Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
go-retryablehttp can leak basic auth credentials to log files CVE-2024-6104, GHSA-v6v8-xj6m-xwqh, GO-2024-2947 | Medium | Not scored | 24 Jun, 2024 | Go github.com/hashicorp/go-retryablehttp |
SpiceDB exclusions can result in no permission returned when permission expected CVE-2024-38361, GHSA-grjv-gjgr-66g2, GO-2024-2939 | Medium | Not scored | 20 Jun, 2024 | Go github.com/authzed/spicedb |
ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability GHSA-rvj4-q8q5-8grf, GO-2024-2941 | Medium | Not scored | 20 Jun, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
SFTPGo has insufficient access control for password reset CVE-2024-37897, GHSA-hw5f-6wvv-xcrh, GO-2024-2940 | Medium | Not scored | 20 Jun, 2024 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |
PocketBase performs password auth and OAuth2 unverified email linking CVE-2024-38351, GHSA-m93w-4fxv-r35v, GO-2024-2936 | Medium | Not scored | 18 Jun, 2024 | Go github.com/pocketbase/pocketbase |
Minder affected by denial of service from maliciously configured Git repository CVE-2024-37904, GHSA-hpcg-xjq5-g666, GO-2024-2934 | Medium | Not scored | 18 Jun, 2024 | Go github.com/stacklok/minder |
CVE-2024-5138: snapd snapctl auth bypass CVE-2024-5138, GHSA-p9v8-q5m4-pf46, GO-2024-2906 | Medium | Not scored | 14 Jun, 2024 | Go github.com/snapcore/snapd |
gqlparser denial of service vulnerability via the parserDirectives function CVE-2023-49559, GHSA-2hmf-46v7-v6fx, GO-2024-2920 | Medium | Not scored | 12 Jun, 2024 | Go github.com/vektah/gqlparser Go github.com/vektah/gqlparser/v2 |
Traefik has unexpected behavior with IPv4-mapped IPv6 addresses GHSA-7jmw-8259-q9jx, GO-2024-2917 | Medium | Not scored | 11 Jun, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-35255, GHSA-m5vv-6r4h-3vj9, GO-2024-2918, PYSEC-2026-1209 | Medium | 0.8% | 11 Jun, 2024 | Go github.com/Azure/azure-sdk-for-go/sdk/azidentity Maven com.azure:azure-identity Maven com.microsoft.azure:msal4j NuGet Azure.Identity +4 more |
Moby (Docker Engine) is vulnerable to Ambiguous OCI manifest parsing GHSA-xmmx-7jpf-fx42, GO-2024-2914 | Medium | Not scored | 10 Jun, 2024 | Go github.com/docker/docker Go github.com/moby/moby |
Docker CLI leaks private registry credentials to registry-1.docker.io BIT-docker-cli-2021-41092, CVE-2021-41092, GHSA-99pg-grm5-qq3v, GO-2024-2912 | Medium | Not scored | 10 Jun, 2024 | Go github.com/docker/cli |
Unauthenticated Access to sensitive settings in Argo CD BIT-argo-cd-2024-37152, CVE-2024-37152, GHSA-87p9-x75h-p4j2, GO-2024-2902 | Medium | Not scored | 06 Jun, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 Go github.com/argoproj/argo-cd/v2/server |
Evmos allows unvested token delegations CVE-2024-37154, GHSA-7hrh-v6wp-53vw, GO-2024-2904 | Medium | Not scored | 06 Jun, 2024 | Go github.com/evmos/evmos Go github.com/evmos/evmos/v10 Go github.com/evmos/evmos/v11 Go github.com/evmos/evmos/v12 +14 more |
Argo-cd authenticated users can enumerate clusters by name BIT-argo-cd-2024-36106, CVE-2024-36106, GHSA-3cqf-953p-h5cp, GO-2024-2898 | Medium | Not scored | 06 Jun, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Owncast Path Traversal vulnerability CVE-2024-31450, GHSA-9355-27m8-h74v, GO-2024-2741 | Medium | Not scored | 04 Jun, 2024 | Go github.com/owncast/owncast |
