Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Denial of Service in serialize-to-js GHSA-w5q7-3pr9-x44w | High | Not scored | 02 Sep, 2020 | npm serialize-to-js |
Arbitrary File Overwrite in decompress-zip GHSA-73v8-v6g4-vrpm | High | Not scored | 02 Sep, 2020 | npm decompress-zip |
Remote Code Execution in pi_video_recording GHSA-9wjh-jr2j-6r4x | High | Not scored | 02 Sep, 2020 | npm pi_video_recording |
Improper Authorization in loopback GHSA-8wgc-jjvv-cv6v | High | Not scored | 02 Sep, 2020 | npm loopback |
Cross-Site Scripting in bootstrap-vue GHSA-c7pp-x73h-4m2v | High | Not scored | 02 Sep, 2020 | npm bootstrap-vue |
NoSQL Injection in loopback-connector-mongodb GHSA-hxwc-5vw9-2w4w | High | Not scored | 02 Sep, 2020 | npm loopback-connector-mongodb |
Cross-Site Scripting in semantic-ui-search GHSA-p9vv-3945-x93h | High | Not scored | 02 Sep, 2020 | npm semantic-ui-search |
Sandbox Breakout / Arbitrary Code Execution in static-eval GHSA-x9hc-rw35-f44h | High | Not scored | 02 Sep, 2020 | npm static-eval |
Remote Code Execution in office-converter GHSA-9p64-h5q4-phpm | High | Not scored | 02 Sep, 2020 | npm office-converter |
Remote Code Execution in pomelo-monitor GHSA-m5ch-gx8g-rg73 | High | Not scored | 02 Sep, 2020 | npm pomelo-monitor |
Sensitive Data Exposure in rails-session-decoder GHSA-44vf-8ffm-v2qh | High | Not scored | 02 Sep, 2020 | npm rails-session-decoder |
Cross-Site Scripting in mermaid GHSA-w32g-5hqp-gg6q | High | Not scored | 02 Sep, 2020 | npm mermaid |
Denial of Service in markdown-it-toc-and-anchor GHSA-x6m6-5hrf-fh6r | High | Not scored | 01 Sep, 2020 | npm markdown-it-toc-and-anchor |
Cross-Site Scripting in jingo GHSA-mpjf-8cmf-p789 | High | Not scored | 01 Sep, 2020 | npm jingo |
Cross-Site Scripting in md-data-table GHSA-hgr5-82rc-p936 | High | Not scored | 01 Sep, 2020 | npm md-data-table |
Cross-Site Scripting in buefy GHSA-xwqw-rf2q-xmhf | High | Not scored | 01 Sep, 2020 | npm buefy |
Entropy Backdoor in text-qrcode GHSA-h5vj-f7r9-w564 | High | Not scored | 01 Sep, 2020 | npm text-qrcode |
NoSQL injection in express-cart GHSA-f5cv-xrv9-r8w7 | High | Not scored | 01 Sep, 2020 | npm express-cart |
Path Traversal in express-cart GHSA-8h8v-6qqm-fwpq | High | Not scored | 01 Sep, 2020 | npm express-cart |
Cross-Site Scripting in react-marked-markdown GHSA-m7qm-r2r5-f77q | High | Not scored | 01 Sep, 2020 | npm react-marked-markdown |
Byass due to validation before canonicalization in serve GHSA-wm7q-rxch-43mx | High | Not scored | 01 Sep, 2020 | npm serve |
Cross-Site Scripting in mrk.js GHSA-hpr5-wp7c-hh5q | High | Not scored | 01 Sep, 2020 | npm mrk.js |
Directory Traversal in @vivaxy/here GHSA-m4vv-p6fq-jhqp | High | Not scored | 01 Sep, 2020 | npm @vivaxy/here |
Directory Traversal in yjmyjmyjm GHSA-g376-whg7-896m | High | Not scored | 01 Sep, 2020 | npm yjmyjmyjm |
Directory Traversal in nodeload-nmickuli GHSA-wmcq-3wfx-qjx5 | High | Not scored | 01 Sep, 2020 | npm nodeload-nmickuli |
Directory Traversal in wenluhong1 GHSA-224h-p7p5-rh85 | High | Not scored | 01 Sep, 2020 | npm wenluhong1 |
