Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
CubeFS leaks users key in logs CVE-2023-46742, GHSA-vwch-g97w-hfg2, GO-2024-2434 | Medium | 0.3% | 03 Jan, 2024 | Go github.com/cubefs/cubefs |
CubeFS leaks magic secret key when starting Blobstore access service CVE-2023-46741, GHSA-8h2x-gr2c-c275, GO-2024-2433 | Medium | 0.3% | 03 Jan, 2024 | Go github.com/cubefs/cubefs |
Mattermost viewing archived public channels permissions vulnerability BIT-mattermost-2023-47858, CVE-2023-47858, GHSA-w88v-pjr8-cmv2, GO-2024-2450 | Medium | 0.4% | 02 Jan, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost notified all users in the channel when using WebSockets to respond individually BIT-mattermost-2023-48732, CVE-2023-48732, GHSA-q7rx-w656-fwmv, GO-2024-2448 | Medium | 0.5% | 02 Jan, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
ewen-lbh/ffcss Late-Unicode normalization vulnerability CVE-2023-52081, GHSA-wpmx-564x-h2mh, GO-2023-2426 | Medium | 0.5% | 28 Dec, 2023 | Go github.com/ewen-lbh/ffcss |
Deis Workflow Manager race condition vulnerability CVE-2016-15036, GHSA-jpfp-xq3p-4h3r, GO-2023-2422 | Medium | 0.4% | 23 Dec, 2023 | Go github.com/deis/workflow-manager |
Potential URI resolution path traversal in the AWS SDK for PHP CVE-2023-51651, CVE-2025-69820, GHSA-557v-xcg6-rm5m, GHSA-73jg-4qh6-3f4g, GO-2026-4390 | Medium | 1.0% | 21 Dec, 2023 | Go github.com/beam-cloud/beta9 Packagist aws/aws-sdk-php |
jose2go vulnerable to denial of service via large p2c value CVE-2023-50658, GHSA-6294-6rgp-fr7r, GHSA-mhpq-9638-x6pw, GO-2023-2409 | Medium | 0.8% | 20 Dec, 2023 | Go github.com/dvsekhvalnov/jose2go |
containerd allows RAPL to be accessible to a container GHSA-7ww5-4wqc-m92c, GO-2023-2412 | Medium | Not scored | 19 Dec, 2023 | Go github.com/containerd/containerd |
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin CVE-2023-48795, GHSA-45x7-px36-x8w8, GO-2023-2402, PYSEC-2026-1758 | Medium | 93.5% | 18 Dec, 2023 | Go golang.org/x/crypto PyPI paramiko crates.io russh |
Elastic Beats inserts sensitive information into log file CVE-2023-49922, GHSA-hj4r-2c9c-29h3, GO-2023-2413 | Medium | 0.7% | 12 Dec, 2023 | Go github.com/elastic/beats Go github.com/elastic/beats/v7 |
User with permission to write actions can impersonate another user when auth token is configured in environment variable GHSA-26hr-q2wp-rvc5, GO-2023-2397 | Medium | Not scored | 12 Dec, 2023 | Go github.com/treeverse/lakefs |
Header spoofing in caddy-geo-ip CVE-2023-50463, GHSA-rxg9-hgq7-8pwx, GO-2023-2394 | Medium | 0.7% | 11 Dec, 2023 | Go github.com/shift72/caddy-geo-ip |
Always incorrect control flow in github.com/mojocn/base64Captcha CVE-2023-45292, GHSA-5mmw-p5qv-w3x5, GO-2023-2386 | Medium | 0.3% | 08 Dec, 2023 | Go github.com/mojocn/base64Captcha |
Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability BIT-mattermost-2023-6459, CVE-2023-6459, GHSA-63cv-4pc2-4fcf | Medium | 0.5% | 06 Dec, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
pubnub Insufficient Entropy vulnerability CVE-2023-26154, GHSA-5844-q3fc-56rh, GO-2023-2385, PYSEC-2026-1807 | Medium | 1.0% | 06 Dec, 2023 | Go github.com/pubnub/go Go github.com/pubnub/go/v5 Go github.com/pubnub/go/v6 Go github.com/pubnub/go/v7 +10 more |
lestrrat-go/jwx's malicious parameters in JWE can cause a DOS CVE-2023-49290, GHSA-7f9x-gw85-8grf, GO-2023-2379 | Medium | 0.7% | 05 Dec, 2023 | Go github.com/lestrrat-go/jwx Go github.com/lestrrat-go/jwx/v2 |
Traefik vulnerable to potential DDoS via ACME HTTPChallenge CVE-2023-47124, GHSA-8g85-whqh-cr2f, GO-2023-2381 | Medium | 0.8% | 05 Dec, 2023 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass CVE-2023-47106, GHSA-fvhj-4qfh-q2hm, GO-2023-2376 | Medium | 0.6% | 05 Dec, 2023 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
OwnCast remote code execution vulnerability CVE-2023-46480, GHSA-392h-r46j-q24p | Medium | 1.6% | 28 Nov, 2023 | Go github.com/owncast/owncast |
Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler CVE-2023-48713, GHSA-qmvj-4qr9-v547, GO-2023-2355 | Medium | 0.9% | 27 Nov, 2023 | Go knative.dev/serving |
github.com/go-resty/resty/v2 HTTP request body disclosure CVE-2023-45286, GHSA-xwh9-gc39-5298, GO-2023-2328 | Medium | 0.7% | 27 Nov, 2023 | Go github.com/go-resty/resty/v2 |
