Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code CVE-2022-39222, GHSA-vh7g-p26c-j2cw | Critical | Not scored | 03 Oct, 2022 | Go github.com/dexidp/dex |
Labstack Echo Open Redirect vulnerability CVE-2022-40083, GHSA-crxj-hrmp-4rwf, GO-2022-1031 | Critical | Not scored | 29 Sep, 2022 | Go github.com/labstack/echo/v4 |
Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials CVE-2021-36782, GHSA-g7j7-h4q8-8w2f | Critical | Not scored | 23 Sep, 2022 | Go github.com/rancher/rancher |
HashiCorp Vault vulnerable to incorrect metadata access BIT-vault-2022-40186, CVE-2022-40186, GHSA-7cgv-v83v-rr87, GO-2022-1021 | Critical | Not scored | 23 Sep, 2022 | Go github.com/hashicorp/vault |
Elrond-go has improper initialization CVE-2022-36061, GHSA-mv8x-668m-53fg, GO-2022-0971 | Critical | Not scored | 16 Sep, 2022 | Go github.com/ElrondNetwork/elrond-go |
Casdoor arbitrary file write vulnerability CVE-2022-38638, GHSA-9vm3-r8gq-cr6x, GO-2022-1006, PYSEC-2022-43190 | Critical | 1.3% | 09 Sep, 2022 | Go github.com/casdoor/casdoor PyPI casdoor |
go.uuid has Predictable UUID Identifiers CVE-2021-3538, GHSA-33m6-q9v5-62r7, GO-2022-0244 | Critical | Not scored | 15 Jul, 2022 | Go github.com/satori/go.uuid |
Path Traversal in Beego CVE-2022-31836, GHSA-95f9-94vc-665h, GO-2022-0569 | Critical | Not scored | 06 Jul, 2022 | Go github.com/astaxie/beego Go github.com/beego/beego Go github.com/beego/beego/v2 |
Improper Restriction of Excessive Authentication Attempts CVE-2022-2321, GHSA-8r94-4h3c-939f | Critical | Not scored | 06 Jul, 2022 | Go github.com/heroiclabs/nakama/v3 |
Weave GitOps leaked cluster credentials into logs on connection errors CVE-2022-31098, GHSA-xggc-qprg-x6mw, GO-2022-0502 | Critical | Not scored | 23 Jun, 2022 | Go github.com/weaveworks/weave-gitops |
Argo CD's external URLs for Deployments can include JavaScript CVE-2022-31035, GHSA-h4w9-6x78-8vrj, GO-2022-0498 | Critical | Not scored | 21 Jun, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Signature forgery in Biscuit CVE-2022-31053, GHSA-75rw-34q6-72cr, GO-2022-0564, HSEC-2023-0002 | Critical | Not scored | 17 Jun, 2022 | Go github.com/biscuit-auth/biscuit-go Maven com.clever-cloud:biscuit-java crates.io biscuit-auth |
Authorization Bypass Through User-Controlled Key in go-restful CVE-2022-1996, GHSA-r48q-9g5r-8q2h, GO-2022-0619 | Critical | Not scored | 09 Jun, 2022 | Go github.com/emicklei/go-restful Go github.com/emicklei/go-restful/v2 Go github.com/emicklei/go-restful/v3 |
OS Command Injection in file editor in Gogs CVE-2022-1986, GHSA-67mx-jc2f-jgjm, GO-2022-0556 | Critical | Not scored | 08 Jun, 2022 | Go gogs.io/gogs |
Path Traversal in file editor on Windows in Gogs CVE-2022-1992, GHSA-994f-7g86-qr56, GO-2022-0570 | Critical | Not scored | 08 Jun, 2022 | Go gogs.io/gogs |
Privilege escalation in Hashicorp Nomad CVE-2022-30324, GHSA-526x-rm7j-v389, GO-2022-0732 | Critical | Not scored | 03 Jun, 2022 | Go github.com/hashicorp/nomad |
OS Command Injection in gogs CVE-2021-32546, GHSA-56j7-2pm8-rgmx, GO-2022-0471 | Critical | Not scored | 02 Jun, 2022 | Go gogs.io/gogs |
