Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
kube-apiserver vulnerable to policy bypass CVE-2023-2727, GHSA-qc2g-gmh6-95p4, GO-2023-1891 | Medium | 1.1% | 03 Jul, 2023 | Go k8s.io/kubernetes |
Kubernetes mountable secrets policy bypass CVE-2023-2728, GHSA-cgcv-5272-97pr, GO-2023-1892 | Medium | 2.2% | 03 Jul, 2023 | Go k8s.io/kubernetes |
OpenFGA vulnerable to denial of service due to circular relationship CVE-2023-35933, GHSA-hr9r-8phq-5x8j, GO-2023-1872 | Medium | 1.1% | 28 Jun, 2023 | Go github.com/openfga/openfga |
Barberry Security Advisory - regarding x/auth periodic vesting accounts GHSA-j2cr-jc39-wpx5, GHSA-w44m-8mv2-v78h, GO-2023-1861 | Medium | Not scored | 22 Jun, 2023 | Go github.com/cosmos/cosmos-sdk |
Casdoor Cross-Site Request Forgery vulnerability CVE-2023-34927, GHSA-rwcp-qrwg-56cg | Medium | 3.1% | 22 Jun, 2023 | Go github.com/casdoor/casdoor |
Vega's validators able to submit duplicate transactions CVE-2023-35163, GHSA-8rc9-vxjh-qjf2, GO-2023-1865 | Medium | 0.5% | 20 Jun, 2023 | Go code.vegaprotocol.io/vega |
Kubelet vulnerable to bypass of seccomp profile enforcement CVE-2023-2431, GHSA-xc8m-28vv-4pjc, GO-2023-1864 | Medium | 0.3% | 16 Jun, 2023 | Go k8s.io/kubernetes |
Mattermost Server Missing Authorization vulnerability CVE-2023-2783, GHSA-455c-vqrf-mghr | Medium | 0.4% | 16 Jun, 2023 | Go github.com/mattermost/mattermost-server/v6 |
github.com/lestrrat-go/jwx vulnerable to Potential Padding Oracle Attack GHSA-rm8v-mxj3-5rmq, GO-2023-1859 | Medium | Not scored | 14 Jun, 2023 | Go github.com/lestrrat-go/jwx Go github.com/lestrrat-go/jwx/v2 |
Grafana has Broken Access Control in Alert manager: Viewer can send test alerts BIT-grafana-2023-2183, CVE-2023-2183, GHSA-cvm3-pp2j-chr3 | Medium | 1.0% | 12 Jun, 2023 | Go github.com/grafana/grafana |
Hashicorp Vault vulnerable to Cross-site Scripting BIT-vault-2023-2121, CVE-2023-2121, GHSA-gq98-53rq-qr5h, GO-2023-1849 | Medium | 0.4% | 09 Jun, 2023 | Go github.com/hashicorp/vault |
Notation's default `maxSignatureAttempts` in `notation verify` enables an endless data attack CVE-2023-33958, GHSA-rvrx-rrwh-r9p6, GO-2023-1831 | Medium | 0.5% | 06 Jun, 2023 | Go github.com/notaryproject/notation |
Notation vulnerable to denial of service from high number of artifact signatures CVE-2023-33957, GHSA-9m3v-v4r5-ppx7, GO-2023-1829 | Medium | 0.5% | 06 Jun, 2023 | Go github.com/notaryproject/notation |
syncthing vulnerable to Cross-site Scripting (XSS) in Web GUI BIT-syncthing-2022-46165, CVE-2022-46165, GHSA-9rp6-23gf-4c3h | Medium | 0.8% | 06 Jun, 2023 | Go github.com/syncthing/syncthing |
Rancher UI has multiple Cross-Site Scripting (XSS) issues CVE-2022-43760, GHSA-46v3-ggjg-qq3x | Medium | 0.7% | 06 Jun, 2023 | Go github.com/rancher/rancher |
Kyverno resource with a deletionTimestamp may allow policy circumvention CVE-2023-34091, GHSA-hq4m-4948-64cc, GO-2023-1819 | Medium | 0.5% | 05 Jun, 2023 | Go github.com/kyverno/kyverno |
Gitpod vulnerable to Cross-site Scripting CVE-2023-32766, GHSA-gqx9-h3w2-fprg | Medium | 0.6% | 05 Jun, 2023 | Go github.com/gitpod-io/gitpod |
