Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
ZITADEL Account Takeover via Malicious Host Header Injection CVE-2023-49097, GHSA-2wmj-46rj-qm2w | High | Not scored | 29 Nov, 2023 | Go github.com/zitadel/zitadel |
Inefficient Regular Expression Complexity in git-urls CVE-2023-46402, GHSA-3f2q-6294-fmq5 | High | Not scored | 18 Nov, 2023 | Go github.com/whilp/git-urls |
Free5gc allows a local attacker to cause a denial of service via the free5gc-compose component CVE-2023-47025, GHSA-q27h-hw2v-x5jm | High | Not scored | 17 Nov, 2023 | Go github.com/free5gc/free5gc |
free5gc Buffer Overflow vulnerability CVE-2023-47345, GHSA-6944-6pmv-6mp2 | High | Not scored | 16 Nov, 2023 | Go github.com/free5gc/free5gc |
Attacker can cause Kyverno user to unintentionally consume insecure image BIT-kyverno-2023-47630, CVE-2023-47630, GHSA-3hfq-cx9j-923w, GO-2023-2340 | High | Not scored | 14 Nov, 2023 | Go github.com/kyverno/kyverno |
Kubernetes Improper Input Validation vulnerability CVE-2023-5528, GHSA-hq6q-c2x6-hmch, GO-2023-2341 | High | Not scored | 14 Nov, 2023 | Go k8s.io/kubernetes |
Fabric vulnerable to crosslinking transaction attack BIT-hyperledger-fabric-orderer-2023-46132, BIT-hyperledger-fabric-peer-2023-46132, BIT-hyperledger-fabric-tools-2023-46132, CVE-2023-46132, GHSA-v9w2-543f-h69m | High | Not scored | 14 Nov, 2023 | Go github.com/hyperledger/fabric |
otelgrpc DoS vulnerability due to unbound cardinality metrics CVE-2023-47108, GHSA-8pgv-569h-w5rw, GO-2023-2331 | High | Not scored | 12 Nov, 2023 | Go go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc |
Headscale writes bearer tokens to info-level logs CVE-2023-47390, GHSA-wp76-cf2j-rqq7 | High | Not scored | 11 Nov, 2023 | Go github.com/juanfont/headscale |
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability BIT-vault-2023-5954, CVE-2023-5954, GHSA-4qhc-v8r6-8vwm, GO-2023-2329 | High | Not scored | 09 Nov, 2023 | Go github.com/hashicorp/vault |
ZITADEL race condition in lockout policy execution CVE-2023-47111, GHSA-7h8m-vrxx-vr4m | High | Not scored | 08 Nov, 2023 | Go github.com/zitadel/zitadel |
Calico Typha denial of service vulnerability CVE-2023-41378, GHSA-5r5h-q934-cccp | High | Not scored | 06 Nov, 2023 | Go github.com/projectcalico/calico |
Kubernetes csi-proxy vulnerable to privilege escalation due to improper input validation CVE-2023-3893, GHSA-r6cc-7wj7-gfx2, GO-2023-2176 | High | Not scored | 03 Nov, 2023 | Go github.com/kubernetes-csi/csi-proxy Go github.com/kubernetes-csi/csi-proxy/v2 |
Kubernetes privilege escalation vulnerability CVE-2023-3676, GHSA-7fxm-f474-hf8w, GO-2023-2330 | High | Not scored | 31 Oct, 2023 | Go k8s.io/kubernetes |
Kubernetes privilege escalation vulnerability CVE-2023-3955, GHSA-q78c-gwqw-jcmc, GO-2023-2170 | High | Not scored | 31 Oct, 2023 | Go k8s.io/kubernetes Go k8s.io/mount-utils |
xkeys seal encryption used fixed key for all encryption BIT-nats-2023-46129, CVE-2023-46129, GHSA-mr45-rx8q-wcm9, GO-2023-2163 | High | Not scored | 31 Oct, 2023 | Go github.com/nats-io/nats-server/v2 Go github.com/nats-io/nkeys |
quic-go vulnerable to pointer dereference that can lead to panic CVE-2023-46239, GHSA-3q6m-v84f-6p9h, GO-2023-2160 | High | Not scored | 30 Oct, 2023 | Go github.com/quic-go/quic-go |
