Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Off-by-one Error in v2fly/v2ray-core CVE-2021-4070, GHSA-4cxw-hq44-r344, GO-2022-0550 | Critical | Not scored | 24 Feb, 2022 | Go github.com/v2fly/v2ray-core Go github.com/v2fly/v2ray-core/v4 |
Privilege Escalation in Kubernetes CVE-2018-1002105, GHSA-579h-mv94-g4gp, GO-2022-0792 | Critical | Not scored | 15 Feb, 2022 | Go github.com/kubernetes/kubernetes |
Grafana Authentication Bypass CVE-2018-15727, GHSA-rgjg-66cx-5x9m, GO-2022-0707 | Critical | Not scored | 15 Feb, 2022 | Go github.com/grafana/grafana |
Gitea Remote Code Execution (RCE) CVE-2018-18926, GHSA-hf6f-jq25-8gq9, GO-2022-0844 | Critical | Not scored | 15 Feb, 2022 | Go code.gitea.io/gitea |
SQL Injection in Couchbase Sync Gateway CVE-2019-9039, GHSA-g622-r636-qfqh | Critical | Not scored | 15 Feb, 2022 | Go github.com/couchbase/sync_gateway |
Use After Free in HashiCorp Nomad CVE-2020-27195, GHSA-77cr-6gr8-7rr9, GO-2022-0806 | Critical | Not scored | 15 Feb, 2022 | Go github.com/hashicorp/nomad |
Git LFS can execute a Git binary from the current directory BIT-git-lfs-2020-27955, CVE-2020-27955, GHSA-4g4p-42wc-9f3m | Critical | Not scored | 11 Feb, 2022 | Go github.com/git-lfs/git-lfs |
Reuse of one time passwords allowed in Gitea BIT-gitea-2021-45331, CVE-2021-45331, GHSA-hfmf-q69j-6m5p, GO-2022-0315 | Critical | Not scored | 10 Feb, 2022 | Go code.gitea.io/gitea |
Improper Privilege Management in Gitea BIT-gitea-2021-45330, CVE-2021-45330, GHSA-pg38-r834-g45j, GO-2022-0982 | Critical | Not scored | 10 Feb, 2022 | Go code.gitea.io/gitea |
Capture-replay in Gitea BIT-gitea-2021-45327, CVE-2021-45327, GHSA-jrpg-35hw-m4p9, GO-2022-0310 | Critical | Not scored | 09 Feb, 2022 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Incorrect validation of parties IDs leaks secret keys in Secret-sharing scheme GHSA-gp6j-vx54-5pmf, GO-2022-0367 | Critical | Not scored | 06 Jan, 2022 | Go github.com/keep-network/keep-ecdsa |
Authentication Bypass in dex CVE-2020-26290, CVE-2020-27847, GHSA-2x32-jm95-2cpx, GHSA-m9hp-7r99-94h5 | Critical | Not scored | 20 Dec, 2021 | Go github.com/dexidp/dex Go github.com/russellhaering/goxmldsig |
Authorization bypass in Openshift CVE-2016-1906, GHSA-m3fm-h5jp-q79p, GO-2022-0854 | Critical | Not scored | 20 Dec, 2021 | Go github.com/openshift/origin |
Authelia vulnerable to an authentication bypassed with malformed request URI on nginx CVE-2021-32637, GHSA-68wm-pfjf-wqp6 | Critical | Not scored | 20 Dec, 2021 | Go github.com/authelia/authelia/v4 |
HashiCorp Vault Incorrect Permission Assignment for Critical Resource BIT-vault-2021-43998, CVE-2021-43998, GHSA-pfmw-vj74-ph8g, GO-2022-0611 | Critical | Not scored | 02 Dec, 2021 | Go github.com/hashicorp/vault |
Policies not properly enforced in bluemonday CVE-2021-42576, GHSA-x95h-979x-cf3j, GO-2022-0588, PYSEC-2021-849 | Critical | 1.6% | 18 Oct, 2021 | Go github.com/microcosm-cc/bluemonday PyPI pybluemonday |
Tarslip in go-unarr CVE-2021-38197, GHSA-v9j4-cp63-qv62, GO-2022-0929 | Critical | Not scored | 01 Sep, 2021 | Go github.com/gen2brain/go-unarr |
HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0 BIT-vault-2021-38553, CVE-2021-38553, GHSA-23fq-q7hc-993r, GO-2022-0620 | Critical | Not scored | 30 Aug, 2021 | Go github.com/hashicorp/vault |
tar-utils Path Traversal vulnerability CVE-2020-36566, GHSA-jpf8-h7h7-3ppm, GO-2021-0106 | Critical | Not scored | 28 Jul, 2021 | Go github.com/whyrusleeping/tar-utils |
Path Traversal in Dutchcoders transfer.sh CVE-2021-33497, GHSA-cf55-rq8x-hm6f, GO-2022-0925 | Critical | Not scored | 29 Jun, 2021 | Go github.com/dutchcoders/transfer.sh |
Denial of service in go-ethereum due to CVE-2020-28362 GHSA-m6gx-rhvj-fh52, GO-2022-0392 | Critical | Not scored | 29 Jun, 2021 | Go github.com/ethereum/go-ethereum |
Auth bypass in SAML provider GHSA-433w-mm6h-rv9p | Critical | Not scored | 23 Jun, 2021 | Go github.com/netlify/gotrue |
Websocket requests did not call AuthenticateMethod CVE-2021-4236, GHSA-5gjg-jgh4-gppm, GHSA-jpgg-cp2x-qrw3, GO-2021-0107 | Critical | Not scored | 23 Jun, 2021 | Go github.com/ecnepsnai/web |
Authentication Bypass in tyk-identity-broker CVE-2021-23365, GHSA-599h-8wpj-75xj, GO-2022-0906, SNYK-GOLANG-GITHUBCOMTYKTECHNOLOGIESTYKIDENTITYBROKER-1089720 | Critical | Not scored | 23 Jun, 2021 | Go github.com/TykTechnologies/tyk-identity-broker Go github.com/tyktechnologies/tyk-identity-broker |
Arbitrary code execution due to an uncontrolled search path for the git binary CVE-2021-28955, GHSA-m898-h4pm-pqfr | Critical | Not scored | 25 May, 2021 | Go github.com/MichaelMure/git-bug |
Signature Validation Bypass GHSA-5684-g483-2249 | Critical | Not scored | 24 May, 2021 | Go github.com/russellhaering/gosaml2 |
Signature Validation Bypass GHSA-rrfw-hg9m-j47h | Critical | Not scored | 24 May, 2021 | Go github.com/russellhaering/goxmldsig |
Duplicate Advisory: GoUtils's randomly-generated alphanumeric strings contain significantly less entropy than expected CVE-2021-4238, GHSA-3839-6r69-m497, GHSA-xg2h-wx96-xgxr, GO-2022-0411 | Critical | Not scored | 21 May, 2021 | Go github.com/Masterminds/goutils |
nats-io/jwt not enforcing checking of Import token permissions BIT-nats-2021-3127, CVE-2021-3127, GHSA-62mh-w5cv-p88c, GHSA-9r5x-fjv3-q6h4, GHSA-j756-f273-xhp4, GO-2022-0386 | Critical | Not scored | 21 May, 2021 | Go github.com/nats-io/jwt Go github.com/nats-io/jwt/v2 Go github.com/nats-io/nats-server/v2 |
Incorrect handling of credential expiry by /nats-io/nats-server CVE-2020-26892, GHSA-2c64-vj8g-vwrq, GHSA-4w5x-x539-ppf5, GO-2022-0380 | Critical | Not scored | 21 May, 2021 | Go github.com/nats-io/jwt Go github.com/nats-io/nats-server/v2 |
Improper Authentication in InfluxDB CVE-2019-20933, GHSA-2rmp-fw5r-j5qv, GO-2022-0780 | Critical | Not scored | 18 May, 2021 | Go github.com/influxdata/influxdb |
Improper Input Validation in HashiCorp Vault BIT-vault-2020-12757, CVE-2020-12757, GHSA-75pc-qvwc-jf3g, GO-2022-0804 | Critical | Not scored | 18 May, 2021 | Go github.com/hashicorp/vault-plugin-secrets-gcp |