Hashicorp Consul vulnerable to denial of service BIT-consul-2023-1297, CVE-2023-1297, GHSA-c57c-7hrj-6q6v, GO-2023-1827 | Medium | 0.8% | 03 Jun, 2023 | Go github.com/hashicorp/consul |
Algernon engine and themes vulnerable to Cross-site Scripting CVE-2023-26131, GHSA-g47h-fgcw-g4ph | Medium | 0.7% | 31 May, 2023 | Go github.com/xyproto/algernon |
Kyverno vulnerable due to usage of insecure cipher BIT-kyverno-2023-54356, CVE-2023-54356, GHSA-hgv6-w7r3-w4qw, GO-2023-1804 | Medium | 0.2% | 30 May, 2023 | Go github.com/kyverno/kyverno |
Go package pydio/cells vulnerable to authorization bypass CVE-2023-2978, GHSA-mv7x-27pc-8c96, GO-2023-1808 | Medium | 0.7% | 30 May, 2023 | Go github.com/pydio/cells Go github.com/pydio/cells/v4 |
Abstrium Pydio Cells Resource Injection vulnerability CVE-2023-2980, GHSA-j327-c69h-4gh8, GO-2023-2344 | Medium | 1.1% | 30 May, 2023 | Go github.com/pydio/cells Go github.com/pydio/cells/v4 |
go package pydio cells vulnerable to cross-site scripting CVE-2023-2981, GHSA-wmfc-g86p-fjvr, GO-2023-1809 | Medium | 0.7% | 30 May, 2023 | Go github.com/pydio/cells Go github.com/pydio/cells/v4 |
malformed proposed intoto entries can cause a panic CVE-2023-33199, GHSA-frqx-jfcm-6jjr, GO-2023-1795 | Medium | 0.7% | 26 May, 2023 | Go github.com/sigstore/rekor |
secrets-store-csi-driver discloses service account tokens in logs CVE-2023-2878, GHSA-g82w-58jf-gcxx, GO-2023-1793 | Medium | 0.4% | 26 May, 2023 | Go sigs.k8s.io/secrets-store-csi-driver |
Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited CVE-2023-33955, GHSA-jv3f-7m33-qp65 | Medium | 0.6% | 26 May, 2023 | Go github.com/minio/console |
kyverno seccomp control can be circumvented CVE-2023-33191, GHSA-33hq-f2mf-jm3c, GO-2023-1801 | Medium | 0.5% | 25 May, 2023 | Go github.com/kyverno/kyverno |
Ingress-nginx `path` sanitization can be bypassed with newline character CVE-2021-25748, GHSA-863x-868h-968x | Medium | 0.7% | 24 May, 2023 | Go k8s.io/ingress-nginx |
Potential HTTP policy bypass when using header rules in Cilium BIT-cilium-2023-30851, BIT-cilium-operator-2023-30851, BIT-cilium-proxy-2023-30851, BIT-hubble-2023-30851, BIT-hubble-relay-2023-30851, BIT-hubble-ui-2023-30851, BIT-hubble-ui-backend-2023-30851, CVE-2023-30851, GHSA-2h44-x2wx-49f4, GO-2023-1785 | Medium | 0.7% | 22 May, 2023 | Go github.com/cilium/cilium |
ginuerzh/gost vulnerable to Timing Attack CVE-2023-32691, GHSA-qjrq-hm79-49ww | Medium | 0.6% | 22 May, 2023 | Go github.com/ginuerzh/gost |
Dgraph Audit Log Encryption Vulnerability CVE-2023-31135, GHSA-92wq-q9pq-gw47 | Medium | 0.2% | 17 May, 2023 | Go github.com/dgraph-io/dgraph |
Improper random reading in CIRCL CVE-2023-1732, GHSA-2q89-485c-9j2x, GO-2023-1765 | Medium | 0.4% | 11 May, 2023 | Go github.com/cloudflare/circl |
github.com/ipfs/kubo affected by DOS Bitswap unbounded persistent memory leak GHSA-qvqg-6rp8-4p9h | Medium | Not scored | 11 May, 2023 | Go github.com/ipfs/kubo |
VTAdmin users that can create shards can deny access to other functions CVE-2023-29195, GHSA-pqj7-jx24-wj7w | Medium | 1.0% | 11 May, 2023 | Go vitess.io/vitess |
Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment function CVE-2023-29401, GHSA-2c4m-59x9-fr2g, GO-2023-1737 | Medium | 0.5% | 11 May, 2023 | Go github.com/gin-gonic/gin |
On a compromised node, the fluid-csi service account can be used to modify node specs CVE-2023-30840, GHSA-93xx-cvmc-9w3v, GO-2023-1763 | Medium | 0.2% | 09 May, 2023 | Go github.com/fluid-cloudnative/fluid |
imgproxy is vulnerable to Server-Side Request Forgery CVE-2023-30019, GHSA-9x7h-ggc3-xg47, GO-2023-1761 | Medium | 2.2% | 08 May, 2023 | Go github.com/imgproxy/imgproxy Go github.com/imgproxy/imgproxy/v2 Go github.com/imgproxy/imgproxy/v3 |
libheif vulnerable to segmentation fault via floating point exception CVE-2023-29659, GHSA-22fx-6r9m-r8h9 | Medium | 0.9% | 05 May, 2023 | Go github.com/strukturag/libheif |
Improper input validation in github.com/gin-gonic/gin CVE-2023-26125, GHSA-3vp4-m3rf-835h | Medium | 0.9% | 04 May, 2023 | Go github.com/gin-gonic/gin |
Ironic and ironic-inspector may expose as ConfigMaps CVE-2023-30841, GHSA-9wh7-397j-722m | Medium | 0.2% | 26 Apr, 2023 | Go github.com/metal3-io/baremetal-operator |
A potential risk in clusternet which can be leveraged to make a cluster-level privilege escalation CVE-2023-30622, GHSA-833c-xh79-p429, GO-2023-1735 | Medium | 0.2% | 21 Apr, 2023 | Go github.com/clusternet/clusternet |
IO FinNet tss-lib vulnerable to replay attacks involving proofs CVE-2022-47930, GHSA-c58h-qv6g-fw74, GO-2023-1867 | Medium | 0.5% | 21 Apr, 2023 | Go github.com/binance-chain/tss-lib Go github.com/bnb-chain/tss-lib |
CubeFS allows Kubernetes cluster-level privilege escalation CVE-2023-30512, GHSA-9337-8c6c-c2xg | Medium | 0.5% | 12 Apr, 2023 | Go github.com/cubefs/cubefs |
vitess allows users to create keyspaces that can deny access to already existing keyspaces CVE-2023-29194, GHSA-735r-hv67-g38f, GO-2023-1717 | Medium | 0.8% | 11 Apr, 2023 | Go vitess.io/vitess |
Answer vulnerable to Exposure of Sensitive Information Through Metadata CVE-2023-1974, GHSA-8jg3-rx43-3fv4, GO-2023-1718 | Medium | 0.6% | 11 Apr, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Insertion of Sensitive Information Into Sent Data CVE-2023-1975, GHSA-65v8-6pvw-jwvq, GO-2023-1716 | Medium | 0.6% | 11 Apr, 2023 | Go github.com/answerdev/answer |
Docker Swarm encrypted overlay network traffic may be unencrypted CVE-2023-28841, GHSA-33pg-m6jh-5237, GO-2023-1700 | Medium | 0.7% | 04 Apr, 2023 | Go github.com/docker/docker |
Docker Swarm encrypted overlay network with a single endpoint is unauthenticated CVE-2023-28842, GHSA-6wrf-mxfj-pf5p, GO-2023-1701 | Medium | 1.4% | 04 Apr, 2023 | Go github.com/docker/docker |
Phachon mm-wiki vulnerable to stored cross-site scripting (XSS) CVE-2020-19277, GHSA-f7rp-xx67-4pj9 | Medium | 0.5% | 04 Apr, 2023 | Go github.com/phachon/mm-wiki |
request-baskets vulnerable to Server-Side Request Forgery CVE-2023-27163, GHSA-58g2-vgpg-335q | Medium | 6.5% | 31 Mar, 2023 | Go github.com/darklynx/request-baskets |