Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Sudden swap of user auth tokens in Volto CVE-2022-24740, GHSA-cfhh-xgwq-5r67 | High | 0.6% | 14 Mar, 2022 | npm @plone/volto |
Execution with Unnecessary Privileges in arc-electron GHSA-v3wr-67px-44xg | High | Not scored | 03 Mar, 2022 | npm @advanced-rest-client/base |
Incorrect Authorization in @uppy/companion CVE-2022-0528, GHSA-q24h-5rq3-63j9 | High | 1.0% | 03 Mar, 2022 | npm @uppy/companion |
Path Traversal in @finastra/ssr-pages CVE-2022-24718, GHSA-w6cx-qg2q-rvq8 | High | 1.1% | 01 Mar, 2022 | npm @finastra/ssr-pages |
Cross site scripting in @awsui/components-react CVE-2022-24709, GHSA-mf22-92pm-m8p8 | High | 0.7% | 24 Feb, 2022 | npm @awsui/components-react |
Cookie exposure in requestretry CVE-2022-0654, GHSA-hjp8-2cm3-cc45 | High | 1.4% | 23 Feb, 2022 | npm requestretry |
Cross-site Scripting in Prism CVE-2022-23647, GHSA-3949-f494-cm99 | High | 1.4% | 18 Feb, 2022 | npm prismjs |
Improper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0 CVE-2022-23646, GHSA-fmvm-x8mv-47mj | High | 1.8% | 17 Feb, 2022 | npm next |
Uncaught Exception in fastify-multipart CVE-2021-23597, GHSA-qh73-qc3p-rjv2, SNYK-JS-FASTIFYMULTIPART-2395480 | High | 2.0% | 11 Feb, 2022 | npm fastify-multipart |
Validation bypass in frourio-express CVE-2022-23624, GHSA-mmj4-777p-fpq9 | High | 1.2% | 07 Feb, 2022 | npm frourio-express |
Validation bypass in frourio CVE-2022-23623, GHSA-8xxm-h73r-ghfj | High | 1.2% | 07 Feb, 2022 | npm frourio |
Denial of Service Vulnerability in next.js CVE-2022-21721, GHSA-wr66-vrwm-5g5x | High | 2.2% | 28 Jan, 2022 | npm next |
Exposure of Sensitive Information in simple-get CVE-2022-0355, GHSA-wpg7-2c88-r8xv | High | 2.0% | 26 Jan, 2022 | npm simple-get |
Server side request forgery in @isomorphic-git/cors-proxy CVE-2021-23664, GHSA-v82v-rq72-phq9, SNYK-JS-ISOMORPHICGITCORSPROXY-1734788 | High | 1.4% | 21 Jan, 2022 | npm @isomorphic-git/cors-proxy |
Path Traversal in convert-svg packages CVE-2021-23631, GHSA-jv7g-9g6q-cxvw | High | 2.0% | 21 Jan, 2022 | npm convert-svg-core npm convert-svg-to-jpeg npm convert-svg-to-png |
Prototype pollution in min-dash CVE-2021-23460, GHSA-2m53-83f3-562j | High | 2.2% | 21 Jan, 2022 | Maven org.webjars.npm:min-dash npm min-dash |
node-fetch forwards secure headers to untrusted sites CVE-2022-0235, GHSA-r683-j2x4-v87g | High | 1.7% | 16 Jan, 2022 | npm node-fetch |
Infinite Loop in colors.js CVE-2021-23567, GHSA-gh88-3pxp-6fm8 | High | 1.7% | 14 Jan, 2022 | npm colors |
Inefficient Regular Expression Complexity in marked CVE-2022-21681, GHSA-5v2h-r2cx-5xgj | High | 2.8% | 14 Jan, 2022 | npm marked |
Inefficient Regular Expression Complexity in marked CVE-2022-21680, GHSA-rrrm-qjm4-v8hf | High | 2.9% | 14 Jan, 2022 | npm marked |
Uncaught Exception in engine.io CVE-2022-21676, GHSA-273r-mgr4-v34f | High | 2.8% | 12 Jan, 2022 | npm engine.io |
Reflected cross-site scripting (XSS) vulnerability CVE-2022-0087, GHSA-hrgx-7j6v-xj82 | High | 2.6% | 12 Jan, 2022 | npm @keystone-6/auth npm @keystone-next/auth |
Improper Privilege Management in shelljs CVE-2022-0144, GHSA-4rq4-32rv-6wp6 | High | 0.4% | 11 Jan, 2022 | npm shelljs |
Exposure of sensitive information in follow-redirects CVE-2022-0155, GHSA-74fj-2j2h-c42q | High | 2.6% | 10 Jan, 2022 | npm follow-redirects |
Infinite loop causing Denial of Service in colors GHSA-5rqg-jm4f-cqx7 | High | Not scored | 10 Jan, 2022 | npm Colors npm colors |
Denial of Service in soketi CVE-2022-21667, GHSA-86ch-6w7v-v6xf | High | 1.7% | 08 Jan, 2022 | npm @soketi/soketi |
Incorrect sanitisation function leads to `XSS` in mermaid CVE-2021-43861, GHSA-p3rp-vmj9-gv6v | High | 0.9% | 30 Dec, 2021 | npm mermaid |
Uncontrolled Resource Consumption in parse-link-header CVE-2021-23490, GHSA-q674-xm3x-2926 | High | 1.9% | 24 Dec, 2021 | npm parse-link-header |
