Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Information Exposure in Heketi CVE-2017-15104, GHSA-q9vw-wr57-xjv3, GO-2022-0866 | High | 0.4% | 15 Feb, 2022 | Go github.com/heketi/heketi |
etcd Cross-site Request Forgery (CSRF) CVE-2018-1098, GHSA-5gjm-fj42-x983 | High | 1.2% | 15 Feb, 2022 | Go go.etcd.io/etcd/v3 |
Gitea Improper Input Validation CVE-2019-11228, GHSA-q47x-6mqq-4w92, GO-2022-0862 | High | 1.3% | 15 Feb, 2022 | Go github.com/go-gitea/gitea |
Gitea Remote Code Execution CVE-2019-11229, GHSA-hpmr-prr2-cqc4, GO-2022-0846 | High | 55.0% | 15 Feb, 2022 | Go github.com/go-gitea/gitea |
Istio may not check inbound TCP connections against istio-policy CVE-2019-12243, GHSA-6g5f-f5pm-mjrg | High | 1.2% | 15 Feb, 2022 | Go istio.io/istio |
Pivotal Concourse SQL Injection Vulnerability CVE-2019-3792, GHSA-4fqx-74rv-638w | High | 1.1% | 15 Feb, 2022 | Go github.com/concourse/concourse |
Link Following in Kata Runtime CVE-2020-2026, GHSA-877x-32pm-p28x | High | 0.5% | 15 Feb, 2022 | Go github.com/kata-containers/runtime |
Improper Input Validation in vault-ssh-helper CVE-2020-24359, GHSA-f9fq-vjvh-779p, GO-2022-0824 | High | 1.0% | 15 Feb, 2022 | Go github.com/hashicorp/vault-ssh-helper |
Denial of service in github.com/nats-io/nats-server/server BIT-nats-2020-28466, CVE-2020-28466, GHSA-m4jx-6526-vvhm, GO-2022-0855, SNYK-GOLANG-GITHUBCOMNATSIONATSSERVERSERVER-1042967 | High | 3.7% | 15 Feb, 2022 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
Cryptographic Issues in ECK CVE-2020-7010, GHSA-vfp4-xx6m-7vf6 | High | 1.4% | 15 Feb, 2022 | Go github.com/elastic/cloud-on-k8s |
Improper Authentication in Kubernetes CVE-2020-8558, GHSA-wqv3-8cm6-h6wg, GO-2022-0885 | High | 3.4% | 15 Feb, 2022 | Go k8s.io/kubernetes |
containernetworking/cni improper limitation of path name CVE-2021-20206, GHSA-xjqr-g762-pxwp, GO-2022-0230, SNYK-GOLANG-GITHUBCOMCONTAINERNETWORKINGCNIPKGINVOKE-1070549 | High | 1.5% | 15 Feb, 2022 | Go github.com/containernetworking/cni |
Authentication Bypass by Primary Weakness in github.com/kongchuanhujiao/server CVE-2021-21403, GHSA-8wrg-m8vm-5fvj | High | 1.4% | 15 Feb, 2022 | Go github.com/kongchuanhujiao/server |
Reject unauthorized access with GitHub PATs CVE-2021-21432, GHSA-8j3f-mhq8-gmh4, GO-2022-0812 | High | 1.0% | 15 Feb, 2022 | Go github.com/go-vela/server |
Authentication bypass by capture-replay in github.com/cosmos/ethermint CVE-2021-25834, GHSA-93p5-8fqw-wjx3, GO-2022-0813 | High | 1.2% | 15 Feb, 2022 | Go github.com/cosmos/ethermint |
Authentication bypass by capture-replay in github.com/cosmos/ethermint CVE-2021-25835, GHSA-x5f3-qmwj-4f84, GO-2022-0889 | High | 1.3% | 15 Feb, 2022 | Go github.com/cosmos/ethermint |
Infinite loop in Yubico yubihsm-connector CVE-2021-28484, GHSA-8m9g-647g-5pxw | High | 1.5% | 15 Feb, 2022 | Go github.com/Yubico/yubihsm-connector |
