-7r3r-gq8p-v9jj | High | 1.5% | 23 Jun, 2022 | npm lettersanitizer |
Denial of Service (DoS) vulnerability in RSSHub CVE-2022-31110, GHSA-jvxx-v45p-v5vf | High | 1.6% | 23 Jun, 2022 | npm rsshub |
Improper Handling of `callbackUrl` parameter in next-auth CVE-2022-31093, GHSA-g5fm-jp9v-2432 | High | 1.7% | 21 Jun, 2022 | npm next-auth |
Invalid file request can crash server BIT-parse-2022-31089, CVE-2022-31089, GHSA-xw6g-jjvf-wwf9 | High | 1.2% | 20 Jun, 2022 | npm parse-server |
Prototype Pollution in querymen CVE-2022-25871, GHSA-p23c-p8w2-ww5v | High | 1.2% | 17 Jun, 2022 | npm querymen |
pg-native and libpq vulnerable to uncontrolled resource consumption CVE-2022-25852, GHSA-j32j-2hxv-rqf7 | High | 1.4% | 17 Jun, 2022 | npm libpq npm pg-native |
Uncontrolled Resource Consumption in @discordjs/opus CVE-2022-25345, GHSA-rvgf-69j7-xh78 | High | 1.4% | 17 Jun, 2022 | npm @discordjs/opus |
Uncontrolled Resource Consumption in fast-string-search CVE-2022-22138, GHSA-4263-q746-94mw | High | 1.2% | 17 Jun, 2022 | npm fast-string-search |
Prototype Pollution in mout CVE-2022-21213, GHSA-vvv8-xw5f-3f88 | High | 2.1% | 17 Jun, 2022 | npm mout |
Authentication bypass vulnerability in Apple Game Center auth adapter BIT-parse-2022-31083, CVE-2022-31083, GHSA-rh9j-f5f8-rvgc | High | 0.9% | 17 Jun, 2022 | npm parse-server |
ProxyAgent vulnerable to MITM CVE-2022-32210, GHSA-pgw7-wx7w-2w33 | High | 0.5% | 17 Jun, 2022 | npm undici |
Potential Sensitive Cookie Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy CVE-2022-31070, GHSA-77mv-4rg7-r8qv | High | 0.7% | 15 Jun, 2022 | npm @finastra/nestjs-proxy |
Potential Authorization Header Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy CVE-2022-31069, GHSA-j562-c3cw-3p5g | High | 0.7% | 15 Jun, 2022 | npm @finastra/nestjs-proxy |
AutoUpdater module fails to validate certain nested components of the bundle CVE-2022-29257, GHSA-77xc-hjv8-ww97 | High | 0.9% | 13 Jun, 2022 | npm electron |
Insufficient Session Expiration in NocoDB CVE-2022-2064, GHSA-6293-2vg2-pmp5 | High | 1.2% | 13 Jun, 2022 | npm nocodb |
Improper Privilege Management in NocoDB CVE-2022-2063, GHSA-fq4h-m3c8-8m2v | High | 1.4% | 13 Jun, 2022 | npm nocodb |
NocoDB information disclosure vulnerability CVE-2022-2062, GHSA-mx8q-jqwm-85mv | High | 1.5% | 13 Jun, 2022 | npm nocodb |
Infinite loop in jpeg-js CVE-2022-25851, GHSA-xvf7-4v9q-58w6 | High | 1.9% | 10 Jun, 2022 | npm jpeg-js |