Open Redirect URL in Harbor BIT-harbor-2024-22244, CVE-2024-22244, GHSA-5757-v49g-f6r7, GO-2024-2915 | Medium | Not scored | 02 Jun, 2024 | Go github.com/goharbor/harbor |
Ollama does not validate the format of the digest (sha256 with 64 hex digits) CVE-2024-37032, GHSA-8hqg-whrw-pv92, GO-2024-2901 | Medium | Not scored | 31 May, 2024 | Go github.com/ollama/ollama |
MinIO information disclosure vulnerability CVE-2024-36107, GHSA-95fr-cm4m-q5p9, GO-2024-2886 | Medium | Not scored | 29 May, 2024 | Go github.com/minio/minio |
Denial of service of Minder Server from maliciously crafted GitHub attestations CVE-2024-35238, GHSA-8fmj-33gw-g7pw, GO-2024-2885 | Medium | Not scored | 28 May, 2024 | Go github.com/stacklok/minder |
Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop GHSA-f7cq-5v43-8pwp, GO-2024-2880 | Medium | Not scored | 23 May, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Dapr API Token Exposure CVE-2024-35223, GHSA-284c-x8m7-9w5h, GO-2024-2879 | Medium | Not scored | 22 May, 2024 | Go github.com/dapr/dapr |
github.com/cosmos/ibc-go affected by IBC protocol "Huckleberry" vulnerability GHSA-qjcv-rx3v-7mvj, GO-2024-2874 | Medium | Not scored | 20 May, 2024 | Go github.com/cosmos/ibc-go Go github.com/cosmos/ibc-go/v2 Go github.com/cosmos/ibc-go/v3 Go github.com/cosmos/ibc-go/v4 +3 more |
Stacklok Minder vulnerable to denial of service from maliciously crafted templates CVE-2024-35194, GHSA-crgc-2583-rw27, GO-2024-2871 | Medium | Not scored | 20 May, 2024 | Go github.com/stacklok/minder |
Trivy possibly leaks registry credential when scanning images from malicious registries CVE-2024-35192, GHSA-xcq4-m2r3-cmrj, GO-2024-2870 | Medium | Not scored | 20 May, 2024 | Go github.com/aquasecurity/trivy |
Submariner Operator sets unnecessary RBAC permissions CVE-2024-5042, GHSA-2rhx-qhxp-5jpw, GO-2024-2866 | Medium | Not scored | 17 May, 2024 | Go github.com/submariner-io/submariner-operator |
Denial of service of Minder Server with attacker-controlled REST endpoint CVE-2024-35185, GHSA-fjw8-3gp8-4cvx, GO-2024-2864 | Medium | Not scored | 16 May, 2024 | Go github.com/stacklok/minder |
wolfictl leaks GitHub tokens to remote non-GitHub git servers CVE-2024-35183, GHSA-8fg7-hp93-qhvr, GO-2024-2863 | Medium | Not scored | 15 May, 2024 | Go github.com/wolfi-dev/wolfictl |
goreleaser shows environment by default GHSA-f6mm-5fc7-3g3c, GO-2024-2860 | Medium | Not scored | 15 May, 2024 | Go github.com/goreleaser/goreleaser |
source-controller leaks Azure Storage SAS token into logs CVE-2024-31216, GHSA-v554-xwgw-hc3w, GO-2024-2859 | Medium | Not scored | 15 May, 2024 | Go github.com/fluxcd/source-controller |
azure-file-csi-driver leaks service account tokens in the logs CVE-2024-3744, GHSA-qjqg-4wg7-957h, GO-2024-2861 | Medium | Not scored | 15 May, 2024 | Go sigs.k8s.io/azurefile-csi-driver |
sshpiper's enabling of proxy protocol without proper feature flagging allows faking source address CVE-2024-35175, GHSA-4w53-6jvp-gg52, GO-2024-2853 | Medium | Not scored | 14 May, 2024 | Go github.com/tg123/sshpiper |
