Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Vela Server Has Insufficient Webhook Payload Data Verification CVE-2025-27616, GHSA-9m63-33q3-xq5x, GO-2025-3509 | High | Not scored | 10 Mar, 2025 | Go github.com/go-vela/server |
Horcrux Double Sign Possibility GHSA-6wxf-7784-62fp, GO-2025-3507 | High | Not scored | 07 Mar, 2025 | Go github.com/strangelove-ventures/horcrux Go github.com/strangelove-ventures/horcrux/v3 |
Goroutine Leak in Abacus SSE Implementation CVE-2025-27421, GHSA-vh64-54px-qgf8, GO-2025-3498 | High | Not scored | 03 Mar, 2025 | Go github.com/jasonlovesdoggo/abacus |
Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login CVE-2025-23389, GHSA-mq23-vvg7-xfm4, GO-2025-3490 | High | Not scored | 27 Feb, 2025 | Go github.com/rancher/rancher |
Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API CVE-2025-23388, GHSA-xr9q-h9c7-xw8q, GO-2025-3491 | High | Not scored | 27 Feb, 2025 | Go github.com/rancher/rancher |
golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability CVE-2025-22868, GHSA-6v2p-p543-phr9, GO-2025-3488 | High | Not scored | 26 Feb, 2025 | Go golang.org/x/oauth2 |
golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange CVE-2025-22869, GHSA-hcg3-q754-cr77, GO-2025-3487 | High | Not scored | 26 Feb, 2025 | Go golang.org/x/crypto |
S3-Proxy allows Reflected Cross-site Scripting (XSS) in template implementation CVE-2025-27088, GHSA-pp9m-qf39-hxjc, GO-2025-3477 | High | Not scored | 20 Feb, 2025 | Go github.com/oxyno-zeta/s3-proxy Go github.com/oxyno-zeta/s3-proxy/cmd/s3-proxy |
Cosmos SDK: Groups module can halt chain when handling a malicious proposal GHSA-x5vx-95h7-rv4p, GO-2025-3476 | High | Not scored | 20 Feb, 2025 | Go github.com/cosmos/cosmos-sdk |
Hermes improperly validates a JWT CVE-2025-1293, GHSA-vxm9-8mfw-vc6g, GO-2025-3475 | High | Not scored | 20 Feb, 2025 | Go github.com/hashicorp-forge/hermes |
go-crypto-winnative BCryptGenerateSymmetricKey memory leak CVE-2025-25199, GHSA-29c6-3hcj-89cf, GO-2025-3461 | High | Not scored | 12 Feb, 2025 | Go github.com/microsoft/go-crypto-winnative |
SFTPGo has insufficient sanitization of user provided rsync command CVE-2025-24366, GHSA-vj7w-3m8c-6vpx, GO-2025-3458 | High | Not scored | 07 Feb, 2025 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |
WhoDB allows parameter injection in DB connection URIs leading to local file inclusion CVE-2025-24787, GHSA-c7w4-9wv8-7x7c, GO-2025-3457 | High | Not scored | 06 Feb, 2025 | Go github.com/clidey/whodb/core |
Contrast's unauthenticated recovery allows Coordinator impersonation CVE-2025-71426, GHSA-vqv5-385r-2hf8, GO-2025-3455 | High | Not scored | 05 Feb, 2025 | Go github.com/edgelesssys/contrast |
MarbleRun unauthenticated recovery allows Coordinator impersonation GHSA-w7wm-2425-7p2h, GO-2025-3450 | High | Not scored | 04 Feb, 2025 | Go github.com/edgelesssys/marblerun |
CometBFT allows a malicious peer to stall the network by disseminating seemingly valid block parts GHSA-r3r4-g7hq-pq4f, GO-2025-3443 | High | Not scored | 03 Feb, 2025 | Go github.com/cometbft/cometbft |
