Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Information disclosure in parse-server BIT-parse-2020-5251, CVE-2020-5251, GHSA-h4mf-75hf-67w4 | High | 0.8% | 04 Mar, 2020 | npm parse-server |
Exposure of Resource to Wrong Sphere in valib CVE-2019-10805, GHSA-pmpr-vc5q-h3jw, SNYK-JS-VALIB-559015 | High | 1.4% | 28 Feb, 2020 | npm valib |
OS Command Injection in compile-sass CVE-2019-10799, GHSA-79qm-h35f-hr77, SNYK-JS-COMPILESASS-551804 | High | 2.3% | 24 Feb, 2020 | npm compile-sass |
discord-html not escaping HTML code blocks when lacking a language identifier GHSA-9r27-994c-4xch | High | Not scored | 24 Feb, 2020 | npm discord-markdown |
Path Traversal in Yarn CVE-2020-8131, GHSA-8mfc-v7wv-p62g | High | 5.2% | 24 Feb, 2020 | npm yarn |
Denial of Service in uap-core when processing crafted User-Agent strings CVE-2020-5243, GHSA-cmcx-xhr8-3w9p | High | 2.3% | 20 Feb, 2020 | RubyGems user_agent_parser npm uap-core |
TaffyDB can allow access to any data items in the DB CVE-2019-10790, GHSA-mxhp-79qh-mcx6 | High | 1.9% | 17 Feb, 2020 | npm taffy npm taffydb |
codecov NPM module allows remote attackers to execute arbitrary commands CVE-2020-7597, GHSA-5q88-cjfq-g2mh, SNYK-JS-CODECOV-548879 | High | 2.9% | 17 Feb, 2020 | npm codecov |
dot-prop Prototype Pollution vulnerability CVE-2020-8116, GHSA-ff7x-qrg7-qggm | High | 3.1% | 04 Feb, 2020 | npm dot-prop |
Malicious takeover of previously owned ENS names CVE-2020-5232, GHSA-8f9f-pc5v-9r5h | High | 1.2% | 30 Jan, 2020 | npm @ensdomains/ens |
Cross-site scripting vulnerability in TinyMCE CVE-2020-17480, GHSA-27gm-ghr9-4v95 | High | 1.2% | 30 Jan, 2020 | npm tinymce |
Insecure Entropy Source - Math.random() in node-uuid CVE-2015-8851, GHSA-265q-28rp-chq5 | High | 2.3% | 30 Jan, 2020 | npm node-uuid |
Improper Neutralization of Special Elements in Output Used by a Downstream Component in Codecov CVE-2020-7596, GHSA-mh2h-6j8q-x246 | High | 1.9% | 25 Jan, 2020 | npm codecov |
Remote Code Execution in Angular Expressions CVE-2020-5219, GHSA-hxhm-96pp-2m43 | High | 2.4% | 24 Jan, 2020 | npm angular-expressions |
HashBrown CMS Directory Traversal CVE-2020-5840, GHSA-q7hx-mrv5-6mrp | High | 1.5% | 06 Jan, 2020 | npm hashbrown-cms |
Cross-Site Scripting in seeftl CVE-2019-15603, GHSA-4g46-5grc-wq49 | High | 0.8% | 06 Jan, 2020 | npm seeftl |
Cross-Site Scripting in fileview CVE-2019-15602, GHSA-gvr4-7xgc-gx3w | High | 0.8% | 06 Jan, 2020 | npm fileview |
Denial of Service in ecstatic CVE-2019-10775, GHSA-jc84-3g44-wf2q | High | 1.3% | 02 Jan, 2020 | npm ecstatic |
Validation Bypass in kind-of CVE-2019-20149, GHSA-6c8f-qphg-qjgp | High | 2.3% | 30 Dec, 2019 | npm kind-of |
Cross-Site Scripting in http_server CVE-2019-15600, GHSA-754x-4jwp-cqp6 | High | 2.5% | 18 Dec, 2019 | npm http_server |
Path Traversal in statics-server CVE-2019-15596, GHSA-j27j-4w6m-8fc4 | High | 1.5% | 18 Dec, 2019 | npm statics-server |
Yarn Improper link resolution before file access (Link Following) CVE-2019-10773, GHSA-5xf4-f2fq-f69j, SNYK-JS-YARN-537806, | High | 1.5% | 16 Dec, 2019 | npm yarn |
npm Vulnerable to Global node_modules Binary Overwrite CVE-2019-16777, GHSA-4328-8hgf-7wjr | High | 2.1% | 13 Dec, 2019 | npm npm |
npm symlink reference outside of node_modules CVE-2019-16776, GHSA-x8qc-rrcw-4r46 | High | 3.4% | 13 Dec, 2019 | npm npm |
Arbitrary File Write in npm CVE-2019-16775, GHSA-m6cx-g6qm-p2cx | High | 3.3% | 13 Dec, 2019 | npm npm |
lodahs is malware CVE-2019-19771, GHSA-hm6q-r2jc-cpqh | High | 1.3% | 12 Dec, 2019 | npm lodahs |
bson-objectid contains Improper input validation CVE-2019-19729, GHSA-p84x-5xx8-hff9 | High | 1.1% | 11 Dec, 2019 | npm bson-objectid |
Command Injection in strapi CVE-2019-19609, GHSA-9p2w-rmx4-9mw7 | High | 54.1% | 05 Dec, 2019 | npm strapi |
Cross-Site Scripting in vant GHSA-9xr8-8hmc-389f | High | Not scored | 22 Nov, 2019 | npm vant |
Arbitrary File Write in iobroker.js-controller CVE-2019-10767, GHSA-cmch-296j-wfvw, SNYK-JS-IOBROKERJSCONTROLLER-534881 | High | 2.2% | 21 Nov, 2019 | npm iobroker.js-controller |
angular Prototype Pollution vulnerability CVE-2019-10768, GHSA-89mq-4x47-5v83, SNYK-JS-ANGULAR-534884 | High | 2.0% | 19 Nov, 2019 | npm angular |
Prototype Pollution in chartkick CVE-2019-18841, GHSA-5pm8-492c-92p5 | High | 1.4% | 11 Nov, 2019 | RubyGems chartkick npm chartkick |
Default Express middleware security check is ignored in production GHSA-4j6x-w426-6rc6 | High | Not scored | 08 Nov, 2019 | npm @cubejs-backend/api-gateway |
PhantomJS Arbitrary File Read CVE-2019-17221, GHSA-x43g-gj9x-838x | High | 3.4% | 05 Nov, 2019 | npm phantomjs |
Cezerin Unauthorized Acces CVE-2019-18608, GHSA-6pq6-crw9-522h | High | 1.0% | 29 Oct, 2019 | npm cezerin |
Renovate vulnerable to leakage of temporary repository tokens into Pull Request comments CVE-2019-25766, GHSA-v7x3-7hw7-pcjg | High | 0.4% | 21 Oct, 2019 | npm renovate |
Regular Expression Denial of Service in csv-parse CVE-2019-17592, GHSA-582f-p4pg-xc74 | High | 2.3% | 14 Oct, 2019 | npm csv-parse |
Buffer Overflow in centra GHSA-v6cj-r88p-92rm | High | Not scored | 30 Sep, 2019 | npm centra |
High severity vulnerability that affects generator-jhipster GHSA-mc84-xr9p-938r | High | Not scored | 23 Sep, 2019 | npm generator-jhipster |
Arbitrary File Read in html-pdf CVE-2019-15138, GHSA-x4w5-r546-x9qh | High | 1.8% | 20 Sep, 2019 | npm html-pdf |
Symlink Arbitrary File Overwrite in bower CVE-2019-5484, GHSA-p6mr-pxg4-68hx | High | 2.6% | 13 Sep, 2019 | npm bower |
Path Traversal in algo-httpserv GHSA-cgjv-rghq-qhgp | High | Not scored | 11 Sep, 2019 | npm algo-httpserv |
Total.js CMS Unauthorized Access CVE-2019-15953, GHSA-q3x9-28f7-w8rc | High | 1.5% | 05 Sep, 2019 | npm total4 |
Total.js CMS Path Traversal CVE-2019-15952, GHSA-pwvp-h579-hfxg | High | 5.1% | 05 Sep, 2019 | npm total4 |
Unintended Require in larvitbase-api CVE-2019-5479, GHSA-xf27-jqwv-gf3r | High | 1.3% | 03 Sep, 2019 | npm larvitbase-api |
SQL Injection in connect-pg-simple CVE-2019-15658, GHSA-xqh8-5j36-4556 | High | 1.0% | 26 Aug, 2019 | npm connect-pg-simple |
Improper Key Verification in openpgp CVE-2019-9154, GHSA-hfmf-q43v-2ffj | High | 1.6% | 22 Aug, 2019 | npm openpgp |
Message Signature Bypass in openpgp CVE-2019-9153, GHSA-qwqc-28w3-fww6 | High | 2.0% | 22 Aug, 2019 | npm openpgp |
assign-deep Vulnerable to Prototype Pollution CVE-2019-10745, GHSA-66rh-8fw6-59q6 | High | 1.1% | 20 Aug, 2019 | npm assign-deep |
Missing Encryption of Sensitive Data in yarn CVE-2019-5448, GHSA-wqfc-cr59-h64p | High | 0.7% | 30 Jul, 2019 | npm yarn |