Insecure Permissions in Gogs CVE-2019-14544, GHSA-5r2v-6gm6-vpvh, GO-2022-0797 | Critical | Not scored | 18 May, 2021 | Go gogs.io/gogs |
Improper Authentication in Apache Traffic Control CVE-2019-12405, GHSA-3f8r-4qwm-r7jf | Critical | Not scored | 18 May, 2021 | Go github.com/apache/trafficcontrol |
Kubernetes Privilege Escalation CVE-2017-1000056, GHSA-2jx2-76rc-2v7v, GO-2023-1492 | Critical | Not scored | 12 May, 2021 | Go k8s.io/kubernetes |
LZ4 vulnerable to Out-of-bounds Write CVE-2014-125026, GHSA-4wp2-8rm2-jgmh, GO-2020-0022 | Critical | Not scored | 14 Apr, 2021 | Go github.com/cloudflare/golz4 |
Elliptic Curve Key Disclosure in go-jose CVE-2016-9121, GHSA-86r9-39j9-99wp, GO-2020-0010 | Critical | Not scored | 14 Apr, 2021 | Go github.com/square/go-jose Go gopkg.in/square/go-jose.v1 |
gorilla/handlers may allow requester to bypass expected behavior of the Same Origin Policy CVE-2017-20146, GHSA-jcr6-mmjj-pchw, GO-2020-0020 | Critical | Not scored | 14 Apr, 2021 | Go github.com/gorilla/handlers |
Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication CVE-2018-21246, GHSA-gr7w-x2jp-3xgw, GO-2020-0043 | Critical | Not scored | 14 Apr, 2021 | Go github.com/caddyserver/caddy Go github.com/mholt/caddy |
Cloud Foundry Archiver vulnerable to path traversal CVE-2018-25046, GHSA-32qh-8vg6-9g43, GO-2020-0025 | Critical | Not scored | 14 Apr, 2021 | Go code.cloudfoundry.org/archiver Go github.com/cloudfoundry/archiver |
Improper Authenication in Pion DTLS CVE-2019-20786, GHSA-7gfg-6934-mqq2, GO-2020-0038 | Critical | Not scored | 14 Apr, 2021 | Go github.com/pion/dtls |
XML Processing error in github.com/crewjam/saml BIT-grafana-2020-27846, CVE-2020-27846, GHSA-4hq8-gmxx-h6w9, GO-2021-0058 | Critical | Not scored | 14 Apr, 2021 | Go github.com/crewjam/saml |
Authentication Bypass in github.com/russellhaering/gosaml2 BIT-golang-2020-29509, CVE-2020-29509, GHSA-xhqq-x44f-9fgg, GO-2021-0060 | Critical | Not scored | 14 Apr, 2021 | Go github.com/russellhaering/gosaml2 |
go-unzip vulnerable to Path Traversal CVE-2020-36560, GHSA-rmj9-q58g-9qgg, GO-2020-0034 | Critical | Not scored | 14 Apr, 2021 | Go github.com/artdarek/go-unzip |
Unzip vulnerable to path traversal CVE-2020-36561, GHSA-f5c5-hmw9-v8hx, GO-2020-0035 | Critical | Not scored | 14 Apr, 2021 | Go github.com/yi-ge/unzip |
golang-nanoauth authentication bypass vulnerability CVE-2020-36569, GHSA-hrm3-3xm6-x33h, GO-2020-0004 | Critical | Not scored | 14 Apr, 2021 | Go github.com/nanobox-io/golang-nanoauth |
Integer overflow in the bundled Brotli C library BIT-brotli-2020-8927, BIT-dotnet-2020-8927, BIT-dotnet-sdk-2020-8927, BIT-powershell-2020-8927, CVE-2020-36846, CVE-2020-8927, GHSA-5v8v-66v8-mwm7, GO-2025-3726, PYSEC-2020-29, RUSTSEC-2021-0131, RUSTSEC-2021-0132 | Critical | 3.2% | 15 Sep, 2020 | Go github.com/google/brotli NuGet Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm NuGet Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm64 NuGet Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x64 +115 more |