Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Openshift Console insufficient entropy vulnerability CVE-2024-6508, GHSA-4crf-28c7-v4gr, GO-2024-3083 | Medium | Not scored | 21 Aug, 2024 | Go github.com/openshift/console |
Withdrawn Advisory: Kanister vulnerable to cluster-level privilege escalation CVE-2024-43403, GHSA-h27c-6xm3-mcqp, GO-2024-3080 | Medium | Not scored | 20 Aug, 2024 | Go github.com/kanisterio/kanister |
Grafana plugin data sources vulnerable to access control bypass BIT-grafana-2024-6322, CVE-2024-6322, GHSA-hh8p-374f-qgr5, GO-2024-3079 | Medium | Not scored | 20 Aug, 2024 | Go github.com/grafana/grafana |
Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API BIT-cilium-2024-42486, BIT-cilium-operator-2024-42486, BIT-hubble-relay-2024-42486, CVE-2024-42486, GHSA-vwf8-q6fw-4wcm, GO-2024-3074 | Medium | Not scored | 16 Aug, 2024 | Go github.com/cilium/cilium |
Gateway API route matching order contradicts specification BIT-cilium-2024-42487, BIT-cilium-operator-2024-42487, BIT-hubble-relay-2024-42487, CVE-2024-42487, GHSA-qcm3-7879-xcww, GO-2024-3071 | Medium | Not scored | 15 Aug, 2024 | Go github.com/cilium/cilium |
Policy bypass for Host Firewall policy due to race condition in Cilium agent BIT-cilium-2024-42488, BIT-cilium-operator-2024-42488, BIT-hubble-relay-2024-42488, CVE-2024-42488, GHSA-q7w8-72mr-vpgw, GO-2024-3072 | Medium | Not scored | 15 Aug, 2024 | Go github.com/cilium/cilium |
Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking CVE-2024-7625, GHSA-25qx-vfw2-fw8r, GO-2024-3073 | Medium | Not scored | 15 Aug, 2024 | Go github.com/hashicorp/nomad |
open-telemetry has an Observable Timing Discrepancy CVE-2024-42368, GHSA-rfxf-mf63-cpqv, GO-2024-3066 | Medium | Not scored | 13 Aug, 2024 | Go github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension |
Apache Answer: The link for resetting user password is not Single-Use CVE-2024-41888, GHSA-v3x9-wrq5-868j, GO-2024-3065 | Medium | Not scored | 12 Aug, 2024 | Go github.com/apache/incubator-answer |
Apache Answer: The link to reset the user's password will remain valid after sending a new link CVE-2024-41890, GHSA-gvpv-r32v-9737, GO-2024-3064 | Medium | Not scored | 12 Aug, 2024 | Go github.com/apache/incubator-answer |
CosmWasm wasmd has large address count in ValidateBasic GHSA-m3rh-cvr5-x6q4, GO-2024-3059 | Medium | Not scored | 08 Aug, 2024 | Go github.com/CosmWasm/wasmd |
Gas mispricing in cosmwasm-vm GHSA-rg2q-2jh9-447q, RUSTSEC-2024-0361 | Medium | Not scored | 08 Aug, 2024 | Go github.com/CosmWasm/wasmvm Go github.com/CosmWasm/wasmvm/v2 crates.io cosmwasm-vm |
Gorush uses deprecated TLS versions CVE-2024-41270, GHSA-p3pf-mff8-3h47, GO-2024-3058 | Medium | Not scored | 06 Aug, 2024 | Go github.com/appleboy/gorush |
Meshery SQL Injection vulnerability CVE-2024-35181, GHSA-9f24-jrv4-f8g5, GO-2024-3050 | Medium | Not scored | 05 Aug, 2024 | Go github.com/layer5io/meshery |
Meshery SQL Injection vulnerability CVE-2024-35182, GHSA-h7cm-jvpp-69xf, GO-2024-3051 | Medium | Not scored | 05 Aug, 2024 | Go github.com/layer5io/meshery |
gotortc Cross-site Scripting vulnerability CVE-2024-29191, GHSA-wv8x-3w6r-6h7v, GO-2024-3055 | Medium | Not scored | 05 Aug, 2024 | Go github.com/AlexxIT/go2rtc |
gotortc Cross-site Scripting vulnerability CVE-2024-29193, GHSA-rh4r-f7f7-r99m, GO-2024-3053 | Medium | Not scored | 05 Aug, 2024 | Go github.com/AlexxIT/go2rtc |
memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta CVE-2024-29028, GHSA-6fcf-g3mp-xj2x, GO-2024-3047 | Medium | Not scored | 05 Aug, 2024 | Go github.com/usememos/memos |
memos vulnerable to Server-Side Request Forgery and Cross-site Scripting CVE-2024-29029, GHSA-9cqm-mgv9-vv9j, GO-2024-3049 | Medium | Not scored | 05 Aug, 2024 | Go github.com/usememos/memos |
memos vulnerable to Server-Side Request Forgery in /api/resource CVE-2024-29030, GHSA-65fm-2jgr-j7qq, GO-2024-3046 | Medium | Not scored | 05 Aug, 2024 | Go github.com/usememos/memos |
lorawan-stack Open Redirect vulnerability CVE-2023-26494, GHSA-5fwq-9x7j-2qpg, GO-2024-3044 | Medium | Not scored | 05 Aug, 2024 | Go go.thethings.network/lorawan-stack Go go.thethings.network/lorawan-stack/v3 |
In regclient, pinned manifest digests may be ignored CVE-2025-24882, GHSA-qv35-3gw6-8q4j, GO-2024-3038 | Medium | Not scored | 05 Aug, 2024 | Go github.com/regclient/regclient |
APM Server vulnerable to Insertion of Sensitive Information into Log File CVE-2024-37286, GHSA-f6cj-4h3g-hwq4, GO-2024-3037 | Medium | Not scored | 03 Aug, 2024 | Go github.com/elastic/apm-server |
Navidrome uses MD5 hashing algorithm CVE-2024-41259, GHSA-hrmx-8jjv-g758, GO-2024-3029 | Medium | Not scored | 01 Aug, 2024 | Go github.com/navidrome/navidrome |
casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification CVE-2024-41264, GHSA-67fw-w8f2-88wp, GO-2024-3026 | Medium | Not scored | 01 Aug, 2024 | Go github.com/casdoor/casdoor |
Mattermost allows a remote actor to permanently delete local data by abusing dangerous error handling CVE-2024-39832, GHSA-762m-4cx6-6mf4, GO-2024-3020 | Medium | Not scored | 01 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows a user on a remote to set their remote username prop to an arbitrary string BIT-mattermost-2024-39839, CVE-2024-39839, GHSA-vg6q-84p8-qvqh, GO-2024-3024 | Medium | Not scored | 01 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows a remote actor to make an arbitrary local channel read-only BIT-mattermost-2024-41162, CVE-2024-41162, GHSA-jr9x-3x7m-4j75, GO-2024-3031 | Medium | Not scored | 01 Aug, 2024 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Mattermost allows remote actor to set arbitrary RemoteId values for synced users BIT-mattermost-2024-41926, CVE-2024-41926, GHSA-9fpw-c9x7-cv3j, GO-2024-3022 | Medium | Not scored | 01 Aug, 2024 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Mattermost failed to properly validate synced reactions CVE-2024-29977, GHSA-jq3g-xqpx-37x3, GO-2024-3030 | Medium | Not scored | 01 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost failed to disallow the modification of local users when syncing users in shared channels CVE-2024-36492, GHSA-56mc-f9w7-2wxq, GO-2024-3025 | Medium | Not scored | 01 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
ZITADEL "ignoring unknown usernames" vulnerability CVE-2024-41952, GHSA-567v-6hmg-6qg7, GO-2024-3014 | Medium | Not scored | 31 Jul, 2024 | Go github.com/zitadel/zitadel |
ZITADEL has improper HTML sanitization in emails and Console UI CVE-2024-41953, GHSA-v333-7h2p-5fhv, GO-2024-3015 | Medium | Not scored | 31 Jul, 2024 | Go github.com/zitadel/zitadel |
snapd failed to restrict writes to the $HOME/bin path CVE-2024-1724, GHSA-4mh8-9689-38vr, GO-2024-3007 | Medium | Not scored | 25 Jul, 2024 | Go github.com/snapcore/snapd |
