Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OctoRPKI crashes when max iterations is reached CVE-2022-3616, GHSA-pmw9-567p-68pc, GO-2022-1089 | Medium | 0.5% | 31 Oct, 2022 | Go github.com/cloudflare/cfrpki |
Hashicorp Boundary vulnerable to clickjacking CVE-2022-36182, GHSA-xqv2-3vvq-qg6r | Medium | 0.7% | 27 Oct, 2022 | Go github.com/hashicorp/boundary |
OpenFGA Authorization Bypass via tupleset wildcard CVE-2022-39341, GHSA-vj4m-83m8-xpw5, GO-2022-1080 | Medium | 1.1% | 25 Oct, 2022 | Go github.com/openfga/openfga |
OpenFGA Authorization Bypass CVE-2022-39342, GHSA-f4mm-2r69-mg5f, GO-2022-1081 | Medium | 1.1% | 25 Oct, 2022 | Go github.com/openfga/openfga |
OpenFGA subject to Information Disclosure via streamed-list-objects endpoint CVE-2022-39340, GHSA-95x7-mh78-7w2r, GO-2022-1079 | Medium | 0.9% | 25 Oct, 2022 | Go github.com/openfga/openfga |
free5GC vulnerable to malformed NGAP message crashing the AMF and NGAP decoders CVE-2022-43677, GHSA-59hj-62f5-fgmc, GO-2022-1083 | Medium | 0.8% | 24 Oct, 2022 | Go github.com/free5gc/aper Go github.com/free5gc/free5gc |
Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollution BIT-concourse-2022-31683, CVE-2022-31683, GHSA-5jp2-vwrj-99rf | Medium | 0.5% | 19 Oct, 2022 | Go github.com/concourse/concourse |
Improper use of metav1.Duration allows for Denial of Service BIT-flux-2022-39272, BIT-kustomize-2022-39272, CVE-2022-39272, GHSA-f4p5-x4vc-mh4v, GO-2022-1071 | Medium | 0.8% | 19 Oct, 2022 | Go github.com/fluxcd/flux2 Go github.com/fluxcd/helm-controller Go github.com/fluxcd/helm-controller/api Go github.com/fluxcd/image-automation-controller +9 more |
Nomad Panics On Job Submission With Bad Artifact Stanza Source URL CVE-2022-41606, GHSA-7v3g-4878-5qrf, GO-2022-1062 | Medium | 0.9% | 12 Oct, 2022 | Go github.com/hashicorp/nomad |
AdGuardHome vulnerable to Cross-Site Request Forgery CVE-2022-32175, GHSA-mwwc-3jv2-62j3 | Medium | 0.3% | 11 Oct, 2022 | Go github.com/AdguardTeam/AdGuardHome |
Blst vulnerable to incorrect results for some inputs in blst_fp_eucl_inverse function GHSA-x279-68rr-jp4p, GO-2022-1053 | Medium | Not scored | 07 Oct, 2022 | Go github.com/supranational/blst |
Tendermint Core vulnerable to Uncontrolled Resource Consumption CVE-2021-21271, GHSA-p658-8693-mhvg, GO-2022-1052 | Medium | 1.8% | 07 Oct, 2022 | Go github.com/tendermint/tendermint |
etcd has no minimum password length CVE-2020-15115, GHSA-4993-m7g5-r9hh | Medium | 1.3% | 06 Oct, 2022 | Go go.etcd.io/etcd/client/v3 |
SIF's Digital Signature Hash Algorithms Not Validated CVE-2022-39237, GHSA-m5m3-46gj-wch8, GO-2022-1045 | Medium | 0.7% | 06 Oct, 2022 | Go github.com/sylabs/sif/v2 |
Dutchoders transfer.sh contains an XSS vulnerability via malicious file upload CVE-2022-40931, GHSA-pwq7-f7f9-cm2j | Medium | 0.6% | 30 Sep, 2022 | Go github.com/dutchcoders/transfer.sh |
Bytebase does not restrict low privilege user to access admin issues CVE-2022-32169, GHSA-5rc4-v5mj-g8c4 | Medium | 0.7% | 29 Sep, 2022 | Go github.com/bytebase/bytebase |
Bytebase allows low-privilege users to view admin projects CVE-2022-32170, GHSA-9mmc-27gw-w6mq | Medium | 0.7% | 29 Sep, 2022 | Go github.com/bytebase/bytebase |
HashiCorp Consul vulnerable to authorization bypass BIT-consul-2022-40716, CVE-2022-40716, GHSA-m69r-9g56-7mv8, GO-2022-1029 | Medium | 1.1% | 25 Sep, 2022 | Go github.com/hashicorp/consul |
Mattermost subject to Denial of Service via upload of special GIF BIT-mattermost-2022-3257, CVE-2022-3257, GHSA-m7w4-q5vg-5xfp | Medium | 1.3% | 25 Sep, 2022 | Go github.com/mattermost/mattermost-server/v6 |
Cross site scripting in Cloudreve CVE-2022-32167, GHSA-fg25-gq9g-32mx | Medium | 0.6% | 21 Sep, 2022 | Go github.com/HFO4/cloudreve Go github.com/cloudreve/Cloudreve/v3 |
SFTPGo WebClient vulnerable to Cross-site Scripting CVE-2022-39220, GHSA-cf7g-cm7q-rq7f, GO-2022-1015 | Medium | 0.6% | 20 Sep, 2022 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |
Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions CVE-2022-36109, GHSA-rc4r-wh2q-q6c4, GO-2022-0985 | Medium | 1.1% | 16 Sep, 2022 | Go github.com/docker/docker |
Harbor fails to validate the user permissions when updating a robot account BIT-harbor-2022-31667, CVE-2022-31667, GHSA-xx9w-464f-7h6f | Medium | 0.5% | 16 Sep, 2022 | Go github.com/goharbor/harbor |
Harbor fails to validate the user permissions when updating tag immutability policies BIT-harbor-2022-31669, CVE-2022-31669, GHSA-8c6p-v837-77f6 | Medium | 0.4% | 16 Sep, 2022 | Go github.com/goharbor/harbor |
Cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature BIT-cosign-2022-36056, CVE-2022-36056, GHSA-8gw7-4j42-w388, GO-2022-0998 | Medium | 0.1% | 16 Sep, 2022 | Go github.com/sigstore/cosign |
nftables binding to an already bound chain GHSA-jr8j-2jhp-m67v | Medium | Not scored | 16 Sep, 2022 | Go github.com/siderolabs/talos |
ouqiang gocron Cross-site scripting vulnerability CVE-2022-40365, GHSA-r947-2crg-xc39 | Medium | 0.6% | 15 Sep, 2022 | Go github.com/ouqiang/gocron |
Gophish before 0.12.0 vulnerable to Open Redirect CVE-2022-25295, GHSA-hvw3-p9px-gpc9, GO-2022-0987 | Medium | 0.7% | 12 Sep, 2022 | Go github.com/gophish/gophish |
Harbor fails to validate the user permissions when reading job execution logs through the P2P preheat execution logs BIT-harbor-2022-31671, CVE-2022-31671, GHSA-q76q-q8hw-hmpw | Medium | 0.5% | 09 Sep, 2022 | Go github.com/goharbor/harbor |
Pinniped Supervisor Insufficient Session Expiration vulnerability BIT-pinniped-2022-31677, CVE-2022-31677, GHSA-rp4v-hhm6-rcv9, GO-2022-0981 | Medium | 0.5% | 01 Sep, 2022 | Go go.pinniped.dev |
Helm Vulnerable to denial of service through string value parsing BIT-helm-2022-36055, CVE-2022-36055, GHSA-7hfp-qfw3-5jxh, GO-2022-0962 | Medium | 1.1% | 30 Aug, 2022 | Go helm.sh/helm/v3 |
Network Policies & (Clusterwide) Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels GHSA-pfhr-pccp-hwmh, GO-2022-0959 | Medium | Not scored | 30 Aug, 2022 | Go github.com/cilium/cilium |
gomatrixserverlib and Dendrite vulnerable to incorrect parsing of the event default power level in event auth CVE-2022-36009, GHSA-grvv-h2f9-7v9c, GO-2022-0952 | Medium | 0.8% | 22 Aug, 2022 | Go github.com/matrix-org/dendrite Go github.com/matrix-org/gomatrixserverlib |
