Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Previous ATX is not checked to be the newest valid ATX by Smesher when validating incoming ATX CVE-2024-34360, GHSA-jcqq-g64v-gcm7, GO-2024-2831 | High | Not scored | 10 May, 2024 | Go github.com/spacemeshos/api Go github.com/spacemeshos/api/release/go Go github.com/spacemeshos/go-spacemesh |
Minder's GitHub Webhook Handler vulnerable to DoS from un-validated requests CVE-2024-34084, GHSA-9c5w-9q3f-3hv7, GO-2024-2821 | High | Not scored | 07 May, 2024 | Go github.com/stacklok/minder |
go-ethereum vulnerable to DoS via malicious p2p message CVE-2024-32972, GHSA-4xc9-8hmq-j652, GO-2024-2819 | High | Not scored | 06 May, 2024 | Go github.com/ethereum/go-ethereum |
Pterodactyl Wings vulnerable to Arbitrary File Write/Read CVE-2024-34066, GHSA-gqmf-jqgv-v8fw, GO-2024-2814 | High | Not scored | 03 May, 2024 | Go github.com/pterodactyl/wings |
piraeus-operator allows attacker to impersonate service account CVE-2024-33398, GHSA-6fg2-hvj9-832f, GO-2024-2811 | High | Not scored | 03 May, 2024 | Go github.com/piraeusdatastore/piraeus-operator Go github.com/piraeusdatastore/piraeus-operator/v2 |
karmada vulnerable to arbitrary code execution via a crafted command CVE-2024-33396, GHSA-wccg-v638-j9q2, GO-2024-2817 | High | Not scored | 02 May, 2024 | Go github.com/karmada-io/karmada |
CRI-O vulnerable to an arbitrary systemd property injection CVE-2024-3154, GHSA-2cgq-h8xw-2v5j, GO-2024-2791 | High | Not scored | 30 Apr, 2024 | Go github.com/cri-o/cri-o |
Calico privilege escalation vulnerability CVE-2024-33522, GHSA-6362-gv4m-53ww, GO-2024-2801 | High | Not scored | 30 Apr, 2024 | Go github.com/projectcalico/calico Go github.com/projectcalico/calico/v3 |
Buffer Overflow vulnerability in osrg gobgp CVE-2023-46565, GHSA-6rqv-5cg7-m4x3, GO-2024-3124 | High | Not scored | 29 Apr, 2024 | Go github.com/osrg/gobgp/v3 |
ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass CVE-2024-32868, GHSA-7j7j-66cv-m239, GO-2024-2788 | High | Not scored | 25 Apr, 2024 | Go github.com/zitadel/zitadel |
Withdrawn Advisory: Cluster Monitoring Operator contains a credentials leak CVE-2024-1139, GHSA-x5m7-63c6-fx79, GO-2024-2789 | High | Not scored | 25 Apr, 2024 | Go github.com/openshift/cluster-monitoring-operator |
Heketi Arbitrary Code Execution CVE-2017-15103, GHSA-6g56-v9qg-jp92, GO-2024-2763 | High | Not scored | 24 Apr, 2024 | Go github.com/heketi/heketi |
Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources CVE-2021-25318, GHSA-f9xf-jq4j-vqw4, GO-2024-2768 | High | Not scored | 24 Apr, 2024 | Go github.com/rancher/rancher |
Rancher Privilege escalation vulnerability via malicious "Connection" header CVE-2021-31999, GHSA-pvxj-25m6-7vqr, GO-2024-2778 | High | Not scored | 24 Apr, 2024 | Go github.com/rancher/rancher |
Rancher's Steve API Component Improper authorization check allows privilege escalation CVE-2021-36776, GHSA-gvh9-xgrq-r8hw, GO-2024-2771 | High | Not scored | 24 Apr, 2024 | Go github.com/rancher/rancher |
Rancher's Failure to delete orphaned role bindings does not revoke project level access from group based authentication CVE-2021-36775, GHSA-28g7-896h-695v, GO-2024-2760 | High | Not scored | 24 Apr, 2024 | Go github.com/rancher/rancher |
