Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Privilege escalation to cluster admin on multi-tenant environments BIT-kustomize-2021-41254, CVE-2021-41254, GHSA-35rf-v2jv-gfg7, GO-2022-0260 | High | 1.8% | 15 Nov, 2021 | Go github.com/fluxcd/kustomize-controller |
NUL character in ROA causes OctoRPKI to crash CVE-2021-3910, GHSA-5mxh-2qfv-4g7j, GO-2022-0251 | High | 1.2% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Path traversal in github.com/cloudflare/cfrpki/cmd/octorpki CVE-2021-3907, GHSA-8459-6rc9-8vf8, GHSA-cqh2-vc2f-q4fh, GO-2022-0248 | High | 4.2% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker CVE-2021-41232, GHSA-26cm-qrc6-mfgj, GO-2022-0939 | High | 1.5% | 08 Nov, 2021 | Go github.com/StevenWeathers/thunderdome-planning-poker Go github.com/stevenweathers/thunderdome-planning-poker |
Files or Directories Accessible to External Parties in kubernetes CVE-2021-25741, GHSA-f5f7-6478-qm6p, GO-2022-0910 | High | 8.0% | 01 Nov, 2021 | Go k8s.io/kubernetes |
Duplicate Advisory: ReDoS via crafted JSON input in GJSON CVE-2021-42248, CVE-2021-42836, GHSA-c9gm-7rfj-8w5h, GHSA-ppj4-34rq-v8j9, GO-2021-0265 | High | 2.4% | 25 Oct, 2021 | Go github.com/tidwall/gjson |
Incorrect Privilege Assignment in HashiCorp Vault BIT-vault-2021-42135, CVE-2021-42135, GHSA-362v-wg5p-64w2, GO-2022-0578 | High | 0.8% | 12 Oct, 2021 | Go github.com/hashicorp/vault |
golang.org/x/text/language Out-of-bounds Read vulnerability CVE-2021-38561, GHSA-ppp9-7jff-5vj2, GO-2021-0113 | High | 1.5% | 06 Oct, 2021 | Go golang.org/x/text |
S3 storage write is not aborted on errors leading to unbounded memory usage GHSA-m6m5-pp4g-fcc8, GO-2022-0374 | High | Not scored | 06 Oct, 2021 | Go github.com/foxcpp/maddy |
Authentication bypass for viewing and deletions of snapshots BIT-grafana-2021-39226, CVE-2021-39226, GHSA-69j6-29vr-p3j9 | HighExploited | 99.9% | 05 Oct, 2021 | Go github.com/grafana/grafana |
Elvish vulnerable to remote code execution via the web UI backend CVE-2021-41088, GHSA-fpv6-f8jw-rc3r, GO-2022-0937 | High | 0.5% | 23 Sep, 2021 | Go github.com/elves/elvish |
Incorrect Authorization with specially crafted requests BIT-envoy-2021-39206, CVE-2021-39206, GHSA-cfc2-wjcm-c8fm | High | 1.5% | 10 Sep, 2021 | Go github.com/pomerium/pomerium |
Excessive CPU usage BIT-envoy-2021-39204, CVE-2021-39204, GHSA-5wjf-62hw-q78r | High | 1.7% | 10 Sep, 2021 | Go github.com/pomerium/pomerium |
Incorrect handling of H2 GOAWAY + SETTINGS frames BIT-envoy-2021-39162, CVE-2021-39162, GHSA-gjcg-vrxg-xmgv, GO-2022-0933 | High | 1.6% | 10 Sep, 2021 | Go github.com/pomerium/pomerium |
HashiCorp Consul Privilege Escalation Vulnerability BIT-consul-2021-37219, CVE-2021-37219, GHSA-ccw8-7688-vqx4, GO-2022-0593 | High | 1.1% | 08 Sep, 2021 | Go github.com/hashicorp/consul |
Privilege escalation in Hashicorp Nomad CVE-2021-37218, GHSA-c8x3-rg72-fwwg, GO-2022-0591 | High | 0.7% | 08 Sep, 2021 | Go github.com/hashicorp/nomad |
OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values CVE-2021-3761, GHSA-c8xp-8mf3-62h9, GO-2022-0246 | High | 1.2% | 07 Sep, 2021 | Go github.com/cloudflare/cfrpki |
Improper Authentication CVE-2019-20894, GHSA-q9mp-79cp-9g8j, GO-2022-0774 | High | 1.6% | 02 Sep, 2021 | Go github.com/containous/traefik Go github.com/containous/traefik/v2 Go github.com/traefik/traefik/v2 |
Improper use of cryptographic key in wal-g CVE-2021-38599, GHSA-vrmr-f2qh-3hhf | High | 0.8% | 02 Sep, 2021 | Go github.com/wal-g/wal-g |
Path traversal in ServiceCenter CVE-2021-21501, GHSA-x6jv-5vfg-gm7x | High | 4.4% | 01 Sep, 2021 | Go github.com/apache/servicecomb-service-center |
ExternalName Services can be used to gain access to Envoy's admin interface BIT-contour-2021-32783, CVE-2021-32783, GHSA-5ph6-qq5x-7jwc, GO-2022-0922 | High | 1.2% | 30 Aug, 2021 | Go github.com/projectcontour/contour |
Istio Fragments in Path May Lead to Authorization Policy Bypass CVE-2021-39156, GHSA-hqxw-mm44-gc4r | High | 1.2% | 30 Aug, 2021 | Go istio.io/istio |
Authorization Policy Bypass Due to Case Insensitive Host Comparison CVE-2021-39155, GHSA-7774-7vr3-cc8j | High | 1.2% | 30 Aug, 2021 | Go istio.io/istio |
Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault BIT-vault-2020-16250, CVE-2020-16250, GHSA-fp52-qw33-mfmw, GO-2022-0825 | High | 1.5% | 02 Aug, 2021 | Go github.com/hashicorp/vault |
Improper Resource Shutdown or Release in HashiCorp Vault BIT-vault-2020-7220, CVE-2020-7220, GHSA-9vh5-r4qw-v3vv, GO-2022-0816 | High | 1.4% | 28 Jul, 2021 | Go github.com/hashicorp/vault |
github.com/pires/go-proxyproto vulnerable to DoS via Connection descriptor exhaustion CVE-2021-23409, GHSA-xcf7-q56x-78gh, GO-2022-0233, SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1316439 | High | 1.6% | 26 Jul, 2021 | Go github.com/pires/go-proxyproto |
Improper Restriction of Excessive Authentication Attempts in Argo API BIT-argo-cd-2020-8827, CVE-2020-8827, GHSA-xcqr-9h24-vrgw, GO-2022-0892 | High | 2.2% | 26 Jul, 2021 | Go github.com/argoproj/argo-cd |
Argo CD Insecure default administrative password BIT-argo-cd-2020-8828, CVE-2020-8828, GHSA-h8jc-jmrf-9h8f | High | 1.8% | 26 Jul, 2021 | Go github.com/argoproj/argo-cd |
HashiCorp Consul L7 deny intention results in an allow action BIT-consul-2021-36213, CVE-2021-36213, GHSA-8h2g-r292-j8xh, GO-2022-0895 | High | 1.7% | 19 Jul, 2021 | Go github.com/hashicorp/consul |
Hashicorp Consul Missing SSL Certificate Validation BIT-consul-2021-32574, CVE-2021-32574, GHSA-25gf-8qrr-g78r, GO-2022-0894 | High | 1.5% | 19 Jul, 2021 | Go github.com/hashicorp/consul |
Incorrect Default Permissions in Binance tss-lib CVE-2020-12118, GHSA-399h-cmvp-qgx5, GO-2022-0769 | High | 1.3% | 29 Jun, 2021 | Go github.com/binance-chain/tss-lib |
Go Ethereum Denial of Service CVE-2018-19184, GHSA-9h4h-8w5p-f28w, GO-2022-0814 | High | 1.5% | 29 Jun, 2021 | Go github.com/ethereum/go-ethereum |
Improper Privilege Management in HashiCorp Nomad CVE-2021-3283, GHSA-35qp-xq9f-2rjx, GO-2022-0622 | High | 1.5% | 24 Jun, 2021 | Go github.com/hashicorp/nomad |