Mattermost Uncontrolled Resource Consumption vulnerability CVE-2023-48369, GHSA-3487-3j7c-7gwj | Medium | 0.6% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Improper Access Control vulnerability CVE-2023-6202, GHSA-85jj-c9jr-9jhx | Medium | 0.4% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Uncontrolled Resource Consumption vulnerability CVE-2023-40703, GHSA-c37r-v8jx-7cv2 | Medium | 0.7% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability CVE-2023-43754, GHSA-jjr7-372r-cx7x | Medium | 0.5% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability CVE-2023-45223, GHSA-p5pr-vm3j-jxxf | Medium | 0.5% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Open Redirect vulnerability CVE-2023-47168, GHSA-4ghx-8jw8-p76q | Medium | 0.4% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Improper Access Control vulnerability CVE-2023-47865, GHSA-jj46-9cgh-qmfx | Medium | 0.4% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Uncontrolled Resource Consumption vulnerability CVE-2023-48268, GHSA-j4c3-3h73-74m9 | Medium | 0.7% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Decryption of malicious PBES2 JWE objects can consume unbounded system resources GHSA-2c7c-3mj9-8fqh, GO-2023-2334 | Medium | Not scored | 21 Nov, 2023 | Go github.com/go-jose/go-jose/v3 Go github.com/square/go-jose |
Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. CVE-2023-47122, GHSA-xvrc-2wvh-49vc, GO-2023-2332 | Medium | 0.4% | 14 Nov, 2023 | Go github.com/sigstore/gitsign |
capsule-proxy service discloses Namespaces of colliding tenants to owners of different tenants with the same ServiceAccount name CVE-2023-46254, GHSA-6758-979h-249x | Medium | 0.4% | 07 Nov, 2023 | Go github.com/projectcapsule/capsule Go github.com/projectcapsule/capsule-proxy |
Mattermost denial of service vulnerability CVE-2023-5967, GHSA-xvq6-h898-wcj8 | Medium | 0.5% | 06 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost password hash disclosure vulnerability CVE-2023-5968, GHSA-r67m-mf7v-qp7j | Medium | 0.5% | 06 Nov, 2023 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost vulnerable to excessive memory consumption CVE-2023-5969, GHSA-w496-f5qq-m58j | Medium | 0.5% | 06 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
SpiceDB leaks information in log files when URI cannot be parsed CVE-2023-46255, GHSA-jg7w-cxjv-98c2, GO-2023-2166 | Medium | 0.4% | 31 Oct, 2023 | Go github.com/authzed/spicedb |
/sys/devices/virtual/powercap accessible by default to containers GHSA-jq35-85cj-fj4p | Medium | Not scored | 30 Oct, 2023 | Go github.com/docker/docker |
Kube-proxy may unintentionally forward traffic CVE-2021-25736, GHSA-35c7-w35f-xwgh, GO-2023-2159 | Medium | 0.9% | 30 Oct, 2023 | Go k8s.io/kubernetes |
Jumpserver Koko vulnerable to remote code execution on the host system via MongoDB shell CVE-2023-43651, GHSA-4r5x-x283-wm96 | Medium | 2.1% | 24 Oct, 2023 | Go github.com/jumpserver/koko |
ydb-go-sdk token in custom credentials object can leak through logs CVE-2023-45825, GHSA-q24m-6h38-5xj8, GO-2023-2137 | Medium | 0.2% | 19 Oct, 2023 | Go github.com/ydb-platform/ydb-go-sdk/v3 |
Artifact Hub has Incorrect Docker Hub registry check CVE-2023-45821, GHSA-g6pq-x539-7w4j, GO-2023-2135 | Medium | 0.2% | 19 Oct, 2023 | Go github.com/artifacthub/hub |
Arduino Create Agent path traversal - arbitrary file deletion vulnerability CVE-2023-43803, GHSA-m5jc-r4gf-c6p8 | Medium | 0.3% | 18 Oct, 2023 | Go github.com/arduino/arduino-create-agent |
Arduino Create Agent path traversal - arbitrary file deletion vulnerability CVE-2023-43801, GHSA-mjq6-pv9c-qppq | Medium | 0.3% | 18 Oct, 2023 | Go github.com/arduino/arduino-create-agent |
Google Sheets data source plugin for Grafana information disclosure vulnerability CVE-2023-4457, GHSA-37x5-qpm8-53rq, GO-2023-2158 | Medium | 0.5% | 16 Oct, 2023 | Go github.com/grafana/google-sheets-datasource |
Grafana privilege escalation vulnerability BIT-grafana-2023-4822, CVE-2023-4822, GHSA-fw9c-75hh-89p6 | Medium | 1.3% | 16 Oct, 2023 | Go github.com/grafana/grafana |
ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting CVE-2023-44399, GHSA-v683-rcxx-vpff | Medium | 0.7% | 10 Oct, 2023 | Go github.com/zitadel/zitadel |
Harbor timing attack risk BIT-harbor-2023-20902, CVE-2023-20902, GHSA-mq6f-5xh5-hgcf, GO-2023-2109 | Medium | 0.5% | 10 Oct, 2023 | Go github.com/goharbor/harbor |
gnark unsoundness in variable comparison / non-unique binary decomposition CVE-2023-44378, GHSA-498w-5j49-vqjg, GO-2023-2098 | Medium | 0.2% | 04 Oct, 2023 | Go github.com/consensys/gnark |
Mattermost Incorrect Authorization vulnerability CVE-2023-5194, GHSA-h69v-mvh9-hfrq | Medium | 0.4% | 29 Sep, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |