Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
golang.org/x/net/html NULL Pointer Dereference vulnerability CVE-2018-17142, GHSA-2wp2-chmh-r934, GO-2022-0192 | High | 2.4% | 13 May, 2022 | Go golang.org/x/net |
golang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory Buffer CVE-2018-17143, GHSA-fcf9-6fv2-fc5v, GO-2022-0193 | High | 2.8% | 13 May, 2022 | Go golang.org/x/net |
Apache Traffic Control vulnerable to Slowloris-style Denial of Service attack CVE-2017-7670, GHSA-f2wr-c4c4-xjg7 | High | 4.7% | 13 May, 2022 | Go github.com/apache/trafficcontrol |
Traefik Missing Authentication CVE-2018-15598, GHSA-2cjc-rgmp-x649, GO-2023-1950 | High | 2.9% | 13 May, 2022 | Go github.com/traefik/traefik |
Rancher Access Control Vulnerability CVE-2017-7297, GHSA-w3x4-9854-95x8, GO-2023-1973 | High | 1.5% | 13 May, 2022 | Go github.com/rancher/rancher |
Rancher Project Members Have Continued Access to Namespaces After Being Removed From Them CVE-2019-6287, GHSA-6r7x-4q7g-h83j, GO-2024-2764 | High | 1.0% | 13 May, 2022 | Go github.com/rancher/rancher |
Improper Input Validation in k8s.io/ingress-nginx CVE-2021-25745, GHSA-pvmg-xgmx-9mxh | High | 1.2% | 07 May, 2022 | Go k8s.io/ingress-nginx |
Arbitrary file deletion in gitea BIT-gitea-2022-27313, CVE-2022-27313, GHSA-g7p7-x6w7-w6qg, GO-2022-0442 | High | 1.0% | 04 May, 2022 | Go code.gitea.io/gitea |
ProxyScotch is vulnerable to a server-side Request Forgery (SSRF) CVE-2022-25850, GHSA-5hjh-c26m-xw8w, SNYK-GOLANG-GITHUBCOMHOPPSCOTCHPROXYSCOTCH-2435228 | High | 1.4% | 03 May, 2022 | Go github.com/hoppscotch/proxyscotch |
Exposure of repository credentials to external third-party sources in Rancher CVE-2021-36778, GHSA-4fc7-hc63-7fjg | High | 0.8% | 02 May, 2022 | Go github.com/rancher/rancher |
Write access to the catalog for any user when restricted-admin role is enabled in Rancher CVE-2021-4200, GHSA-hx8w-ghh8-r4xf | High | 0.6% | 02 May, 2022 | Go github.com/rancher/rancher |
Podman publishes a malicious image to public registries CVE-2022-1227, GHSA-66vw-v2x9-hw75, GO-2022-0558 | High | 4.2% | 30 Apr, 2022 | Go github.com/containers/podman/v3 Go github.com/containers/psgo |
http-swagger XSS via PUT requests CVE-2022-24863, CVE-2024-25712, GHSA-49w7-5r33-jm9m, GHSA-xg75-q3q5-cqmv, GO-2022-0427 | High | 2.4% | 22 Apr, 2022 | Go github.com/swaggo/http-swagger |
Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector BIT-consul-2022-29153, CVE-2022-29153, GHSA-q6h7-4qgw-2j9p, GO-2022-0615 | High | 8.7% | 20 Apr, 2022 | Go github.com/hashicorp/consul |
Insecure plugin handling in Mattermost BIT-mattermost-2022-1384, CVE-2022-1384, GHSA-32rp-q37p-jg6w, GO-2022-0576 | High | 0.7% | 20 Apr, 2022 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
Daemon panics when processing certain blocks GHSA-mcq2-w56r-5w2w | High | Not scored | 08 Apr, 2022 | Go github.com/ipld/go-ipfs |
