Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration CVE-2022-2713, GHSA-vm6p-35rw-3fxc | Critical | 1.3% | 08 Aug, 2022 | Packagist aheinze/cockpit |
@acrontum/filesystem-template vulnerable to Command Injection due to fetchRepo API missing sanitization CVE-2022-21186, GHSA-m2fc-9h5m-29cm | Critical | 26.1% | 05 Aug, 2022 | npm @acrontum/filesystem-template |
Raneto v0.17.0 employs weak password complexity requirements CVE-2022-35143, GHSA-7942-2fx8-qhpf | Critical | 1.7% | 04 Aug, 2022 | npm raneto |
NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails CVE-2022-35924, GHSA-xv97-c62v-4587 | Critical | 1.5% | 02 Aug, 2022 | npm next-auth |
get-npm-package-version Command Injection vulnerability CVE-2020-7795, GHSA-4h66-vghf-xg5x | Critical | 4.0% | 02 Aug, 2022 | npm get-npm-package-version |
npos-tesseract Command Injection vulnerability CVE-2020-28453, GHSA-mpwp-pf96-9g4r | Critical | 1.3% | 02 Aug, 2022 | npm npos-tesseract |
image-tiler susceptible to command injection CVE-2020-28451, GHSA-mrxv-pr4h-963q | Critical | 1.5% | 02 Aug, 2022 | npm image-tiler |
heroku-env susceptible to command injection CVE-2020-28437, GHSA-jp45-65jw-94mj | Critical | 1.3% | 02 Aug, 2022 | npm heroku-env |
gitblame susceptible to command injection CVE-2020-28434, GHSA-3486-rvxc-hrrj | Critical | 1.3% | 02 Aug, 2022 | npm gitblame |
node-latex-pdf is susceptible to command injection CVE-2020-28433, GHSA-32fw-9wq8-9x9c | Critical | 0.9% | 02 Aug, 2022 | npm node-latex-pdf |
curljs Command Injection vulnerability CVE-2020-28425, GHSA-cqfc-9452-r36j | Critical | 0.9% | 02 Aug, 2022 | npm curljs |
monorepo-build Command Injection vulnerability CVE-2020-28423, GHSA-5vrc-7jfr-4642 | Critical | 1.3% | 02 Aug, 2022 | npm monorepo-build |
PrestaShop eval injection possible if shop vulnerable to SQL injection CVE-2022-31181, GHSA-hrgx-p36p-89q4 | Critical | 6.7% | 29 Jul, 2022 | Packagist prestashop/prestashop |
WMAgent arbitrary code execution via a crafted dbs-client package CVE-2022-34558, GHSA-4vq7-8699-4xgc, PYSEC-2022-43136, PYSEC-2022-43163, PYSEC-2022-43174, PYSEC-2026-523 | Critical | 1.3% | 28 Jul, 2022 | PyPI global-workqueue PyPI reqmgr2 PyPI reqmon PyPI wmagent |
automattic/mongoose vulnerable to Prototype pollution via Schema.path BIT-mongoose-2022-2564, CVE-2022-2564, GHSA-f825-f98c-gj3g | Critical | 31.3% | 28 Jul, 2022 | npm mongoose |
Joplin is vulnerable to arbitrary code execution CVE-2022-35131, GHSA-ww2v-frv5-pj5x | Critical | 2.3% | 25 Jul, 2022 | npm joplin |
Moodle PostScript Code Injection BIT-moodle-2022-35649, CVE-2022-35649, GHSA-xp2f-9mx3-3c6p | Critical | 8.6% | 25 Jul, 2022 | Packagist moodle/moodle |
otp-generator before v3.0.0 insecurely generates random one-time passwords CVE-2021-23451, GHSA-6x93-h9g3-9phr | Critical | 0.9% | 25 Jul, 2022 | npm otp-generator |
@ianwalter/merge Prototype Pollution via `merge` function CVE-2021-23397, GHSA-42m6-g935-5vmq | Critical | 0.8% | 25 Jul, 2022 | npm @ianwalter/merge |
set-deep-prop Prototype Pollution CVE-2021-23373, GHSA-v42q-78w8-8fcc | Critical | 1.2% | 25 Jul, 2022 | npm set-deep-prop |
node-import `params` argument can be controlled by users without any sanitization CVE-2020-7678, GHSA-pc62-cq5x-3j5g | Critical | 1.2% | 25 Jul, 2022 | npm node-import |
ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse` CVE-2020-28462, GHSA-7vrv-5m2h-rjw9 | Critical | 0.9% | 25 Jul, 2022 | npm ion-parser |
js-ini Prorotype Pollution when malicious INI files submitted to an application that parses it with `parse` CVE-2020-28461, GHSA-m939-vrfp-9v8p | Critical | 1.2% | 25 Jul, 2022 | npm js-ini |
xopen is vulnerable to OS Command Injection in Exported Function xopen(filepath) CVE-2020-28447, GHSA-74wf-cwjg-9cf2 | Critical | 1.3% | 25 Jul, 2022 | npm xopen |
ntesseract vulnerable to Command Injection CVE-2020-28446, GHSA-w868-4576-rv24 | Critical | 3.5% | 25 Jul, 2022 | npm ntesseract |
sonar-wrapper Command Injection vulnerability CVE-2020-28443, GHSA-wr4v-3f2h-6hhh | Critical | 1.3% | 25 Jul, 2022 | npm sonar-wrapper |
conf-cfg-ini Prototype Pollution via malicious INI file before v1.2.2 CVE-2020-28441, GHSA-m6mg-jvjf-w44x | Critical | 1.2% | 25 Jul, 2022 | npm conf-cfg-ini |
deferred-exec Command Injection vulnerability CVE-2020-28438, GHSA-54w4-2f2p-f48h | Critical | 1.3% | 25 Jul, 2022 | npm deferred-exec |
google-cloudstorage-commands Command Injection vulnerability CVE-2020-28436, GHSA-6367-p3v8-7mgw | Critical | 1.0% | 25 Jul, 2022 | npm google-cloudstorage-commands |
ffmpeg-sdk vulnerable to OS Command Injection CVE-2020-28435, GHSA-rwvf-c3wm-qm6w | Critical | 1.4% | 25 Jul, 2022 | npm ffmpeg-sdk |
convert-svg-core vulnerable to remote code injection CVE-2022-25759, GHSA-5gxc-fxcr-9326 | Critical | 11.5% | 22 Jul, 2022 | npm convert-svg-core |
The PyCrowdTangle package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party. CVE-2022-34981, PYSEC-2022-242 | Critical | 1.7% | 22 Jul, 2022 | PyPI pycrowdtangle |
The eziod package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party. CVE-2022-34982, PYSEC-2022-241 | Critical | 1.4% | 22 Jul, 2022 | PyPI eziod |
The scu-captcha package in PyPI v0.0.1 to v0.0.4 included a code execution backdoor inserted by a third party. CVE-2022-34983, PYSEC-2022-43166 | Critical | 1.7% | 22 Jul, 2022 | PyPI scu-captcha |
Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository GHSA-m58q-qq5h-mgqq | Critical | Not scored | 21 Jul, 2022 | Packagist islandora/islandora |
Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability CVE-2022-26138 | CriticalExploited | 98.2% | 20 Jul, 2022 | |
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability CVE-2022-35405 | CriticalExploited | 99.9% | 19 Jul, 2022 | |
Properties-Reader before v2.2.0 vulnerable to prototype pollution CVE-2020-28471, GHSA-jxvf-m3x5-mxwq | Critical | 1.5% | 19 Jul, 2022 | npm properties-reader |
thenify before 3.3.1 made use of unsafe calls to `eval`. CVE-2020-7677, GHSA-29xr-v42j-r956 | Critical | 2.1% | 18 Jul, 2022 | Maven org.webjars.npm:thenify npm thenify |
dotCMS Unrestricted Upload of File Vulnerability CVE-2022-26352 | CriticalExploited | 91.2% | 17 Jul, 2022 | |
Octobot mishandles Tentacles upload CVE-2021-36711, GHSA-fr75-x856-q6j8, PYSEC-2022-235 | Critical | 16.6% | 16 Jul, 2022 | PyPI OctoBot PyPI octobot |
Shescape vulnerable to insufficient escaping of whitespace CVE-2022-31180, GHSA-44vr-rwwj-p88h | Critical | 2.0% | 15 Jul, 2022 | npm shescape |
Shescape prior to 1.5.8 vulnerable to insufficient escaping of line feeds for CMD CVE-2022-31179, GHSA-jjc5-fp7p-6f8w | Critical | 1.4% | 15 Jul, 2022 | npm shescape |
llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields BIT-node-2022-32214, BIT-node-min-2022-32214, CVE-2022-32214, GHSA-q5vx-44v4-gch4 | Critical | 81.8% | 14 Jul, 2022 | npm llhttp |
llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding BIT-node-2022-32213, BIT-node-min-2022-32213, CVE-2022-32213, GHSA-5689-v88g-g6rv | Critical | 44.8% | 14 Jul, 2022 | npm llhttp |
SQL Injection in typo3 extension "LUX - TYPO3 Marketing Automation" CVE-2022-35628, GHSA-rpxg-hg79-h8q9 | Critical | 26.8% | 12 Jul, 2022 | Packagist in2code/lux |
Valinor error messages leading to potential data exfiltration before v0.12.0 CVE-2022-31140, GHSA-5pgm-3j3g-2rc7 | Critical | 1.5% | 11 Jul, 2022 | Packagist cuyz/valinor |
Microweber before 1.2.21 allows attacker to bypass IP detection to brute-force password CVE-2022-2368, GHSA-9wqr-9787-p4rf | Critical | 1.2% | 11 Jul, 2022 | Packagist microweber/microweber |
ChainerRL Visualizer 0.1.1 vulnerable to Path Traversal via unsafe use of send_file function CVE-2022-31573, GHSA-687h-86vc-5x59, PYSEC-2026-309 | Critical | 1.4% | 11 Jul, 2022 | PyPI chainerrl-visualizer |
Tooxie Shiva 0.10.0 allows absolute path traversal because Flask send_file function used unsafely CVE-2022-31558, GHSA-qp72-96p2-g644, PYSEC-2026-541 | Critical | 1.3% | 11 Jul, 2022 | PyPI shiva |