Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SpiceDB binding metrics port to untrusted networks and can leak command-line flags CVE-2023-29193, GHSA-cjr9-mr35-7xh6, GO-2023-1723 | High | 0.8% | 13 Apr, 2023 | Go github.com/authzed/spicedb |
OpenFeature Operator vulnerable to Cluster-level Privilege Escalation CVE-2023-29018, GHSA-cwf6-xj49-wp83, GO-2023-1721 | High | 0.7% | 12 Apr, 2023 | Go github.com/open-feature/open-feature-operator |
Traefik HTTP header parsing could cause a denial of service CVE-2023-29013, GHSA-7hj9-rv74-5g92 | High | 1.1% | 11 Apr, 2023 | Go github.com/traefik/traefik/v2 |
Answer vulnerable to account takeover because password reset links do not expire CVE-2023-1976, GHSA-j97g-77fj-9c4p, GO-2023-1719 | High | 0.6% | 11 Apr, 2023 | Go github.com/answerdev/answer |
HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation CVE-2023-1782, GHSA-f8r8-h93m-mj77, GO-2023-1707 | High | 0.8% | 05 Apr, 2023 | Go github.com/hashicorp/nomad |
Docker Swarm encrypted overlay network may be unauthenticated CVE-2023-28840, GHSA-232p-vwff-86mp, GO-2023-1699 | High | 2.6% | 04 Apr, 2023 | Go github.com/docker/docker |
Phachon mm-wiki Cross Site Request Forgery vulnerability CVE-2020-19278, GHSA-f6xp-59jq-r35c | High | 0.5% | 04 Apr, 2023 | Go github.com/phachon/mm-wiki |
Stud42 vulnerable to denial of service GHSA-3hwm-922r-47hw | High | Not scored | 31 Mar, 2023 | Go atomys.codes/stud42 |
Gophish vulnerable to Denial of Service via crafted payload involving autofocus CVE-2022-45003, GHSA-8gg8-wr4j-v2wr | High | 1.0% | 22 Mar, 2023 | Go github.com/gophish/gophish |
crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb CVE-2023-28119, GHSA-5mqj-xc49-246p, GO-2023-1664 | High | 1.0% | 22 Mar, 2023 | Go github.com/crewjam/saml |
Privilege Escalation on Linux/MacOS CVE-2023-28434, GHSA-2pxw-r47w-4p8c | HighExploited | 7.9% | 22 Mar, 2023 | Go github.com/minio/minio |
cloudflared's Installer has Local Privilege Escalation Vulnerability CVE-2023-1314, GHSA-7mjv-x3jf-545x, GO-2023-1652 | High | 0.3% | 21 Mar, 2023 | Go github.com/cloudflare/cloudflared |
Answer vulnerable to Insufficient Session Expiration CVE-2023-1543, GHSA-79hx-g43v-xfmr, GO-2023-1655 | High | 0.8% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Go-huge-util vulnerable to path traversal when unzipping files CVE-2023-28105, GHSA-5g39-ppwg-6xx8, GO-2023-1640 | High | 0.6% | 16 Mar, 2023 | Go github.com/dablelv/go-huge-util |
On a compromised node, the virt-handler service account can be used to modify all node specs CVE-2023-26484, GHSA-cp96-jpmq-xrr2 | High | 0.6% | 16 Mar, 2023 | Go kubevirt.io/kubevirt |
google.golang.org/protobuf vulnerable to panic leading to denial of service CVE-2023-24535, GHSA-hw7c-3rfg-p46j, GO-2023-1631 | High | 1.1% | 14 Mar, 2023 | Go google.golang.org/protobuf |
Nomad Job Submitter Privilege Escalation Using Workload Identity CVE-2023-1299, GHSA-rqm8-q8j9-662f, GO-2023-1633 | High | 0.5% | 14 Mar, 2023 | Go github.com/hashicorp/nomad |