Duplicate Advisory: go-codec-dagpb vulnerable to panic when decoding invalid blocks CVE-2022-2584, GHSA-967g-cjx4-h7j6, GHSA-g3vv-g2j5-45f2, GO-2022-0422 | High | 0.8% | 08 Apr, 2022 | Go github.com/ipld/go-codec-dagpb |
Privilege escalation in beego CVE-2021-27116, GHSA-ffjp-66mx-3qpj | High | 0.4% | 06 Apr, 2022 | Go github.com/beego/beego Go github.com/beego/beego/v2 |
Privilege escalation in beego CVE-2021-27117, GHSA-2v6v-q994-xvxx | High | 0.4% | 06 Apr, 2022 | Go github.com/beego/beego Go github.com/beego/beego/v2 |
Access control bypass in Beego CVE-2021-30080, GHSA-28r6-jm5h-mrgg, GO-2022-0572 | High | 1.3% | 06 Apr, 2022 | Go github.com/astaxie/beego Go github.com/beego/beego Go github.com/beego/beego/v2 |
Podman's default inheritable capabilities for linux container not empty CVE-2022-27649, GHSA-qvf8-p83w-v58j, GO-2022-0416 | High | 1.4% | 01 Apr, 2022 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 |
Incorrect Authorization in imgcrypt CVE-2022-24778, GHSA-8v99-48m9-c8pm, GO-2021-0412 | High | 2.7% | 28 Mar, 2022 | Go github.com/containerd/imgcrypt |
Unrestricted Upload of File with Dangerous Type in Gogs CVE-2022-0415, GHSA-5gjh-5j4f-cpwv, GO-2022-0554 | High | 65.9% | 28 Mar, 2022 | Go gogs.io/gogs |
Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server CVE-2022-24730, GHSA-r9cr-hvjj-496v, GO-2022-0357 | High | 0.9% | 24 Mar, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
golang.org/x/crypto/ssh Denial of service via crafted Signer CVE-2022-27191, GHSA-8c26-wmh5-6g9v, GO-2021-0356 | High | 4.0% | 19 Mar, 2022 | Go golang.org/x/crypto |
Denial of service in go-ethereum CVE-2021-42219, GHSA-vrcc-g6vj-mh5w | High | 1.2% | 18 Mar, 2022 | Go github.com/ethereum/go-ethereum |
Path traversal in github.com/valyala/fasthttp CVE-2022-21221, GHSA-fx95-883v-4q4h, GO-2022-0355, SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866 | High | 2.5% | 18 Mar, 2022 | Go github.com/valyala/fasthttp |
Code Injection in CRI-O CVE-2022-0811, GHSA-6x2m-w449-qwx7, GO-2022-0354 | High | 19.0% | 15 Mar, 2022 | Go github.com/cri-o/cri-o |
Gogs vulnerable to improper PAM authorization handling CVE-2022-0871, GHSA-gw5h-h6hj-f56g, GO-2022-0369 | High | 1.2% | 14 Mar, 2022 | Go gogs.io/gogs |
Gitea Missing Authorization vulnerability BIT-gitea-2022-0905, CVE-2022-0905, GHSA-jr9c-h74f-2v28, GO-2022-0609 | High | 0.8% | 11 Mar, 2022 | Go code.gitea.io/gitea |
Arbitrary file write in nats-server BIT-nats-2022-26652, CVE-2022-26652, GHSA-6h3m-36w8-hv68, GO-2022-0351 | High | 2.3% | 10 Mar, 2022 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 Go github.com/nats-io/nats-streaming-server |
Code injection in Stripe CLI on windows CVE-2022-24753, GHSA-4cx6-fj7j-pjx9, GO-2022-0350 | High | 0.4% | 10 Mar, 2022 | Go github.com/stripe/stripe-cli |