Gitea allowed assignment of private issues BIT-gitea-2022-38183, CVE-2022-38183, GHSA-fhv8-m4j4-cww2, GO-2024-2769 | Medium | 0.9% | 13 Aug, 2022 | Go code.gitea.io/gitea |
Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks CVE-2022-37450, GHSA-rqmg-hrg4-fm69 | Medium | 1.3% | 06 Aug, 2022 | Go github.com/ethereum/go-ethereum |
FlyteAdmin Insufficient AccessToken Expiration Check CVE-2022-31145, GHSA-qwrj-9hmp-gpxh, GO-2022-0519 | Medium | 1.0% | 15 Jul, 2022 | Go github.com/flyteorg/flyteadmin |
Mattermost users could access some sensitive information via API call BIT-mattermost-2022-2401, CVE-2022-2401, GHSA-7ggc-5r84-xf54, GO-2022-0540 | Medium | 0.8% | 15 Jul, 2022 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
DoS in KubeEdge's Websocket Client in package Viaduct CVE-2022-31080, GHSA-6wvc-6pww-qr4r, GO-2022-0512 | Medium | 0.7% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
KubeEdge Cloud Stream and Edge Stream DoS from large stream message CVE-2022-31079, GHSA-wrcr-x4qj-j543, GO-2022-0511 | Medium | 0.7% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
KubeEdge CloudCore Router memory exhaustion vulnerability CVE-2022-31078, GHSA-qpx3-9565-5xwm, GO-2022-0510 | Medium | 0.7% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
KubeEdge DoS when signing the CSR from EdgeCore CVE-2022-31075, GHSA-x3px-2p95-f6jr, GO-2022-0509 | Medium | 1.0% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
KubeEdge Cloud AdmissionController component DoS CVE-2022-31074, GHSA-w52j-3457-q9wr, GO-2022-0508 | Medium | 0.8% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
KubeEdge Edge ServiceBus module DoS CVE-2022-31073, GHSA-vwm6-qc77-v2rh, GO-2022-0507 | Medium | 1.7% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
Insecure cookies in Openshift Origin CVE-2015-3207, GHSA-rqph-25q9-9jhp, GO-2022-0505 | Medium | 0.7% | 07 Jul, 2022 | Go github.com/openshift/origin |
DOS and excessive memory usage when passing untrusted user input to to dag import GHSA-f2gr-7299-487h | Medium | Not scored | 06 Jul, 2022 | Go github.com/ipfs/go-ipfs |
Malformed CAR panics and excessive memory usage GHSA-9x4h-8wgm-8xfg, GO-2022-0503 | Medium | Not scored | 06 Jul, 2022 | Go github.com/ipld/go-car Go github.com/ipld/go-car/v2 |
CloudCore UDS Server: Malicious Message can crash CloudCore CVE-2022-31076, GHSA-8f4f-v9x5-cg6j, GO-2022-0500 | Medium | 0.6% | 25 Jun, 2022 | Go github.com/kubeedge/kubeedge |
CloudCore CSI Driver: Malicious response from KubeEdge can crash CSI Driver controller server CVE-2022-31077, GHSA-x938-fvfw-7jh5, GO-2022-0501 | Medium | 0.8% | 25 Jun, 2022 | Go github.com/kubeedge/kubeedge |
golang.org/x/sys/unix has Incorrect privilege reporting in syscall BIT-golang-2022-29526, CVE-2022-29526, GHSA-p782-xgp4-8hr8, GO-2022-0493 | Medium | 3.0% | 24 Jun, 2022 | Go golang.org/x/sys Go stdlib |
DoS through large manifest files in Argo CD CVE-2022-31016, GHSA-jhqp-vf4w-rpwq, GO-2022-0495 | Medium | 0.9% | 21 Jun, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |