Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mattermost Incorrect Authorization vulnerability CVE-2023-5195, GHSA-9hwp-cj7m-wjw4 | Medium | 0.5% | 29 Sep, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Uncontrolled Resource Consumption vulnerability CVE-2023-5196, GHSA-33r7-wjfc-7w98 | Medium | 0.7% | 29 Sep, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
OpenFGA Vulnerable to DoS from circular relationship definitions CVE-2023-43645, GHSA-2hm9-h873-pgqh, GO-2023-2084 | Medium | 0.9% | 28 Sep, 2023 | Go github.com/openfga/openfga |
Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server CVE-2023-40026, GHSA-6jqw-jwf5-rp8h, GO-2023-2085 | Medium | 0.6% | 27 Sep, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy BIT-cilium-2023-41333, BIT-cilium-operator-2023-41333, BIT-cilium-proxy-2023-41333, BIT-hubble-2023-41333, BIT-hubble-relay-2023-41333, BIT-hubble-ui-2023-41333, BIT-hubble-ui-backend-2023-41333, CVE-2023-41333, GHSA-4xp2-w642-7mcx, GO-2023-2080 | Medium | 0.5% | 27 Sep, 2023 | Go github.com/cilium/cilium |
Kubernetes users may update Pod labels to bypass network policy BIT-cilium-2023-39347, BIT-cilium-operator-2023-39347, BIT-cilium-proxy-2023-39347, BIT-hubble-2023-39347, BIT-hubble-relay-2023-39347, BIT-hubble-ui-2023-39347, BIT-hubble-ui-backend-2023-39347, CVE-2023-39347, GHSA-gj2r-phwg-6rww, GO-2023-2078 | Medium | 0.6% | 26 Sep, 2023 | Go github.com/cilium/cilium |
Kiali content spoofing vulnerability CVE-2022-3962, GHSA-6f4m-j56w-55c3, GO-2023-2075 | Medium | 0.7% | 23 Sep, 2023 | Go github.com/kiali/kiali |
Sender can cause a receiver to overwrite files during ZIP extraction in Croc CVE-2023-43616, GHSA-8c8w-f7wp-2jr2, GO-2023-2071 | Medium | 0.4% | 20 Sep, 2023 | Go github.com/schollz/croc Go github.com/schollz/croc/v6 Go github.com/schollz/croc/v8 Go github.com/schollz/croc/v9 |
Cros secrets may be disclosed to untrusted relay CVE-2023-43617, GHSA-hp56-xvf4-g6wr, GO-2023-2072 | Medium | 0.8% | 20 Sep, 2023 | Go github.com/schollz/croc Go github.com/schollz/croc/v6 Go github.com/schollz/croc/v8 Go github.com/schollz/croc/v9 |
Croc requires senders to provide local IP addresses in cleartext CVE-2023-43618, GHSA-7mp6-929p-pqhj, GO-2023-2070 | Medium | 0.5% | 20 Sep, 2023 | Go github.com/schollz/croc Go github.com/schollz/croc/v6 Go github.com/schollz/croc/v8 Go github.com/schollz/croc/v9 |
Croc may expose secret to local users CVE-2023-43621, GHSA-7g3v-4ggr-xvjf, GO-2023-2069 | Medium | 0.3% | 20 Sep, 2023 | Go github.com/schollz/croc Go github.com/schollz/croc/v6 Go github.com/schollz/croc/v8 Go github.com/schollz/croc/v9 |
HashiCorp Vault Improper Input Validation vulnerability BIT-vault-2023-4680, CVE-2023-4680, GHSA-v84f-6r39-cpfc, GO-2023-2063 | Medium | 0.4% | 15 Sep, 2023 | Go github.com/hashicorp/vault |
Argo CD repo-server Denial of Service vulnerability BIT-argo-cd-2023-40584, CVE-2023-40584, GHSA-g687-f2gx-6wm8, GO-2023-2050 | Medium | 1.4% | 11 Sep, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Terraform allows arbitrary file write during the `init` operation CVE-2023-4782, GHSA-h626-pv66-hhm7, GO-2023-2055 | Medium | 0.3% | 08 Sep, 2023 | Go github.com/hashicorp/terraform |
Fiber unauthorized access vulnerability in `ctx.IsFromLocal()` CVE-2023-41338, GHSA-3q5p-3558-364f, GO-2023-2052 | Medium | 0.7% | 08 Sep, 2023 | Go github.com/gofiber/fiber Go github.com/gofiber/fiber/v2 |
matrix-media-repo: Unsafe media served inline on download endpoints CVE-2023-41318, GHSA-5crw-6j7v-xc72, GO-2023-2053 | Medium | 0.5% | 08 Sep, 2023 | Go github.com/turt2live/matrix-media-repo |
SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced GHSA-6xv5-86q9-7xr8, GO-2023-2048 | Medium | Not scored | 07 Sep, 2023 | Go github.com/cyphar/filepath-securejoin |
Cosmos-SDK Cosmovisor component may be vulnerable to denial of service GHSA-23px-mw2p-46qm | Medium | Not scored | 06 Sep, 2023 | Go github.com/cosmos/cosmos-sdk |
Index out of bounds leading to crash CVE-2023-36307, GHSA-xgmm-3vvr-6c8j | Medium | 0.3% | 05 Sep, 2023 | Go simonwaldherr.de/go/zplgfa |
Improper log output when using GitHub Status Notifications in spinnaker CVE-2023-39348, GHSA-rq5c-hvw6-8pr7 | Medium | 0.4% | 29 Aug, 2023 | Go github.com/spinnaker/spinnaker |
OpenFGA Authorization Bypass CVE-2023-40579, GHSA-jcf2-mxr2-gmqp, GO-2023-2028 | Medium | 0.5% | 25 Aug, 2023 | Go github.com/openfga/openfga |
Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint BIT-alertmanager-2023-40577, CVE-2023-40577, GHSA-v86x-5fm3-5p7j, GO-2023-2020 | Medium | 0.6% | 23 Aug, 2023 | Go github.com/prometheus/alertmanager |
lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files GHSA-9phh-r37v-34wh, GO-2023-2012 | Medium | Not scored | 14 Aug, 2023 | Go github.com/treeverse/lakefs |
Mattermost fails to check if user is a guest before performing actions on public playbooks CVE-2023-4106, GHSA-p267-jjfq-pphf | Medium | 0.4% | 11 Aug, 2023 | Go github.com/mattermost/mattermost-server/v6 |
Mattermost does not validate requesting user permissions before updating admin details CVE-2023-4107, GHSA-6xjj-v76v-fwpj | Medium | 0.5% | 11 Aug, 2023 | Go github.com/mattermost/mattermost-server/v6 |
Mattermost fails to sanitize post metadata CVE-2023-4108, GHSA-9rww-66w7-7vjx | Medium | 0.6% | 11 Aug, 2023 | Go github.com/mattermost/mattermost-server/v6 |
1Panel Arbitrary File Download vulnerability CVE-2023-39965, GHSA-85cf-gj29-f555, GO-2023-2005 | Medium | 0.4% | 10 Aug, 2023 | Go github.com/1Panel-dev/1Panel |
Blst has logical error in SigValidate in Go bindings GHSA-8c37-7qx3-4c4p, GO-2023-2003 | Medium | Not scored | 09 Aug, 2023 | Go github.com/supranational/blst |
Gitea erroneous repo clones BIT-gitea-2022-38795, CVE-2022-38795, GHSA-8j3v-68w3-3848, GO-2023-1999 | Medium | 0.6% | 07 Aug, 2023 | Go code.gitea.io/gitea |
Answer has Race Condition within a Thread CVE-2023-4127, GHSA-52h8-c876-989c, GO-2023-1995 | Medium | 0.5% | 03 Aug, 2023 | Go github.com/answerdev/answer |
Answer Insufficient Session Expiration vulnerability CVE-2023-4126, GHSA-ggcf-hwxp-rc77, GO-2023-1996 | Medium | 0.6% | 03 Aug, 2023 | Go github.com/answerdev/answer |
Improper rendering of text nodes in golang.org/x/net/html CVE-2023-3978, GHSA-2wrh-6pvc-2jm9, GO-2023-1988 | Medium | 0.9% | 02 Aug, 2023 | Go golang.org/x/net |
