Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and sdk.Dec can lead to panic GHSA-7225-m954-23v7, GO-2024-3279 | High | Not scored | 20 Nov, 2024 | Go cosmossdk.io/math |
github.com/rancher/steve's users can issue watch commands for arbitrary resources CVE-2024-52280, GHSA-j5hq-5jcr-xwx7, GO-2024-3281 | High | Not scored | 20 Nov, 2024 | Go github.com/rancher/steve |
Kubernetes Nil pointer dereference in KCM after v1 HPA patch request CVE-2024-0793, GHSA-h7wq-jj8r-qm7p, GO-2024-3277 | High | Not scored | 17 Nov, 2024 | Go k8s.io/kubernetes |
Remote Code Execution in Gogs CVE-2024-44625, GHSA-phm4-wf3h-pc3r, GO-2024-3275 | High | Not scored | 15 Nov, 2024 | Go gogs.io/gogs |
Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer CVE-2024-52308, GHSA-p2h2-3vg9-4p87, GO-2024-3269 | High | Not scored | 14 Nov, 2024 | Go github.com/cli/cli Go github.com/cli/cli/v2 |
Harbor fails to validate the user permissions when updating p2p preheat policies BIT-harbor-2022-31668, CVE-2022-31668, GHSA-3wpx-625q-22j7, GHSA-r864-28pw-8682, GO-2024-3268 | High | Not scored | 14 Nov, 2024 | Go github.com/goharbor/harbor Go github.com/goharbor/harbor/src |
Zoraxy has an authenticated command injection in the Web SSH feature CVE-2024-52010, GHSA-7hpf-g48v-hw3j, GO-2024-3267 | High | Not scored | 12 Nov, 2024 | Go github.com/tobychui/zoraxy |
Git credentials are exposed in Atlantis logs CVE-2024-52009, GHSA-gppm-hq3p-h4rp, GO-2024-3265 | High | Not scored | 08 Nov, 2024 | Go github.com/runatlantis/atlantis |
Devtron has SQL Injection in CreateUser API CVE-2024-45794, GHSA-q78v-cv36-8fxj, GO-2024-3260 | High | Not scored | 07 Nov, 2024 | Go github.com/devtron-labs/devtron |
CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data GHSA-p7mv-53f2-4cwj, GO-2024-3259 | High | Not scored | 06 Nov, 2024 | Go github.com/cometbft/cometbft |
Ollama Out-of-bounds Read CVE-2024-39720, GHSA-95j2-w8x7-hm88, GO-2024-3245 | High | Not scored | 31 Oct, 2024 | Go github.com/ollama/ollama |
Hashicorp Vault vulnerable to denial of service through memory exhaustion BIT-openbao-2024-8185, BIT-vault-2024-8185, CVE-2024-8185, GHSA-g233-2p4r-3q7v, GO-2024-3246 | High | Not scored | 31 Oct, 2024 | Go github.com/hashicorp/vault Go github.com/openbao/openbao |
Hashicorp Consul Path Traversal vulnerability BIT-consul-2024-10005, CVE-2024-10005, GHSA-chgm-7r52-whjj, GO-2024-3243 | High | Not scored | 31 Oct, 2024 | Go github.com/hashicorp/consul |
Kyverno's PolicyException objects can be created in any namespace by default BIT-kyverno-2024-48921, CVE-2024-48921, GHSA-qjvc-p88j-j9rm, GO-2024-3230 | High | Not scored | 29 Oct, 2024 | Go github.com/kyverno/kyverno |
Plenti arbitrary file write vulnerability CVE-2024-49380, GHSA-2p96-p7qh-4rgr, GO-2024-3213 | High | Not scored | 28 Oct, 2024 | Go github.com/plentico/plenti |
Plenti arbitrary file deletion vulnerability CVE-2024-49381, GHSA-6h8w-hrfp-pffx, GO-2024-3214 | High | Not scored | 28 Oct, 2024 | Go github.com/plentico/plenti |
Exposure of vSphere's CPI and CSI credentials in Rancher CVE-2022-45157, GHSA-xj7w-r753-vj8v, GO-2024-3223 | High | Not scored | 25 Oct, 2024 | Go github.com/rancher/rancher |
User Registration Bypass in Zitadel CVE-2024-49757, GHSA-3rmw-76m6-4gjc, GO-2024-3217 | High | Not scored | 25 Oct, 2024 | Go github.com/zitadel/zitadel |
Permissive Regular Expression in tacquito GHSA-p5wf-cmr4-xrwr, GO-2024-3207 | High | Not scored | 18 Oct, 2024 | Go github.com/facebookincubator/tacquito |
Vault Community Edition privilege escalation vulnerability BIT-openbao-2024-9180, BIT-vault-2024-9180, CVE-2024-9180, GHSA-rr8j-7w34-xp5j, GO-2024-3191 | High | Not scored | 10 Oct, 2024 | Go github.com/hashicorp/vault Go github.com/openbao/openbao |
btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality CVE-2024-38365, GHSA-27vh-h6mc-q6g8, GO-2024-3189 | High | Not scored | 10 Oct, 2024 | Go github.com/btcsuite/btcd |
Adguard Home arbitrary file read vulnerability CVE-2024-36814, GHSA-9cp9-8gw2-8v7m, GO-2024-3184 | High | Not scored | 08 Oct, 2024 | Go github.com/AdguardTeam/AdGuardHome |
PAM module may allow accessing with the credentials of another user CVE-2024-9313, GHSA-x5q3-c8rm-w787, GO-2024-3181 | High | Not scored | 03 Oct, 2024 | Go github.com/ubuntu/authd |
Pomerium service account access token may grant unintended access to databroker API CVE-2024-47616, GHSA-r7rh-jww5-5fjr, GO-2024-3179 | High | Not scored | 02 Oct, 2024 | Go github.com/pomerium/pomerium |
Portainer improperly uses an encryption algorithm in the AesEncrypt function CVE-2024-33662, GHSA-9mjw-79r6-c9m8, GO-2024-3172 | High | Not scored | 02 Oct, 2024 | Go github.com/portainer/portainer |
Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability CVE-2024-9355, GHSA-3h3x-2hwv-hr52, GO-2024-3167 | High | Not scored | 01 Oct, 2024 | Go github.com/golang-fips/openssl |
Incorrect delegation lookups can make go-tuf download the wrong artifact CVE-2024-47534, GHSA-4f8r-qqr9-fq8j, GO-2024-3166 | High | Not scored | 01 Oct, 2024 | Go github.com/theupdateframework/go-tuf/v2 |
Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default BIT-openbao-2024-7594, BIT-vault-2024-7594, CVE-2024-7594, GHSA-jg74-mwgw-v6x3, GO-2024-3162 | High | Not scored | 26 Sep, 2024 | Go github.com/hashicorp/vault Go github.com/openbao/openbao |
Rancher agents can be hijacked by taking over the Rancher Server URL CVE-2024-22030, GHSA-h4h5-9833-v2p4, GO-2024-3161 | High | Not scored | 26 Sep, 2024 | Go github.com/rancher/rancher |
ZITADEL Allows Unauthorized Access After Organization or Project Deactivation CVE-2024-47060, GHSA-jj94-6f5c-65r8, GO-2024-3138 | High | Not scored | 19 Sep, 2024 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
ZITADEL's Service Users Deactivation not Working CVE-2024-47000, GHSA-qr2h-7pwm-h393, GO-2024-3139 | High | Not scored | 19 Sep, 2024 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
ZITADEL's User Grant Deactivation not Working CVE-2024-46999, GHSA-2w5j-qfvw-2hf5, GO-2024-3137 | High | Not scored | 19 Sep, 2024 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
CoreDNS vulnerable to TuDoor Attacks CVE-2023-28452, GHSA-hfmw-7g3m-gj6q, GO-2024-3130 | High | Not scored | 18 Sep, 2024 | Go github.com/coredns/coredns |
External Secrets Operator vulnerable to privilege escalation CVE-2024-45041, GHSA-qwgc-rr35-h4x9, GO-2024-3126 | High | Not scored | 09 Sep, 2024 | Go github.com/external-secrets/external-secrets |