Noise vulnerable to denial of service CVE-2021-4239, GHSA-6cr6-fmvc-vw2p, GHSA-g9mp-8g3h-3c5c, GO-2022-0425 | High | 0.4% | 15 Feb, 2022 | Go github.com/flynn/noise |
Denial of Service in Gitea BIT-gitea-2020-13246, CVE-2020-13246, GHSA-g2qx-6ghw-67hm, GO-2022-0830 | High | 2.0% | 15 Feb, 2022 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Exposure of server configuration in github.com/go-vela/server CVE-2020-26294, GHSA-gv2h-gf8m-r68j, GO-2022-0838 | High | 1.8% | 15 Feb, 2022 | Go github.com/go-vela/compiler |
SAML authentication vulnerability due to stdlib XML parsing CVE-2020-26276, GHSA-w3wf-cfx3-6gcx | High | 2.2% | 11 Feb, 2022 | Go github.com/fleetdm/fleet/v4 |
Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers CVE-2020-14359, GHSA-jh6m-3pqw-242h | High | 0.9% | 09 Feb, 2022 | Go github.com/keycloak/keycloak-gatekeeper |
Cross Site Request Forgery in Gitea BIT-gitea-2021-45326, CVE-2021-45326, GHSA-4wp3-8q92-mh8w, GO-2022-0309 | High | 0.6% | 09 Feb, 2022 | Go github.com/go-gitea/gitea |
Incorrect Authorization in NATS nats-server BIT-nats-2022-24450, CVE-2022-24450, GHSA-g6w6-r76c-28j7, GO-2022-0307 | High | 1.3% | 08 Feb, 2022 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 Go github.com/nats-io/nats-streaming-server |
Path traversal and dereference of symlinks in Argo CD CVE-2022-24348, GHSA-63qx-x74g-jcr7, GO-2022-0304 | High | 2.8% | 07 Feb, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Server-Side Request Forgery in Apache Traffic Control CVE-2022-23206, GHSA-wp47-9r3h-xfgq, GO-2022-0585 | High | 2.0% | 07 Feb, 2022 | Go github.com/apache/trafficcontrol |
Cross-Site Request Forgery in Filebrowser CVE-2021-46398, GHSA-72wf-hwcq-65h9, GO-2022-0563 | High | 6.7% | 05 Feb, 2022 | Go github.com/filebrowser/filebrowser/v2 |
SQL Injection in Casdoor CVE-2022-24124, GHSA-m358-g4rp-533r, GO-2022-0303, PYSEC-2022-43189 | High | 55.3% | 29 Jan, 2022 | Go github.com/casdoor/casdoor PyPI casdoor |
Withdrawn Advisory: NULL Pointer Dereference in Protocol Buffers CVE-2021-22570, GHSA-77rm-9x9h-xj3g, PYSEC-2022-48 | High | 2.7% | 26 Jan, 2022 | Go github.com/protocolbuffers/protobuf Maven com.google.protobuf:protobuf-java NuGet Google.Protobuf Packagist google/protobuf +1 more |
Lookup operations do not take into account wildcards in SpiceDB CVE-2022-21646, GHSA-7p8f-8hjm-wm92, GO-2022-0295 | High | 1.3% | 13 Jan, 2022 | Go github.com/authzed/spicedb |
Unbounded memory usage on exposed HTTP/2 (non-gRPC) endpoints GHSA-m7vp-hqwv-7m5x | High | Not scored | 12 Jan, 2022 | Go github.com/spiffe/spire |
Use of a Broken or Risky Cryptographic Algorithm in Max Mazurov Maddy CVE-2021-42583, GHSA-5r5w-h76p-m726, GO-2022-0306 | High | 0.7% | 06 Jan, 2022 | Go github.com/foxcpp/maddy |
Link Following in Iris CVE-2021-23772, GHSA-jcxc-rh6w-wf49, GO-2022-0272 | High | 1.9% | 06 Jan, 2022 | Go github.com/kataras/iris Go github.com/kataras/iris/v12 |