Cosmos packet-forward-middleware vulnerable to chain-halt GHSA-w6rp-vxj2-fjhr, GO-2023-2156 | High | Not scored | 26 Oct, 2023 | Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6 |
Ingress nginx annotation injection causes arbitrary command execution CVE-2023-5043, GHSA-5wj4-wffq-3378 | High | Not scored | 25 Oct, 2023 | Go k8s.io/ingress-nginx |
Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation CVE-2023-5044, GHSA-fp9f-44c2-cw27, GO-2024-2428 | High | Not scored | 25 Oct, 2023 | Go k8s.io/ingress-nginx |
Ingress-nginx path sanitization can be bypassed CVE-2022-4886, GHSA-gvrm-w2f9-f77q | High | Not scored | 25 Oct, 2023 | Go k8s.io/ingress-nginx |
gRPC-Go HTTP/2 Rapid Reset vulnerability GHSA-m425-mq94-257g, GO-2023-2153 | High | Not scored | 25 Oct, 2023 | Go google.golang.org/grpc |
free5GC udm vulnerable to Invalid Curve Attack CVE-2023-46324, GHSA-cqvv-r3g3-26rf | High | Not scored | 23 Oct, 2023 | Go github.com/free5gc/udm |
Artifact Hub arbitrary file read vulnerability CVE-2023-45823, GHSA-hmq4-c2r4-5q8h, GO-2023-2136 | High | Not scored | 19 Oct, 2023 | Go github.com/artifacthub/hub |
NATS.io: Adding accounts for just the system account adds auth bypass CVE-2023-47090, GHSA-fr2g-9hjm-wr23, GO-2023-2133 | High | Not scored | 19 Oct, 2023 | Go github.com/nats-io/nats-server/v2 |
OpenFGA DoS vulnerability CVE-2023-45810, GHSA-hr4f-6jh8-f2vq, GO-2023-2121 | High | Not scored | 18 Oct, 2023 | Go github.com/openfga/openfga |
Arduino Create Agent path traversal - local privilege escalation vulnerability CVE-2023-43802, GHSA-75j7-w798-cwwx | High | Not scored | 18 Oct, 2023 | Go github.com/arduino/arduino-create-agent |
Arduino Create Agent Insufficient Verification of Data Authenticity vulnerability CVE-2023-43800, GHSA-4x5q-q7wc-q22p | High | Not scored | 18 Oct, 2023 | Go github.com/arduino/arduino-create-agent |
go-ethereum vulnerable to denial of service via crafted GraphQL query CVE-2023-42319, GHSA-v9jh-j8px-98vq | High | Not scored | 18 Oct, 2023 | Go github.com/ethereum/go-ethereum |
Cross-site Scripting via missing Binding syntax validation CVE-2023-45683, GHSA-267v-3v32-g6q5, GO-2023-2114 | High | Not scored | 17 Oct, 2023 | Go github.com/crewjam/saml |
github.com/kumahq/kuma affected by CVE-2023-44487 GHSA-9wmc-rg4h-28wv | High | Not scored | 17 Oct, 2023 | Go github.com/kumahq/kuma |
Go Fiber CSRF Token Validation Vulnerability CVE-2023-45141, GHSA-mv73-f69x-444p, GO-2023-2116 | High | Not scored | 17 Oct, 2023 | Go github.com/gofiber/fiber/v2 |
Traefik vulnerable to HTTP/2 request causing denial of service BIT-golang-2023-54365, CVE-2023-54365, GHSA-7v4p-328v-8v5g | High | Not scored | 17 Oct, 2023 | Go github.com/traefik/traefik |
OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics CVE-2023-45142, GHSA-rcjv-mgp8-qvmr, GO-2023-2113 | High | Not scored | 16 Oct, 2023 | Go go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful Go go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin Go go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux Go go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho +3 more |
kOps privilege escalation vulnerability CVE-2023-1943, GHSA-8gwj-m6vh-2g6j, GO-2023-2125 | High | Not scored | 12 Oct, 2023 | Go k8s.io/kops |
HTTP/2 rapid reset can cause excessive work in net/http BIT-golang-2023-39325, CVE-2023-39325, GHSA-4374-p667-p6c8, GO-2023-2102 | High | Not scored | 11 Oct, 2023 | Go golang.org/x/net Go stdlib |
