Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Directory traversal in fast-http CVE-2020-7687, GHSA-7phr-5m9x-rw9q | High | 1.8% | 25 Jul, 2020 | npm fast-http |
Directory traversal in rollup-plugin-server CVE-2020-7686, GHSA-vr98-27qj-3c8q | High | 1.8% | 25 Jul, 2020 | npm rollup-plugin-server |
Directory traversal in rollup-plugin-server CVE-2020-7683, GHSA-34gh-3cwv-wvp2 | High | 1.8% | 25 Jul, 2020 | npm rollup-plugin-server |
Path Traversal in marked-tree CVE-2020-7682, GHSA-xr8h-53xr-jhcm | High | 1.7% | 25 Jul, 2020 | npm marked-tree |
Path Traversal in marscode CVE-2020-7681, GHSA-8pww-pp5r-rff8 | High | 1.7% | 25 Jul, 2020 | npm marscode |
Improper Input Validation in sails-hook-sockets CVE-2018-21036, GHSA-f7f4-hqp2-7prc | High | 1.8% | 21 Jul, 2020 | npm sails-hook-sockets |
Path traversal in servey CVE-2020-8214, GHSA-v3px-6cc8-f8j3 | High | 2.0% | 20 Jul, 2020 | npm servey |
Buffer overflow in canvas CVE-2020-8215, GHSA-73rg-x683-m3qw | High | 2.3% | 20 Jul, 2020 | npm canvas |
Server-Side Request Forgery in @uppy/companion CVE-2020-8205, GHSA-9m4x-8w29-r78g | High | 1.2% | 20 Jul, 2020 | npm @uppy/companion |
Prototype Pollution in lodash CVE-2020-8203, GHSA-p6mc-m468-83gw | High | 5.2% | 15 Jul, 2020 | RubyGems lodash-rails npm lodash npm lodash-es npm lodash.pick +4 more |
Stored XSS in TimelineJS3 CVE-2020-15092, GHSA-2jpm-827p-j44g | High | 1.1% | 09 Jul, 2020 | npm @knight-lab/timelinejs |
Path Traversal in socket.io-file CVE-2020-15779, GHSA-9h4g-27m8-qjrg | High | 1.6% | 07 Jul, 2020 | npm socket.io-file |
Arbitrary file read via window-open IPC in Electron CVE-2020-4075, GHSA-f9mq-jph6-9mhm | High | 1.2% | 07 Jul, 2020 | npm electron |
OS Command Injection in mversion CVE-2020-7688, GHSA-6m8p-4fxj-pgc2, SNYK-JS-MVERSION-573174 | High | 0.5% | 01 Jul, 2020 | npm mversion |
Integer Overflow or Wraparound and Use of a Broken or Risky Cryptographic Algorithm in bcrypt CVE-2020-7689, GHSA-5wg4-74h6-q47v, SNYK-JS-BCRYPT-572911 | High | 0.8% | 01 Jul, 2020 | npm bcrypt |
Command Injection in Limdu CVE-2020-4066, GHSA-77qv-gh6f-pgh4 | High | 1.6% | 22 Jun, 2020 | npm limdu |
ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign CVE-2020-14966, GHSA-p8c3-7rj8-q963 | High | 1.1% | 22 Jun, 2020 | npm jsrsasign |
Command injection in mversion CVE-2020-4059, GHSA-qjg4-w4c6-f6c6 | High | 2.6% | 18 Jun, 2020 | npm mversion |
MJML vulnerable to path traversal CVE-2020-12827, GHSA-4hch-r9xf-6vfr | High | 2.7% | 17 Jun, 2020 | npm mjml |
Information disclosure in SSB-DB CVE-2020-4045, GHSA-mpgr-2cx9-327h | High | 1.3% | 11 Jun, 2020 | npm ssb-db |
Code Injection in mosc CVE-2020-7672, GHSA-j665-rvj7-2jv9 | High | 2.0% | 10 Jun, 2020 | npm mosc |
Reflected XSS in GraphQL Playground CVE-2020-4038, GHSA-4852-vrh7-28rf | High | 7.2% | 08 Jun, 2020 | npm graphql-playground-html |
Regular expression denial of service in url-regex CVE-2020-7661, GHSA-v4rh-8p82-6h5w | High | 2.7% | 04 Jun, 2020 | npm url-regex |
Signature Malleabillity in elliptic CVE-2020-13822, GHSA-vh7m-p724-62c2 | High | 2.7% | 04 Jun, 2020 | npm elliptic |
Regular Expression Denial of Service in websocket-extensions (NPM package) CVE-2020-7662, GHSA-g78m-2chm-r7qv, SNYK-JS-WEBSOCKETEXTENSIONS-570623 | High | 3.1% | 02 Jun, 2020 | npm websocket-extensions |
Insecure serialization leading to RCE in serialize-javascript CVE-2020-7660, GHSA-hxcc-f52p-wc94 | High | 3.0% | 01 Jun, 2020 | npm serialize-javascript |
Information Exposure in Snyk Broker CVE-2020-7654, GHSA-mgh5-4h95-qj4p, SNYK-JS-SNYKBROKER-570613 | High | 1.1% | 29 May, 2020 | npm snyk-broker |
DLL Injection in kerberos CVE-2020-13110, GHSA-m2mx-rfpw-jghv | High | 0.7% | 16 May, 2020 | npm kerberos |
Http request which redirect to another hostname do not strip authorization header in @actions/http-client CVE-2020-11021, GHSA-9w6v-m7wp-jwg4 | High | 1.8% | 29 Apr, 2020 | npm @actions/http-client |
Uncontrolled Resource Consumption in fun-map CVE-2020-7644, GHSA-p33m-7w7f-gmj8, SNYK-JS-FUNMAP-564436 | High | 1.2% | 28 Apr, 2020 | npm fun-map |
CSRF and DNS Rebinding in Oasis CVE-2020-11003, GHSA-j438-45hc-vjhm | High | 0.5% | 14 Apr, 2020 | npm @fraction/oasis |
Information disclosure through error object in auth0.js CVE-2020-5263, GHSA-prfq-f66g-43mp | High | 0.9% | 09 Apr, 2020 | npm auth0-js |
xdlocalstorage does not verify request origin CVE-2020-11610, GHSA-mr5m-2385-2vcp | High | 1.4% | 07 Apr, 2020 | npm xdlocalstorage |
Improper Input Validation in xdLocalStorage CVE-2015-9545, GHSA-76qm-4f93-fg6f | High | 1.3% | 07 Apr, 2020 | npm xdLocalStorage npm xdlocalstorage |
Improper Input Validation in xdLocalStorage CVE-2015-9544, GHSA-vrc7-6g8w-jh56 | High | 1.3% | 07 Apr, 2020 | npm xdLocalStorage npm xdlocalstorage |
OS Command Injection in fsa CVE-2020-7615, GHSA-3p94-vj97-fm4q | High | 1.1% | 07 Apr, 2020 | npm fsa |
Clamscan vulnerable to command injection CVE-2020-7613, GHSA-5v25-xr56-phph, SNYK-JS-CLAMSCAN-564113 | High | 2.1% | 07 Apr, 2020 | npm clamscan |
Regular Expression Denial of Service in Acorn GHSA-6chw-6frg-f759 | High | Not scored | 03 Apr, 2020 | npm acorn |
Open Redirect in ecstatic GHSA-9q64-mpxx-87fg | High | Not scored | 01 Apr, 2020 | npm ecstatic |
Incorrect Account Used for Signing GHSA-vg44-fw64-cpjx | High | Not scored | 24 Mar, 2020 | npm @metamask/eth-ledger-bridge-keyring npm eth-ledger-bridge-keyring |
Machine-In-The-Middle in lix CVE-2020-10800, GHSA-q8xg-8xwf-m598 | High | 1.4% | 21 Mar, 2020 | npm lix |
Uncontrolled Resource Consumption in fastify-multipart CVE-2020-8136, GHSA-p9f8-gqjf-m75j | High | 1.5% | 20 Mar, 2020 | npm fastify-multipart |
Server-side request forgery in Ghost CMS BIT-ghost-2020-8134, CVE-2020-8134, GHSA-q4h8-7qff-gh6c | High | 1.2% | 20 Mar, 2020 | npm ghost |
Improper Control of Generation of Code in doT CVE-2020-8141, GHSA-297x-8xj4-vcxv | High | 2.2% | 15 Mar, 2020 | npm dot |
Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify CVE-2019-10808, GHSA-9534-h433-2rjf | High | 2.0% | 11 Mar, 2020 | npm utilitify |
Prototype Pollution in Dojox CVE-2020-5259, GHSA-3hw5-q855-g6cw | High | 2.0% | 10 Mar, 2020 | npm dojox |
Prototype pollution in dojo CVE-2020-5258, GHSA-jxfh-8wgv-vfr2 | High | 4.0% | 10 Mar, 2020 | npm dojo |
Insufficient Verification of Data Authenticity in Eclipse Theia CVE-2019-17636, GHSA-f7vx-j8mp-3h2x | High | 0.6% | 10 Mar, 2020 | npm @theia/mini-browser |
Holder can (re)create authentic credentials after receiving a credential in vp-toolkit GHSA-p94w-42g3-f7h4 | High | Not scored | 06 Mar, 2020 | npm vp-toolkit |
Holder can generate proof of ownership for credentials it does not control in vp-toolkit GHSA-ff5x-w9wg-h275 | High | Not scored | 06 Mar, 2020 | npm vp-toolkit |