snapd failed to properly check the file type when extracting a snap CVE-2024-29068, GHSA-64jh-cjwc-w8q6, GO-2024-3008 | Medium | Not scored | 25 Jul, 2024 | Go github.com/snapcore/snapd |
The Argo CD web terminal session does not handle the revocation of user permissions properly BIT-argo-cd-2024-41666, CVE-2024-41666, GHSA-v8wx-v5jq-qhhw, GO-2024-3006 | Medium | Not scored | 24 Jul, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Woodpecker's custom environment variables allow to alter execution flow of plugins CVE-2024-41122, GHSA-3wf2-2pq4-4rvc, GO-2024-2998 | Medium | Not scored | 19 Jul, 2024 | Go go.woodpecker-ci.org/woodpecker Go go.woodpecker-ci.org/woodpecker/v2 |
github.com/gitpod-io/gitpod vulnerable to Cookie Tossing CVE-2024-21583, GHSA-8pgc-65mj-53h5, GO-2024-2997 | Medium | Not scored | 19 Jul, 2024 | Go github.com/gitpod-io/gitpod Go github.com/gitpod-io/gitpod/components/server/go Go github.com/gitpod-io/gitpod/components/ws-proxy Go github.com/gitpod-io/gitpod/install/installer |
ZITADEL Go's GRPC example code vulnerability - GO-2024-2687 HTTP/2 CONTINUATION flood in net/http GHSA-qc6v-5g5m-8cw2 | Medium | Not scored | 15 Jul, 2024 | Go github.com/zitadel/zitadel-go/v3 |
Cache driver GetBlob() allows read access to any blob without access control check CVE-2024-39897, GHSA-55r9-5mx9-qq7r, GO-2024-2979 | Medium | Not scored | 09 Jul, 2024 | Go zotregistry.dev/zot Go zotregistry.io/zot |
ZITADEL Vulnerable to Session Information Leakage CVE-2024-39683, GHSA-cvw9-c57h-3397, GO-2024-2968 | Medium | Not scored | 05 Jul, 2024 | Go github.com/zitadel/zitadel |
github.com/google/nftable IP addresses were encoded in the wrong byte order CVE-2024-6284, GHSA-qjvf-8748-9w7h, GO-2024-2977 | Medium | Not scored | 04 Jul, 2024 | Go github.com/google/nftables |
Pomerium exposed OAuth2 access and ID tokens in user info endpoint response CVE-2024-39315, GHSA-rrqr-7w59-637v, GO-2024-2965 | Medium | Not scored | 03 Jul, 2024 | Go github.com/pomerium/pomerium |
Panic in Pipeline when PgConn is busy or closed in github.com/jackc/pgx GHSA-fqpg-rq76-99pq, GO-2024-2567 | Medium | Not scored | 02 Jul, 2024 | Go github.com/jackc/pgx/v5 |
Denial of service via malicious preflight requests in github.com/rs/cors CVE-2025-47908, GHSA-mh55-gqvf-xfwm, GO-2024-2883 | Medium | Not scored | 02 Jul, 2024 | Go github.com/rs/cors |
CometBFT is unstability during blocksync when syncing from malicious peer GHSA-hg58-rf2h-6rr7, GO-2024-2951 | Medium | Not scored | 28 Jun, 2024 | Go github.com/cometbft/cometbft |
PingCAP TiDB nil pointer dereference CVE-2024-37820, GHSA-9g6g-xqv5-8g5w, GO-2024-3284 | Medium | Not scored | 25 Jun, 2024 | Go github.com/pingcap/tidb |
go-retryablehttp can leak basic auth credentials to log files CVE-2024-6104, GHSA-v6v8-xj6m-xwqh, GO-2024-2947 | Medium | Not scored | 24 Jun, 2024 | Go github.com/hashicorp/go-retryablehttp |
SpiceDB exclusions can result in no permission returned when permission expected CVE-2024-38361, GHSA-grjv-gjgr-66g2, GO-2024-2939 | Medium | Not scored | 20 Jun, 2024 | Go github.com/authzed/spicedb |
ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability GHSA-rvj4-q8q5-8grf, GO-2024-2941 | Medium | Not scored | 20 Jun, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |