Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Arbitrary file read in ginadmin CVE-2022-30428, GHSA-5824-6jfv-xr3r | High | 1.1% | 26 May, 2022 | Go github.com/gphper/ginadmin |
NULL Pointer Dereference in HyperLedger Fabric CVE-2021-43667, GHSA-vjj6-5m9f-wqjw | High | 1.3% | 25 May, 2022 | Go github.com/hyperledger/fabric |
Pion DTLS Header reconstruction method can be thrown into an infinite loop CVE-2022-29190, GHSA-cm8f-h6j3-p25c, GO-2022-0460 | High | 1.7% | 24 May, 2022 | Go github.com/pion/dtls Go github.com/pion/dtls/v2 |
Istio vulnerable to denial of service CVE-2019-18817, GHSA-vc7h-cmp3-4hw5 | High | 1.2% | 24 May, 2022 | Go istio.io/istio |
Improper Privilege Management in Cilium BIT-cilium-2022-29179, BIT-cilium-operator-2022-29179, BIT-cilium-proxy-2022-29179, BIT-hubble-2022-29179, BIT-hubble-relay-2022-29179, BIT-hubble-ui-2022-29179, BIT-hubble-ui-backend-2022-29179, CVE-2022-29179, GHSA-fmrf-gvjp-5j5g, GO-2022-0458 | High | 0.4% | 24 May, 2022 | Go github.com/cilium/cilium |
Access to Unix domain socket can lead to privileges escalation in Cilium BIT-cilium-2022-29178, BIT-cilium-operator-2022-29178, BIT-cilium-proxy-2022-29178, BIT-hubble-2022-29178, BIT-hubble-relay-2022-29178, BIT-hubble-ui-2022-29178, BIT-hubble-ui-backend-2022-29178, CVE-2022-29178, GHSA-6p8v-8cq8-v2r3, GO-2022-0457 | High | 0.3% | 24 May, 2022 | Go github.com/cilium/cilium |
Improper Validation of Integrity Check Value in go-tuf CVE-2022-29173, GHSA-66x3-6cw3-v5gj, GO-2022-0444 | High | 0.6% | 24 May, 2022 | Go github.com/theupdateframework/go-tuf |
Mattermost Server is vulnerable to a Denial of Service attack through `invite_people` command CVE-2018-21258, GHSA-5mh6-p63g-3mv5, GO-2025-4146 | High | 1.2% | 24 May, 2022 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 |
Mattermost Server allows an attacker to specify a full pathname of a log file CVE-2017-18912, GHSA-m2ch-x2q7-2284, GO-2026-4487 | High | 1.4% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations CVE-2017-18917, GHSA-jxc4-w54c-qv5r, GO-2026-4463 | High | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server vulnerable to CSRF if CORS is enabled CVE-2017-18903, GHSA-fcwg-45jh-5qhf, GO-2026-4305 | High | 0.4% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is used CVE-2017-18906, GHSA-fpcr-4rr5-hpcp, GO-2026-4477 | High | 0.8% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server SAML implementation does not require encryption or signature verification as default CVE-2017-18909, GHSA-r6j5-fqx9-7qv9, GO-2026-4478 | High | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server has intermittent Authorization bypass for resource-owners CVE-2017-18894, GHSA-gg42-mwr6-p82c, GO-2026-4297 | High | 0.8% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not properly restrict use of slash commands CVE-2017-18886, GHSA-wvjg-33p9-938h, GO-2025-4204 | High | 1.0% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names CVE-2017-18871, GHSA-jc6w-8r7f-vmp5, GO-2025-4184 | High | 1.1% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server: initial_load API exposes unnecessary information CVE-2016-11066, GHSA-r93j-3mmp-px57, GO-2025-4047 | High | 1.2% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not enforce rate limits on password change attempts CVE-2016-11069, GHSA-qrf6-h5fc-7m96, GO-2025-4051 | High | 0.9% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server: Insufficient Password-Reset Link Invalidation CVE-2016-11074, GHSA-j26g-95ph-2mwv, GO-2025-4059 | High | 1.2% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not check if cookies are used over SSL CVE-2016-11076, GHSA-379p-37xc-q963, GO-2025-4054 | High | 0.9% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Grafana information disclosure BIT-grafana-2020-12458, CVE-2020-12458, GHSA-3jq7-8ph8-63xm, GO-2024-2513 | High | 0.5% | 24 May, 2022 | Go github.com/grafana/grafana |
Grafana world readable configuration files BIT-grafana-2020-12459, CVE-2020-12459, GHSA-m25m-5778-fm22, GO-2024-2519 | High | 0.3% | 24 May, 2022 | Go github.com/grafana/grafana |
Singularity insecure permissions CVE-2019-19724, GHSA-mj73-5x75-9phh | High | 1.2% | 24 May, 2022 | Go github.com/sylabs/singularity |
Kubernetes kube-apiserver unauthorized access CVE-2019-11247, GHSA-fp37-c92q-4pwq | High | 2.1% | 24 May, 2022 | Go k8s.io/apiextensions-apiserver |
golang.org/x/net/http vulnerable to a reset flood CVE-2019-9512, CVE-2019-9514, GHSA-39qc-96h7-956f, GHSA-hgr8-6h9x-f7q9, GO-2022-0536 | High | 83.4% | 24 May, 2022 | Go golang.org/x/net Go stdlib |
Istio ReDoS Vulnerability CVE-2019-14993, GHSA-qcvw-82hh-gq38 | High | 2.3% | 24 May, 2022 | Go istio.io/istio |
Podman Path Traversal Vulnerability leads to arbitrary file read/write CVE-2019-10152, GHSA-rh5f-2w6r-q7vj, GO-2023-1927 | High | 0.5% | 24 May, 2022 | Go github.com/containers/podman |
mastercactapus proxyprotocol vulnerable to denial of service CVE-2019-14243, GHSA-85c5-ccm8-vr96, GO-2023-1923 | High | 4.3% | 24 May, 2022 | Go github.com/mastercactapus/proxyprotocol |
Secret insertion into debug log in Docker CVE-2019-13509, GHSA-j249-ghv5-7mxv | High | 3.7% | 24 May, 2022 | Go github.com/docker/docker |
b3log Wide unauthenticated file access CVE-2019-13915, GHSA-6452-jr93-r5qm, GO-2023-1924 | High | 2.6% | 24 May, 2022 | Go github.com/b3log/wide |
Rancher Privilege Escalation Vulnerability CVE-2019-12274, GHSA-gc62-j469-9gjm, GO-2023-1991 | High | 1.1% | 24 May, 2022 | Go github.com/rancher/rancher |
Rancher code injection via fluentd config commands CVE-2019-12303, GHSA-53pj-67m4-9w98, GO-2024-2762 | High | 2.0% | 24 May, 2022 | Go github.com/rancher/rancher |
Containous Traefik Exposes Password Hashes CVE-2019-12452, GHSA-r3fq-cmmw-cpmm, GO-2023-1919 | High | 2.5% | 24 May, 2022 | Go github.com/traefik/traefik |
Kubernetes did not effectively clear service account credentials CVE-2019-11243, GHSA-gc2p-g4fg-29vh, GO-2025-3645 | High | 1.5% | 24 May, 2022 | Go k8s.io/kubernetes |
Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows BIT-argo-workflows-2022-29164, CVE-2022-29164, GHSA-cmv8-6362-r5w9 | High | 0.9% | 23 May, 2022 | Go github.com/argoproj/argo-workflows/v3 |
Improper path handling in Kustomization files allows for denial of service BIT-flux-2022-24878, BIT-kustomize-2022-24878, CVE-2022-24878, GHSA-7pwf-jg34-hxwp, GO-2022-0448 | High | 1.0% | 20 May, 2022 | Go github.com/fluxcd/flux2 Go github.com/fluxcd/kustomize-controller |
Out of bounds memory access in github.com/open-policy-agent/opa CVE-2022-28946, GHSA-x7f3-62pm-9p38, GO-2022-0587 | High | 1.0% | 20 May, 2022 | Go github.com/open-policy-agent/opa |
gopkg.in/yaml.v3 Denial of Service CVE-2022-28948, GHSA-hp87-p4gw-j4gq, GO-2022-0603 | High | 4.0% | 20 May, 2022 | Go gopkg.in/yaml.v3 |
Shell command injection in gitea BIT-gitea-2022-30781, CVE-2022-30781, GHSA-p5f9-c9j9-g8qx, GO-2022-0450 | High | 87.9% | 17 May, 2022 | Go code.gitea.io/gitea |
Syncthing vulnerable to symlink traversal and arbitrary file overwrite CVE-2017-1000420, GHSA-28xp-g7f6-7mhf | High | 1.5% | 14 May, 2022 | Go github.com/syncthing/syncthing |
Docker Notary Signature Algorithm Not Matched to Key vulnerability CVE-2015-9258, GHSA-785h-hrf7-gqxc | High | 1.0% | 14 May, 2022 | Go github.com/docker/notary |
Gogs and Gitea SSRF Vulnerability CVE-2018-15192, GHSA-fg3x-rwq9-74cw, GO-2023-1971 | High | 2.1% | 14 May, 2022 | Go code.gitea.io/gitea Go gogs.io/gogs |
Sylabs Singularity Improper Input Validation CVE-2018-19295, GHSA-p83v-8vmr-qfv9 | High | 0.5% | 14 May, 2022 | Go github.com/sylabs/singularity |
Gogs Directory Traversal CVE-2018-20303, GHSA-9hxg-w7qf-hh93 | High | 3.3% | 14 May, 2022 | Go gogs.io/gogs |
Minikube RCE via DNS Rebinding CVE-2018-1002103, GHSA-6pcv-qqx4-mxm3, GO-2023-1961 | High | 0.7% | 13 May, 2022 | Go k8s.io/minikube |
Podman Elevated Container Privileges CVE-2018-10856, GHSA-wp7w-vx86-vj9h, GO-2023-1962 | High | 0.9% | 13 May, 2022 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 |
Apache Thrift Go Library Command Injection CVE-2016-5397, GHSA-r4m4-pmvw-m6j5 | High | 6.9% | 13 May, 2022 | Go github.com/apache/thrift |
HashiCorp Consul vulnerable to Origin Validation Error CVE-2019-9764, GHSA-q7fx-wm2p-qfj8, GO-2023-1853 | High | 0.6% | 13 May, 2022 | Go github.com/hashicorp/consul |
HashiCorp Consul Access Restriction Bypass CVE-2019-8336, GHSA-fhm8-cxcv-pwvc, GO-2023-1945 | High | 1.3% | 13 May, 2022 | Go github.com/hashicorp/consul |
golang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory Buffer CVE-2018-17847, CVE-2018-17848, GHSA-4r78-hx75-jjj2, GHSA-mv93-wvcp-7m7r, GO-2022-0197 | High | 2.4% | 13 May, 2022 | Go golang.org/x/net |