Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mattermost fails to properly validate post props CVE-2025-20086, GHSA-5m7j-6gc4-ff5g, GO-2025-3392 | Medium | Not scored | 15 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly validate post props CVE-2025-20088, GHSA-45v9-w9fh-33j6, GO-2025-3394 | Medium | Not scored | 15 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Incorrect Type Conversion or Cast CVE-2025-21088, GHSA-8j3q-gc9x-7972, GO-2025-3393 | Medium | Not scored | 15 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
OpenFGA Authorization Bypass CVE-2024-56323, GHSA-32q6-rr98-cjqv, GO-2025-3384 | Medium | Not scored | 13 Jan, 2025 | Go github.com/openfga/openfga |
notation-go's timestamp signature generation lacks certificate revocation check CVE-2024-56138, GHSA-45v3-38pc-874v, GO-2025-3381 | Medium | Not scored | 13 Jan, 2025 | Go github.com/notaryproject/notation-go |
Mattermost Improper Validation of Specified Type of Input vulnerability CVE-2025-20033, GHSA-2549-xh72-qrpm, GO-2025-3379 | Medium | Not scored | 09 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Soft Serve vulnerable to path traversal attacks CVE-2025-22130, GHSA-j4jw-m6xr-fv6c, GO-2025-3374 | Medium | Not scored | 08 Jan, 2025 | Go github.com/charmbracelet/soft-serve |
Karmada Tar Slips in CRDs archive extraction CVE-2024-56514, GHSA-cwrh-575j-8vr3, GO-2025-3363 | Medium | Not scored | 03 Jan, 2025 | Go github.com/karmada-io/karmada |
Hashicorp Nomad Incorrect Privilege Assignment vulnerability CVE-2024-12678, GHSA-hr68-hvgv-xxqf, GO-2024-3354 | Medium | Not scored | 20 Dec, 2024 | Go github.com/hashicorp/nomad |
age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution GHSA-32gq-x56h-299c, GO-2024-3344 | Medium | Not scored | 18 Dec, 2024 | Go filippo.io/age |
Traefik affected by CVE-2024-53259 GHSA-hxr6-2p24-hf98, GO-2024-3342 | Medium | Not scored | 17 Dec, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Mattermost Race Condition vulnerability CVE-2024-48872, GHSA-826h-p4c3-477p, GO-2024-3338 | Medium | Not scored | 16 Dec, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Improper Validation of Specified Type of Input vulnerability CVE-2024-54083, GHSA-69pr-78gv-7c6h, GO-2024-3337 | Medium | Not scored | 16 Dec, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Data Amplification vulnerability CVE-2024-54682, GHSA-v647-h8jj-fw5r, GO-2024-3340 | Medium | Not scored | 16 Dec, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service CVE-2024-12289, GHSA-xx83-cxmq-x89m, GO-2024-3335 | Medium | Not scored | 13 Dec, 2024 | Go github.com/hashicorp/boundary |
Beego has Collision Hazards of MD5 in Cache Key Filenames CVE-2024-55885, GHSA-9j3m-fr7q-jxfw, GO-2024-3331 | Medium | Not scored | 12 Dec, 2024 | Go github.com/beego/beego Go github.com/beego/beego/v2 |
SiYuan has an SSTI via /api/template/renderSprig CVE-2024-55660, GHSA-4pjc-pwgq-q9jp, GO-2024-3324 | Medium | Not scored | 11 Dec, 2024 | Go github.com/siyuan-note/siyuan/kernel |
kcp's impersonation allows access to global administrative groups GHSA-c7xh-gjv4-4jgv, GO-2024-3325 | Medium | Not scored | 11 Dec, 2024 | Go github.com/kcp-dev/kcp |
CosmWasm VM Incorrect metering GHSA-2q97-m5rc-p3gp | Medium | Not scored | 10 Dec, 2024 | Go github.com/CosmWasm/wasmvm Go github.com/CosmWasm/wasmvm/v2 crates.io cosmwasm-vm |
Panic in wasmvm can slow down block production GHSA-vmqh-5232-v43r | Medium | Not scored | 10 Dec, 2024 | Go github.com/CosmWasm/wasmvm Go github.com/CosmWasm/wasmvm/v2 crates.io cosmwasm-vm |
Hugo does not escape some attributes in internal templates CVE-2024-55601, GHSA-c2xf-9v2r-r2rx, GO-2024-3314 | Medium | Not scored | 09 Dec, 2024 | Go github.com/gohugoio/hugo |
Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability CVE-2024-54132, GHSA-2m9h-r57g-45pj, GO-2024-3310 | Medium | Not scored | 04 Dec, 2024 | Go github.com/cli/cli Go github.com/cli/cli/v2 |
Vitess allows HTML injection in /debug/querylogz & /debug/env CVE-2024-53257, GHSA-7mwh-q3xm-qh6p, GO-2024-3306 | Medium | Not scored | 03 Dec, 2024 | Go vitess.io/vitess |
BunkerWeb has Open Redirect Vulnerability in Loading Page CVE-2024-53264, GHSA-q9rr-h3hx-m87g, GO-2024-3294 | Medium | Not scored | 02 Dec, 2024 | Go github.com/bunkerity/bunkerweb |
Access to Archived Argo Workflows with Fake Token in `client` mode BIT-argo-workflows-2024-53862, CVE-2024-53862, GHSA-h36c-m3rf-34h9, GO-2024-3303 | Medium | Not scored | 02 Dec, 2024 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
quic-go affected by an ICMP Packet Too Large Injection Attack on Linux CVE-2024-53259, GHSA-px8v-pp82-rcvr, GO-2024-3302 | Medium | Not scored | 02 Dec, 2024 | Go github.com/quic-go/quic-go |