OpenShift GitOps Operator Namespace Isolation Break CVE-2024-13484, GHSA-58fx-7v9q-3g56, GO-2025-3427 | High | Not scored | 28 Jan, 2025 | Go github.com/redhat-developer/gitops-operator |
Updatecli exposes Maven credentials in console output CVE-2025-24355, GHSA-v34r-vj4r-38j6, GO-2025-3419 | High | Not scored | 24 Jan, 2025 | Go github.com/updatecli/updatecli |
Envoy Admin Interface Exposed through prometheus metrics endpoint BIT-envoy-gateway-2025-24030, CVE-2025-24030, GHSA-j777-63hf-hx76, GO-2025-3418 | High | Not scored | 23 Jan, 2025 | Go github.com/envoyproxy/gateway |
Buildah allows build breakout using malicious Containerfiles and concurrent builds CVE-2024-11218, GHSA-5vpc-35f4-r8w6, GO-2025-3414 | High | Not scored | 21 Jan, 2025 | Go github.com/containers/buildah |
HashiCorp go-slug Vulnerable to Zip Slip Attack CVE-2025-0377, GHSA-wpfp-cm49-9m9q, GO-2025-3413 | High | Not scored | 21 Jan, 2025 | Go github.com/hashicorp/go-slug |
Insecure default config access in WriteFreely CVE-2025-24337, GHSA-3qc3-mx6x-267h, GO-2025-3410 | High | Not scored | 20 Jan, 2025 | Go github.com/writefreely/writefreely |
Zot IdP group membership revocation ignored CVE-2025-23208, GHSA-c9p4-xwr9-rfhx, GO-2025-3409 | High | Not scored | 17 Jan, 2025 | Go zotregistry.dev/zot |
Rancher UI has Stored Cross-site Scripting vulnerability CVE-2024-52281, GHSA-2v2w-8v8c-wcm9, GO-2025-3391 | High | Not scored | 14 Jan, 2025 | Go github.com/rancher/rancher |
Git LFS permits exfiltration of credentials via crafted HTTP URLs BIT-git-lfs-2024-53263, CVE-2024-53263, GHSA-q6r2-x2cc-vrp7, GO-2025-3390 | High | Not scored | 14 Jan, 2025 | Go github.com/git-lfs/git-lfs Go github.com/git-lfs/git-lfs/v3 |
WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover GHSA-2r2v-9pf8-6342, GO-2025-3371 | High | Not scored | 07 Jan, 2025 | Go github.com/h44z/wg-portal |
go-git clients vulnerable to DoS via maliciously crafted Git server replies CVE-2025-21614, GHSA-r9px-m959-cxf4, GO-2025-3367 | High | Not scored | 06 Jan, 2025 | Go github.com/go-git/go-git Go github.com/go-git/go-git/v4 Go github.com/go-git/go-git/v5 Go gopkg.in/src-d/go-git.v4 |
SiYuan has an arbitrary file deletion vulnerability CVE-2025-21609, GHSA-8fx8-pffw-w498, GO-2025-3362 | High | Not scored | 03 Jan, 2025 | Go github.com/siyuan-note/siyuan/kernel |
Karmada PULL Mode Cluster Privilege Escalation CVE-2024-56513, GHSA-mg7w-c9x2-xh7r, GO-2025-3364 | High | Not scored | 03 Jan, 2025 | Go github.com/karmada-io/karmada |
OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation CVE-2024-25133, GHSA-wgqq-9qh8-wvqv, GO-2024-3360 | High | Not scored | 31 Dec, 2024 | Go github.com/openshift/hive |
Navidrome Stores JWT Secret in Plaintext in navidrome.db CVE-2024-56362, GHSA-xwx7-p63r-2rj8, GO-2024-3357 | High | Not scored | 23 Dec, 2024 | Go github.com/navidrome/navidrome |
SQL injection in Apache Traffic Control CVE-2024-45387, GHSA-vq94-9pfv-ccqr, GO-2024-3358 | High | Not scored | 23 Dec, 2024 | Go github.com/apache/trafficcontrol Go github.com/apache/trafficcontrol/v8 |
Path Traversal in file update API in gogs CVE-2024-55947, GHSA-qf5v-rp47-55gg, GO-2024-3356 | High | Not scored | 23 Dec, 2024 | Go gogs.io/gogs |