gnark commitments to private witnesses in Groth16 as implemented break zero-knowledge property CVE-2024-45040, GHSA-9xcg-3q8v-7fq6, GO-2024-3123 | High | Not scored | 06 Sep, 2024 | Go github.com/consensys/gnark |
Interchain Security: The signers of ICS messages do not need to match the provider address GHSA-7q74-g774-7x3g, GO-2024-3121 | High | Not scored | 05 Sep, 2024 | Go github.com/cosmos/interchain-security Go github.com/cosmos/interchain-security/v2 Go github.com/cosmos/interchain-security/v3 Go github.com/cosmos/interchain-security/v4 +1 more |
Hoverfly allows an arbitrary file read in the `/api/v2/simulation` endpoint (`GHSL-2023-274`) CVE-2024-45388, GHSA-6xx4-x46f-f897, GO-2024-3108 | High | Not scored | 03 Sep, 2024 | Go github.com/SpectoLabs/hoverfly Go github.com/spectolabs/hoverfly |
Ollama can extract members of a ZIP archive outside of the parent directory CVE-2024-45436, GHSA-846m-99qv-67mg, GO-2024-3104 | High | Not scored | 29 Aug, 2024 | Go github.com/ollama/ollama |
Chisel's AUTH environment variable not respected in server entrypoint CVE-2024-43798, GHSA-38jh-8h67-m7mj, GO-2024-3100 | High | Not scored | 27 Aug, 2024 | Go github.com/jpillora/chisel |
Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams BIT-mattermost-2024-42497, CVE-2024-42497, GHSA-fxq9-6946-34q7, GO-2024-3091 | High | Not scored | 22 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
memos CORS Misconfiguration in server.go (GHSL-2024-034) CVE-2024-41659, GHSA-p4fx-qf2h-jpmj, GO-2024-3088 | High | Not scored | 22 Aug, 2024 | Go github.com/usememos/memos |
Casdoor CORS misconfiguration (GHSL-2024-035) CVE-2024-41657, GHSA-mchx-7j67-8mcf, GO-2024-3087 | High | Not scored | 22 Aug, 2024 | Go github.com/casdoor/casdoor |
CWA-2024-005: Stackoverflow in wasmd GHSA-g8w7-7vgg-x7xg, GO-2024-3082 | High | Not scored | 21 Aug, 2024 | Go github.com/CosmWasm/wasmd |
Capsule tenant owner with "patch namespace" permission can hijack system namespaces CVE-2024-39690, GHSA-mq69-4j5w-3qwp, GO-2024-3077 | High | Not scored | 20 Aug, 2024 | Go github.com/projectcapsule/capsule |
LF Edge eKuiper has a SQL Injection in sqlKvStore CVE-2024-43406, GHSA-r5ph-4jxm-6j9p, GO-2024-3078, PYSEC-2024-72 | High | 0.9% | 20 Aug, 2024 | Go github.com/lf-edge/ekuiper PyPI ekuiper |
OpenFGA Authorization Bypass CVE-2024-42473, GHSA-3f6g-m4hr-59h8, GO-2024-3061 | High | Not scored | 09 Aug, 2024 | Go github.com/openfga/openfga |
gotortc vulnerable to Cross-Site Request Forgery CVE-2024-29192, GHSA-qgj8-g9q4-7f2p, GO-2024-3052 | High | Not scored | 05 Aug, 2024 | Go github.com/AlexxIT/go2rtc |
Meshery SQL Injection vulnerability CVE-2024-29031, GHSA-652r-q29p-m25h, GO-2024-3045 | High | Not scored | 05 Aug, 2024 | Go github.com/layer5io/meshery |
RobotsAndPencils go-saml authentication bypass vulnerability CVE-2023-48703, GHSA-6h53-q94j-348w, GO-2024-3048 | High | Not scored | 05 Aug, 2024 | Go github.com/RobotsAndPencils/go-saml |
Owncast Cross-Site Request Forgery vulnerability CVE-2024-29026, GHSA-v99w-r56h-g23v, GO-2024-3054 | High | Not scored | 05 Aug, 2024 | Go github.com/owncast/owncast |