Golang TIFF decoder vulnerable to excessive CPU consumption CVE-2023-29407, GHSA-j3p8-6mrq-6g7h, GO-2023-1990 | Medium | 0.9% | 02 Aug, 2023 | Go golang.org/x/image |
Golang TIFF decoder does not place a limit on the size of compressed tile data CVE-2023-29408, GHSA-x92r-3vfx-4cv3, GO-2023-1989 | Medium | 0.9% | 02 Aug, 2023 | Go golang.org/x/image |
HashiCorp Vault and Vault Enterprise vulnerable to user enumeration BIT-vault-2023-3462, CVE-2023-3462, GHSA-9v3w-w2jh-4hff, GO-2023-1986 | Medium | 0.6% | 01 Aug, 2023 | Go github.com/hashicorp/vault |
Ineffective privileges drop when requesting container network CVE-2023-38496, GHSA-mmx5-32m4-wxvx, GO-2023-1965 | Medium | 0.3% | 25 Jul, 2023 | Go github.com/apptainer/apptainer |
KubePi may leak password hash of any user CVE-2023-37916, GHSA-87f6-8gr7-pc6h, GO-2023-1957 | Medium | 0.8% | 21 Jul, 2023 | Go github.com/KubeOperator/kubepi |
Dapr API token authentication bypass in HTTP endpoints CVE-2023-37918, GHSA-59m6-82qm-vqgj, GO-2023-1955 | Medium | 1.4% | 21 Jul, 2023 | Go github.com/dapr/dapr |
Nomad Search API Leaks Information About CSI Plugins CVE-2023-3300, GHSA-v5fm-hr72-27hx, GO-2024-2671 | Medium | 0.6% | 20 Jul, 2023 | Go github.com/hashicorp/nomad |
Nomad ACL Policies without Label are Applied to Unexpected Resources CVE-2023-3072, GHSA-rpvr-38xv-xvxq, GO-2024-2670 | Medium | 0.4% | 20 Jul, 2023 | Go github.com/hashicorp/nomad |
Tokenizer vulnerable to client brute-force of token secrets GHSA-f28g-86hc-823q, GO-2023-1914 | Medium | Not scored | 13 Jul, 2023 | Go github.com/superfly/tokenizer |
A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries GHSA-2w8w-qhg4-f78j | Medium | Not scored | 11 Jul, 2023 | Go github.com/jaegertracing/jaeger |
iprange may panic when parsing ranges with invalid masks GHSA-f99h-w337-mv56, GO-2023-1857 | Medium | Not scored | 11 Jul, 2023 | Go github.com/malfunkt/iprange |
Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables CVE-2023-1296, GHSA-hhvx-8755-4cvw, GO-2023-1899 | Medium | 0.5% | 06 Jul, 2023 | Go github.com/hashicorp/nomad |
HashiCorp Vault's revocation list not respected BIT-vault-2022-41316, CVE-2022-41316, GHSA-9mh8-9j64-443f, GO-2023-1897 | Medium | 0.5% | 06 Jul, 2023 | Go github.com/hashicorp/vault |
Zinc Cross-site Scripting vulnerability CVE-2022-32171, GHSA-4fgv-8448-gf82, GO-2023-1895 | Medium | 0.7% | 06 Jul, 2023 | Go github.com/zinclabs/zinc Go github.com/zincsearch/zincsearch |
Zinc Cross-site Scripting vulnerability CVE-2022-32172, GHSA-7j6x-42mm-p7jm, GO-2023-1896 | Medium | 0.7% | 06 Jul, 2023 | Go github.com/zinclabs/zinc Go github.com/zincsearch/zincsearch |
1Panel vulnerable to command injection when entering the container terminal CVE-2023-36458, GHSA-7x2c-fgx6-xf9h, GO-2023-1888 | Medium | 2.3% | 05 Jul, 2023 | Go github.com/1Panel-dev/1Panel |
1Panel vulnerable to command injection when adding container repositories CVE-2023-36457, GHSA-q2mx-gpjf-3h8x, GO-2023-1887 | Medium | 2.3% | 05 Jul, 2023 | Go github.com/1Panel-dev/1Panel |
CometBFT PeerState JSON serialization deadlock CVE-2023-34450, GHSA-mvj3-qrqh-cjvr, GO-2023-1882 | Medium | 0.9% | 05 Jul, 2023 | Go github.com/cometbft/cometbft |