Remote Command Execution in file editing in gogs CVE-2024-54148, GHSA-r7j8-5h9c-f6fx, GO-2024-3355 | High | Not scored | 23 Dec, 2024 | Go gogs.io/gogs |
GoPhish sends cleartext passwords CVE-2024-55196, GHSA-rv83-h68q-c4wq, GO-2025-3361 | High | Not scored | 19 Dec, 2024 | Go github.com/gophish/gophish |
OpenShift Must Gather Operator Improper Input Validation vulnerability CVE-2024-25131, GHSA-77c2-c35q-254w, GO-2024-3349 | High | Not scored | 19 Dec, 2024 | Go github.com/openshift/must-gather |
WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service GHSA-5pf6-cq2v-23ww, GO-2024-3350 | High | Not scored | 19 Dec, 2024 | Go github.com/clidey/whodb/core |
Non-linear parsing of case-insensitive content in golang.org/x/net/html CVE-2024-45338, GHSA-w32m-9786-jp63, GO-2024-3333 | High | Not scored | 18 Dec, 2024 | Go golang.org/x/net Go golang.org/x/net/html |
Open Cluster Management vulnerable to Trust Boundary Violation CVE-2024-9779, GHSA-jhh6-6fhp-q2xp, GO-2024-3343 | High | Not scored | 18 Dec, 2024 | Go open-cluster-management.io/ocm |
ASA-2024-0012, ASA-2024-0013: CosmosSDK: Transaction decoding may result in a stack overflow or resource exhaustion GHSA-8wcc-m6j2-qxvm, GO-2024-3339 | High | Not scored | 16 Dec, 2024 | Go cosmossdk.io/x/tx Go github.com/cosmos/cosmos-sdk |
MinIO vulnerable to privilege escalation in IAM import API CVE-2024-55949, GHSA-cwq8-g58r-32hg, GO-2024-3336 | High | Not scored | 16 Dec, 2024 | Go github.com/minio/minio |
Potential Vulnerabilities Due to Outdated golang.org/x/crypto Dependency in NanoProxy GHSA-7prj-hgx4-2xc3, GO-2024-3330 | High | Not scored | 12 Dec, 2024 | Go github.com/ryanbekhen/nanoproxy |
SiYuan has an arbitrary file read via /api/template/render CVE-2024-55657, GHSA-xx68-37v4-4596, GO-2024-3327 | High | Not scored | 11 Dec, 2024 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan has an arbitrary file read and path traversal via /api/export/exportResources CVE-2024-55658, GHSA-25w9-wqfq-gwqx, GO-2024-3323 | High | Not scored | 11 Dec, 2024 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan has an arbitrary file write in the host via /api/asset/upload CVE-2024-55659, GHSA-fqj6-whhx-47p7, GO-2024-3326 | High | Not scored | 11 Dec, 2024 | Go github.com/siyuan-note/siyuan/kernel |
Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3) CVE-2024-54131, GHSA-66q9-2rvx-qfj5, GO-2024-3308 | High | Not scored | 03 Dec, 2024 | Go github.com/kolide/launcher |
Moby Race Condition vulnerability CVE-2024-36621, GHSA-2mj3-vfvx-fc43, GO-2024-3304 | High | Not scored | 29 Nov, 2024 | Go github.com/moby/moby |
Moby Race Condition vulnerability CVE-2024-36623, GHSA-gh5c-3h97-2f3q, GO-2024-3305 | High | Not scored | 29 Nov, 2024 | Go github.com/moby/moby |
Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws GHSA-7f6p-phw2-8253, GO-2024-3288 | High | Not scored | 25 Nov, 2024 | Go github.com/taurusgroup/multi-party-sig |
Kubernetes kubelet arbitrary command execution CVE-2024-10220, GHSA-27wf-5967-98gx, GO-2024-3286 | High | Not scored | 22 Nov, 2024 | Go k8s.io/kubernetes |