Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
GraphiQL introspection schema template injection attack CVE-2021-41248, GHSA-x4r7-m2q9-69c8 | High | 1.3% | 04 Nov, 2021 | npm graphiql |
XSS vulnerability in GraphQL Playground from untrusted schemas CVE-2021-41249, GHSA-59r9-6jp6-jcm7 | High | 1.2% | 04 Nov, 2021 | npm graphql-playground-react |
Inefficient Regular Expression Complexity in validator.js CVE-2021-3765, GHSA-qgmg-gppg-76g5 | High | 1.8% | 02 Nov, 2021 | npm validator |
Embedded malware in ua-parser-js CVE-2021-4229, GHSA-pjwm-rvh2-c87w | High | 1.5% | 22 Oct, 2021 | npm ua-parser-js |
modern-async's `forEachSeries` and `forEachLimit` functions do not limit the number of requests CVE-2021-41167, GHSA-3pcq-34w5-p4g2 | High | 1.7% | 20 Oct, 2021 | npm modern-async |
Cross Site Request Forgery in kindeditor CVE-2021-42228, GHSA-3ww4-cp53-6g2x | High | 1.0% | 14 Oct, 2021 | npm kindeditor |
Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API CVE-2021-39184, GHSA-mpjm-v997-c4h4 | High | 1.1% | 12 Oct, 2021 | npm electron |
DOS and Open Redirect with user input CVE-2021-22964, GHSA-pgh6-m65r-2rhq | High | 1.0% | 12 Oct, 2021 | npm fastify-static |
LiveQuery publishes user session tokens in parse-server BIT-parse-2021-41109, CVE-2021-41109, GHSA-7pr3-p5fm-8r9x | High | 1.2% | 30 Sep, 2021 | npm parse-server |
Inefficient Regular Expression Complexity in handsontable CVE-2021-23446, GHSA-hf66-r44g-p7j9 | High | 3.0% | 29 Sep, 2021 | npm handsontable |
Regular Expression Denial of Service in jsoneditor CVE-2021-3822, GHSA-hhfg-6hfc-rvxm | High | 1.4% | 27 Sep, 2021 | npm jsoneditor |
inflect vulnerable to Inefficient Regular Expression Complexity CVE-2021-3820, GHSA-x55w-vjjp-222r | High | 1.2% | 27 Sep, 2021 | npm i |
Clipboard-based XSS CVE-2021-41086, GHSA-qh7x-j4v8-qw5w | High | 0.9% | 21 Sep, 2021 | npm jsuites |
Prototype Pollution in mixme GHSA-84p7-fh9c-6g8h | High | Not scored | 20 Sep, 2021 | npm mixme |
Inefficient Regular Expression Complexity in code-server CVE-2021-3810, GHSA-49x3-8228-3w3m | High | 1.3% | 17 Sep, 2021 | npm code-server |
Inefficient Regular Expression Complexity in chalk/ansi-regex CVE-2021-3807, GHSA-93q8-gq69-wqmw | High | 3.6% | 17 Sep, 2021 | npm ansi-regex |
Inefficient Regular Expression Complexity in taro CVE-2021-3804, GHSA-468q-v4jj-485h | High | 1.3% | 17 Sep, 2021 | npm @tarojs/helper |
Inefficient Regular Expression Complexity in nth-check CVE-2021-3803, GHSA-rp65-9cf3-cjxr | High | 2.2% | 17 Sep, 2021 | npm nth-check |
Prototype Pollution in object-path CVE-2021-3805, GHSA-8v63-cqqc-6r2c | High | 2.0% | 17 Sep, 2021 | npm object-path |
semver-regex Regular Expression Denial of Service (ReDOS) CVE-2021-3795, GHSA-44c6-4v22-4mhx | High | 1.5% | 15 Sep, 2021 | npm semver-regex |
Inefficient Regular Expression Complexity in vuelidate CVE-2021-3794, GHSA-vvf2-ppj9-pp49 | High | 1.2% | 15 Sep, 2021 | npm @vuelidate/validators |
tmpl vulnerable to Inefficient Regular Expression Complexity which may lead to resource exhaustion CVE-2021-3777, GHSA-jgrx-mgxx-jf9v | High | 1.3% | 15 Sep, 2021 | npm tmpl |
Incorrect version tags linked to external repository BIT-parse-2021-47986, BIT-parse-2021-47987, CVE-2021-47986, CVE-2021-47987, GHSA-593v-wcqx-hq2w | High | 0.2% | 07 Sep, 2021 | npm parse-server |
Parse Server crashes with query parameter BIT-parse-2021-39187, CVE-2021-39187, GHSA-xqp8-w826-hh6x | High | 1.8% | 02 Sep, 2021 | npm parse-server |
