Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm CVE-2024-6984, GHSA-6vjm-54vp-mxhx, GO-2024-3010, GO-2024-3040 | High | Not scored | 05 Aug, 2024 | Go github.com/juju/juju |
Kubean vulnerable to cluster-level privilege escalation CVE-2024-41820, GHSA-3wfj-3x8q-hrpg, GO-2024-3039 | High | Not scored | 05 Aug, 2024 | Go github.com/kubean-io/kubean |
Podman vulnerable to memory-based denial of service CVE-2024-3056, GHSA-rpcc-p8xm-rc6p, GO-2024-3042 | High | Not scored | 02 Aug, 2024 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 +1 more |
soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests CVE-2024-41956, GHSA-m445-w3xr-vp2f, GO-2024-3019 | High | Not scored | 02 Aug, 2024 | Go github.com/charmbracelet/soft-serve |
NetBird uses a static initialization vector (IV) CVE-2024-41260, GHSA-9v35-4xcr-w9ph, GO-2024-3057 | High | Not scored | 01 Aug, 2024 | Go github.com/netbirdio/netbird |
cortex establishes TLS connections with `InsecureSkipVerify` set to `true` CVE-2024-41265, GHSA-vw7g-3cc7-7rmh, GO-2024-3036 | High | Not scored | 01 Aug, 2024 | Go github.com/cortexlabs/cortex Go github.com/cortexproject/cortex |
Mattermost allows remote actor to create/update/delete posts in arbitrary channels BIT-mattermost-2024-41144, CVE-2024-41144, GHSA-vg67-chm7-8m3j, GO-2024-3023 | High | Not scored | 01 Aug, 2024 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Beego privilege escalation vulnerability CVE-2024-40464, GHSA-r6qh-j42j-pw64, GO-2024-3016 | High | Not scored | 31 Jul, 2024 | Go github.com/beego/beego/v2 |
Beego privilege escalation vulnerability CVE-2024-40465, GHSA-wr3p-r5fj-wf97 | High | Not scored | 31 Jul, 2024 | Go github.com/beego/beego/v2 |
Filestash configured to skip TLS certificate verification when using the FTPS protocol CVE-2024-41255, GHSA-4jmm-c6jw-g796, GO-2024-3033 | High | Not scored | 31 Jul, 2024 | Go github.com/mickael-kerjean/filestash |
Filestash skips TLS certificate verification process when sending out email verification codes CVE-2024-41256, GHSA-mpvx-whpp-99xj, GO-2024-3035 | High | Not scored | 31 Jul, 2024 | Go github.com/mickael-kerjean/filestash |
Harbor fails to validate the user permissions when updating project configurations BIT-harbor-2024-22278, CVE-2024-22278, GHSA-hw28-333w-qxp3, GO-2024-3013 | High | Not scored | 31 Jul, 2024 | Go github.com/goharbor/harbor |
HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration CVE-2024-6717, GHSA-5mqx-rpxv-mvxj, GO-2026-4278 | High | Not scored | 23 Jul, 2024 | Go github.com/hashicorp/nomad |
Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint BIT-argo-cd-2024-40634, CVE-2024-40634, GHSA-jmvp-698c-4x3w, GO-2024-3002 | High | Not scored | 22 Jul, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Woodpecker's custom workspace allow to overwrite plugin entrypoint executable CVE-2024-41121, GHSA-xw35-rrcp-g7xm, GO-2024-2999 | High | Not scored | 19 Jul, 2024 | Go go.woodpecker-ci.org/woodpecker Go go.woodpecker-ci.org/woodpecker/v2 |
Kubernetes sets incorrect permissions on Windows containers logs CVE-2024-5321, GHSA-82m2-cv7p-4m75, GO-2024-2994 | High | Not scored | 18 Jul, 2024 | Go k8s.io/kubernetes |
Sliver Allows Authenticated Operator-to-Server Remote Code Execution CVE-2024-41111, GHSA-hc5w-gxxr-w8x8, GO-2024-2993 | High | Not scored | 18 Jul, 2024 | Go github.com/bishopfox/sliver |
projectdiscovery/nuclei allows unsigned code template execution through workflows CVE-2024-40641, GHSA-c3q9-c27p-cw9h, GO-2024-2989 | High | Not scored | 17 Jul, 2024 | Go github.com/projectdiscovery/nuclei Go github.com/projectdiscovery/nuclei/v2 Go github.com/projectdiscovery/nuclei/v3 |
Skupper uses a static cookie secret for the openshift oauth-proxy CVE-2024-6535, GHSA-w799-v85j-88pg, GO-2024-2987 | High | Not scored | 17 Jul, 2024 | Go github.com/skupperproject/skupper |
SQL Injection in the KubeClarity REST API CVE-2024-39909, GHSA-5248-h45p-9pgw, GO-2024-2981 | High | Not scored | 12 Jul, 2024 | Go github.com/openclarity/kubeclarity/backend |
Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions BIT-vault-2024-6468, CVE-2024-6468, GHSA-2qmw-pvf7-4mw6, GO-2024-2982 | High | Not scored | 11 Jul, 2024 | Go github.com/hashicorp/vault |
NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects CVE-2022-29946, GHSA-2h2x-8hh2-mfq8, GO-2024-2980 | High | Not scored | 11 Jul, 2024 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 Go github.com/nats-io/nats-streaming-server |
Evmos vulnerable to exploit of smart contract account and vesting CVE-2024-39696, GHSA-q6hg-6m9x-5g9c, GO-2024-2974 | High | Not scored | 09 Jul, 2024 | Go github.com/evmos/evmos Go github.com/evmos/evmos/v10 Go github.com/evmos/evmos/v11 Go github.com/evmos/evmos/v12 +15 more |
Bypassing IP allow-lists in traefik via HTTP/3 early data requests in QUIC 0-RTT handshakes CVE-2024-39321, GHSA-gxrv-wf35-62w9, GO-2024-2973 | High | Not scored | 05 Jul, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Duplicate Advisory: Gogs allows argument injection during the tagging of a new release CVE-2024-39933, GHSA-8mm6-wmpp-mmm3, GHSA-m27m-h5gj-wwmg, GO-2024-2972 | High | Not scored | 04 Jul, 2024 | Go github.com/gogs/gogs Go gogs.io/gogs |
Potential memory exhaustion attack due to sparse slice deserialization CVE-2024-37298, GHSA-3669-72x9-r9p3, GO-2024-2958 | High | Not scored | 01 Jul, 2024 | Go github.com/gorilla/schema |
Panic when parsing invalid palette-color images in golang.org/x/image CVE-2024-24792, GHSA-9phm-fm57-rhg8, GO-2024-2937 | High | Not scored | 25 Jun, 2024 | Go golang.org/x/image |
HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation CVE-2024-6257, GHSA-xfhp-jf8p-mh5w, GO-2024-2948 | High | Not scored | 25 Jun, 2024 | Go github.com/hashicorp/go-getter |
Lightning Network Daemon (LND)'s onion processing logic leads to a denial of service CVE-2024-38359, GHSA-9gxx-58q6-42p7, GO-2024-2943 | High | Not scored | 20 Jun, 2024 | Go github.com/lightningnetwork/lnd |
LocalAI path traversal vulnerability CVE-2024-5182, GHSA-cpcx-r2gq-x893, GO-2024-2938 | High | Not scored | 20 Jun, 2024 | Go github.com/go-skynet/LocalAI |
Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec CVE-2024-22032, GHSA-q6c7-56cq-g2wm, GO-2024-2932 | High | Not scored | 17 Jun, 2024 | Go github.com/rancher/rancher |
Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider CVE-2023-22650, GHSA-9ghh-mmcq-8phc, GO-2024-2931 | High | Not scored | 17 Jun, 2024 | Go github.com/rancher/rancher |
AdGuardHome privilege escalation vulnerability CVE-2024-36586, GHSA-7jp9-vgmq-c8r5, GO-2024-2924 | High | Not scored | 13 Jun, 2024 | Go github.com/AdguardTeam/AdGuardHome |
Vulnerabilities with the k8sGPT GHSA-85rg-8m6h-825p, GO-2024-2923 | High | Not scored | 13 Jun, 2024 | Go github.com/k8sgpt-ai/k8sgpt |
Cilium leaks sensitive information in cilium-bugtool BIT-cilium-2024-37307, BIT-cilium-operator-2024-37307, BIT-cilium-proxy-2024-37307, BIT-hubble-2024-37307, BIT-hubble-relay-2024-37307, BIT-hubble-ui-2024-37307, BIT-hubble-ui-backend-2024-37307, CVE-2024-37307, GHSA-wh78-7948-358j, GO-2024-2922 | High | Not scored | 13 Jun, 2024 | Go github.com/cilium/cilium |
go-grpc-compression has a zstd decompression bombing vulnerability GHSA-87m9-rv8p-rgmg, GO-2024-2911 | High | Not scored | 10 Jun, 2024 | Go github.com/mostynb/go-grpc-compression |
Contract balance not updating correctly after interchain transaction CVE-2024-37153, GHSA-xgr7-jgq3-mhmc, GO-2024-2903 | High | Not scored | 06 Jun, 2024 | Go github.com/evmos/evmos Go github.com/evmos/evmos/v10 Go github.com/evmos/evmos/v11 Go github.com/evmos/evmos/v12 +14 more |
Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC BIT-opentelemetry-collector-2024-36129, CVE-2024-36129, GHSA-c74f-6mfw-mm4v, GO-2024-2900 | High | Not scored | 05 Jun, 2024 | Go go.opentelemetry.io/collector/config/configgrpc Go go.opentelemetry.io/collector/config/confighttp |
malicious container creates symlink "mtab" on the host External CVE-2024-5154, GHSA-j9hf-98c3-wrm8, GO-2024-2919 | High | Not scored | 04 Jun, 2024 | Go github.com/cri-o/cri-o |
apko Exposure of HTTP basic auth credentials in log output CVE-2024-36127, GHSA-v6mg-7f7p-qmqp, GO-2024-2899 | High | Not scored | 04 Jun, 2024 | Go chainguard.dev/apko |
Stakater Forecastle has a directory traversal vulnerability CVE-2023-40297, GHSA-x8xm-wrjq-5g54, GO-2024-2865 | High | Not scored | 15 May, 2024 | Go github.com/stakater/Forecastle |
Grafana folders admin only permission privilege escalation BIT-grafana-2022-36062, CVE-2022-36062, GHSA-p978-56hq-r492, GO-2024-2854 | High | Not scored | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins BIT-grafana-2022-39201, CVE-2022-39201, GHSA-x744-mm8v-vpgr, GO-2024-2858 | High | Not scored | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Email addresses and usernames can not be trusted BIT-grafana-2022-39306, CVE-2022-39306, GHSA-2x6g-h2hg-rq84, GO-2024-2843 | High | Not scored | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana User enumeration via forget password BIT-grafana-2022-39307, CVE-2022-39307, GHSA-3p62-42x7-gxg5, GO-2024-2844 | High | Not scored | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Escalation from admin to server admin when auth proxy is used BIT-grafana-2022-35957, CVE-2022-35957, GHSA-ff5c-938w-8c9q, GO-2024-2847 | High | Not scored | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Plugin signature bypass BIT-grafana-2022-31123, CVE-2022-31123, GHSA-rhxj-gh46-jvw8, GO-2024-2855 | High | Not scored | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana account takeover via OAuth vulnerability BIT-grafana-2022-31107, CVE-2022-31107, GHSA-mx47-6497-3fv2, GO-2024-2852 | High | Not scored | 14 May, 2024 | Go github.com/grafana/grafana |
dotmesh arbitrary file read and/or write CVE-2020-26312, GHSA-hf54-fq2m-p9v6, GO-2024-2849 | High | Not scored | 14 May, 2024 | Go github.com/dotmesh-io/dotmesh |
github.com/containers/image allows unexpected authenticated registry accesses CVE-2024-3727, GHSA-6wvf-f2vw-3425, GO-2024-2842 | High | Not scored | 14 May, 2024 | Go github.com/containers/image Go github.com/containers/image/v5 |