Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') CVE-2024-58398, GHSA-wcx9-ccpj-hx3c, GO-2024-3228 | Medium | Not scored | 28 Oct, 2024 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Argo Workflows Controller: Denial of Service via malicious daemon Workflows BIT-argo-workflows-2024-47827, CVE-2024-47827, GHSA-ghjw-32xw-ffwr, GO-2024-3226 | Medium | Not scored | 28 Oct, 2024 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
Denied Host Validation Bypass in Zitadel Actions CVE-2024-49753, GHSA-6cf5-w9h3-4rqv, GO-2024-3216 | Medium | Not scored | 25 Oct, 2024 | Go github.com/zitadel/zitadel |
Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse CVE-2023-26248, GHSA-mqr9-hjr8-2m9w, GO-2024-3218 | Medium | Not scored | 25 Oct, 2024 | Go github.com/libp2p/go-libp2p-kad-dht |
Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present BIT-cilium-2024-47825, BIT-cilium-operator-2024-47825, BIT-hubble-relay-2024-47825, CVE-2024-47825, GHSA-3wwx-63fv-pfq6, GO-2024-3208 | Medium | Not scored | 21 Oct, 2024 | Go github.com/cilium/cilium |
Infinite loop in github.com/gomarkdown/markdown CVE-2024-44337, GHSA-xhr3-wf7j-h255, GO-2024-3205 | Medium | Not scored | 15 Oct, 2024 | Go github.com/gomarkdown/markdown |
VM images built with Image Builder with some providers use default credentials during builds in github.com/kubernetes-sigs/image-builder CVE-2024-9594, GHSA-8jpg-62jc-hwhr, GO-2024-3204 | Medium | Not scored | 15 Oct, 2024 | Go github.com/kubernetes-sigs/image-builder |
KubeSphere IDOR vulnerability CVE-2024-46528, GHSA-p26r-gfgc-c47h, GO-2024-3248 | Medium | Not scored | 14 Oct, 2024 | Go github.com/kubesphere/kubesphere |
Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory. CVE-2024-47877, GHSA-8rm2-93mq-jqhc, GO-2024-3196 | Medium | Not scored | 11 Oct, 2024 | Go github.com/codeclysm/extract Go github.com/codeclysm/extract/v3 Go github.com/codeclysm/extract/v4 |
Alist reflected Cross-Site Scripting vulnerability CVE-2024-47067, GHSA-8pph-gfhp-w226, GO-2024-3190 | Medium | Not scored | 10 Oct, 2024 | Go github.com/alist-org/alist Go github.com/alist-org/alist/v3 |
Authd allows attacker-controlled usernames to yield controllable UIDs CVE-2024-9312, GHSA-4gfw-wf7c-w6g2, GO-2024-3188 | Medium | Not scored | 10 Oct, 2024 | Go github.com/ubuntu/authd |
Buildah allows arbitrary directory mount CVE-2024-9675, GHSA-586p-749j-fhwp, GO-2024-3186 | Medium | Not scored | 09 Oct, 2024 | Go github.com/containers/buildah |
Vulnerable juju introspection abstract UNIX domain socket CVE-2024-8038, GHSA-xwgj-vpm9-q2rq, GO-2024-3175 | Medium | Not scored | 03 Oct, 2024 | Go github.com/juju/juju |
Vulnerable juju hook tool abstract UNIX domain socket CVE-2024-8037, GHSA-8v4w-f4r9-7h6x, GO-2024-3174 | Medium | Not scored | 03 Oct, 2024 | Go github.com/juju/juju |
JUJU_CONTEXT_ID is a predictable authentication secret CVE-2024-7558, GHSA-mh98-763h-m9v4, GO-2024-3173 | Medium | Not scored | 03 Oct, 2024 | Go github.com/juju/juju |
Improper Input Validation in Buildah and Podman CVE-2024-9407, GHSA-fhqq-8f65-5xfc, GO-2024-3169 | Medium | Not scored | 01 Oct, 2024 | Go github.com/containers/buildah Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 +2 more |
Link Following in github.com/containers/common CVE-2024-9341, GHSA-mc76-5925-c5p6, GO-2024-3171 | Medium | Not scored | 01 Oct, 2024 | Go github.com/containers/common |