OS Command Injection in gogs CVE-2022-1884, GHSA-958j-443g-7mm7, GO-2022-0749 | Critical | Not scored | 02 Jun, 2022 | Go gogs.io/gogs |
HashiCorp go-getter unsafe downloads could lead to asymmetric resource exhaustion CVE-2022-26945, CVE-2022-30321, CVE-2022-30322, CVE-2022-30323, GHSA-28r2-q6m8-9hpx, GHSA-cjr4-fv6c-f3mv, GHSA-fcgg-rvwg-jv58, GHSA-x24g-9w7v-vprh, GO-2022-0586 | Critical | Not scored | 26 May, 2022 | Go github.com/hashicorp/go-getter Go github.com/hashicorp/go-getter/gcs/v2 Go github.com/hashicorp/go-getter/s3/v2 Go github.com/hashicorp/go-getter/v2 |
gitjacker arbitrary code execution CVE-2021-29417, GHSA-4j5x-f394-xx79, GO-2023-1911 | Critical | Not scored | 24 May, 2022 | Go github.com/liamg/gitjacker |
Token leases could outlive their TTL in HashiCorp Vault BIT-vault-2020-25816, CVE-2020-25816, GHSA-57gg-cj55-q5g2, GO-2024-2514 | Critical | Not scored | 24 May, 2022 | Go github.com/hashicorp/vault |
Helm Unsafe Link Following CVE-2019-18658, GHSA-p5pc-m4q7-7qm9, GO-2023-1938 | Critical | Not scored | 24 May, 2022 | Go helm.sh/helm |
Server-Side Request Forgery in charm CVE-2022-29180, GHSA-4wpp-w5r4-7v5v, GO-2022-0449 | Critical | Not scored | 24 May, 2022 | Go github.com/charmbracelet/charm |
Argo CD will blindly trust JWT claims if anonymous access is enabled CVE-2022-29165, GHSA-r642-gv9p-2wjj, GO-2022-0455 | Critical | Not scored | 24 May, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Apache Traffic Control Traffic Ops Vulnerable to LDAP Injection CVE-2021-43350, GHSA-mg2c-rc36-p594, GO-2024-2776 | Critical | Not scored | 24 May, 2022 | Go github.com/apache/trafficcontrol |
DevSpace vulnerable to remote code execution CVE-2020-15391, GHSA-6h8c-gw33-cjm2 | Critical | Not scored | 24 May, 2022 | Go github.com/loft-sh/devspace |
Mattermost Server has X.509 Improper Certificate Validation CVE-2017-18911, GHSA-m462-mqw4-2c8m, GO-2026-4464 | Critical | Not scored | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server server restarts may provide attackers with API access CVE-2017-18915, GHSA-hxxj-8phw-74vw, GO-2026-4462 | Critical | Not scored | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable CSV Injection CVE-2017-18900, GHSA-8q4v-35v6-g8wr, GO-2026-4303 | Critical | Not scored | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server password reset email requests can be sent to attacker-provided email addresses CVE-2017-18908, GHSA-34cx-hvm4-vx7j, GO-2026-4476 | Critical | Not scored | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to SQL Injection when executing multiple POST requests CVE-2017-18888, GHSA-v2vm-hq26-5jv6, GO-2025-4203 | Critical | Not scored | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes OAuth personal access tokens to attackers CVE-2017-18884, GHSA-876j-jfqf-m7j7, GO-2025-4197 | Critical | Not scored | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials CVE-2017-18885, GHSA-g78f-6xq7-rrhq, GO-2025-4200 | Critical | Not scored | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Hashicorp Nomad Access Control Issues CVE-2019-12618, GHSA-2w2v-xcr9-mj4m, GO-2023-1928 | Critical | Not scored | 24 May, 2022 | Go github.com/hashicorp/nomad |