Constellation allows Emergency shell access during initramfs boot phase GHSA-6w5f-5wgr-qjg5, GO-2023-1622 | High | Not scored | 09 Mar, 2023 | Go github.com/edgelesssys/constellation Go github.com/edgelesssys/constellation/v2 |
Goutil vulnerable to path traversal when unzipping files CVE-2023-27475, GHSA-fx2v-qfhr-4chv, GO-2023-1611 | High | 0.8% | 07 Mar, 2023 | Go github.com/gookit/goutil |
Yapscan Denial of Service vulnerability in report server GHSA-wxwq-525w-hcqx, GO-2023-1607 | High | Not scored | 03 Mar, 2023 | Go github.com/fkie-cad/yapscan |
Opencontainers runc Incorrect Authorization vulnerability CVE-2023-27561, GHSA-vpvm-3wq2-2wvm, GO-2023-1627 | High | 0.4% | 03 Mar, 2023 | Go github.com/opencontainers/runc |
Kubernetes vulnerable to validation bypass CVE-2022-3294, GHSA-jh36-q97c-9928, GO-2023-1629 | High | 1.6% | 01 Mar, 2023 | Go github.com/kubernetes/kubernetes Go k8s.io/kubernetes |
nistec has Incorrect Calculation in Multiplication of unreduced P-256 scalars CVE-2023-24533, GHSA-f6hc-9g49-xmx7, GO-2023-1595 | High | 0.7% | 28 Feb, 2023 | Go filippo.io/nistec |
notation-go has excessive memory allocation on verification CVE-2023-25656, GHSA-87x9-7grx-m28v, GO-2023-1589 | High | 0.4% | 22 Feb, 2023 | Go github.com/notaryproject/notation-go |
GoPistolet vulnerable to Improper Resource Shutdown or Release CVE-2015-10085, GHSA-wr8h-w969-36m8, GO-2023-1590 | High | 0.9% | 21 Feb, 2023 | Go github.com/gopistolet/gopistolet |
User data in TPM attestation vulnerable to MITM GHSA-r2h5-3hgw-8j34, GO-2023-1583 | High | Not scored | 17 Feb, 2023 | Go github.com/edgelesssys/constellation Go github.com/edgelesssys/constellation/v2 |
golang.org/x/net vulnerable to Uncontrolled Resource Consumption BIT-golang-2022-41723, CVE-2022-41723, GHSA-vvpx-j8f3-3w6h, GO-2023-1571 | High | 4.6% | 16 Feb, 2023 | Go golang.org/x/net Go stdlib |
rttys SQL Injection vulnerability CVE-2022-38867, GHSA-54q4-74p3-mgcw | High | 0.9% | 16 Feb, 2023 | Go github.com/zhaojh329/rttys |
IPFS go-unixfsnode subject to DOS via HAMT Decoding Panics CVE-2023-23631, GHSA-4gj3-6r43-3wfc, GO-2023-1559 | High | 0.9% | 10 Feb, 2023 | Go github.com/ipfs/go-unixfsnode |
otelhttp and otelbeego have DoS vulnerability for high cardinality metrics CVE-2023-25151, GHSA-5r5m-65gx-7vrh, GO-2023-1546 | High | 1.0% | 08 Feb, 2023 | Go go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego Go go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp |
Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following CVE-2023-25152, GHSA-p8r3-83r8-jwj5, GO-2023-1542 | High | 0.7% | 08 Feb, 2023 | Go github.com/pterodactyl/wings |
mrpack-install vulnerable to path traversal with dependency CVE-2023-25307, GHSA-r887-gfxh-m9rr, GO-2023-1543 | High | 0.6% | 08 Feb, 2023 | Go github.com/nothub/mrpack-install |
Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injection CVE-2022-45786, GHSA-6p5q-h963-pwwf, GO-2024-2587, PYSEC-2026-769 | High | 1.0% | 04 Feb, 2023 | Go github.com/apache/age/drivers/golang PyPI apache-age-python |
Path Traversal in gin-vue-admin CVE-2022-47762, GHSA-x623-hr8h-7g5v, GO-2023-1560 | High | 0.9% | 03 Feb, 2023 | Go github.com/flipped-aurora/gin-vue-admin |
Paranoidhttp Server-Side Request Forgery vulnerability CVE-2023-24623, GHSA-v9mp-j8g7-2q6m, GO-2023-1526 | High | 0.7% | 30 Jan, 2023 | Go github.com/hakobe/paranoidhttp |
Command injection in Git package in Wrangler CVE-2022-31249, GHSA-qrg7-hfx7-95c5, GO-2023-1519 | High | 3.8% | 25 Jan, 2023 | Go github.com/rancher/wrangler |
Controller reconciles apps outside configured namespaces when sharding is enabled CVE-2023-22736, GHSA-6p4m-hw2h-6gmw, GO-2023-1512 | High | 0.8% | 25 Jan, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Rancher generated tokens not revoked after modifications made to authentication provider GHSA-c45c-39f6-6gw9 | High | Not scored | 25 Jan, 2023 | Go github.com/rancher/rancher |
Plaintext storage of sensitive data in Rancher API and cluster.management.cattle.io objects CVE-2022-43757, GHSA-cq4p-vp5q-4522 | High | 0.6% | 25 Jan, 2023 | Go github.com/rancher/rancher |
Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster CVE-2022-21953, GHSA-g25r-gvq3-wrq7 | High | 0.5% | 25 Jan, 2023 | Go github.com/rancher/rancher |
Privilege escalation in project role template binding (PRTB) and -promoted roles CVE-2022-43759, GHSA-7m72-mh5r-6j3r | High | 0.7% | 25 Jan, 2023 | Go github.com/rancher/rancher |
Rancher cattle-token is predictable CVE-2022-43755, GHSA-8c69-r38j-rpfj | High | 1.7% | 25 Jan, 2023 | Go github.com/rancher/rancher |
Kraken has arbitrary file read vulnerability via component testfs CVE-2022-47747, GHSA-hj4g-4w36-x8hp, GO-2023-1505 | High | 0.8% | 20 Jan, 2023 | Go github.com/uber/kraken |
act vulnerable to arbitrary file upload in artifact server CVE-2023-22726, GHSA-pc99-qmg4-rcff, GO-2023-1504 | High | 1.3% | 20 Jan, 2023 | Go github.com/nektos/act |
Velociraptor vulnerable to Missing Authorization CVE-2023-0242, GHSA-g5vm-525q-r66c, GO-2023-1527 | High | 0.6% | 18 Jan, 2023 | Go www.velocidex.com/golang/velociraptor |
golang.org/x/net/http2/h2c vulnerable to request smuggling attack CVE-2022-41721, GHSA-fxg5-wq6x-vr4w, GO-2023-1495 | High | 1.8% | 13 Jan, 2023 | Go golang.org/x/net |
Bloom Uncontrolled Search Path Element vulnerability CVE-2023-0247, GHSA-fgwp-pwqq-g3w4 | High | 0.4% | 12 Jan, 2023 | Go github.com/bits-and-blooms/bloom |
KubeOperator allows unauthorized access to system API CVE-2023-22480, GHSA-jxgp-jgh3-8jc8 | High | 66.8% | 09 Jan, 2023 | Go github.com/KubeOperator/KubeOperator |
KubePi session fixation attack allows an attacker to hijack a legitimate user session. CVE-2023-22479, GHSA-v4w5-r2xc-7f8h, GO-2023-1468 | High | 0.4% | 09 Jan, 2023 | Go github.com/KubeOperator/kubepi |
KubePi may allow unauthorized access to system API CVE-2023-22478, GHSA-gqx8-hxmv-c4v4, GO-2023-1463 | High | 3.7% | 09 Jan, 2023 | Go github.com/KubeOperator/kubepi |