Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Caddy-SSH vulnerable to Authorization Bypass due to incorrect usage of PAM library GHSA-gmhj-xjfh-cf6m | High | Not scored | 23 Sep, 2022 | Go github.com/mohammed90/caddy-ssh |
lakeFS vulnerable to authenticated users deleting files they are not authorized to delete GHSA-28q9-9c3g-v3f9, GO-2022-1019 | High | Not scored | 23 Sep, 2022 | Go github.com/treeverse/lakefs |
Grafana folders admin only permission privilege escalation BIT-grafana-2022-36062, CVE-2022-36062, GHSA-p978-56hq-r492, GO-2024-2854 | High | 0.7% | 22 Sep, 2022 | Go github.com/grafana/grafana |
CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure CVE-2022-2995, GHSA-phjr-8j92-w5v7, GO-2022-1014 | High | 0.4% | 20 Sep, 2022 | Go github.com/cri-o/cri-o |
SFTPGo vulnerable to recovery codes abuse CVE-2022-36071, GHSA-54qx-8p8w-xhg8, GO-2022-0964 | High | 0.5% | 16 Sep, 2022 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |
Go-CVSS has Out-of-bounds Read vulnerability in ParseVector function CVE-2022-39213, GHSA-xhmf-mmv2-4hhx, GO-2022-1002 | High | 1.7% | 16 Sep, 2022 | Go github.com/pandatix/go-cvss |
Harbor fails to validate the user permissions when viewing Webhook policies BIT-harbor-2022-31666, CVE-2022-31666, GHSA-8hwq-5f22-jfr3, GHSA-jf8p-3vjh-pq94 | High | 0.5% | 16 Sep, 2022 | Go github.com/goharbor/harbor |
Harbor fails to validate the user permissions when updating tag retention policies BIT-harbor-2022-31670, CVE-2022-31670, GHSA-3637-v6vq-xqqw | High | 0.5% | 16 Sep, 2022 | Go github.com/goharbor/harbor |
Helm Controller denial of service BIT-flux-2022-36049, BIT-helm-2022-36049, CVE-2022-36049, GHSA-p2g7-xwvr-rrw3 | High | 1.5% | 16 Sep, 2022 | Go github.com/fluxcd/flux2 Go github.com/fluxcd/helm-controller |
Talos worker join token can be used to get elevated access level to the Talos API CVE-2022-36103, GHSA-7hgc-php5-77qq, GO-2022-0995 | High | 0.7% | 16 Sep, 2022 | Go github.com/talos-systems/talos |
Talos vulnerable dependency due to race condition in Linux kernel's IP framework XFRM GHSA-34vw-m4rh-r36p | High | Not scored | 16 Sep, 2022 | Go github.com/talos-systems/talos |
Netmaker vulnerable to Insufficient Granularity of Access Control CVE-2022-36110, GHSA-ggf6-638m-vqmg, GO-2022-0986 | High | 0.9% | 15 Sep, 2022 | Go github.com/gravitl/netmaker |
Dendrite signature checks not applied to some retrieved missing events CVE-2022-39200, GHSA-pfw4-xjgm-267c, GO-2022-0989 | High | 0.4% | 15 Sep, 2022 | Go github.com/matrix-org/dendrite |
Podman's incorrect handling of the supplementary groups may lead to data disclosure, modification CVE-2022-2989, GHSA-4wjj-jwc9-2x96 | High | 0.3% | 14 Sep, 2022 | Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 |
Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification CVE-2022-2990, GHSA-fjm8-m7m6-2fjp, GO-2022-1008 | High | 0.3% | 14 Sep, 2022 | Go github.com/containers/buildah |
OPA Compiler: Bypass of WithUnsafeBuiltins using "with" keyword to mock functions CVE-2022-36085, GHSA-f524-rf33-2jjr, GO-2022-0978 | High | 1.6% | 13 Sep, 2022 | Go github.com/open-policy-agent/opa |
