Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Code injection via SVG file in convert-svg-core CVE-2022-24429, GHSA-54px-mhwv-5v8x, SNYK-JS-CONVERTSVGCORE-2859212 | High | 0.9% | 10 Jun, 2022 | npm convert-svg-core |
Unhandled crash in npm posix CVE-2022-21211, GHSA-27mx-gchc-6xjp | High | 1.1% | 10 Jun, 2022 | npm posix |
Exposure of Sensitive Information to an Unauthorized Actor in semantic-release CVE-2022-31051, GHSA-x2pg-mjhr-2m5x | High | 1.8% | 09 Jun, 2022 | npm semantic-release |
Packing does not respect root-level ignore files in workspaces CVE-2022-29244, GHSA-hj9c-8jmm-8c52 | High | 4.0% | 02 Jun, 2022 | npm npm |
Regular expression denial of service in devcert CVE-2022-1929, GHSA-fp36-299x-pwmw | High | 0.6% | 02 Jun, 2022 | npm devcert |
Regular expression denial of service in markdown-link-extractor CVE-2021-43308, GHSA-mmh6-m7v9-5956 | High | 1.1% | 02 Jun, 2022 | npm markdown-link-extractor |
Regular expression denial of service in semver-regex CVE-2021-43307, GHSA-4x5v-gmq8-25ch | High | 1.6% | 02 Jun, 2022 | npm semver-regex |
Regular expression denial of service in jquery-validation CVE-2021-43306, GHSA-j9m2-h2pv-wvph | High | 1.5% | 02 Jun, 2022 | npm jquery-validation |
Command injection in google-it CVE-2021-34083, GHSA-7xhv-mpjw-422f | High | 2.1% | 02 Jun, 2022 | npm google-it |
OS Command Injection in gitsome CVE-2021-34081, GHSA-9v73-x562-wv5x | High | 3.4% | 02 Jun, 2022 | npm gitsome |
OS Command Injection in lifion-verify-deps CVE-2021-34078, GHSA-rphm-c8gw-3r38 | High | 2.4% | 02 Jun, 2022 | npm lifion-verify-deps |
Prototype Pollution in protobufjs CVE-2022-25878, GHSA-g954-5hwp-pp24 | High | 2.3% | 27 May, 2022 | npm protobufjs |
AttesterSlashing number overflow CVE-2022-29219, GHSA-cvj7-5f3c-9vg9 | High | 1.3% | 24 May, 2022 | npm @chainsafe/lodestar |
Crash in HeaderParser in dicer CVE-2022-24434, GHSA-wm7h-9275-46v2 | High | 3.5% | 20 May, 2022 | Maven org.webjars.npm:dicer npm dicer |
Improper Removal of Sensitive Information Before Storage or Transfer in Strapi CVE-2022-30618, GHSA-vgj7-895j-gpr6 | High | 1.0% | 19 May, 2022 | npm @strapi/strapi npm strapi |
Improper Removal of Sensitive Information Before Storage or Transfer in Strapi CVE-2022-30617, GHSA-f6fm-r26q-p747 | High | 1.5% | 19 May, 2022 | npm @strapi/strapi npm strapi |
Missing Cryptographic Step in cassproject CVE-2022-29229, GHSA-7qcx-4p32-qcmx | High | 0.4% | 18 May, 2022 | npm cassproject |
Connect-Multiparty allows arbitrary file upload CVE-2022-29623, GHSA-w2xw-44r3-4v9g | High | 1.4% | 16 May, 2022 | npm connect-multiparty |
Prototype Pollution in sds CVE-2022-25862, GHSA-ph28-wwfj-fv7f | High | 0.7% | 13 May, 2022 | npm sds |
Race Condition in Grunt CVE-2022-1537, GHSA-rm36-94g8-835r | High | 0.3% | 10 May, 2022 | npm grunt |
Uncaught Exception in bignum CVE-2022-25324, GHSA-6429-3g3w-6mw5 | High | 1.5% | 06 May, 2022 | npm bignum |
Uncontrolled Resource Consumption in Hawk CVE-2022-29167, GHSA-44pw-h2cw-w3vq | High | 1.1% | 05 May, 2022 | npm hawk |
Improper handling of multiline messages in node-irc affects matrix-appservice-irc CVE-2022-29166, GHSA-37hr-348p-rmf4 | High | 1.0% | 05 May, 2022 | npm matrix-appservice-irc |
Improper handling of multiline messages in node-irc GHSA-52rh-5rpj-c3w6 | High | Not scored | 05 May, 2022 | npm matrix-org-irc |
Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter BIT-parse-2022-24901, CVE-2022-24901, GHSA-qf8x-vqjv-92gr | High | 0.7% | 04 May, 2022 | npm parse-server |
