Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Incorrect TLS certificate auth method in Vault BIT-vault-2024-2048, CVE-2024-2048, GHSA-r3w7-mfpm-c2vw, GO-2024-2617 | High | Not scored | 04 Mar, 2024 | Go github.com/hashicorp/vault |
Coder's OIDC authentication allows email with partially matching domain to register CVE-2024-27918, GHSA-7cc2-r658-7xpf, GO-2024-2602 | High | Not scored | 04 Mar, 2024 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
pgproto3 SQL Injection via Protocol Message Size Overflow CVE-2024-27304, GHSA-7jwh-3vrq-q3m8, GHSA-mrww-27vc-gghv, GO-2024-2606 | High | Not scored | 04 Mar, 2024 | Go github.com/jackc/pgproto3 Go github.com/jackc/pgproto3/v2 Go github.com/jackc/pgx Go github.com/jackc/pgx/v4 +1 more |
pgx SQL Injection via Line Comment Creation CVE-2024-27289, GHSA-m7wr-2xf7-cm9p, GO-2024-2605 | High | Not scored | 04 Mar, 2024 | Go github.com/jackc/pgx Go github.com/jackc/pgx/v4 |
Integer overflow in chunking helper causes dispatching to miss elements or panic CVE-2024-27101, GHSA-h3m7-rqc4-7h9p, GO-2024-2597 | High | Not scored | 01 Mar, 2024 | Go github.com/authzed/spicedb |
Mattermost post fetching without auditing in compliance export CVE-2024-1887, GHSA-fx48-xv6q-6gp3, GO-2024-2591 | High | Not scored | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Helm's Missing YAML Content Leads To Panic BIT-helm-2024-26147, CVE-2024-26147, GHSA-r53h-jv2g-vpx6, GO-2024-2575 | High | Not scored | 22 Feb, 2024 | Go helm.sh/helm/v3 |
Apache Answer Unrestricted Upload of File with Dangerous Type vulnerability CVE-2024-22393, GHSA-rmqp-mvv2-54c6, GO-2024-2579 | High | Not scored | 22 Feb, 2024 | Go github.com/apache/incubator-answer |
HashiCorp Nomad vulnerable to symlink attacks CVE-2024-1329, GHSA-c866-8gpw-p3mv, GO-2024-2538 | High | Not scored | 08 Feb, 2024 | Go github.com/hashicorp/nomad |
Rancher API Server Cross-site Scripting Vulnerability CVE-2023-32192, GHSA-833m-37f7-jq55, GO-2024-2534 | High | Not scored | 08 Feb, 2024 | Go github.com/rancher/apiserver |
Norman API Cross-site Scripting Vulnerability CVE-2023-32193, GHSA-r8f4-hv23-6qp6, GO-2024-2536 | High | Not scored | 08 Feb, 2024 | Go github.com/rancher/norman |
Rancher 'Audit Log' leaks sensitive information CVE-2023-22649, GHSA-xfj7-qf8w-2gcr, GO-2024-2537 | High | Not scored | 08 Feb, 2024 | Go github.com/rancher/rancher |
Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core' CVE-2023-32194, GHSA-c85r-fwc7-45vc, GO-2024-2535 | High | Not scored | 08 Feb, 2024 | Go github.com/rancher/rancher |
APM Server vulnerable to Insertion of Sensitive Information into Log File CVE-2024-23448, GHSA-8r33-q5j5-rh7g, GO-2024-2556 | High | Not scored | 08 Feb, 2024 | Go github.com/elastic/apm-server |
Boundary vulnerable to session hijacking through TLS certificate tampering CVE-2024-1052, GHSA-vh73-q3rw-qx7w, GO-2024-2532 | High | Not scored | 05 Feb, 2024 | Go github.com/hashicorp/boundary |
Talos Linux ships runc vulnerable to the escape to the host attack GHSA-g5p6-327m-3fxx | High | Not scored | 02 Feb, 2024 | Go github.com/siderolabs/talos |
Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation CVE-2024-24747, GHSA-xx8w-mq23-29g4, GO-2024-2499 | High | Not scored | 01 Feb, 2024 | Go github.com/minio/minio |
Docker Authentication Bypass CVE-2018-12608, GHSA-qrqr-3x5j-2xw9 | High | Not scored | 31 Jan, 2024 | Go github.com/docker/docker |
Improper Authentication in HashiCorp Vault BIT-vault-2021-3282, CVE-2021-3282, GHSA-rq95-xf66-j689, GO-2024-2509 | High | Not scored | 31 Jan, 2024 | Go github.com/hashicorp/vault |
Denial of service in HashiCorp Consul BIT-consul-2020-25201, CVE-2020-25201, GHSA-496g-fr33-whrf, GO-2024-2501 | High | Not scored | 31 Jan, 2024 | Go github.com/hashicorp/consul |
runc vulnerable to container breakout through process.cwd trickery and leaked fds CVE-2024-21626, GHSA-xr7r-f8xq-vfvv, GO-2024-2491 | High | Not scored | 31 Jan, 2024 | Go github.com/opencontainers/runc |
BuildKit vulnerable to possible race condition with accessing subpaths from cache mounts CVE-2024-23651, GHSA-m3r6-h7wv-7xxv, GO-2024-2493 | High | Not scored | 31 Jan, 2024 | Go github.com/moby/buildkit |
Apache ServiceComb Service-Center Server-Side Request Forgery vulnerability CVE-2023-44313, GHSA-9xc9-xq7w-vpcr, GO-2024-2495 | High | Not scored | 31 Jan, 2024 | Go github.com/apache/servicecomb-service-center |
HashiCorp Vault Authentication bypass BIT-vault-2020-16251, CVE-2020-16251, GHSA-4mp7-2m29-gqxf, GO-2024-2488 | High | Not scored | 31 Jan, 2024 | Go github.com/hashicorp/vault |
Etcd Gateway can include itself as an endpoint resulting in resource exhaustion CVE-2020-15114, GHSA-2xhq-gv6c-p224 | High | Not scored | 31 Jan, 2024 | Go go.etcd.io/etcd |
Authentik vulnerable to PKCE downgrade attack BIT-authentik-2024-23647, CVE-2024-23647, GHSA-mrx3-gxjx-hjqj, GO-2024-2479 | High | Not scored | 29 Jan, 2024 | Go goauthentik.io |
Nginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF CVE-2024-23828, GHSA-qcjq-7f7v-pvc8, GO-2024-2480 | High | Not scored | 29 Jan, 2024 | Go github.com/0xJacky/Nginx-UI |
Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers CVE-2024-23656, GHSA-gr79-9v6v-gc9r, GO-2024-2476 | High | Not scored | 26 Jan, 2024 | Go github.com/dexidp/dex |
chasquid HTTP Request/Response Smuggling vulnerability CVE-2023-52354, GHSA-g4x3-mfpj-f335, GO-2024-2478 | High | Not scored | 22 Jan, 2024 | Go blitiri.com.ar/go/chasquid Go github.com/albertito/chasquid |
github.com/argoproj/argo-cd Cross-Site Request Forgery vulnerability CVE-2024-22424, GHSA-92mw-q256-5vwg | High | Not scored | 19 Jan, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Validation of `VoteExtensionsEnableHeight` can cause chain halt in Go package github.com/cometbft/cometbft GHSA-qr8r-m495-7hc4, GO-2024-2471 | High | Not scored | 19 Jan, 2024 | Go github.com/cometbft/cometbft |
crystals-go vulnerable to KyberSlash (timing side-channel attack for Kyber) GHSA-f6jh-hvg2-9525, GO-2024-2469 | High | Not scored | 17 Jan, 2024 | Go github.com/kudelskisecurity/crystals-go |
Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268) CVE-2024-22198, GHSA-8r25-68wm-jw35, GO-2024-2462 | High | Not scored | 11 Jan, 2024 | Go github.com/0xJacky/Nginx-UI |
Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269) CVE-2024-22197, GHSA-pxmr-q2x3-9x9m, GO-2024-2464 | High | Not scored | 11 Jan, 2024 | Go github.com/0xJacky/Nginx-UI |
Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270) CVE-2024-22196, GHSA-h374-mm57-879c, GO-2024-2463 | High | Not scored | 11 Jan, 2024 | Go github.com/0xJacky/Nginx-UI |
CIRCL's Kyber: timing side-channel (kyberslash2) GHSA-9763-4f94-gfch, GO-2024-2453 | High | Not scored | 08 Jan, 2024 | Go github.com/cloudflare/circl |
Insecure random string generator used for sensitive data CVE-2023-46740, GHSA-4248-p65p-hcrm, GO-2024-2431 | High | Not scored | 03 Jan, 2024 | Go github.com/cubefs/cubefs |
CubeFS timing attack can leak user passwords CVE-2023-46739, GHSA-8579-7p32-f398, GO-2024-2432 | High | Not scored | 03 Jan, 2024 | Go github.com/cubefs/cubefs |
Authenticated users can crash the CubeFS servers with maliciously crafted requests CVE-2023-46738, GHSA-qc6v-g3xw-grmx, GO-2024-2430 | High | Not scored | 03 Jan, 2024 | Go github.com/cubefs/cubefs |
Maliciously crafted Git server replies can cause DoS on go-git clients CVE-2023-49568, GHSA-mw99-9chc-xw7r, GO-2024-2466 | High | Not scored | 27 Dec, 2023 | Go github.com/go-git/go-git/v5 Go gopkg.in/src-d/go-git.v4 |
free5GC AMF denial of service vulnerability CVE-2023-49391, GHSA-jcrr-rr6w-8c83 | High | Not scored | 22 Dec, 2023 | Go github.com/free5gc/amf |
Buildkite Elastic CI for AWS symbolic link following vulnerability CVE-2023-43116, GHSA-7c44-7j7v-w554 | High | Not scored | 22 Dec, 2023 | Go github.com/buildkite/elastic-ci-stack-for-aws/v6 |
Buildkite Elastic CI for AWS time-of-check-time-of-use race condition vulnerability CVE-2023-43741, GHSA-r5hg-349q-mg2q, GO-2024-2440 | High | Not scored | 22 Dec, 2023 | Go github.com/buildkite/elastic-ci-stack-for-aws Go github.com/buildkite/elastic-ci-stack-for-aws/v5 Go github.com/buildkite/elastic-ci-stack-for-aws/v6 |
Authentication bypass vulnerability in navidrome's subsonic endpoint CVE-2023-51442, GHSA-wq59-4q6r-635r, GO-2023-2414 | High | Not scored | 19 Dec, 2023 | Go github.com/navidrome/navidrome |
lakeFS logs S3 credentials in plain text GHSA-4rgc-5g6r-2rjf, GO-2023-2398 | High | Not scored | 12 Dec, 2023 | Go github.com/treeverse/lakefs |
Memory exhaustion in HashiCorp Vault BIT-vault-2023-6337, CVE-2023-6337, GHSA-6p62-6cg9-f5f5, GO-2023-2399 | High | Not scored | 09 Dec, 2023 | Go github.com/hashicorp/vault |
Mattermost Injection vulnerability BIT-mattermost-2023-6458, CVE-2023-6458, GHSA-7664-hcp7-f497 | High | Not scored | 06 Dec, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server Go github.com/mattermost/mattermost/server/v8 |
github.com/ecies/go vulnerable to possible private key restoration CVE-2023-49292, GHSA-8j98-cjfr-qx3h, GO-2023-2380 | High | Not scored | 05 Dec, 2023 | Go github.com/ecies/go/v2 |
Traefik docker container using 100% CPU CVE-2023-47633, GHSA-6fwg-jrfw-ff7p, GO-2023-2377 | High | Not scored | 05 Dec, 2023 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks GHSA-j3rq-4xjw-xg63, GO-2023-2378 | High | Not scored | 04 Dec, 2023 | Go github.com/edgelesssys/marblerun |