Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenShift Hive Has an Uncontrolled Resource Consumption Vulnerability CVE-2024-25132, GHSA-c392-wrgw-jjfw, GO-2025-3536 | Medium | Not scored | 19 Mar, 2025 | Go github.com/openshift/hive |
Mattermost Fails to Properly Perform Viewer Role Authorization CVE-2025-1472, GHSA-fqrq-xmxj-v47x, GO-2025-3534 | Medium | Not scored | 19 Mar, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
buildx allows a possible credential leakage to telemetry endpoint CVE-2025-0495, GHSA-m4gq-fm9h-8q75, GO-2025-3527 | Medium | Not scored | 17 Mar, 2025 | Go github.com/docker/buildx |
Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD CVE-2025-29781, GHSA-c98h-7hp9-v9hq, GO-2025-3530 | Medium | Not scored | 17 Mar, 2025 | Go github.com/metal3-io/baremetal-operator/apis |
containerd has an integer overflow in User ID handling CVE-2024-40635, GHSA-265r-hfxg-fhmg, GO-2025-3528 | Medium | Not scored | 17 Mar, 2025 | Go github.com/containerd/containerd Go github.com/containerd/containerd/v2 |
onos-lib-go allows an index out-of-range panic CVE-2025-30077, GHSA-jrqj-6vq2-7r63, GO-2025-3526 | Medium | Not scored | 16 Mar, 2025 | Go github.com/onosproject/onos-lib-go |
Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API CVE-2024-9042, GHSA-vv39-3w5q-974q, GO-2025-3522 | Medium | Not scored | 13 Mar, 2025 | Go k8s.io/kubernetes |
Kubernetes GitRepo Volume Inadvertent Local Repository Access CVE-2025-1767, GHSA-3wgm-2gw2-vh5m, GO-2025-3521 | Medium | Not scored | 13 Mar, 2025 | Go k8s.io/kubernetes |
HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net CVE-2025-22870, GHSA-qxp5-gwg8-xv66, GO-2025-3503 | Medium | Not scored | 12 Mar, 2025 | Go golang.org/x/net Go stdlib |
LF Edge eKuiper allows Stored XSS in Rules Functionality CVE-2024-52812, GHSA-6hrw-x7pr-4mp8, GO-2025-3508 | Medium | Not scored | 10 Mar, 2025 | Go github.com/lf-edge/ekuiper Go github.com/lf-edge/ekuiper/v2 |
Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs CVE-2025-1296, GHSA-c3q9-q986-vrwh, GO-2025-3510 | Medium | Not scored | 10 Mar, 2025 | Go github.com/hashicorp/nomad |
Envoy Gateway Log Injection Vulnerability BIT-envoy-gateway-2025-25294, CVE-2025-25294, GHSA-mf24-chxh-hmvj, GO-2025-3504 | Medium | Not scored | 06 Mar, 2025 | Go github.com/envoyproxy/gateway |
In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim CVE-2025-27155, GHSA-fr62-mg2q-7wqv, GO-2025-3500 | Medium | Not scored | 04 Mar, 2025 | Go github.com/matrix-org/pinecone |
MinIO allows an SFTP authentication bypass due to improperly trusted SSH key CVE-2025-27414, GHSA-wc79-7x8x-2p58, GO-2025-3495 | Medium | Not scored | 03 Mar, 2025 | Go github.com/minio/minio |
Memos Server-Side Request Forgery (SSRF) CVE-2025-22952, GHSA-wfxg-v3j4-7qmj, GO-2025-3492 | Medium | Not scored | 27 Feb, 2025 | Go github.com/usememos/memos |
Rancher's SAML-based login via CLI can be denied by unauthenticated users CVE-2025-23387, GHSA-5qmp-9x47-92q8, GO-2025-3489 | Medium | Not scored | 27 Feb, 2025 | Go github.com/rancher/rancher |
Navidrome allows an authentication bypass in Subsonic API with non-existent username CVE-2025-27112, GHSA-c3p4-vm8f-386p, GO-2025-3484 | Medium | Not scored | 25 Feb, 2025 | Go github.com/navidrome/navidrome |
DoS in go-jose Parsing CVE-2025-27144, GHSA-c6gw-w398-hv78, GO-2025-3485 | Medium | Not scored | 24 Feb, 2025 | Go github.com/go-jose/go-jose Go github.com/go-jose/go-jose/v3 Go github.com/go-jose/go-jose/v4 Go github.com/square/go-jose |
Mattermost fails to restrict channel export of archived channels CVE-2025-24526, GHSA-q8p2-2hwc-jw64, GO-2025-3481 | Medium | Not scored | 24 Feb, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
lakeFS allows an authenticated user to cause a crash by exhausting server memory CVE-2025-27100, GHSA-j7jw-28jm-whr6, GO-2025-3479 | Medium | Not scored | 21 Feb, 2025 | Go github.com/treeverse/lakefs |
SSRF in sliver teamserver CVE-2025-27090, GHSA-fh4v-v779-4g2w, GO-2025-3472 | Medium | Not scored | 19 Feb, 2025 | Go github.com/bishopfox/sliver |
OpenFGA Authorization Bypass CVE-2025-25196, GHSA-g4v5-6f5p-m38j, GO-2025-3470 | Medium | Not scored | 19 Feb, 2025 | Go github.com/openfga/openfga |
`gh attestation verify` returns incorrect exit code during verification if no attestations are present CVE-2025-25204, GHSA-fgw4-v983-mgp8, GO-2025-3467 | Medium | Not scored | 14 Feb, 2025 | Go github.com/cli/cli Go github.com/cli/cli/v2 |
Node Denial of Service via kubelet Checkpoint API CVE-2025-0426, GHSA-jgfp-53c3-624w, GO-2025-3465 | Medium | Not scored | 13 Feb, 2025 | Go k8s.io/kubernetes |
Missing rate limit in MaysWind ezBookkeeping CVE-2024-57603, GHSA-772m-773g-qmhc, GO-2025-3466 | Medium | Not scored | 13 Feb, 2025 | Go github.com/mayswind/ezbookkeeping |
Potential Denial-of-Service condition leading to temporary disability in IBC transfers to the native chain GHSA-6fgm-x6ff-w78f, GO-2025-3463 | Medium | Not scored | 12 Feb, 2025 | Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6 Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7 +1 more |
Plenti - Code Injection - Denial of Services CVE-2025-26260, GHSA-mj4v-hp69-27x5, GO-2025-3454, GO-2025-3515 | Medium | Not scored | 05 Feb, 2025 | Go github.com/plentico/plenti |
wasmvm: Malicious smart contract can slow down block production GHSA-mx2j-7cmv-353c, GO-2025-3449 | Medium | Not scored | 04 Feb, 2025 | Go github.com/CosmWasm/wasmvm Go github.com/CosmWasm/wasmvm/v2 crates.io cosmwasm-vm |
wasmvm: Malicious smart contract can crash the chain GHSA-23qp-3c2m-xx6w, GO-2025-3448 | Medium | Not scored | 04 Feb, 2025 | Go github.com/CosmWasm/wasmvm Go github.com/CosmWasm/wasmvm/v2 |
CometBFT allows a malicious peer to make node stuck in blocksync CVE-2025-24371, GHSA-22qq-3xwm-r5x4, GO-2025-3442 | Medium | Not scored | 03 Feb, 2025 | Go github.com/cometbft/cometbft |
Grafana Alerting VictorOps integration could be exposed to users with Viewer permission BIT-grafana-2024-11741, CVE-2024-11741, GHSA-wxcc-2f3q-4h58, GO-2025-3438 | Medium | Not scored | 31 Jan, 2025 | Go github.com/grafana/grafana |
Argo CD does not scrub secret values from patch errors BIT-argo-cd-2025-23216, CVE-2025-23216, GHSA-47g2-qmh2-749v, GO-2025-3433 | Medium | Not scored | 30 Jan, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
KubeWarden's AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources CVE-2025-24376, GHSA-fc89-jghx-8pvg, GO-2025-3434 | Medium | Not scored | 30 Jan, 2025 | Go github.com/kubewarden/kubewarden-controller |
Kubewarden-Controller information leak via AdmissionPolicyGroup Resource CVE-2025-24784, GHSA-756x-m4mj-q96c, GO-2025-3435 | Medium | Not scored | 30 Jan, 2025 | Go github.com/kubewarden/kubewarden-controller |