Drainage of FeeCollector's Block Transaction Fees in cronos CVE-2021-43839, GHSA-f854-hpxv-cw9r | High | 1.4% | 06 Jan, 2022 | Go github.com/crypto-org-chain/cronos Go github.com/tharsis/ethermint Go github.com/tharsis/evmos |
Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux CVE-2021-43816, GHSA-mvff-h3cj-wj9c, GO-2022-0278 | High | 1.8% | 06 Jan, 2022 | Go github.com/containerd/containerd |
golang.org/x/net/http2 allows uncontrolled memory consumption BIT-golang-2021-44716, CVE-2021-44716, GHSA-vc3p-29h2-gpcp, GO-2022-0288 | High | 4.3% | 02 Jan, 2022 | Go golang.org/x/net Go golang.org/x/net/http2 Go stdlib |
Insecure permissions on user namespace / fakeroot temporary rootfs in Singularity CVE-2020-25039, GHSA-w6v2-qchm-grj7 | High | 2.0% | 20 Dec, 2021 | Go github.com/sylabs/singularity |
Incorrect Permission Assignment for Critical Resource in Singularity CVE-2019-11328, GHSA-557g-r22w-9wvx | High | 2.1% | 20 Dec, 2021 | Go github.com/sylabs/singularity |
"Verify All" Returns Success Despite Validation Failures in Singularity CVE-2020-13846, GHSA-6w7g-p4jh-rf92 | High | 1.3% | 20 Dec, 2021 | Go github.com/sylabs/singularity |
Execution Control List (ECL) Is Insecure in Singularity CVE-2020-13845, GHSA-pmfr-63c2-jr5c | High | 0.5% | 20 Dec, 2021 | Go github.com/sylabs/singularity |
Cross-site Request Forgery (CSRF) CVE-2017-1000069, GHSA-rrm8-32g4-w8m3 | High | 0.7% | 20 Dec, 2021 | Go github.com/bitly/oauth2_proxy |
Open Redirect in OAuth2 Proxy BIT-oauth2-proxy-2020-11053, CVE-2020-11053, GHSA-j7px-6hwj-hpjg | High | 0.8% | 20 Dec, 2021 | Go github.com/oauth2-proxy/oauth2-proxy |
GitLab auth uses full name instead of username as user ID, allowing impersonation BIT-concourse-2020-5415, CVE-2020-5415, GHSA-627p-rr78-99rj | High | 1.2% | 20 Dec, 2021 | Go github.com/concourse/concourse Go github.com/concourse/dex |
Withdrawn Advisory: Infinite loop in xz BIT-golang-2020-16845, CVE-2020-16845, GHSA-q6gq-997w-f55g, GO-2021-0142 | High | 4.9% | 16 Dec, 2021 | Go github.com/ulikunitz/xz Go stdlib |
Unsafe inline XSS in pasting DOM element into chat CVE-2021-39183, GHSA-2hfj-cxw7-g45p, GO-2022-0291 | High | 0.8% | 14 Dec, 2021 | Go github.com/owncast/owncast |
Improper Authentication in HashiCorp Nomad CVE-2021-43415, GHSA-2jhh-5xm2-j4gf, GO-2022-0573 | High | 1.2% | 10 Dec, 2021 | Go github.com/hashicorp/nomad |
Grafana path traversal BIT-grafana-2021-43798, CVE-2021-43798, GHSA-8pjx-jj86-j47p | HighExploited | 88.5% | 07 Dec, 2021 | Go github.com/grafana/grafana |
HTTP Request Smuggling in github.com/hyperledger/fabric CVE-2021-43669, GHSA-j96p-r523-8r3w | High | 1.1% | 03 Dec, 2021 | Go github.com/hyperledger/fabric |
Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki CVE-2021-3978, GHSA-3pqh-p72c-fj85, GO-2022-0580 | High | 0.1% | 19 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Authentication bypass issue in the Operator Console CVE-2021-41266, GHSA-4999-659w-mq36, GO-2022-0261 | High | 48.1% | 15 Nov, 2021 | Go github.com/minio/console |