sftpgo vulnerable to brute force takeover of OpenID Connect session cookies CVE-2024-52801, GHSA-6943-qr24-82vx, GO-2024-3300 | Medium | Not scored | 02 Dec, 2024 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |
Traefik's X-Forwarded-Prefix Header still allows for Open Redirect CVE-2024-52003, GHSA-h924-8g65-j9wg, GO-2024-3299 | Medium | Not scored | 02 Dec, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
NULL Pointer Dereference on moby image history CVE-2024-36620, GHSA-q59j-vv4j-v33c, GO-2024-3311 | Medium | Not scored | 29 Nov, 2024 | Go github.com/moby/moby |
Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts CVE-2024-53858, GHSA-jwcm-9g39-pmcw, GO-2024-3296 | Medium | Not scored | 27 Nov, 2024 | Go github.com/cli/cli Go github.com/cli/cli/v2 |
`auth.TokenForHost` violates GitHub host security boundary when sourcing authentication token within a codespace CVE-2024-53859, GHSA-55v3-xh23-96gh, GO-2024-3295 | Medium | Not scored | 27 Nov, 2024 | Go github.com/cli/go-gh Go github.com/cli/go-gh/v2 |
CRI-O: Maliciously structured checkpoint file can gain arbitrary node access CVE-2024-8676, GHSA-7p9f-6x8j-gxxp, GO-2024-3292 | Medium | Not scored | 26 Nov, 2024 | Go github.com/cri-o/cri-o |
Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion CVE-2024-43784, GHSA-hh33-46q4-hwm2, GO-2024-3291 | Medium | Not scored | 26 Nov, 2024 | Go github.com/treeverse/lakefs |
Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges BIT-cilium-2024-52529, BIT-cilium-operator-2024-52529, BIT-hubble-relay-2024-52529, CVE-2024-52529, GHSA-xg58-75qf-9r67, GO-2024-3290 | Medium | Not scored | 25 Nov, 2024 | Go github.com/cilium/cilium |
OpenShift Console Server Side Request Forgery vulnerability CVE-2024-6538, GHSA-v3w7-g6p2-mpx7, GO-2024-3289 | Medium | Not scored | 25 Nov, 2024 | Go github.com/openshift/console |
SFTPGo allows administrators to restrict command execution from the EventManager CVE-2024-52309, GHSA-49cc-xrjf-9qf7, GO-2024-3283 | Medium | Not scored | 21 Nov, 2024 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 Go sftpgo |
Duplicate Advisory: cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs CVE-2024-12401, GHSA-ghw8-3xqw-hhcj, GHSA-r4pg-vg54-wxx4, GO-2024-3282 | Medium | Not scored | 20 Nov, 2024 | Go github.com/cert-manager/cert-manager |
Rancher Helm Applications may have sensitive values leaked CVE-2024-52282, GHSA-9c5p-35gj-jqp4, GO-2024-3280 | Medium | Not scored | 20 Nov, 2024 | Go github.com/rancher/rancher |
Rclone has Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata BIT-rclone-2024-52522, CVE-2024-52522, GHSA-hrxh-9w67-g4cv, GO-2024-3271 | Medium | Not scored | 19 Nov, 2024 | Go github.com/rclone/rclone |
Stored XSS using two files in usememos/memos CVE-2023-0109, GHSA-5r2g-59px-3q9w, GO-2024-3274 | Medium | Not scored | 15 Nov, 2024 | Go github.com/usememos/memos |
Hashicorp Nomad Incorrect Authorization vulnerability CVE-2024-10975, GHSA-2w5v-x29g-jw7j, GO-2024-3262 | Medium | Not scored | 07 Nov, 2024 | Go github.com/hashicorp/nomad |
Safearchive Path Traversal vulnerability CVE-2024-10389, GHSA-q3rp-vvm7-j8jg, GO-2024-3251 | Medium | Not scored | 04 Nov, 2024 | Go github.com/google/safearchive |
Gnark out-of-memory during deserialization with crafted inputs CVE-2024-50354, GHSA-cph5-3pgr-c82g, GO-2024-3244 | Medium | Not scored | 31 Oct, 2024 | Go github.com/consensys/gnark |
Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability BIT-consul-2024-10006, CVE-2024-10006, GHSA-5c4w-8hhh-3c3h, GO-2024-3241 | Medium | Not scored | 31 Oct, 2024 | Go github.com/hashicorp/consul |
Hashicorp Consul Cross-site Scripting vulnerability BIT-consul-2024-10086, CVE-2024-10086, GHSA-99wr-c2px-grmh, GO-2024-3242 | Medium | Not scored | 31 Oct, 2024 | Go github.com/hashicorp/consul |
NVIDIA Container Toolkit allows specially crafted container image to create empty files on the host file system CVE-2024-0133, GHSA-f748-7hpg-88ch, GO-2024-3237 | Medium | Not scored | 29 Oct, 2024 | Go github.com/NVIDIA/nvidia-container-toolkit |
Mattermost Server allows user to get private channel names CVE-2024-10241, GHSA-6mvp-gh77-7vwh, GO-2024-3232 | Medium | Not scored | 29 Oct, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery BIT-mattermost-2024-46872, CVE-2024-46872, GHSA-762g-9p7f-mrww, GO-2024-3233 | Medium | Not scored | 29 Oct, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Server vulnerable to application crash from attacker-generated large response CVE-2024-47401, GHSA-762v-rq7q-ff97, GO-2024-3234 | Medium | Not scored | 29 Oct, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost server allows authenticated user to delete arbitrary post CVE-2024-50052, GHSA-g376-m3h3-mj4r, GO-2024-3235 | Medium | Not scored | 29 Oct, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |