Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Lodestar snappy checksum issue GHSA-m9c9-mc2h-9wjw | Low | Not scored | 14 Jan, 2025 | npm @lodestar/reqresp |
Lodestar snappy decompression issue GHSA-53rv-hcvm-rpp9 | Low | Not scored | 14 Jan, 2025 | npm @lodestar/reqresp |
Prototype pollution in jsii.configureCategories GHSA-m56h-5xx3-2jc2 | Low | Not scored | 18 Dec, 2024 | npm jsii |
@sveltejs/kit vulnerable to XSS on dev mode 404 page CVE-2024-53261, GHSA-rjjv-87mx-6x3h | Low | 0.3% | 25 Nov, 2024 | npm @sveltejs/kit |
@sveltejs/kit has unescaped error message included on error page CVE-2024-53262, GHSA-mh2x-fcqh-fmqv | Low | 0.5% | 25 Nov, 2024 | npm @sveltejs/kit |
@workos-inc/authkit-remix refresh tokens are logged when the debug flag is enabled CVE-2024-51753, GHSA-v2qh-f584-6hj8 | Low | 0.2% | 05 Nov, 2024 | npm @workos-inc/authkit-remix |
@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled CVE-2024-51752, GHSA-5wmg-9cvh-qw25 | Low | 0.2% | 05 Nov, 2024 | npm @workos-inc/authkit-nextjs |
ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function CVE-2024-9506, GHSA-5j4c-8p2g-v4jx | Low | 0.6% | 15 Oct, 2024 | npm vue |
The fuels-ts typescript SDK has no awareness of to-be-spent transactions CVE-2024-41945, GHSA-3jcg-vx7f-j6qf | Low | 0.3% | 30 Jul, 2024 | npm @fuel-ts/account |
Undici vulnerable to data leak when using response.arrayBuffer() CVE-2024-38372, GHSA-3g92-w8c5-73pq | Low | 0.5% | 08 Jul, 2024 | npm undici |
Mattermost Desktop App allows for bypassing TCC restrictions on macOS CVE-2024-36287, GHSA-xgqm-wp7w-mgg2 | Low | 0.2% | 14 Jun, 2024 | npm mattermost-desktop |
@strapi/plugin-content-manager leaks data via relations via the Admin Panel CVE-2024-29181, GHSA-6j89-frxc-q26m | Low | 0.4% | 12 Jun, 2024 | npm @strapi/plugin-content-manager |
thelounge may publicly disclose of all usernames/idents via port 113 GHSA-g49q-jw42-6x85 | Low | Not scored | 09 May, 2024 | npm thelounge |
Enabling Authentication does not close all logged in socket connections immediately GHSA-23q2-5gf8-gjpp | Low | Not scored | 19 Apr, 2024 | npm uptime-kuma |
Prototype pollution in emit function GHSA-82jv-9wjw-pqh6 | Low | Not scored | 17 Apr, 2024 | npm derby |
Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect CVE-2024-30261, GHSA-9qxr-qj54-h672 | Low | 0.8% | 04 Apr, 2024 | npm undici |
Session Token in URL in directus CVE-2024-28238, GHSA-2ccr-g2rv-h677 | Low | 0.2% | 12 Mar, 2024 | npm directus |
Potential leakage of Sentry auth tokens by React Native SDK with Expo plugin GHSA-68c2-4mpx-qh95 | Low | Not scored | 01 Mar, 2024 | npm @sentry/react-native |
Local File Inclusion vulnerability in zmarkdown GHSA-mq6v-w35g-3c97 | Low | Not scored | 03 Feb, 2024 | npm zmarkdown |
google-translate-api-browser Server-Side Request Forgery (SSRF) Vulnerability CVE-2023-48711, GHSA-4233-7q5q-m7p6 | Low | 0.5% | 24 Nov, 2023 | npm google-translate-api-browser |
Undici's cookie header not cleared on cross-origin redirect in fetch CVE-2023-45143, GHSA-wqq4-5wpv-mx2g | Low | 1.4% | 12 Oct, 2023 | npm undici |
Prevent logging invalid header values GHSA-j5g3-5c8r-7qfx | Low | Not scored | 30 Aug, 2023 | npm @apollo/server npm apollo-server-core |
Minimal `basti` IAM Policy Allows Shell Access GHSA-q4pp-j36h-3gqg | Low | Not scored | 24 Aug, 2023 | npm basti-cdk |
matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms CVE-2023-38700, GHSA-c7hh-3v6c-fj4q | Low | 0.6% | 04 Aug, 2023 | npm matrix-appservice-irc |
Vendure Cross Site Request Forgery vulnerability impacting all API requests GHSA-h9wq-xcqx-mqxm | Low | Not scored | 11 Jul, 2023 | npm @vendure/core |
sweetalert2 contains potentially undesirable behavior GHSA-mrr8-v49w-3333 | Low | Not scored | 10 Jul, 2023 | npm sweetalert2 |
@apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces GHSA-68jh-rf6x-836f | Low | Not scored | 16 Jun, 2023 | npm @apollo/server |
fast-xml-parser regex vulnerability patch could be improved from a safety perspective GHSA-gpv5-7x3g-ghjv | Low | Not scored | 15 Jun, 2023 | npm fast-xml-parser |
@keystone-6/core's bundled cuid package known to be insecure GHSA-5fp6-4xw3-xqq3 | Low | Not scored | 12 Jun, 2023 | npm @keystone-6/core |
Possible prototype pollution in metadata record, when using meta decorator CVE-2023-30857, GHSA-wwxh-74fx-33c6 | Low | 0.5% | 28 Apr, 2023 | npm @aedart/support |
sweetalert2 v8.19.1 and above contains hidden functionality GHSA-8jh9-wqpf-q52c | Low | Not scored | 23 Nov, 2022 | npm sweetalert2 |
sweetalert2 v9.17.4 and above contains hidden functionality GHSA-pg98-6v7f-2xfv | Low | Not scored | 23 Nov, 2022 | npm sweetalert2 |
sweetalert2 v10.16.10 and above contains hidden functionality GHSA-457r-cqc8-9vj9 | Low | Not scored | 23 Nov, 2022 | npm sweetalert2 |
sweetalert2 v11.4.9 and above contains hidden functionality GHSA-qq6h-5g6j-q3cm | Low | Not scored | 23 Nov, 2022 | npm sweetalert2 |
Hardening of TypedArrays with non-canonical numeric property names in SES GHSA-whpx-q3rq-w8jc | Low | Not scored | 20 Oct, 2022 | npm ses |
Incorrect default cookie name and recommendation GHSA-jjmg-x456-w976 | Low | Not scored | 10 Oct, 2022 | npm csrf-csrf |
parse-server auth adapter app ID validation can be circumvented BIT-parse-2022-39231, CVE-2022-39231, GHSA-r657-33vp-gp22 | Low | 0.5% | 21 Sep, 2022 | npm parse-server |
Command Injection in moment-timezone GHSA-56x4-j7p9-fcf9 | Low | Not scored | 30 Aug, 2022 | npm moment-timezone |
next-auth before v4.10.2 and v3.29.9 leaks excessive information into log CVE-2022-31186, GHSA-p6mm-27gq-9v3p | Low | 0.3% | 01 Aug, 2022 | npm next-auth |
node-ipc behavior change GHSA-3mpp-xfvh-qh37 | Low | Not scored | 16 Mar, 2022 | npm node-ipc |
Hidden functionality in node-ipc GHSA-8gr3-2gjw-jj7g | Low | Not scored | 16 Mar, 2022 | npm node-ipc |
Inconsistent storage layout for ERC2771ContextUpgradeable GHSA-7j52-6fjp-58gr | Low | Not scored | 14 Mar, 2022 | npm @openzeppelin/contracts-upgradeable |
Prototype Pollution in node-forge debug API. GHSA-5rrq-pxf6-6jx5 | Low | Not scored | 08 Jan, 2022 | npm node-forge |
Prototype Pollution in node-forge util.setPath API GHSA-wxgw-qj99-44c2 | Low | Not scored | 08 Jan, 2022 | npm node-forge |
URL parsing in node-forge could lead to undesired behavior. GHSA-gf8q-jrpm-jvxq | Low | Not scored | 08 Jan, 2022 | npm node-forge |
ERC1155Supply vulnerability in OpenZeppelin Contracts GHSA-wmpv-c2jp-j2xg | Low | Not scored | 15 Nov, 2021 | npm @openzeppelin/contracts npm @openzeppelin/contracts-upgradeable |
Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name GHSA-q324-q795-2q5p | Low | Not scored | 12 Oct, 2021 | npm @redocly/openapi-cli |
Incorrect TCR calculation in batchLiquidateTroves() during Recovery Mode GHSA-xh2p-7p87-fhgh | Low | Not scored | 05 Aug, 2021 | npm @liquity/contracts |
Improper Neutralization of Special Elements used in a Command ('Command Injection') in @floffah/build GHSA-jcgr-9698-82jx | Low | Not scored | 28 May, 2021 | npm @floffah/build |
Regex denial of service vulnerability in codesample plugin GHSA-h96f-fc7c-9r55 | Low | Not scored | 06 Jan, 2021 | npm tinymce |