Account compromise in Evmos CVE-2022-24738, GHSA-5jgq-x857-p8xw, GO-2022-0348 | High | 1.1% | 07 Mar, 2022 | Go github.com/tharsis/evmos Go github.com/tharsis/evmos/v2 |
Denial of Service in Go-Ethereum CVE-2022-23327, GHSA-pvx3-gm3c-gmpr | High | 1.4% | 05 Mar, 2022 | Go github.com/ethereum/go-ethereum |
Denial of Service in Go-Ethereum CVE-2022-23328, GHSA-vmf7-hmh6-vv57 | High | 1.4% | 05 Mar, 2022 | Go github.com/ethereum/go-ethereum |
Path traversal in claircore CVE-2021-3762, GHSA-mq47-6wwv-v79w, GO-2022-0346 | High | 4.8% | 04 Mar, 2022 | Go github.com/quay/claircore |
containerd CRI plugin: Insecure handling of image volumes CVE-2022-23648, GHSA-crp2-qrr5-8pq7, GO-2022-0344 | High | 27.4% | 02 Mar, 2022 | Go github.com/containerd/containerd |
HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling CVE-2022-24685, GHSA-3382-r9q8-4hfg, GO-2022-0577 | High | 1.5% | 01 Mar, 2022 | Go github.com/hashicorp/nomad |
Improper Authentication in Capsule Proxy CVE-2022-23652, GHSA-9cwv-cppx-mqjm, GO-2022-0329 | High | 1.4% | 23 Feb, 2022 | Go github.com/clastix/capsule-proxy |
Unauthenticated control plane denial of service attack in Istio CVE-2022-23635, GHSA-856q-xv3c-7f2f | High | 1.7% | 23 Feb, 2022 | Go istio.io/istio |
Use of Hard-coded Cryptographic Key in Netmaker CVE-2022-23650, GHSA-86f3-hf24-76q4, GO-2022-0328 | High | 1.6% | 22 Feb, 2022 | Go github.com/gravitl/netmaker |
Use of Hard-coded Cryptographic Key in Netmaker CVE-2022-0664, GHSA-6rrw-4fm9-rghv, GO-2022-0561 | High | 1.7% | 19 Feb, 2022 | Go github.com/gravitl/netmaker |
Arbitrary file reads in HashiCorp Nomad CVE-2022-24683, GHSA-wmrx-57hm-mw7r, GO-2022-0584 | High | 1.5% | 18 Feb, 2022 | Go github.com/hashicorp/nomad |
golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability CVE-2020-29652, GHSA-3vm4-22fp-5rfm, GO-2021-0227 | High | 3.2% | 17 Feb, 2022 | Go golang.org/x/crypto |
golang.org/x/net/html Infinite Loop vulnerability BIT-golang-2021-33194, CVE-2021-33194, GHSA-83g2-8m93-v3w7, GO-2021-0238 | High | 7.5% | 17 Feb, 2022 | Go golang.org/x/net |
Skip the router TLS configuration when the host header is an FQDN CVE-2022-23632, GHSA-hrhx-6h34-j5hc, GO-2022-0325 | High | 1.7% | 16 Feb, 2022 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 |
Uncontrolled Resource Consumption in promhttp CVE-2022-21698, GHSA-cg3q-j54f-5p7p, GO-2022-0322 | High | 6.0% | 16 Feb, 2022 | Go github.com/prometheus/client_golang |
Access Restriction Bypass in kubernetes CVE-2016-1905, GHSA-xx8c-m748-xr4j, GO-2022-0893 | High | 1.6% | 15 Feb, 2022 | Go github.com/kubernetes/kubernetes |
Denial of Service in Packetbeat CVE-2017-11480, GHSA-9q3g-m353-cp4p, GO-2022-0643 | High | 1.4% | 15 Feb, 2022 | Go github.com/elastic/beats |
Access Restriction Bypass in go-ldap CVE-2017-14623, GHSA-x27w-qxhg-343v, GO-2022-0887 | High | 1.7% | 15 Feb, 2022 | Go github.com/go-ldap/ldap |