Ory Kratos's setting required_aal `highest_available` does not properly respect code + mfa credentials CVE-2024-45042, GHSA-wc43-73w7-x2f5, GO-2024-3160 | Medium | Not scored | 26 Sep, 2024 | Go github.com/ory/kratos |
Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events BIT-mattermost-2024-47003, CVE-2024-47003, GHSA-59hf-mpf8-pqjh, GO-2024-3164 | Medium | Not scored | 26 Sep, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Grafana Alloy on Windows has Unquoted Search Path or Element vulnerability BIT-grafana-alloy-2024-8975, CVE-2024-8975, GHSA-chqx-36rm-rf8h, GO-2024-3168 | Medium | Not scored | 25 Sep, 2024 | Go github.com/grafana/alloy |
Grafana Agent (Flow mode) on Windows has Unquoted Search Path or Element vulnerability CVE-2024-8996, GHSA-m5gv-m5f9-wgv4, GO-2024-3170 | Medium | Not scored | 25 Sep, 2024 | Go github.com/grafana/agent |
Apache Answer: Avatar URL leaked user email addresses CVE-2024-40761, GHSA-48cr-j2cx-mcr8, GO-2024-3158 | Medium | Not scored | 25 Sep, 2024 | Go github.com/apache/incubator-answer |
CoreDNS Cache Poisoning via a birthday attack CVE-2023-30464, GHSA-h92q-fgpp-qhrq, GO-2024-3134 | Medium | Not scored | 18 Sep, 2024 | Go github.com/coredns/coredns |
SpiceDB having multiple caveats on resources of the same type may improperly result in no permission CVE-2024-46989, GHSA-jhg6-6qrx-38mr, GO-2024-3131 | Medium | Not scored | 18 Sep, 2024 | Go github.com/authzed/spicedb |
OpenShift Controller Manager Improper Privilege Management CVE-2024-45496, GHSA-j8gh-87rx-c7w9, GO-2024-3128 | Medium | Not scored | 17 Sep, 2024 | Go github.com/openshift/openshift-controller-manager |
OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer CVE-2024-7387, GHSA-qqv8-ph7f-h3f7, GO-2024-3129 | Medium | Not scored | 17 Sep, 2024 | Go github.com/openshift/builder |
Gouniverse GoLang CMS vulnerable to Cross-site Scripting CVE-2024-8572, GHSA-pv7h-hg6m-82j8, GO-2024-3125 | Medium | Not scored | 08 Sep, 2024 | Go github.com/gouniverse/cms |
gnark's Groth16 commitment extension unsound for more than one commitment CVE-2024-45039, GHSA-q3hw-3gm4-w5cr, GO-2024-3122 | Medium | Not scored | 06 Sep, 2024 | Go github.com/consensys/gnark |
Windmill HTTP Request users.rs excessive authentication in github.com/windmill-labs/windmill CVE-2024-8462, GHSA-g6q4-w3j3-jfc4, GO-2024-3118 | Medium | Not scored | 05 Sep, 2024 | Go github.com/windmill-labs/windmill |
Nuclei Template Signature Verification Bypass CVE-2024-43405, GHSA-7h5p-mmpp-hgmm, GO-2024-3114 | Medium | Not scored | 04 Sep, 2024 | Go github.com/projectdiscovery/nuclei Go github.com/projectdiscovery/nuclei/v2 Go github.com/projectdiscovery/nuclei/v3 |
The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD CVE-2024-43803, GHSA-pqfh-xh7w-7h3p, GO-2024-3109 | Medium | Not scored | 03 Sep, 2024 | Go github.com/metal3-io/baremetal-operator |
runc can be confused to create empty files/directories on the host CVE-2024-45310, GHSA-jfvp-7x6p-h2pv, GO-2024-3110 | Medium | Not scored | 03 Sep, 2024 | Go github.com/opencontainers/runc |
Vault Leaks Client Token and Token Accessor in Audit Devices BIT-vault-2024-8365, CVE-2024-8365, GHSA-jjxf-26c9-77gm, GO-2024-3113 | Medium | Not scored | 02 Sep, 2024 | Go github.com/hashicorp/vault |
OPA for Windows has an SMB force-authentication vulnerability CVE-2024-8260, GHSA-c77r-fh37-x2px, GO-2024-3141 | Medium | Not scored | 30 Aug, 2024 | Go github.com/open-policy-agent/opa |