Buffer Overflow in gitea BIT-gitea-2021-3382, CVE-2021-3382, GHSA-9f8c-pfvv-p4gm, GO-2024-2757 | High | Not scored | 24 Apr, 2024 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Access Restriction Bypass in go-ipfs CVE-2020-10937, GHSA-r23h-3jmw-q7hr, GO-2024-2779 | High | Not scored | 24 Apr, 2024 | Go github.com/ipfs/go-ipfs |
github.com/u-root/u-root/pkg/cpio Arbitrary File Write via Archive Extraction (Zip Slip) CVE-2020-7666, GHSA-mq35-x99r-54fc | High | Not scored | 24 Apr, 2024 | Go github.com/u-root/u-root/pkg/cpio |
Arbitrary Code Execution in Gitea BIT-gitea-2020-14144, CVE-2020-14144, GHSA-3h6c-c475-jm7v | High | Not scored | 22 Apr, 2024 | Go code.gitea.io/gitea |
OpenFGA Authorization Bypass CVE-2024-31452, GHSA-8cph-m685-6v6r, GO-2024-2729 | High | Not scored | 16 Apr, 2024 | Go github.com/openfga/openfga |
Constallation has pods exposed to peers in VPC GHSA-g8fc-vrcg-8vjg, GO-2024-2727 | High | Not scored | 15 Apr, 2024 | Go github.com/edgelesssys/constellation Go github.com/edgelesssys/constellation/v2 |
Traefik vulnerable to denial of service with Content-length header CVE-2024-28869, GHSA-4vwx-54mw-vqfw, GO-2024-2722 | High | Not scored | 12 Apr, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
gin-vue-admin background arbitrary code coverage vulnerability CVE-2024-31457, GHSA-gv3w-m57p-3wc4, GO-2024-2702 | High | Not scored | 09 Apr, 2024 | Go github.com/flipped-aurora/gin-vue-admin/server |
Ollama DNS rebinding vulnerability CVE-2024-28224, GHSA-5jx5-hqx5-2vrj, GO-2024-2699 | High | Not scored | 08 Apr, 2024 | Go github.com/jmorganca/ollama Go github.com/ollama/ollama |
Grafana: Users outside an organization can delete a snapshot with its key BIT-grafana-2024-1313, CVE-2024-1313, GHSA-67rv-qpw2-6qrr, GO-2024-2697 | High | Not scored | 05 Apr, 2024 | Go github.com/grafana/grafana |
Mattermost fails to authenticate the source of certain types of post actions BIT-mattermost-2024-2447, CVE-2024-2447, GHSA-wp43-vprh-c3w5, GO-2024-2696 | High | Not scored | 05 Apr, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack CVE-2024-22189, GHSA-c33x-xqrf-c478, GO-2024-2682 | High | Not scored | 02 Apr, 2024 | Go github.com/quic-go/quic-go |
Cilium has insecure IPsec transport encryption BIT-cilium-2024-28860, BIT-cilium-operator-2024-28860, BIT-cilium-proxy-2024-28860, BIT-hubble-2024-28860, BIT-hubble-relay-2024-28860, BIT-hubble-ui-2024-28860, BIT-hubble-ui-backend-2024-28860, CVE-2024-28860, GHSA-pwqm-x5x6-5586, GO-2024-2666 | High | Not scored | 28 Mar, 2024 | Go github.com/cilium/cilium |
ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass CVE-2024-29891, GHSA-hr5w-cwwq-2v4m, GO-2024-2665 | High | Not scored | 28 Mar, 2024 | Go github.com/zitadel/zitadel |
ZITADEL's actions can overload reserved claims CVE-2024-29892, GHSA-gp8g-f42f-95q2, GO-2024-2664 | High | Not scored | 28 Mar, 2024 | Go github.com/zitadel/zitadel |
Memory leaks in code encrypting and verifying RSA payloads CVE-2024-1394, GHSA-78hx-gp6g-7mj6, GO-2024-2660 | High | Not scored | 20 Mar, 2024 | Go github.com/golang-fips/go Go github.com/golang-fips/openssl/v2 Go github.com/microsoft/go-crypto-openssl Go github.com/microsoft/go-crypto-openssl/openssl |
Podman affected by CVE-2024-1753 container escape at build time CVE-2024-1753, GHSA-874v-pj72-92f3, GHSA-pmf3-c36m-g5cf, GO-2024-2658 | High | Not scored | 19 Mar, 2024 | Go github.com/containers/buildah Go github.com/containers/podman/v4 Go github.com/containers/podman/v5 |