x/crypto/ssh vulnerable to panic via malformed packets CVE-2021-43565, GHSA-gwc9-m7rh-j2ww, GO-2022-0968 | High | 1.2% | 07 Sep, 2022 | Go golang.org/x/crypto |
golang.org/x/net/http2 Denial of Service vulnerability BIT-golang-2022-27664, CVE-2022-27664, GHSA-69cg-p879-7622, GO-2022-0969 | High | 3.5% | 07 Sep, 2022 | Go golang.org/x/net Go golang.org/x/net/http2 Go stdlib |
Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing GHSA-74fp-r6jw-h4mp, GO-2022-0965 | High | Not scored | 02 Sep, 2022 | Go k8s.io/apimachinery |
Binary vulnerable to Slice Memory Allocation with Excessive Size Value CVE-2022-36078, GHSA-4p6f-m4f9-ch88, GO-2022-0963 | High | 1.2% | 02 Sep, 2022 | Go github.com/gagliardetto/binary |
elrond-go MultiESDTNFTTransfer call on a SC address with missing function name CVE-2022-36058, GHSA-qf7j-25g9-r63f, GO-2022-0970 | High | 1.3% | 01 Sep, 2022 | Go github.com/ElrondNetwork/elrond-go |
Flux CLI Workload Injection BIT-flux-2022-36035, CVE-2022-36035, GHSA-xwf3-6rgv-939r, GO-2022-0960 | High | 0.3% | 01 Sep, 2022 | Go github.com/fluxcd/flux2 |
Broken Authorization in ZITADEL Actions CVE-2022-36051, GHSA-c8fj-4pm8-mp2c | High | 1.0% | 30 Aug, 2022 | Go github.com/zitadel/zitadel |
yaml package for Go can consume excessive amounts of CPU or memory CVE-2022-3064, GHSA-6q6q-88xp-6f2r, GO-2022-0956 | High | 1.9% | 29 Aug, 2022 | Go gopkg.in/yaml.v2 |
Improper token validation leading to code execution in Teleport CVE-2022-36633, GHSA-6xf3-5hp7-xqqg | High | 50.3% | 25 Aug, 2022 | Go github.com/gravitational/teleport |
Ethermint vulnerable to DoS through unintended Contract Selfdestruct CVE-2022-35936, GHSA-f92v-grc2-w2fg, GO-2022-0760 | High | 1.5% | 18 Aug, 2022 | Go github.com/Kava-Labs/kava Go github.com/crypto-org-chain/cronos Go github.com/evmos/ethermint Go github.com/evmos/evmos +7 more |
Duplicate Advisory: KubeVirt arbitrary host file read from the VM CVE-2022-1798, GHSA-cvx8-ppmc-78hm, GHSA-qv98-3369-g364, GO-2022-1000 | High | 0.4% | 18 Aug, 2022 | Go kubevirt.io/kubevirt |
HashiCorp Consul Template could reveal Vault secret contents in error messages CVE-2022-38149, GHSA-8449-7gc2-pwrp, GO-2022-0980 | High | 0.9% | 18 Aug, 2022 | Go github.com/hashicorp/consul-template |
Cronos vulnerable to DoS through unintended Contract Selfdestruct GHSA-gwj5-wp6r-5q9f, GO-2022-0829 | High | Not scored | 11 Aug, 2022 | Go github.com/crypto-org-chain/cronos |
cosign's `cosign verify-attestaton --type` can report a false positive if any attestation exists BIT-cosign-2022-35929, CVE-2022-35929, GHSA-vjxv-45g9-9296, GO-2022-0758 | High | 0.7% | 10 Aug, 2022 | Go github.com/sigstore/cosign |
PolicyController before 0.2.1 may bypass attestation verification CVE-2022-35930, GHSA-739f-hw6h-7wq8, GO-2022-0759 | High | 0.7% | 10 Aug, 2022 | Go github.com/sigstore/policy-controller |
graphql-go has infinite recursion in the type definition parser CVE-2022-37315, GHSA-h3qm-jrrf-cgj3, GO-2022-0942 | High | 1.2% | 02 Aug, 2022 | Go github.com/graphql-go/graphql |
Atlantis Events vulnerable to Timing Attack CVE-2022-24912, GHSA-jxqv-jcvh-7gr4, GO-2022-0534 | High | 1.2% | 30 Jul, 2022 | Go github.com/runatlantis/atlantis |