Hwameistor Potential Permission Leakage of Cluster Level CVE-2024-45054, GHSA-mgwr-h7mv-fh29, GO-2024-3103 | Medium | Not scored | 29 Aug, 2024 | Go github.com/hwameistor/hwameistor |
OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability CVE-2024-45043, GHSA-prf6-xjxh-p698, GO-2024-3102 | Medium | Not scored | 29 Aug, 2024 | Go github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver |
CWA-2023-004: Excessive number of function parameters in compiled Wasm GHSA-75qh-gg76-p2w4, GO-2024-3101, RUSTSEC-2024-0366 | Medium | Not scored | 27 Aug, 2024 | Go github.com/CosmWasm/wasmvm crates.io cosmwasm-vm |
req may send an unintended request when a malformed URL is provided CVE-2024-45258, GHSA-cj55-gc7m-wvcq, GO-2024-3098 | Medium | Not scored | 26 Aug, 2024 | Go github.com/imroc/req Go github.com/imroc/req/v2 Go github.com/imroc/req/v3 |
Hyperledger Fabric does not verify request has a timestamp within the expected time window BIT-hyperledger-fabric-orderer-2024-45244, BIT-hyperledger-fabric-peer-2024-45244, BIT-hyperledger-fabric-tools-2024-45244, CVE-2024-45244, GHSA-48gg-32q2-4r6m, GO-2024-3099 | Medium | Not scored | 25 Aug, 2024 | Go github.com/hyperledger/fabric |
Mattermost Plugin Channel Export excessive resource consumption CVE-2024-43105, GHSA-869f-px86-vj84, GO-2024-3095 | Medium | Not scored | 23 Aug, 2024 | Go github.com/mattermost/mattermost-plugin-channel-export |
Mattermost allows guest user with read access to upload files to a channel BIT-mattermost-2024-43780, CVE-2024-43780, GHSA-2jhx-w3vc-w59g, GO-2024-3089 | Medium | Not scored | 22 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows team admin user without "Add Team Members" permission to disable invite URL BIT-mattermost-2024-40884, CVE-2024-40884, GHSA-3j95-8g47-fpwh, GO-2024-3090 | Medium | Not scored | 22 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Casdoor has reflected XSS in QrCodePage.js (GHSL-2024-036) CVE-2024-41658, GHSA-gv2p-4mvg-g32h, GO-2024-3086 | Medium | Not scored | 22 Aug, 2024 | Go github.com/casdoor/casdoor |
Mattermost doesn't redact remote users' original email addresses CVE-2024-32939, GHSA-4ww8-fprq-cq34, GO-2024-3093 | Medium | Not scored | 22 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows remote/synthetic users to create sessions, reset passwords CVE-2024-39836, GHSA-c6vp-jjgv-38wj, GO-2024-3096 | Medium | Not scored | 22 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Cross-Site Request Forgery vulnerability CVE-2024-40886, GHSA-hrf9-rm95-fpf3, GO-2024-3097 | Medium | Not scored | 22 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't restrict which roles can promote a user as system admin CVE-2024-8071, GHSA-5263-pm2h-m7hw, GO-2024-3094 | Medium | Not scored | 22 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
CWA-2024-006: wasmd non-deterministic module_query_safe query GHSA-fpgj-cr28-fvpx, GO-2024-3081 | Medium | Not scored | 21 Aug, 2024 | Go github.com/CosmWasm/wasmd |
Default installation of `synthetic-monitoring-agent` exposes sensitive information CVE-2022-46156, GHSA-9j4f-f249-q5w8, GO-2022-1132 | Medium | Not scored | 21 Aug, 2024 | Go github.com/grafana/synthetic-monitoring-agent Go github.com/grafana/synthetic-monitoring-agent/cmd/synthetic-monitoring-agent |
Exposure of debug and metrics endpoints in Pomerium CVE-2022-24797, GHSA-q98f-2x4p-prjr, GO-2022-0413 | Medium | Not scored | 21 Aug, 2024 | Go github.com/pomerium/pomerium |