Helm uses crypto package vulnerable to panic from malformed X.509 certificate BIT-golang-2020-7919, CVE-2020-7919, GHSA-cjjc-xp8v-855w, GO-2022-0229 | High | 2.6% | 23 Jun, 2021 | Go github.com/helm/helm Go golang.org/x/crypto Go helm.sh/helm/v3 Go stdlib |
Possible bypass of token claim validation when OAuth2 Introspection caching is enabled CVE-2021-32701, GHSA-qvp4-rpmr-xwrr, GHSA-vfvf-6gx5-mqv6, GO-2022-0406, GO-2022-0920 | High | 1.6% | 23 Jun, 2021 | Go github.com/ory/oathkeeper |
Hugo can execute a binary from the current directory on Windows CVE-2020-26284, GHSA-8j34-9876-pvfq | High | 1.5% | 23 Jun, 2021 | Go github.com/gohugoio/hugo |
Path traversal in github.com/ipfs/go-ipfs CVE-2020-26279, GHSA-27pv-q55r-222g, GO-2022-0779 | High | 1.7% | 23 Jun, 2021 | Go github.com/ipfs/go-ipfs |
Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone BIT-rclone-2020-28924, CVE-2020-28924, GHSA-rmw5-xpg9-jr29, GO-2022-0878 | High | 1.4% | 10 Jun, 2021 | Go github.com/rclone/rclone |
Access control flaw in Kiali CVE-2021-3495, GHSA-mv55-23xp-3wp8, GO-2022-0645 | High | 1.0% | 08 Jun, 2021 | Go github.com/kiali/kiali |
Invalid session token expiration BIT-vault-2021-32923, CVE-2021-32923, GHSA-38j9-7pp9-2hjw, GO-2022-0623 | High | 1.4% | 08 Jun, 2021 | Go github.com/hashicorp/vault |
Lookup function information discolosure in helm BIT-helm-2020-11013, CVE-2020-11013, GHSA-q8q8-93cv-v6h8 | High | 1.4% | 27 May, 2021 | Go helm.sh/helm/v3 |
Listing of upload directory contents possible GHSA-qmfx-75ff-8mw6, GO-2022-0407 | High | Not scored | 27 May, 2021 | Go github.com/ThomasLeister/prosody-filer |
mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs CVE-2021-30465, GHSA-c3xm-pvg7-gh7r, GO-2022-0914 | High | 10.2% | 25 May, 2021 | Go github.com/opencontainers/runc |
Path traversal and files overwrite with unsquashfs in singularity CVE-2020-15229, GHSA-7gcp-w6ww-2xv9 | High | 2.0% | 24 May, 2021 | Go github.com/sylabs/singularity |
Token reuse in Ory fosite CVE-2020-15222, GHSA-v3q9-2p3m-7g43, GO-2021-0110 | High | 0.9% | 24 May, 2021 | Go github.com/ory/fosite |
Ory fosite contains Improper Handling of Exceptional Conditions CVE-2020-15223, GHSA-7mqr-2v3q-v2wm, GO-2021-0109 | High | 1.6% | 24 May, 2021 | Go github.com/ory/fosite |
Local Privilege Escalation in cloudflared CVE-2020-24356, GHSA-hgwp-4vp4-qmm2, GO-2022-0845 | High | 0.3% | 24 May, 2021 | Go github.com/cloudflare/cloudflared |
Insecure permissions on build temporary rootfs in Singularity CVE-2020-25040, GHSA-jv9c-w74q-6762 | High | 2.0% | 24 May, 2021 | Go github.com/sylabs/singularity |
Nil dereference in NATS JWT, DoS of nats-server CVE-2020-26521, GHSA-h2fg-54x9-5qhq, GHSA-hmm9-r2m2-qg9w, GO-2022-0402 | High | 2.2% | 21 May, 2021 | Go github.com/nats-io/jwt Go github.com/nats-io/nats-server/v2 |
Privilege escalation in rbac CVE-2021-22538, GHSA-5v95-v8c8-3rh6, GO-2022-0798 | High | 0.7% | 21 May, 2021 | Go github.com/google/exposure-notifications-verification-server |