Shoutrrr util package DoS via sending 2000, 4000, or 6000 character messages CVE-2022-25891, GHSA-477v-w82m-634j, GO-2022-0528, SNYK-GOLANG-GITHUBCOMCONTAINRRRSHOUTRRRPKGUTIL-2849059 | High | 1.6% | 16 Jul, 2022 | Go github.com/containrrr/shoutrrr |
aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9 CVE-2022-2385, GHSA-pp3f-98qg-5g75, GO-2022-0547 | High | 1.1% | 13 Jul, 2022 | Go sigs.k8s.io/aws-iam-authenticator |
Argo CD certificate verification is skipped for connections to OIDC providers CVE-2022-31105, GHSA-7943-82jg-wmw5, GO-2022-0518 | High | 0.8% | 12 Jul, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Hyperledger Fabric vulnerable to Improper Input Validation in orderer/common/cluster consensus request BIT-hyperledger-fabric-orderer-2022-31121, BIT-hyperledger-fabric-peer-2022-31121, BIT-hyperledger-fabric-tools-2022-31121, CVE-2022-31121, GHSA-72x4-cq6r-jp4p | High | 2.1% | 08 Jul, 2022 | Go github.com/hyperledger/fabric |
Insufficient Session Expiration in Nakama CVE-2022-2306, GHSA-xv59-gc3r-rf92 | High | 0.9% | 06 Jul, 2022 | Go github.com/heroiclabs/nakama |
Denial of service in Open Policy Agent CVE-2022-33082, GHSA-2m4x-4q9j-w97g, GO-2022-0574 | High | 1.7% | 01 Jul, 2022 | Go github.com/open-policy-agent/opa |
Path traversal mitigation bypass in OctoRPKI GHSA-3jhm-87m6-x959, GO-2022-0496 | High | Not scored | 25 Jun, 2022 | Go github.com/cloudflare/cfrpki |
Query predicate bypass in Zalando Skipper CVE-2022-34296, GHSA-qx2j-85q5-ffp8, GO-2022-0494 | High | 1.1% | 24 Jun, 2022 | Go github.com/zalando/skipper |
Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params CVE-2022-31034, GHSA-2m7h-86qq-fp4v, GO-2022-0497 | High | 1.0% | 21 Jun, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Insecure path traversal in Git Trigger Source can lead to arbitrary file read CVE-2022-25856, GHSA-qpgx-64h2-gc3c, GO-2022-0492, SNYK-GOLANG-GITHUBCOMARGOPROJARGOEVENTSSENSORSARTIFACTS-2864522 | High | 1.9% | 17 Jun, 2022 | Go github.com/argoproj/argo-events |
Uses of deprecated API can be used to cause DoS in user-facing endpoints CVE-2022-31054, GHSA-5q86-62xr-3r57, GO-2022-0490 | High | 1.6% | 17 Jun, 2022 | Go github.com/argoproj/argo-events |
Path Traversal in Git HTTP endpoints in Gogs CVE-2022-1993, GHSA-6vcc-v9vw-g2x5, GO-2022-0562 | High | 36.7% | 08 Jun, 2022 | Go gogs.io/gogs |
Node DOS by way of memory exhaustion through ExecSync request in CRI-O CVE-2022-1708, GHSA-fcm2-6c3h-pg6j, GO-2022-0480 | High | 3.2% | 06 Jun, 2022 | Go github.com/cri-o/cri-o |
TiDB authentication bypass vulnerability CVE-2022-31011, GHSA-4whx-7p29-mq22 | High | 0.3% | 06 Jun, 2022 | Go github.com/pingcap/tidb |
Server-Side Request Forgery in gogs webhook CVE-2022-1285, GHSA-w689-557m-2cvq, GO-2022-0583 | High | 1.1% | 03 Jun, 2022 | Go gogs.io/gogs |
Arbitrary command execution in Minidoc CVE-2022-29637, GHSA-f7ff-xf87-f22q | High | 0.9% | 27 May, 2022 | Go github.com/mindoc-org/mindoc |
Path traversal in ginadmin CVE-2022-30427, GHSA-9pg5-3pjc-f8wm | High | 1.5% | 26 May, 2022 | Go github.com/gphper/ginadmin |