Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
CoreDNS may return invalid cache entries CVE-2024-0874, GHSA-m9w6-wp3h-vq8g, GO-2024-2785 | Medium | 0.8% | 25 Apr, 2024 | Go github.com/coredns/coredns |
Information disclosure in podman CVE-2020-14370, GHSA-c3wv-qmjj-45r6, GO-2024-2766 | Medium | 1.4% | 24 Apr, 2024 | Go github.com/containers/libpod Go github.com/containers/libpod/v2 Go github.com/containers/podman/v2 |
Kubelet Incorrect Privilege Assignment CVE-2019-11245, GHSA-r76g-g87f-vw8f, GO-2024-2780 | Medium | 0.6% | 24 Apr, 2024 | Go k8s.io/kubernetes Go k8s.io/kubernetes/cmd/kubelet |
Sensitive Information leak via Log File in Kubernetes CVE-2020-8563, GHSA-5xfg-wv98-264m, GO-2024-2755 | Medium | 0.5% | 24 Apr, 2024 | Go github.com/kubernetes/kubernetes Go k8s.io/kubernetes |
Sensitive Information leak via Log File in Kubernetes CVE-2020-8566, GHSA-5x96-j797-5qqw, GO-2024-2754 | Medium | 0.5% | 24 Apr, 2024 | Go github.com/kubernetes/kubernetes Go k8s.io/kubernetes |
Denial of service in Kubernetes CVE-2020-8557, GHSA-55qj-gj3x-jq9r, GO-2024-2753 | Medium | 0.4% | 24 Apr, 2024 | Go k8s.io/kubernetes Go k8s.io/kubernetes/pkg/kubelet |
Privilege Escalation in Kubernetes CVE-2020-8559, GHSA-33c5-9fx5-fvjm, GO-2024-2748 | Medium | 6.1% | 24 Apr, 2024 | Go k8s.io/apimachinery Go k8s.io/kubernetes |
Hugo Markdown titles do not escaped in internal render hooks CVE-2024-32875, GHSA-ppf8-hhpp-f5hj, GO-2024-2747 | Medium | 0.5% | 23 Apr, 2024 | Go github.com/gohugoio/hugo |
Moby (Docker Engine) started with non-empty inheritable Linux process capabilities CVE-2022-24769, GHSA-2mm7-x5h6-5pvq, GO-2022-0390 | Medium | 0.5% | 22 Apr, 2024 | Go github.com/docker/docker Go github.com/moby/moby |
Apache Answer: XSS vulnerability when changing personal website CVE-2024-29217, GHSA-cvqr-mwh6-2vc6, GO-2024-2743 | Medium | 1.0% | 21 Apr, 2024 | Go github.com/apache/incubator-answer |
IPv6 enabled on IPv4-only network interfaces CVE-2024-32473, GHSA-x84c-p2g9-rqv9, GO-2024-2737 | Medium | 0.4% | 18 Apr, 2024 | Go github.com/docker/docker |
Evmos vulnerable to unauthorized account creation with vesting module GHSA-m99c-q26r-m7m7, GO-2024-2731 | Medium | Not scored | 17 Apr, 2024 | Go github.com/evmos/evmos Go github.com/evmos/evmos/v10 Go github.com/evmos/evmos/v11 Go github.com/evmos/evmos/v12 +10 more |
Argo CD's API server does not enforce project sourceNamespaces BIT-argo-cd-2024-31990, CVE-2024-31990, GHSA-2gvw-w6fj-7m3c, GO-2024-2728 | Medium | 0.4% | 15 Apr, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Traefik affected by HTTP/2 CONTINUATION flood in net/http GHSA-7f4j-64p6-5h5v, GO-2024-2726 | Medium | Not scored | 15 Apr, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Apache Solr Operator liveness and readiness probes may leak basic auth credentials CVE-2024-31391, GHSA-g9qx-25vj-rf53, GO-2024-2723 | Medium | 0.8% | 12 Apr, 2024 | Go github.com/apache/solr-operator |
tiagorlampert CHAOS vulnerable to Cross Site Scripting CVE-2024-31839, GHSA-c5rv-hjjc-jv7m, GO-2024-2721 | Medium | 8.1% | 12 Apr, 2024 | Go github.com/tiagorlampert/CHAOS |
Cosign malicious artifacts can cause machine-wide DoS BIT-cosign-2024-29903, CVE-2024-29903, GHSA-95pr-fxf5-86gv, GO-2024-2719 | Medium | 0.9% | 11 Apr, 2024 | Go github.com/sigstore/cosign Go github.com/sigstore/cosign/v2 |