Remote code execution in Eclipse Theia CVE-2021-34435, GHSA-v9w2-v7j9-rjpr | High | 0.6% | 01 Sep, 2021 | npm @theia/mini-browser |
Prototype Pollution in Proto CVE-2021-23426, GHSA-58g2-9fqr-36q2 | High | 0.9% | 01 Sep, 2021 | npm Proto |
Path traversal in atlasboard CVE-2021-39109, GHSA-25pr-6pr6-68v7 | High | 1.7% | 01 Sep, 2021 | npm atlasboard |
Missing Release of Memory after Effective Lifetime in detect-character-encoding CVE-2021-39176, GHSA-5rwj-j5m3-3chj | High | 1.9% | 31 Aug, 2021 | npm detect-character-encoding |
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links CVE-2021-37701, GHSA-9r2w-394v-53qc | High | 3.3% | 31 Aug, 2021 | npm tar |
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links CVE-2021-37712, GHSA-qq89-hq3f-393p | High | 1.9% | 31 Aug, 2021 | npm tar |
Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization CVE-2021-37713, GHSA-5955-9wpr-37jh | High | 1.3% | 31 Aug, 2021 | npm tar |
@npmcli/arborist vulnerable to UNIX Symbolic Link (Symlink) Following CVE-2021-39134, GHSA-2h3h-q99f-3fhc | High | 0.6% | 31 Aug, 2021 | npm @npmcli/arborist |
UNIX Symbolic Link (Symlink) Following in @npmcli/arborist CVE-2021-39135, GHSA-gmw6-94gg-2rc2 | High | 0.6% | 31 Aug, 2021 | npm @npmcli/arborist |
axios Inefficient Regular Expression Complexity vulnerability CVE-2021-3749, GHSA-cph5-m8f7-6c5x | High | 8.5% | 31 Aug, 2021 | npm axios |
XSS in Image Optimization API for Next.js CVE-2021-39178, GHSA-9gr3-7897-pp7m | High | 1.1% | 31 Aug, 2021 | npm next |
Code Injection in total.js CVE-2021-32831, GHSA-vwhc-pww7-72x6 | High | 1.5% | 30 Aug, 2021 | npm total.js |
Unlimited transforms allowed for signed nodes CVE-2021-39171, GHSA-5379-r78w-42h2 | High | 1.3% | 27 Aug, 2021 | npm passport-saml |
Prototype Pollution in object-path CVE-2021-23434, GHSA-v39p-96qg-c8rf | High | 1.9% | 27 Aug, 2021 | npm object-path |
Improper Handling of Exceptional Conditions in detect-character-encoding CVE-2021-39157, GHSA-jqfh-8hw5-fqjr | High | 2.1% | 24 Aug, 2021 | npm detect-character-encoding |
Cross-site Request Forgery (CSRF) in joplin CVE-2021-23431, GHSA-gjwp-7v3g-99pj, SNYK-JS-JOPLIN-1325537 | High | 0.4% | 24 Aug, 2021 | npm joplin |
Directory Traversal in startserver CVE-2021-23430, GHSA-hqv3-qq72-78cv | High | 1.8% | 24 Aug, 2021 | npm startserver |
Uncontrolled Resource Consumption in transpile CVE-2021-23429, GHSA-7xrj-f5rp-j55h | High | 1.0% | 24 Aug, 2021 | npm transpile |
Uncontrolled Resource Consumption in ansi-html CVE-2021-23424, GHSA-whgm-jr23-g3j9 | High | 1.8% | 18 Aug, 2021 | npm ansi-html |
Improper Handling of Unexpected Data Type in ced CVE-2021-39131, GHSA-27wq-qx3q-fxm9 | High | 1.9% | 17 Aug, 2021 | npm ced |
Command injection in @diez/generation CVE-2021-32830, GHSA-8c3f-x5f9-6h62 | High | 1.9% | 17 Aug, 2021 | npm @diez/generation |
Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML. CVE-2021-37695, GHSA-m94c-37g6-cjhc | High | 1.3% | 13 Aug, 2021 | npm ckeditor4 |
Cross-Site Request Forgery in express-cart CVE-2020-22403, GHSA-h5q8-5697-9p9h | High | 0.6% | 12 Aug, 2021 | npm express-cart |
Widget feature vulnerability allowing to execute JavaScript code using undo functionality CVE-2021-32808, GHSA-6226-h7ff-ch6c | High | 1.2% | 12 Aug, 2021 | npm ckeditor4 |
Code injection issue for java-spring-cloud-stream-template CVE-2021-37694, GHSA-xj6r-2jpm-qvxp | High | 0.9% | 11 Aug, 2021 | npm @asyncapi/java-spring-cloud-stream-template |
Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization CVE-2021-32804, GHSA-3jfq-g458-7qm9 | High | 15.1% | 03 Aug, 2021 | npm tar |