Improper HTML sanitization in ZITADEL CVE-2024-28855, GHSA-hfrg-4jwr-jfpj, GO-2024-2655 | High | Not scored | 18 Mar, 2024 | Go github.com/zitadel/zitadel |
Intermittent HTTP policy bypass BIT-cilium-2024-28248, BIT-cilium-operator-2024-28248, BIT-cilium-proxy-2024-28248, BIT-hubble-2024-28248, BIT-hubble-relay-2024-28248, BIT-hubble-ui-2024-28248, BIT-hubble-ui-backend-2024-28248, CVE-2024-28248, GHSA-68mj-9pjq-mc85, GO-2024-2653 | High | Not scored | 18 Mar, 2024 | Go github.com/cilium/cilium |
Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment BIT-argo-cd-2024-21661, CVE-2024-21661, GHSA-6v85-wr92-q4p7, GO-2024-2654 | High | Not scored | 18 Mar, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
CLI for Vela Insecure Variable Substitution GHSA-4jhj-3gv3-c3gr, GO-2024-2647 | High | Not scored | 15 Mar, 2024 | Go github.com/go-vela/cli |
Golang SDK for Vela Insecure Variable Substitution GHSA-v8mx-hp2q-gw85, GO-2024-2650 | High | Not scored | 15 Mar, 2024 | Go github.com/go-vela/sdk-go |
Server/API for Vela Insecure Variable Substitution GHSA-69p4-j5v5-x234, GO-2024-2648 | High | Not scored | 15 Mar, 2024 | Go github.com/go-vela/server |
Types for Vela Insecure Variable Substitution GHSA-7v38-w32m-wx4m, GO-2024-2649 | High | Not scored | 15 Mar, 2024 | Go github.com/go-vela/types |
Nuclei allows unsigned code template execution through workflows CVE-2024-27920, GHSA-w5wx-6g2r-r78q, GO-2024-2645 | High | Not scored | 15 Mar, 2024 | Go github.com/projectdiscovery/nuclei Go github.com/projectdiscovery/nuclei/v2 Go github.com/projectdiscovery/nuclei/v3 |
Insecure Variable Substitution in Vela CVE-2024-28236, GHSA-pwx5-6wxg-px5h, GO-2024-2641 | High | Not scored | 14 Mar, 2024 | Go github.com/go-vela/worker |
ASA-2024-006: ValidateVoteExtensions helper function in Cosmos SDK may allow incorrect voting power assumptions GHSA-95rx-m9m5-m94v, GO-2024-2638 | High | Not scored | 12 Mar, 2024 | Go github.com/cosmos/cosmos-sdk |
Account Takeover via Session Fixation in Zitadel [Bypassing MFA] CVE-2024-28197, GHSA-mq4x-r2w3-j7mr, GO-2024-2637 | High | Not scored | 11 Mar, 2024 | Go github.com/zitadel/zitadel |
kubevirt-csi: PersistentVolume allows access to HCP's root node CVE-2024-1725, GHSA-fg9q-5cw2-p6r9, GO-2025-3512 | High | Not scored | 07 Mar, 2024 | Go github.com/kubevirt/csi-driver |
Grafana's users with permissions to create a data source can CRUD all data sources BIT-grafana-2024-1442, CVE-2024-1442, GHSA-5mxf-42f5-j782, GO-2024-2629 | High | Not scored | 07 Mar, 2024 | Go github.com/grafana/grafana |
Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials CVE-2024-28110, GHSA-5pf6-2qwx-pxm2, GO-2024-2618 | High | Not scored | 06 Mar, 2024 | Go github.com/cloudevents/sdk-go/v2 |
CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability CVE-2024-24767, GHSA-c69x-5xmw-v44x, GO-2024-2614 | High | Not scored | 06 Mar, 2024 | Go github.com/IceWhaleTech/CasaOS-UserService |
CasaOS-UserService allows unauthorized access to any file CVE-2024-24765, GHSA-h5gf-cmm8-cg7c, GO-2024-2616 | High | Not scored | 06 Mar, 2024 | Go github.com/IceWhaleTech/CasaOS-UserService |
`GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated user CVE-2024-27916, GHSA-v627-69v2-xx37, GO-2024-2608 | High | Not scored | 05 Mar, 2024 | Go github.com/stacklok/minder |