Cosign malicious attachments can cause system-wide denial of service BIT-cosign-2024-29902, CVE-2024-29902, GHSA-88jx-383q-w4qc, GO-2024-2718 | Medium | 0.7% | 11 Apr, 2024 | Go github.com/sigstore/cosign Go github.com/sigstore/cosign/v2 |
Portainer CE allows username enumeration through authentication response timing CVE-2024-29296, GHSA-87x6-8m9v-g8c2, GO-2026-6619 | Medium | 1.3% | 10 Apr, 2024 | Go github.com/portainer/portainer |
Minder GetRepositoryByName data leak CVE-2024-31455, GHSA-ggp5-28x4-xcj9, GO-2024-2701 | Medium | 0.8% | 09 Apr, 2024 | Go github.com/stacklok/minder |
Archiver Path Traversal vulnerability CVE-2024-0406, GHSA-rhh4-rh7c-7r5v, GO-2024-2698 | Medium | 0.9% | 06 Apr, 2024 | Go github.com/mholt/archiver Go github.com/mholt/archiver/v3 |
Pebble service manager's file pull API allows access by any user BIT-pebble-2024-3250, CVE-2024-3250, GHSA-4685-2x5r-65pj, GO-2024-2692 | Medium | 0.2% | 05 Apr, 2024 | Go github.com/canonical/pebble |
Mattermost Server doesn't limit the number of user preferences BIT-mattermost-2024-28949, CVE-2024-28949, GHSA-mcw6-3256-64gg, GO-2024-2695 | Medium | 0.6% | 05 Apr, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Server Improper Access Control BIT-mattermost-2024-29221, CVE-2024-29221, GHSA-w67v-ph4x-f48q, GO-2024-2706 | Medium | 0.3% | 05 Apr, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
HashiCorpVault does not correctly validate OCSP responses BIT-vault-2024-2660, CVE-2024-2660, GHSA-j2rp-gmqv-frhv, GO-2024-2690 | Medium | 0.3% | 04 Apr, 2024 | Go github.com/hashicorp/vault |
Temporal Server Denial of Service CVE-2024-2689, GHSA-wmxc-v39r-p9wf, GO-2024-2689 | Medium | 0.5% | 04 Apr, 2024 | Go github.com/temporalio/temporal Go go.temporal.io/server |
net/http, x/net/http2: close connections when receiving too many headers BIT-golang-2023-45288, CVE-2023-45288, GHSA-4v7x-pqxf-cx7m, GO-2024-2687 | Medium | 89.5% | 03 Apr, 2024 | Go golang.org/x/net Go golang.org/x/net/http2 Go net/http Go stdlib |
KubeVirt NULL pointer dereference flaw CVE-2024-31420, GHSA-vjhf-6xfr-5p9g, GO-2024-2688 | Medium | 0.6% | 03 Apr, 2024 | Go kubevirt.io/kubevirt |
Temporal UI Server cross-site scripting vulnerability CVE-2024-2435, GHSA-8f25-w7qj-r7hc, GO-2024-2675 | Medium | 0.4% | 02 Apr, 2024 | Go github.com/temporalio/ui-server Go github.com/temporalio/ui-server/v2 |
CA17 TeamsACS Cross Site Scripting vulnerability CVE-2024-22780, GHSA-hwvw-gh23-qpvq, GO-2024-2684 | Medium | 0.6% | 02 Apr, 2024 | Go github.com/ca17/teamsacs |
LocalAI cross-site request forgery vulnerability CVE-2024-3135, GHSA-jhvf-7c85-3c9g, GO-2024-2705 | Medium | 0.3% | 01 Apr, 2024 | Go github.com/go-skynet/LocalAI |
CasaOS Username Enumeration - Bypass of CVE-2024-24766 CVE-2024-28232, GHSA-hcw2-2r9c-gc6p, GO-2024-2668 | Medium | 0.6% | 01 Apr, 2024 | Go github.com/IceWhaleTech/CasaOS-UserService |
ArgoCD's repo server has Uncontrolled Resource Consumption vulnerability BIT-argo-cd-2024-29893, CVE-2024-29893, GHSA-jhwx-mhww-rgc3, GO-2024-2667 | Medium | 1.0% | 29 Mar, 2024 | Go github.com/argoproj/argo-cd/v2 |
Moby's external DNS requests from 'internal' networks could lead to data exfiltration CVE-2024-29018, GHSA-mq39-4gv4-mvpx, GO-2024-2659 | Medium | 0.7% | 20 Mar, 2024 | Go github.com/docker/docker |
Unencrypted traffic between nodes when using WireGuard and L7 policies BIT-cilium-2024-28250, BIT-cilium-operator-2024-28250, BIT-cilium-proxy-2024-28250, BIT-hubble-2024-28250, BIT-hubble-relay-2024-28250, BIT-hubble-ui-2024-28250, BIT-hubble-ui-backend-2024-28250, CVE-2024-28250, GHSA-v6q2-4qr3-5cw6, GO-2024-2657 | Medium | 0.2% | 18 Mar, 2024 | Go github.com/cilium/cilium |
Unencrypted traffic between nodes when using IPsec and L7 policies BIT-cilium-2024-28249, BIT-cilium-operator-2024-28249, BIT-cilium-proxy-2024-28249, BIT-hubble-2024-28249, BIT-hubble-relay-2024-28249, BIT-hubble-ui-2024-28249, BIT-hubble-ui-backend-2024-28249, CVE-2024-28249, GHSA-j89h-qrvr-xc36, GO-2024-2656 | Medium | 0.3% | 18 Mar, 2024 | Go github.com/cilium/cilium |
Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime CVE-2023-51699, GHSA-wx8q-4gm9-rj2g, GO-2024-2644 | Medium | 0.6% | 15 Mar, 2024 | Go github.com/fluid-cloudnative/fluid |
Users with `create` but not `override` privileges can perform local sync BIT-argo-cd-2023-50726, CVE-2023-50726, GHSA-g623-jcgg-mhmm, GO-2024-2643 | Medium | 0.5% | 15 Mar, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
1Panel is vulnerable to command injection CVE-2024-2352, GHSA-x2vg-5wrf-vj6v, GO-2024-2636 | Medium | 3.0% | 10 Mar, 2024 | Go github.com/1Panel-dev/1Panel |
JWX vulnerable to a denial of service attack using compressed JWE message CVE-2024-28122, GHSA-hj3v-m684-v259, GO-2024-2632 | Medium | 0.6% | 08 Mar, 2024 | Go github.com/lestrrat-go/jwx Go github.com/lestrrat-go/jwx/v2 |
Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) CVE-2024-28180, GHSA-c5q2-7r4c-mv6g, GO-2024-2631 | Medium | 2.0% | 07 Mar, 2024 | Go github.com/go-jose/go-jose/v3 Go github.com/go-jose/go-jose/v4 Go gopkg.in/go-jose/go-jose.v2 Go gopkg.in/square/go-jose.v2 |
1Panel open source panel project has an unauthorized vulnerability. CVE-2024-27288, GHSA-26w3-q4j8-4xjp, GO-2024-2613 | Medium | 0.5% | 06 Mar, 2024 | Go github.com/1Panel-dev/1Panel |
CasaOS Username Enumeration CVE-2024-24766, GHSA-c967-2652-gfjm, GO-2024-2615 | Medium | 0.8% | 06 Mar, 2024 | Go github.com/IceWhaleTech/CasaOS-UserService |
Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON CVE-2024-24786, GHSA-8r3f-844c-mc37, GO-2024-2611 | Medium | 1.3% | 05 Mar, 2024 | Go google.golang.org/protobuf Go google.golang.org/protobuf/encoding/protojson Go google.golang.org/protobuf/internal/encoding/json |
Mattermost allows attackers access to posts in channels they are not a member of BIT-mattermost-2024-1942, CVE-2024-1942, GHSA-hwjf-4667-gqwx, GO-2024-2592 | Medium | 0.4% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to limit the number of role names BIT-mattermost-2024-1953, CVE-2024-1953, GHSA-vm9m-57jr-4pxh, GO-2024-2594 | Medium | 0.5% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to check the "invite_guest" permission CVE-2024-1888, GHSA-pfw6-5rx3-xh3c, GO-2024-2593 | Medium | 0.3% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost leaks details of AD/LDAP groups of a teams BIT-mattermost-2024-23493, CVE-2024-23493, GHSA-7v3v-984v-h74r, GO-2024-2590 | Medium | 0.4% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost denial of service through long emoji value BIT-mattermost-2024-24988, CVE-2024-24988, GHSA-6mx3-9qfh-77gj, GO-2024-2589 | Medium | 0.7% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Minder trusts client-provided mapping from repo name to upstream ID CVE-2024-27093, GHSA-q6h8-4j2v-pjg4, GO-2024-2582 | Medium | 0.6% | 26 Feb, 2024 | Go github.com/stacklok/minder |