Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Go-Ethereum vulnerable to denial of service via malicious p2p message CVE-2023-40591, GHSA-ppjg-v974-84cm, GO-2023-2046 | High | Not scored | 06 Sep, 2023 | Go github.com/ethereum/go-ethereum |
Minio vulnerable to Privilege Escalation on Windows via Path separator manipulation CVE-2023-28433, GHSA-w23q-4hw3-2pp6 | High | Not scored | 06 Sep, 2023 | Go github.com/minio/minio |
usememos/memos vulnerable to privilege escalation CVE-2023-4697, GHSA-5j6p-59cj-j6cp, GO-2023-2036 | High | Not scored | 01 Sep, 2023 | Go github.com/usememos/memos |
usememos/memos vulnerable to improper input validation CVE-2023-4698, GHSA-96gq-6ch5-mm54 | High | Not scored | 01 Sep, 2023 | Go github.com/usememos/memos |
Code injection in ansible semaphore CVE-2023-39059, GHSA-3r32-cp7v-5wq4 | High | Not scored | 29 Aug, 2023 | Go github.com/ansible-semaphore/semaphore |
Netmaker Vulnerable to Privilege Escalation From Non Admin To Admin User CVE-2023-32079, GHSA-826j-8wp2-4x6q, GO-2023-2025 | High | Not scored | 25 Aug, 2023 | Go github.com/gravitl/netmaker |
Netmaker IDOR Allows User to Update Other User's Password CVE-2023-32078, GHSA-256m-j5qw-38f4, GO-2023-2023 | High | Not scored | 25 Aug, 2023 | Go github.com/gravitl/netmaker |
Netmaker has Hardcoded DNS Secret Key CVE-2023-32077, GHSA-8x8h-hcq8-jwwx, GO-2023-2022 | High | Not scored | 25 Aug, 2023 | Go github.com/gravitl/netmaker |
libp2p nodes vulnerable to OOM attack CVE-2023-40583, GHSA-gcq9-qqwx-rgj3, GO-2023-2024 | High | Not scored | 24 Aug, 2023 | Go github.com/libp2p/go-libp2p |
Argo CD web terminal session doesn't expire CVE-2023-40025, GHSA-c8xw-vjgf-94hr, GO-2023-2018 | High | Not scored | 23 Aug, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Weaviate denial of service vulnerability CVE-2023-38976, GHSA-8697-479h-5mfp, GO-2023-2017 | High | Not scored | 22 Aug, 2023 | Go github.com/weaviate/weaviate |
Woodpecker does not validate webhook before changing any data CVE-2023-40034, GHSA-4gcf-5m39-98mc, GO-2023-2014 | High | Not scored | 16 Aug, 2023 | Go github.com/woodpecker-ci/woodpecker |
Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading CVE-2023-40023, GHSA-xvhg-w6qc-m3qq, GO-2023-2011 | High | Not scored | 15 Aug, 2023 | Go github.com/yaklang/yaklang |
1Panel arbitrary file write vulnerability CVE-2023-39966, GHSA-hf7j-xj3w-87g4, GO-2023-2006 | High | Not scored | 10 Aug, 2023 | Go github.com/1Panel-dev/1Panel |
1Panel O&M management panel has a background arbitrary file reading vulnerability CVE-2023-39964, GHSA-pv7q-v9mv-9mh5, GO-2023-2004 | High | Not scored | 10 Aug, 2023 | Go github.com/1Panel-dev/1Panel |
Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers BIT-consul-2023-3518, CVE-2023-3518, GHSA-9rhf-q362-77mx, GO-2024-2704 | High | Not scored | 09 Aug, 2023 | Go github.com/hashicorp/consul |
libp2p nodes vulnerable to attack using large RSA keys CVE-2023-39533, GHSA-876p-8259-xjgg, GO-2023-2000 | High | Not scored | 08 Aug, 2023 | Go github.com/libp2p/go-libp2p |
Nuclei Path Traversal vulnerability CVE-2023-37896, GHSA-2xx4-jj5v-6mff, GO-2023-1998 | High | Not scored | 04 Aug, 2023 | Go github.com/projectdiscovery/nuclei Go github.com/projectdiscovery/nuclei/v2 |