Rancher Recreates Default User With Known Password Despite Deletion CVE-2019-11202, GHSA-xh8x-j8h3-m5ph, GO-2024-2784 | Critical | Not scored | 24 May, 2022 | Go github.com/rancher/rancher |
Moby Docker cp broken with debian containers CVE-2019-14271, GHSA-v2cv-wwxq-qq97, GO-2024-2521 | Critical | Not scored | 24 May, 2022 | Go github.com/docker/docker Go github.com/moby/moby |
Helm Improper Certificate Validation CVE-2019-1010275, GHSA-x6r5-vxfg-gq3v, GO-2023-1993 | Critical | Not scored | 24 May, 2022 | Go helm.sh/helm |
glot-code-runner RCE CVE-2018-15747, GHSA-vj95-2f9q-x7h6 | Critical | Not scored | 24 May, 2022 | Go github.com/prasmussen/glot-code-runner |
Gitea Allows 1FA Even for 2FA-Enrolled Accounts CVE-2019-11576, GHSA-3393-r4p5-vhqh | Critical | Not scored | 24 May, 2022 | Go code.gitea.io/gitea |
EnvoyProxy Envoy Missing HTTP URL path normalization CVE-2019-9901, GHSA-2wmf-p7f8-w42h, GHSA-xcx5-93pw-jw2w | Critical | Not scored | 24 May, 2022 | Go github.com/envoyproxy/envoy |
Access control bypass in beego CVE-2022-31259, GHSA-qx32-f6g6-fcfr, GO-2022-0463 | Critical | Not scored | 22 May, 2022 | Go github.com/astaxie/beego Go github.com/beego/beego Go github.com/beego/beego/v2 |
Improper kubeconfig validation allows arbitrary code execution BIT-flux-2022-24817, BIT-kustomize-2022-24817, CVE-2022-24817, GHSA-vvmq-fwmg-2gjc | Critical | Not scored | 16 May, 2022 | Go github.com/fluxcd/flux2 Go github.com/fluxcd/helm-controller Go github.com/fluxcd/kustomize-controller |
HashiCorp Terraform Amazon Web Services (AWS) uses an insecure PRNG CVE-2018-9057, GHSA-r48h-jr2j-9g78 | Critical | Not scored | 14 May, 2022 | Go github.com/hashicorp/terraform-provider-aws |
Juju uses a UNIX domain socket without setting appropriate permissions CVE-2017-9232, GHSA-j3hp-pv6v-rgrx, GO-2025-3639 | Critical | Not scored | 13 May, 2022 | Go github.com/juju/juju |
Improper path handling in kustomization files allows path traversal BIT-flux-2022-24877, BIT-kustomize-2022-24877, CVE-2022-24877, GHSA-j77r-2fxf-5jrw, GO-2022-0447 | Critical | Not scored | 04 May, 2022 | Go github.com/fluxcd/flux2 Go github.com/fluxcd/kustomize-controller |
Git LFS can execute a binary from the current directory on Windows BIT-git-lfs-2022-24826, CVE-2022-24826, GHSA-6rw3-3whw-jvjj | Critical | Not scored | 22 Apr, 2022 | Go github.com/git-lfs/git-lfs Go github.com/git-lfs/git-lfs/v3 |
Command Injection Vulnerability with Mercurial in VCS CVE-2022-21235, GHSA-6635-c626-vj4r, GO-2022-0414, SNYK-GOLANG-GITHUBCOMMASTERMINDSVCS-2437078 | Critical | Not scored | 01 Apr, 2022 | Go github.com/Masterminds/vcs |
SQLinjection in falcon-plus CVE-2022-26245, GHSA-76j4-gggq-7rg9 | Critical | Not scored | 28 Mar, 2022 | Go github.com/open-falcon/falcon-plus |
Improper access control allows admin privilege escalation in Argo CD CVE-2022-1025, CVE-2022-24768, GHSA-2f5v-8r3f-8pww, GHSA-96jv-vj39-x4j6, GO-2022-0359, GO-2022-0516 | Critical | Not scored | 24 Mar, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Command Injection in CasaOS CVE-2022-24193, GHSA-jh63-28gx-7p26, GO-2022-0606 | Critical | Not scored | 11 Mar, 2022 | Go github.com/IceWhaleTech/CasaOS |