Go Ethereum vulnerable to DoS via malicious p2p message CVE-2025-24883, GHSA-q26p-9cq4-7fc2, GO-2025-3436 | Medium | Not scored | 30 Jan, 2025 | Go github.com/ethereum/go-ethereum |
Argo CD GitOps Engine does not scrub secret values from patch errors GHSA-274v-mgcv-cm8j, GO-2025-3437 | Medium | Not scored | 30 Jan, 2025 | Go github.com/argoproj/gitops-engine |
kube-audit-rest's example logging configuration could disclose secret values in the audit log CVE-2025-24884, GHSA-hcr5-wv4p-h2g2, GO-2025-3431 | Medium | Not scored | 29 Jan, 2025 | Go github.com/RichardoC/kube-audit-rest |
CRI-O Path Traversal vulnerability CVE-2025-0750, GHSA-hp5j-2585-qx6g, GO-2025-3426 | Medium | Not scored | 28 Jan, 2025 | Go github.com/cri-o/cri-o |
Insecure Temporary File usage in github.com/golang/glog CVE-2024-45339, GHSA-6wxm-mpqj-6jpf, GO-2025-3372 | Medium | Not scored | 28 Jan, 2025 | Go github.com/golang/glog |
imgproxy is vulnerable to SSRF against 0.0.0.0 CVE-2025-24354, GHSA-j2hp-6m75-v4j4, GO-2025-3422 | Medium | Not scored | 27 Jan, 2025 | Go github.com/imgproxy/imgproxy Go github.com/imgproxy/imgproxy/v2 Go github.com/imgproxy/imgproxy/v3 |
Cilium has an information leakage via insecure default Hubble UI CORS header BIT-cilium-2025-23047, BIT-cilium-operator-2025-23047, BIT-hubble-relay-2025-23047, CVE-2025-23047, GHSA-h78m-j95m-5356, GO-2025-3416 | Medium | Not scored | 22 Jan, 2025 | Go github.com/cilium/cilium |
DoS in Cilium agent DNS proxy from crafted DNS responses BIT-cilium-2025-23028, BIT-cilium-operator-2025-23028, BIT-hubble-relay-2025-23028, CVE-2025-23028, GHSA-9m5p-c77c-f9j7, GO-2025-3415 | Medium | Not scored | 22 Jan, 2025 | Go github.com/cilium/cilium |
Excessive Platform Resource Consumption within a Loop when unmarshalling Compose file having recursive loop CVE-2024-10846, GHSA-36gq-35j3-p9r9, GO-2025-3412 | Medium | Not scored | 21 Jan, 2025 | Go github.com/compose-spec/compose-go/v2 |
Gomatrixserverlib Server-Side Request Forgery (SSRF) on redirects and federation CVE-2024-52594, GHSA-4ff6-858j-r822, GO-2025-3396 | Medium | Not scored | 16 Jan, 2025 | Go github.com/matrix-org/gomatrixserverlib |
Mattermost webapp crash via a crafted post CVE-2025-20621, GHSA-w6xh-c82w-h997, GO-2025-3407 | Medium | Not scored | 16 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Matrix Media Repo (MMR) allows untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders CVE-2024-56515, GHSA-rcxc-wjgw-579r, GO-2025-3400 | Medium | Not scored | 16 Jan, 2025 | Go github.com/t2bot/matrix-media-repo |
Matrix Media Repo (MMR) allows Server-Side Request Forgery (SSRF) on redirects and federation CVE-2024-52602, GHSA-r6jg-jfv6-2fjv, GO-2025-3399 | Medium | Not scored | 16 Jan, 2025 | Go github.com/t2bot/matrix-media-repo |
matrix-media-repo (MMR) allows a denial of service through memory exhaustion CVE-2024-52791, GHSA-gp86-q8hg-fpxj, GO-2025-3398 | Medium | Not scored | 16 Jan, 2025 | Go github.com/t2bot/matrix-media-repo |
matrix-media-repo (MMR) allows denial of service/high operating costs through unauthenticated downloads CVE-2024-36403, GHSA-vc2m-hw89-qjxf, GO-2025-3401 | Medium | Not scored | 16 Jan, 2025 | Go github.com/t2bot/matrix-media-repo |
matrix-media-repo (MMR) allows unauthenticated writes to the media repository, which may allow planting of problematic content CVE-2024-36402, GHSA-8vmr-h7h5-cqhg, GO-2025-3397 | Medium | Not scored | 16 Jan, 2025 | Go github.com/t2bot/matrix-media-repo |