Grafana when using email as a username can block other users from signing in BIT-grafana-2022-39229, CVE-2022-39229, GHSA-gj7m-853r-289r, GO-2024-2848 | Medium | Not scored | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins BIT-grafana-2022-31130, CVE-2022-31130, GHSA-jv32-5578-pxjc, GO-2024-2851 | Medium | Not scored | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana API IDOR BIT-grafana-2022-21713, CVE-2022-21713, GHSA-63g3-9jq3-mccv | Medium | Not scored | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Stored Cross-site Scripting in Unified Alerting BIT-grafana-2022-31097, CVE-2022-31097, GHSA-vw7q-p2qg-4m5f, GO-2024-2857 | Medium | Not scored | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana proxy Cross-site Scripting BIT-grafana-2022-21702, CVE-2022-21702, GHSA-xc3p-28hw-q24g | Medium | Not scored | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana directory traversal for .cvs files BIT-grafana-2021-43815, CVE-2021-43815, GHSA-7533-c8qv-jm9m | Medium | Not scored | 14 May, 2024 | Go github.com/grafana/grafana |
1Panel arbitrary file write vulnerability CVE-2024-34352, GHSA-f8ch-w75v-c847, GO-2024-2830 | Medium | Not scored | 09 May, 2024 | Go github.com/1Panel-dev/1Panel |
Vitess vulnerable to infinite memory consumption and vtgate crash CVE-2024-32886, GHSA-649x-hxfx-57j2, GO-2024-2826 | Medium | Not scored | 08 May, 2024 | Go github.com/vitessio/vitess Go vitess.io/vitess |
btcd susceptible to consensus failures CVE-2024-34478, GHSA-3jgf-r68h-xfqm, GO-2024-2818 | Medium | Not scored | 05 May, 2024 | Go github.com/btcsuite/btcd |
Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull CVE-2024-34068, GHSA-qq22-jj8x-4wwv, GO-2024-2815 | Medium | Not scored | 03 May, 2024 | Go github.com/pterodactyl/wings |
kubevirt allows a local attacker to execute arbitrary code via a crafted command CVE-2024-33394, GHSA-4q63-mr2m-57hf, GO-2024-2816 | Medium | Not scored | 02 May, 2024 | Go kubevirt.io/kubevirt |
Firebase vulnerable to CRSF attack CVE-2024-4128, GHSA-rcm2-22f3-pqv3, GO-2024-2808 | Medium | 0.1% | 02 May, 2024 | Go github.com/firebase/firebase-tools npm firebase-tools |
Zitadel exposing internal database user name and host information CVE-2024-32967, GHSA-q5qj-x2h5-3945, GO-2024-2804 | Medium | Not scored | 01 May, 2024 | Go github.com/zitadel/zitadel |
Navidrome Parameter Tampering vulnerability CVE-2024-32963, GHSA-4jrx-5w4h-3gpm, GO-2024-2803 | Medium | Not scored | 01 May, 2024 | Go github.com/navidrome/navidrome |
Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences BIT-argo-cd-2024-32476, CVE-2024-32476, GHSA-9m6p-x4h2-6frq, GO-2024-2792 | Medium | Not scored | 26 Apr, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Mattermost's detailed error messages reveal the full file path CVE-2024-32046, GHSA-vx97-8q8q-qgq5, GO-2024-2797 | Medium | Not scored | 26 Apr, 2024 | Go github.com/mattermost/mattermost-server |
Mattermost crashes web clients via a malformed custom status CVE-2024-4182, GHSA-8f99-g2pj-x8w3, GO-2024-2795 | Medium | Not scored | 26 Apr, 2024 | Go github.com/mattermost/mattermost-server |
Mattermost fails to limit the number of active sessions CVE-2024-4183, GHSA-wj37-mpq9-xrcm, GO-2024-2798 | Medium | Not scored | 26 Apr, 2024 | Go github.com/mattermost/mattermost-server |