github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset GHSA-vx74-f528-fxqg | High | Not scored | 10 Oct, 2023 | Go github.com/nghttp2/nghttp2 |
HTTP/2 Stream Cancellation Attack BIT-apisix-2023-44487, BIT-aspnet-core-2023-44487, BIT-contour-2023-44487, BIT-dotnet-2023-44487, BIT-dotnet-sdk-2023-44487, BIT-envoy-2023-44487, BIT-golang-2023-44487, BIT-jenkins-2023-44487, BIT-kong-2023-44487, BIT-nginx-2023-44487, BIT-nginx-gateway-2023-44487, BIT-node-2023-44487, BIT-node-min-2023-44487, BIT-solr-2023-44487, BIT-tomcat-2023-44487, BIT-varnish-2023-44487, CVE-2023-44487, GHSA-qppj-fm5r-hxr3 | HighExploited | 100.0% | 10 Oct, 2023 | Go golang.org/x/net Maven com.typesafe.akka:akka-http-core Maven com.typesafe.akka:akka-http-core_2.11 Maven com.typesafe.akka:akka-http-core_2.12 +8 more |
Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled CVE-2023-43809, GHSA-mc97-99j4-vm2v, GO-2023-2097 | High | Not scored | 02 Oct, 2023 | Go github.com/charmbracelet/soft-serve |
Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability BIT-vault-2023-5077, CVE-2023-5077, GHSA-86c6-3g63-5w64, GO-2023-2088 | High | Not scored | 29 Sep, 2023 | Go github.com/hashicorp/vault |
kube-apiserver authentication bypass vulnerability CVE-2023-1260, GHSA-92hx-3mh6-hc49 | High | Not scored | 24 Sep, 2023 | Go github.com/openshift/apiserver-library-go |
Markdown vulnerable to Out-of-bounds Read while parsing citations CVE-2023-42821, GHSA-m9xq-6h2j-65r2, GO-2023-2074 | High | Not scored | 22 Sep, 2023 | Go github.com/gomarkdown/markdown |
Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input CVE-2023-37279, GHSA-x4hh-vjm7-g2jv, GO-2023-2067 | High | Not scored | 20 Sep, 2023 | Go github.com/contribsys/faktory |
Croc sender may send dangerous new files to receiver CVE-2023-43619, GHSA-ppjh-xp5v-46wc, GO-2023-2073 | High | Not scored | 20 Sep, 2023 | Go github.com/schollz/croc Go github.com/schollz/croc/v6 Go github.com/schollz/croc/v8 Go github.com/schollz/croc/v9 |
Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device CVE-2023-43620, GHSA-364c-vvqx-446c, GO-2023-2068 | High | Not scored | 20 Sep, 2023 | Go github.com/schollz/croc Go github.com/schollz/croc/v6 Go github.com/schollz/croc/v8 Go github.com/schollz/croc/v9 |
Cross-Site Request Forgery (CSRF) in usememos/memos CVE-2023-5036, GHSA-2g7r-9xq5-c6hv, GO-2023-2065 | High | Not scored | 18 Sep, 2023 | Go github.com/usememos/memos |
libwebp: OOB write in BuildHuffmanTable A-299477569, ASB-A-299477569, CVE-2023-4863, CVE-2023-5129, GHSA-j7hp-h8jx-5ppr, PYSEC-2026-1794, RUSTSEC-2023-0060, RUSTSEC-2023-0061 | HighExploited | 100.0% | 12 Sep, 2023 | Go github.com/chai2010/webp NuGet SkiaSharp NuGet magick.net-q16-anycpu NuGet magick.net-q16-hdri-anycpu +10 more |
RKE2 supervisor port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack CVE-2023-32186, GHSA-p45j-vfv5-wprq | High | Not scored | 11 Sep, 2023 | Go github.com/rancher/rke2 |
K3s apiserver port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack CVE-2023-32187, GHSA-m4hf-6vgr-75r2 | High | Not scored | 11 Sep, 2023 | Go github.com/k3s-io/k3s |
Answer Missing Authentication for Critical Function CVE-2023-4815, GHSA-pj2h-85jq-g5vg, GO-2023-2051 | High | Not scored | 07 Sep, 2023 | Go github.com/answerdev/answer |