jsx-slack insufficient patch for CVE-2021-43838 ReDoS CVE-2021-43843, GHSA-hp68-xhvj-x6j6 | High | 2.0% | 20 Dec, 2021 | npm jsx-slack |
Regular Expression Denial of Service (ReDoS) in jsx-slack CVE-2021-43838, GHSA-55xv-f85c-248q | High | 1.4% | 17 Dec, 2021 | npm jsx-slack |
Improper Initialization in OpenZeppelin CVE-2021-46320, CVE-2022-39384, GHSA-88g8-f5mf-f5rj, GHSA-9c22-pwxw-p6hx | High | 1.2% | 14 Dec, 2021 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
Uncaught Exception in mercurius CVE-2021-43801, GHSA-273r-rm8g-7f3x | High | 1.6% | 13 Dec, 2021 | npm mercurius |
Session fixation in express-openid-connect CVE-2021-41246, GHSA-7rg2-qxmf-hhx9 | High | 0.9% | 09 Dec, 2021 | npm express-openid-connect |
Unexpected server crash in Next.js. CVE-2021-43803, GHSA-25mp-g6fv-mqxx | High | 47.3% | 07 Dec, 2021 | npm next |
Code injection in plupload CVE-2021-23562, GHSA-rp2c-jrgp-cvr8 | High | 1.0% | 03 Dec, 2021 | npm plupload |
RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend GHSA-2g8g-63j4-9w3r | High | Not scored | 01 Dec, 2021 | npm @backstage/plugin-scaffolder-backend |
Path Traversal in @backstage/plugin-scaffolder-backend CVE-2021-43783, GHSA-mg3m-f475-28hv | High | 1.2% | 29 Nov, 2021 | npm @backstage/plugin-scaffolder-backend |
Cross-Site Scripting Vulnerability in @joeattardi/emoji-button CVE-2021-43785, GHSA-f34m-x9pj-62vq | High | 1.0% | 26 Nov, 2021 | npm @joeattardi/emoji-button |
Cross-Site Scripting vulnerability in @backstage/plugin-auth-backend CVE-2021-43776, GHSA-w7fj-336r-vw49 | High | 0.7% | 26 Nov, 2021 | npm @backstage/plugin-auth-backend |
Improper certificate management in AWS IoT Device SDK v2 CVE-2021-40828, GHSA-94jq-q5v2-76wj, PYSEC-2021-861 | High | 0.4% | 23 Nov, 2021 | Maven software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk PyPI awsiotsdk npm aws-iot-device-sdk-v2 |
Improper certificate management in AWS IoT Device SDK v2 CVE-2021-40829, GHSA-743r-5g92-5vgf, PYSEC-2021-862 | High | 0.4% | 23 Nov, 2021 | Maven software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk PyPI awsiotsdk npm aws-iot-device-sdk-v2 |
Improper certificate management in AWS IoT Device SDK v2 CVE-2021-40830, GHSA-c4rh-4376-gff4, PYSEC-2021-863 | High | 0.4% | 23 Nov, 2021 | Maven software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk PyPI awsiotsdk npm aws-iot-device-sdk-v2 |
Improper certificate management in AWS IoT Device SDK v2 CVE-2021-40831, GHSA-j3f7-7rmc-6wqj, PYSEC-2021-864 | High | 0.6% | 23 Nov, 2021 | Maven software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk PyPI awsiotsdk npm aws-iot-device-sdk-v2 |
Server-Side Request Forgery in ssrf-agent CVE-2021-23718, GHSA-6gww-qpm6-mc2g | High | 1.6% | 22 Nov, 2021 | npm ssrf-agent |
HTML comments vulnerability allowing to execute JavaScript code BIT-drupal-2021-41165, CVE-2021-41165, GHSA-7h26-63m7-qhf2 | High | 1.6% | 17 Nov, 2021 | Packagist ckeditor/ckeditor npm ckeditor4 |
Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML BIT-drupal-2021-41164, CVE-2021-41164, GHSA-pvmx-g8h5-cprj | High | 1.3% | 17 Nov, 2021 | npm ckeditor4 |
Insufficient Session Expiration in @cyyynthia/tokenize GHSA-jcjx-c3j3-44pr | High | Not scored | 10 Nov, 2021 | npm @cyyynthia/tokenize |
Signature verification vulnerability in Stark Bank ecdsa libraries GHSA-9wx7-jrvc-28mm | High | Not scored | 08 Nov, 2021 | Maven com.starkbank:ecdsa-java NuGet starkbank-ecdsa PyPI starkbank-ecdsa npm starkbank-ecdsa |
Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server) GHSA-qm7x-rc44-rrqw | High | Not scored | 08 Nov, 2021 | npm apollo-server |
Obsidian Dataview vulnerable to code injection due to unsafe eval CVE-2021-42057, GHSA-xfg5-vrmc-24wc | High | 1.2% | 04 Nov, 2021 | npm obsidian-dataview |