Answer Missing Authorization vulnerability CVE-2023-4124, GHSA-v9vc-7x69-c2x8, GO-2023-1997 | High | Not scored | 03 Aug, 2023 | Go github.com/answerdev/answer |
Answer has Weak Password Requirements CVE-2023-4125, GHSA-j63x-f657-2m9g, GO-2023-2001 | High | Not scored | 03 Aug, 2023 | Go github.com/answerdev/answer |
Possible image tampering from missing image validation for Packages BIT-crossplane-2023-38495, CVE-2023-38495, GHSA-pj4x-2xr5-w87m, GO-2023-1980 | High | Not scored | 28 Jul, 2023 | Go github.com/crossplane/crossplane |
goproxy Denial of Service vulnerability CVE-2023-37788, GHSA-4r8x-2p26-976p, GO-2023-1941 | High | Not scored | 18 Jul, 2023 | Go github.com/elazarl/goproxy |
1Panel command injection vulnerability in Firewall ip functionality CVE-2023-37477, GHSA-p9xf-74xh-mhw5, GO-2023-1940 | High | Not scored | 18 Jul, 2023 | Go github.com/1Panel-dev/1Panel |
avro vulnerable to denial of service via attacker-controlled parameter CVE-2023-37475, GHSA-9x44-9pgq-cf45, GO-2023-1930 | High | Not scored | 17 Jul, 2023 | Go github.com/hamba/avro Go github.com/hamba/avro/v2 |
Weave GitOps Terraform Controller Information Disclosure Vulnerability CVE-2023-34236, GHSA-6hvv-j432-23cv, GO-2023-1925 | High | Not scored | 14 Jul, 2023 | Go github.com/weaveworks/tf-controller |
mx-chain-go's relayed transactions always increment nonce CVE-2023-34458, GHSA-j494-7x2v-vvvp, GO-2023-1912 | High | Not scored | 13 Jul, 2023 | Go github.com/multiversx/mx-chain-go |
Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation BIT-vault-2023-24999, CVE-2023-24999, GHSA-wmg5-g953-qqfw, GO-2023-1900 | High | Not scored | 06 Jul, 2023 | Go github.com/hashicorp/vault |
HashiCorp Boundary Workers Store Rotated Credentials in Plaintext Even When Key Management Service Configured CVE-2023-0690, GHSA-9vrm-v9xv-x3xr, GO-2023-1898 | High | Not scored | 06 Jul, 2023 | Go github.com/hashicorp/boundary |
CometBFT may duplicate transactions in the mempool's data structures CVE-2023-34451, GHSA-w24w-wp77-qffm, GO-2023-1883 | High | Not scored | 05 Jul, 2023 | Go github.com/cometbft/cometbft |
Sealos billing system permission control defect CVE-2023-36815, GHSA-vpxf-q44g-w34w | High | Not scored | 30 Jun, 2023 | Go github.com/labring/sealos |
Coraza has potential denial of service vulnerability CVE-2023-40586, GHSA-c2pj-v37r-2p6h, GO-2023-1874 | High | Not scored | 26 Jun, 2023 | Go github.com/corazawaf/coraza/v2 Go github.com/corazawaf/coraza/v3 |
hjson stack exhaustion vulnerability CVE-2023-34620, GHSA-5wfc-hjrc-gq87, GO-2026-5157 | High | 0.8% | 14 Jun, 2023 | Go github.com/hjson/hjson-go Go github.com/hjson/hjson-go/v4 Maven org.hjson:hjson Packagist laktak/hjson |
cheqd-node subject to Cosmos SDK "Barberry" vulnerability GHSA-8qxh-2gh8-r923 | High | Not scored | 12 Jun, 2023 | Go github.com/cheqd/cheqd-node |
HashiCorp Consul Incorrect Access Control vulnerability CVE-2019-12291, GHSA-h65h-v7fw-4p38, GO-2023-1852 | High | Not scored | 09 Jun, 2023 | Go github.com/hashicorp/consul |
Snowflake Golang Driver vulnerable to Command Injection CVE-2023-34231, GHSA-fwv2-65wh-2w8c | High | Not scored | 09 Jun, 2023 | Go github.com/snowflakedb/gosnowflake |
alist Incorrect Access Control vulnerability CVE-2023-33498, GHSA-hh54-53m7-7ffj | High | Not scored | 07 Jun, 2023 | Go github.com/alist-org/alist/v3 |
Grafana Missing Synchronization vulnerability BIT-grafana-2023-2801, CVE-2023-2801, GHSA-x2w4-c67p-g44j | High | Not scored | 06 Jun, 2023 | Go github.com/grafana/grafana |
notation-go's verification bypass can cause users to verify the wrong artifact CVE-2023-33959, GHSA-xhg5-42rf-296r, GO-2023-1832 | High | Not scored | 06 Jun, 2023 | Go github.com/notaryproject/notation-go |
Rancher users retain access after moving namespaces into projects they don't have access to CVE-2020-10676, GHSA-8vhc-hwhc-cpj4 | High | Not scored | 06 Jun, 2023 | Go github.com/rancher/rancher |
SQL injection when using MySQL/PostgreSQL data checking CVE-2023-33967, GHSA-4c32-w6c7-77x4 | High | Not scored | 06 Jun, 2023 | Go github.com/megaease/easeprobe |
Hashicorp Consul allows user with service:write permissions to patch remote proxy instances BIT-consul-2023-2816, CVE-2023-2816, GHSA-rqjq-ww83-wv5c, GO-2023-1828 | High | Not scored | 03 Jun, 2023 | Go github.com/hashicorp/consul |
mx-chain-go does not treat invalid transaction with wrong username correctly CVE-2023-33964, GHSA-7xpv-4pm9-xch2, GO-2023-1806 | High | Not scored | 02 Jun, 2023 | Go github.com/multiversx/mx-chain-go |
nfpm has incorrect default permissions CVE-2023-32698, GHSA-w7jw-q4fg-qc4c, GO-2023-1788 | High | Not scored | 24 May, 2023 | Go github.com/goreleaser/nfpm Go github.com/goreleaser/nfpm/v2 |
Mattermost Incorrect Authorization vulnerability BIT-mattermost-2023-2515, CVE-2023-2515, GHSA-7g2v-2frm-rg94 | High | Not scored | 12 May, 2023 | Go github.com/mattermost/mattermost-server/v6 |
distribution catalog API endpoint can lead to OOM via malicious user input CVE-2023-2253, GHSA-hqxw-f8mx-cpmw, GO-2023-1772 | High | Not scored | 11 May, 2023 | Go github.com/distribution/distribution Go github.com/docker/distribution |
Boxo bitswap/server: DOS unbounded persistent memory leak CVE-2023-25568, GHSA-m974-xj4j-7qv5, GHSA-q3j6-22wf-3jh9, GO-2023-1766 | High | Not scored | 11 May, 2023 | Go github.com/ipfs/go-bitswap Go github.com/ipfs/go-libipfs |
Rekor's compressed archives can result in OOM conditions CVE-2023-30551, GHSA-2h5h-59f5-c5x9, GO-2023-1754 | High | Not scored | 03 May, 2023 | Go github.com/sigstore/rekor |
Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer CVE-2023-30549, GHSA-j4rf-7357-f4cg, GO-2023-1738 | High | Not scored | 25 Apr, 2023 | Go github.com/apptainer/apptainer |
IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar arithmetic CVE-2023-26557, GHSA-mjqv-xhgm-gx8c, GO-2023-1733 | High | Not scored | 21 Apr, 2023 | Go github.com/binance-chain/tss-lib Go github.com/bnb-chain/tss-lib |
Debug mode leaks confidential data in Cilium BIT-cilium-2023-29002, BIT-cilium-operator-2023-29002, BIT-cilium-proxy-2023-29002, BIT-hubble-2023-29002, BIT-hubble-relay-2023-29002, BIT-hubble-ui-2023-29002, BIT-hubble-ui-backend-2023-29002, CVE-2023-29002, GHSA-pg5p-wwp8-97g8, GO-2023-1730 | High | Not scored | 19 Apr, 2023 | Go github.com/cilium/cilium |