Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning CVE-2021-32803, GHSA-r628-mhmh-qjhw | High | 7.8% | 03 Aug, 2021 | npm tar |
Improperly Controlled Modification of Object Prototype Attributes GHSA-6cj2-92m5-7mvp | High | Not scored | 03 Aug, 2021 | npm think-config |
Privilege escalation: all users can access Admin-level API keys BIT-ghost-2021-39192, CVE-2021-39192, GHSA-j5c2-hm46-wp5c | High | 1.0% | 22 Jul, 2021 | npm ghost |
Basic-auth app bundle credential exposure in gatsby-source-wordpress CVE-2021-32770, GHSA-rqjw-p5vr-c695 | High | 1.4% | 15 Jul, 2021 | npm gatsby-source-wordpress |
Improper Input Validation in is-email CVE-2021-36716, GHSA-j377-2x76-558h | High | 1.0% | 14 Jul, 2021 | npm is-email |
Prototype Pollution in think-helper CVE-2021-32736, GHSA-vr5m-3h59-7jcp | High | 1.0% | 30 Jun, 2021 | npm think-helper |
Header injection in nodemailer CVE-2021-23400, GHSA-hwqf-gcqm-7353 | High | 1.4% | 29 Jun, 2021 | npm nodemailer |
Regular Expression Denial of Service (ReDoS) in Prism CVE-2021-32723, GHSA-gj77-59wh-66hg | High | 1.4% | 28 Jun, 2021 | npm prismjs |
Reflected XSS from the callback handler's error query parameter CVE-2021-32702, GHSA-954c-jjx6-cxv7 | High | 1.4% | 25 Jun, 2021 | npm @auth0/nextjs-auth0 |
Cross-site scripting CVE-2021-21422, GHSA-7p8h-86p5-wv3p | High | 1.6% | 21 Jun, 2021 | npm mongo-express |
ReDOS in IS-SVG CVE-2021-29059, GHSA-r8j5-h5cx-65gg | High | 2.6% | 21 Jun, 2021 | npm is-svg |
Prototype pollution in supermixer CVE-2020-24939, GHSA-7prf-vw4p-qr59 | High | 1.7% | 16 Jun, 2021 | npm supermixer |
Prototype Pollution in nedb CVE-2021-23395, GHSA-339j-hqgx-qrrx | High | 0.9% | 15 Jun, 2021 | npm nedb |
Uncontrolled Resource Consumption in locutus CVE-2021-23392, GHSA-39q4-p535-c852, SNYK-JS-LOCUTUS-1090597 | High | 1.9% | 08 Jun, 2021 | npm locutus |
Calipso Arbitrary File Write via Archive Extraction (Zip Slip) CVE-2021-23391, GHSA-jxcc-g75x-qgw9 | High | 0.4% | 07 Jun, 2021 | npm calipso |
Reflected XSS when using flashMessages or languageDictionary CVE-2021-32641, GHSA-jr3j-whm4-9wwm | High | 1.5% | 04 Jun, 2021 | npm auth0-lock |
Script injection CVE-2021-32661, GHSA-gg96-f8wr-p89f | High | 1.2% | 03 Jun, 2021 | npm @backstage/plugin-techdocs |
Script injection CVE-2021-32660, GHSA-pwhf-39xg-4rxw | High | 1.3% | 03 Jun, 2021 | npm @backstage/techdocs-common |
glob-parent vulnerable to Regular Expression Denial of Service in enclosure regex BIT-gulp-2020-28469, CVE-2020-28469, GHSA-ww39-953v-wcq6 | High | 4.6% | 03 Jun, 2021 | npm glob-parent |
Regular expression denial of service in react-native CVE-2020-1920, GHSA-7f53-fmmv-mfjv | High | 1.4% | 01 Jun, 2021 | npm react-native |
Denial of service in css-what CVE-2021-33587, GHSA-q8pj-2vqx-8ggc | High | 2.0% | 28 May, 2021 | npm css-what |
constructEvent does not verify header GHSA-4g53-vp7q-gfjv | High | Not scored | 28 May, 2021 | npm @worker-tools/stripe-webhook |
Uncontrolled Resource Consumption in trim-newlines CVE-2021-33623, GHSA-7p7h-4mm5-852v | High | 2.9% | 28 May, 2021 | npm trim-newlines |
Arbitrary Code Execution in json-ptr GHSA-rrqv-vjrw-hrcr | High | Not scored | 26 May, 2021 | npm json-ptr |
Private Field data leak CVE-2021-32624, GHSA-27g8-r9vw-765x | High | 0.9% | 24 May, 2021 | npm @keystonejs/keystone |
ReDoS in normalize-url CVE-2021-33502, GHSA-px4h-xg32-q955 | High | 1.7% | 24 May, 2021 | npm normalize-url |
Potential memory exposure in dns-packet CVE-2021-23386, GHSA-3wcq-x3mq-6r9p | High | 1.4% | 20 May, 2021 | npm dns-packet |
Improper file handling in matrix-react-sdk CVE-2021-32622, GHSA-8796-gc9j-63rv, GHSA-cg57-p69r-3m7p | High | 0.4% | 17 May, 2021 | npm matrix-react-sdk |
Insecure template handling in Express-handlebars BIT-handlebars-2021-32820, CVE-2021-32820, GHSA-fr76-2wp8-fp92 | High | 15.7% | 14 May, 2021 | npm express-handlebars |
Insecure template handling in Squirrelly CVE-2021-32819, GHSA-q8j6-pwqx-pm96 | High | 58.3% | 14 May, 2021 | npm squirrelly |
Insecure template handling in haml-coffee CVE-2021-32818, GHSA-m7mf-vm62-7x3q | High | 0.7% | 14 May, 2021 | npm haml-coffee |
Weak Password Recovery Mechanism for Forgotten Password in Strapi CVE-2021-28128, GHSA-37hx-4mcq-wc3h | High | 1.3% | 06 May, 2021 | npm strapi |
Command injection in git-parse CVE-2021-26543, GHSA-m744-2jj8-vpfv | High | 2.5% | 06 May, 2021 | npm git-parse |
Options structure open to Cross-site Scripting if passed unfiltered CVE-2021-29489, GHSA-8j65-4pcq-xq95 | High | 0.9% | 05 May, 2021 | npm highcharts |
Arbitrary code execution in ExifTool GHSA-4whq-r978-2x68 | High | Not scored | 04 May, 2021 | npm exiftool-vendored |
Regular Expression Denial of Service in path-parse CVE-2021-23343, GHSA-hj48-42vr-x3v9 | High | 2.2% | 04 May, 2021 | npm path-parse |
cumulative-distribution-function Infinite Loop vulnerability CVE-2021-29486, GHSA-58qp-5328-v7mh | High | 2.0% | 30 Apr, 2021 | npm cumulative-distribution-function |
Regular Expression Denial of Service in postcss CVE-2021-23382, GHSA-566m-qj78-rww5 | High | 2.6% | 26 Apr, 2021 | npm postcss |
Prototype Pollution in jquery-bbq CVE-2021-20086, GHSA-7w8j-85wm-6xfq | High | 6.1% | 23 Apr, 2021 | npm jquery-bbq |
Prototype Pollution in backbone-query-parameters CVE-2021-20085, GHSA-8qpm-5c82-rf96 | High | 1.6% | 23 Apr, 2021 | npm backbone-query-parameters |
jquery-plugin-query-object contains prototype pollution vulnerability CVE-2021-20083, GHSA-q9xg-h756-8689 | High | 4.2% | 23 Apr, 2021 | npm jquery-query-object |
Node-Redis potential exponential regex in monitor mode CVE-2021-29469, GHSA-35q2-47q7-3pc3 | High | 1.6% | 23 Apr, 2021 | npm redis |
mootools-more vulnerable to prototype pollution CVE-2021-20088, GHSA-fw45-938v-p26j | High | 1.4% | 23 Apr, 2021 | npm mootools-more |
Prototype Pollution in jquery-deparam CVE-2021-20087, GHSA-xg68-chx2-253g | High | 2.1% | 23 Apr, 2021 | npm jquery-deparam |
Arbitrary command execution in roar-pidusage CVE-2021-23380, GHSA-xfxf-qw26-hr33 | High | 1.2% | 18 Apr, 2021 | npm roar-pidusage |
Any logged in user could edit any other logged in user. CVE-2021-29452, GHSA-8hw9-22v6-9jr9 | High | 0.8% | 16 Apr, 2021 | npm @curveball/a12n-server |
Broken Authentication in Atlassian Connect Express CVE-2021-26073, GHSA-4v96-m8xv-x83v | High | 0.9% | 16 Apr, 2021 | npm atlassian-connect-express |
Improper Privilege Management in Azure ms-rest-nodeauth CVE-2021-28458, GHSA-qpfw-4m9x-rxx8 | High | 2.0% | 13 Apr, 2021 | npm @azure/ms-rest-nodeauth |
Denial of Service (DoS) in mongo-express CVE-2021-23372, GHSA-m2r3-8492-vx59 | High | 0.9% | 13 Apr, 2021 | npm mongo-express |
Denial of service in chrono-node CVE-2021-23371, GHSA-hpmr-g4pq-jhgp, SNYK-JS-CHRONONODE-1083228 | High | 2.0% | 12 Apr, 2021 | npm chrono-node |