fury-adapter-swagger allows arbitrary file read from system CVE-2016-1000249, GHSA-2r7f-4h2c-5x73 | High | Not scored | 01 Sep, 2020 | npm fury-adapter-swagger |
Denial of Service in mqtt CVE-2016-1000242, GHSA-hg78-c92r-hvwr | High | Not scored | 01 Sep, 2020 | npm mqtt |
Cross-Site Scripting (XSS) in pivottable CVE-2016-1000241, GHSA-cjj8-wfrx-jqcf | High | Not scored | 01 Sep, 2020 | npm pivottable |
fuelux vulnerable to Cross-Site Scripting in Pillbox feature CVE-2016-1000235, GHSA-fwcw-5qw2-87mp | High | Not scored | 01 Sep, 2020 | npm fuelux |
Cross-Site Scripting in swagger-ui CVE-2016-1000233, GHSA-mrx7-8hxf-f853 | High | Not scored | 01 Sep, 2020 | npm swagger-ui |
Cross-Site Scripting in jqtree CVE-2016-1000234, GHSA-gjhx-gxwx-jx9j | High | Not scored | 01 Sep, 2020 | npm jqtree |
Cross-Site Scripting in emojione CVE-2016-1000231, GHSA-46m8-42hm-wvvw | High | Not scored | 01 Sep, 2020 | npm emojione |
XSS in client rendered block templates in rendr CVE-2016-1000230, GHSA-v5hp-35hw-cw5x | High | Not scored | 01 Sep, 2020 | npm rendr |
DOM-based XSS in gmail-js CVE-2016-1000228, GHSA-c7pp-g2v2-2766 | High | Not scored | 01 Sep, 2020 | npm gmail-js |
Cross-Site Scripting in bootstrap-tagsinput CVE-2016-1000227, GHSA-v2jq-9475-r5g8 | High | Not scored | 01 Sep, 2020 | npm bootstrap-tagsinput |
Forgeable Public/Private Tokens in jws CVE-2016-1000223, GHSA-gjcw-v447-2w7q | High | Not scored | 01 Sep, 2020 | npm jws |
Denial of Service in yar CVE-2014-4179, GHSA-gg6m-fhqv-hg56 | High | Not scored | 01 Sep, 2020 | npm yar |
Prototype Pollution in node-forge CVE-2020-7720, GHSA-92xj-mqp7-vmcj | High | 3.2% | 01 Sep, 2020 | npm node-forge |
Regular Expression Denial of Service in validator CVE-2014-8882, GHSA-f5w6-r7rg-mcgq | High | Not scored | 31 Aug, 2020 | npm validator |
Unauthenticated Remote Command Injection in ep_imageconvert CVE-2013-3364, GHSA-28gr-86hg-r48w | High | Not scored | 31 Aug, 2020 | npm ep_imageconvert |
trentm/json vulnerable to command injection CVE-2020-7712, GHSA-3c6g-pvg8-gqw2 | High | 3.1% | 30 Aug, 2020 | Maven org.webjars.npm:json npm json |
XSS due to lack of CSRF validation for replying/publishing CVE-2020-15156, GHSA-43m5-c88r-cjvv | High | 0.6% | 26 Aug, 2020 | npm nodebb-plugin-blog-comments |
Improper exception handling in Aedes CVE-2020-13410, GHSA-gh78-48h3-frjq | High | 2.2% | 26 Aug, 2020 | npm aedes |
Cross-Site Scripting in highcharts GHSA-gr4j-r575-g665 | High | Not scored | 25 Aug, 2020 | npm highcharts |
Cross-Site Scripting in @progress/kendo-angular-editor GHSA-j7wp-vjj6-cp5m | High | Not scored | 11 Aug, 2020 | npm @progress/kendo-angular-editor |
Cross-Site Scripting in Prism CVE-2020-15138, GHSA-wvhm-4hhf-97x9 | High | 2.0% | 07 Aug, 2020 | npm prismjs |
CSRF vulnerability in save-server CVE-2020-15135, GHSA-wwrj-35w6-77ff | High | 0.7% | 04 Aug, 2020 | npm save-server |
Authorization header is not sanitized in an error object in auth0 CVE-2020-15125, GHSA-5jpf-pj32-xx53 | High | 1.5% | 29 Jul, 2020 | npm auth0 |
Command Injection in git-tags-remote GHSA-gm9x-q798-hmr4 | High | Not scored | 29 Jul, 2020 | npm git-tags-remote |