Insecure password handling vulnerability in Strapi CVE-2021-46440, GHSA-85vg-grr5-pw42 | High | 2.9% | 03 May, 2022 | npm @strapi/strapi npm strapi |
angular vulnerable to regular expression denial of service (ReDoS) CVE-2022-25844, GHSA-m2h2-264f-f486 | High | 4.9% | 01 May, 2022 | npm angular |
Prototype Pollution in dset CVE-2022-25645, GHSA-23wx-cgxq-vpwx | High | 1.8% | 01 May, 2022 | Maven org.webjars.npm:dset npm dset |
Denial of service vulnerability exists in libxmljs CVE-2022-21144, GHSA-773h-w45w-f2f9, SNYK-JS-LIBXMLJS-2348756 | High | 1.9% | 01 May, 2022 | npm libxmljs |
Denial-of-Service when binding invalid parameters in sqlite3 CVE-2022-21227, GHSA-9qrh-qjmc-5w2p | High | 2.2% | 28 Apr, 2022 | npm sqlite3 |
Prototype Pollution in madlib-object-utils CVE-2022-24279, GHSA-pfv6-prqm-85q8, SNYK-JS-MADLIBOBJECTUTILS-2388572 | High | 1.3% | 15 Apr, 2022 | npm madlib-object-utils |
Express-FileUpload Arbitrary File Overwrite CVE-2022-27261, GHSA-w4m6-x6c2-j5c9 | High | 1.4% | 12 Apr, 2022 | npm express-fileupload |
Prototype Pollution in nconf CVE-2022-21803, GHSA-6xwr-q98w-rvg7 | High | 1.8% | 12 Apr, 2022 | npm nconf |
SQL Injection when creating an application with Reactive SQL backend CVE-2022-24815, GHSA-qjmq-8hjr-qcv6 | High | 1.4% | 07 Apr, 2022 | npm generator-jhipster |
Denial of Service vulnerability in @podium/layout and @podium/proxy CVE-2022-24822, GHSA-3hjg-vc7r-rcrw | High | 1.7% | 06 Apr, 2022 | npm @podium/layout npm @podium/proxy |
Prototype Pollution in async CVE-2021-43138, GHSA-fwr7-v2mv-hh25 | High | 3.3% | 06 Apr, 2022 | npm async |
Incorrect protocol extraction via \r, \n and \t characters CVE-2022-1243, GHSA-3vjf-82ff-p4r3 | High | 0.7% | 05 Apr, 2022 | npm urijs |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus CVE-2022-24814, GHSA-xmjj-3c76-5w84 | High | 1.0% | 04 Apr, 2022 | npm directus |
Path Traversal: 'dir/../../filename' in moment.locale CVE-2022-24785, GHSA-8hfj-j24r-96c4 | High | 13.8% | 04 Apr, 2022 | NuGet Moment.js npm moment |
URL Redirection to Untrusted Site ('Open Redirect') in express-openid-connect CVE-2022-24794, GHSA-7p99-3798-f85c | High | 0.7% | 31 Mar, 2022 | npm express-openid-connect |
Removal of functional code in faker.js GHSA-5w9c-rv96-fr7g | High | Not scored | 22 Mar, 2022 | npm faker |
Untrusted Search Path in PNPM CVE-2022-26183, GHSA-9m87-6fj3-c5xh | High | 1.6% | 21 Mar, 2022 | npm pnpm |
Command Injection in ungit CVE-2022-25766, GHSA-hf8c-xr89-vfm5, SNYK-JS-UNGIT-2414099 | High | 34.5% | 21 Mar, 2022 | npm ungit |
Improper Verification of Cryptographic Signature in node-forge CVE-2022-24772, GHSA-x4jg-mjrx-434g | High | 1.1% | 18 Mar, 2022 | npm node-forge |
Improper Verification of Cryptographic Signature in node-forge CVE-2022-24771, GHSA-cfm4-qjh2-4765 | High | 0.8% | 18 Mar, 2022 | npm node-forge |
Failure to validate signature during handshake CVE-2022-24759, GHSA-j3ff-xp6c-6gcc | High | 0.5% | 17 Mar, 2022 | npm @chainsafe/libp2p-noise |
Prototype Pollution in bodymen CVE-2022-25296, GHSA-vhxc-fhm5-qcp9 | High | 1.0% | 17 Mar, 2022 | npm bodymen |
Unhandled case in node-lmdb CVE-2022-21164, GHSA-32j9-6qqm-mq9g, SNYK-JS-NODELMDB-2400723 | High | 1.3% | 16 Mar, 2022 | npm node-lmdb |
Cross-site Scripting in CKEditor4 BIT-drupal-2022-24728, BIT-drupal-2022-24729, CVE-2022-24728, CVE-2022-24729, DRUPAL-CORE-2022-005, GHSA-4fc4-4p5g-6w89, GHSA-f6rf-9m92-x2hh | High | 2.5% | 16 Mar, 2022 | Packagist drupal/core npm ckeditor4 |
Server-Side Request Forgery in FUXA CVE-2021-45851, GHSA-9vp3-7qwq-83r9 | High | 1.5% | 16 Mar, 2022 | npm @frangoteam/fuxa |