Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server CVE-2022-31036, GHSA-q4w5-4gq2-98vm, GO-2022-0499 | Medium | 0.9% | 21 Jun, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Configuration API in EdgeXFoundry 2.1.0 and earlier exposes message bus credentials to local unauthenticated users CVE-2022-31066, GHSA-g63h-q855-vp3q, GO-2022-0491 | Medium | 0.3% | 17 Jun, 2022 | Go github.com/edgexfoundry/app-functions-sdk-go Go github.com/edgexfoundry/app-functions-sdk-go/v2 Go github.com/edgexfoundry/device-sdk-go Go github.com/edgexfoundry/device-sdk-go/v2 |
Ill-formed headers may lead to unexpected behavior in Istio CVE-2022-31045, GHSA-xwx5-5c9g-x68x | Medium | 1.2% | 10 Jun, 2022 | Go istio.io/istio |
Cross-site Scripting vulnerability in repository issue list in Gogs CVE-2022-31038, GHSA-xq4v-vrp9-vcf2, GO-2022-0483 | Medium | 0.7% | 08 Jun, 2022 | Go gogs.io/gogs |
Calico vulnerable to pod route hijacking CVE-2022-28224, GHSA-9394-xfq9-6qrp | Medium | 0.6% | 07 Jun, 2022 | Go github.com/projectcalico/calico |
containerd CRI plugin: Host memory exhaustion through ExecSync CVE-2022-31030, GHSA-5ffw-gxpp-mxpf, GO-2022-0482 | Medium | 0.4% | 06 Jun, 2022 | Go github.com/containerd/containerd |
Missing Role Based Access Control for the REST handlers in bleve/http package CVE-2022-31022, GHSA-9w9f-6mg8-jp7w, GO-2022-0470 | Medium | 0.3% | 03 Jun, 2022 | Go github.com/blevesearch/bleve Go github.com/blevesearch/bleve/v2 |
Uncontrolled Resource Consumption in Mattermost server BIT-mattermost-2022-1982, CVE-2022-1982, GHSA-gwpf-95jc-63rv | Medium | 0.9% | 03 Jun, 2022 | Go github.com/mattermost/mattermost-server |
Open redirect in caddy CVE-2022-29718, GHSA-2927-hv3p-f3vp | Medium | 1.1% | 03 Jun, 2022 | Go github.com/caddyserver/caddy Go github.com/caddyserver/caddy/v2 |
Stored Cross-site Scripting in gitea BIT-gitea-2022-1928, CVE-2022-1928, GHSA-ph3w-2843-72mx, GO-2022-0612 | Medium | 0.8% | 30 May, 2022 | Go code.gitea.io/gitea |
Ignition config accessible to unprivileged software on VMware CVE-2022-1706, GHSA-hj57-j5cw-2mwp, GO-2022-0451 | Medium | 1.3% | 25 May, 2022 | Go github.com/coreos/ignition Go github.com/coreos/ignition/v2 |
Pion/DLTS Accepts Client Certificates Without CertificateVerify CVE-2022-29222, GHSA-w45j-f832-hxvh, GO-2022-0462 | Medium | 0.8% | 25 May, 2022 | Go github.com/pion/dtls Go github.com/pion/dtls/v2 |
Pion/DTLS contains buffer for inbound DTLS fragments with no limit CVE-2022-29189, GHSA-cx94-mrg9-rq4j, GO-2022-0461 | Medium | 2.1% | 24 May, 2022 | Go github.com/pion/dtls Go github.com/pion/dtls/v2 |
Smokescreen SSRF via deny list bypass (square brackets) CVE-2022-29188, GHSA-qwrf-gfpj-qvj6, GO-2022-0459 | Medium | 0.9% | 24 May, 2022 | Go github.com/stripe/smokescreen |
openark/orchestrator cross-site scripting vulnerability CVE-2021-27940, GHSA-752c-vfpf-cp2w | Medium | 1.2% | 24 May, 2022 | Go github.com/openark/orchestrator |
InfluxDB Reflected Cross-site Scripting CVE-2018-17572, GHSA-w55x-q3gv-px85 | Medium | 0.7% | 24 May, 2022 | Go github.com/influxdata/influxdb |
DoS via malicious p2p message in Go Ethereum CVE-2022-29177, GHSA-wjxw-gh3m-7pm5, GO-2022-0456 | Medium | 1.2% | 24 May, 2022 | Go github.com/ethereum/go-ethereum |
Cross-site Scripting in Gogs CVE-2022-1464, GHSA-ff28-f46g-r9g8, GO-2022-0597 | Medium | 0.7% | 24 May, 2022 | Go gogs.io/gogs |
golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion BIT-golang-2021-31525, CVE-2021-31525, GHSA-h86h-8ppg-mxmh, GO-2022-0236 | Medium | 3.7% | 24 May, 2022 | Go golang.org/x/net Go stdlib |
HashiCorp Consul Cross-site Scripting vulnerability BIT-consul-2020-25864, CVE-2020-25864, GHSA-8xmx-h8rq-h94j, GO-2023-1851 | Medium | 6.1% | 24 May, 2022 | Go github.com/hashicorp/consul |
MongoDB Tools Improper Certificate Validation vulnerability CVE-2020-7924, GHSA-6cwm-wm82-hgrw, GO-2024-2550 | Medium | 0.7% | 24 May, 2022 | Go github.com/mongodb/mongo-tools |
Rancher Cross-site Scripting Vulnerability CVE-2021-25313, GHSA-6m8r-jh89-rq7h | Medium | 1.5% | 24 May, 2022 | Go github.com/rancher/rancher |
Default inheritable capabilities for linux container should be empty CVE-2022-29162, GHSA-f3fp-gc8g-vw66, GO-2022-0452 | Medium | 0.4% | 24 May, 2022 | Go github.com/opencontainers/runc |
Heketi logs sensitive information CVE-2020-10763, GHSA-rm7c-x6gj-2mr8 | Medium | 0.4% | 24 May, 2022 | Go github.com/heketi/heketi |
Grafana XSS via a query alias for the ElasticSearch datasource BIT-grafana-2020-24303, CVE-2020-24303, GHSA-mvpr-q6rh-8vrp, GO-2024-2520 | Medium | 2.1% | 24 May, 2022 | Go github.com/grafana/grafana |
Gophish vulnerable to Server-Side Request Forgery CVE-2020-24710, GHSA-9c9w-9pq7-f35h, GO-2023-1982 | Medium | 1.3% | 24 May, 2022 | Go github.com/gophish/gophish |
ingress-nginx component for Kubernetes allows file overwrite CVE-2020-8553, GHSA-hhpm-74pm-hf35 | Medium | 0.9% | 24 May, 2022 | Go k8s.io/ingress-nginx |
Grafana stored XSS BIT-grafana-2020-11110, CVE-2020-11110, GHSA-xr3x-62qw-vc4w, GO-2024-2523 | Medium | 9.6% | 24 May, 2022 | Go github.com/grafana/grafana |
Mattermost Server Sensitive Data Exposure BIT-mattermost-2020-14457, CVE-2020-14457, GHSA-j2h2-cvwh-cr64, GO-2023-1939 | Medium | 0.9% | 24 May, 2022 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 |
Mattermost Server has Improper Authorization for Integration Requests CVE-2017-18916, GHSA-x33g-375j-jhf7, GO-2026-4467 | Medium | 0.8% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not restrict SAML certificate path for System Administrators CVE-2017-18918, GHSA-5ghq-28r7-qwfj, GO-2026-4460 | Medium | 0.5% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes private team invite ID CVE-2017-18901, GHSA-c253-8hr4-r8v9, GO-2026-4304 | Medium | 0.9% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes team invite IDs through API endpoints CVE-2017-18902, GHSA-jwfv-5hwq-f97r, GO-2025-4185 | Medium | 0.9% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server vulnerable to XSS via an uploaded file CVE-2017-18904, GHSA-8pff-p3gx-w4jf, GO-2026-4302 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider CVE-2017-18905, GHSA-g24c-fx4v-xg9w, GO-2026-4306 | Medium | 0.8% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server vulnerable to XSS through channel headers CVE-2017-18907, GHSA-42x9-rr3c-gr59, GO-2026-4459 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows attackers to create buttons that can launch API requests CVE-2017-18890, GHSA-m497-hq5x-6jcv, GO-2025-4202 | Medium | 0.8% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not safeguard against phishing via error page links CVE-2017-18891, GHSA-vrh2-rprg-rgc6, GO-2026-4298 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not neutralize HTML content in an Email template field CVE-2017-18892, GHSA-wj5w-qghh-gvqp, GO-2026-4317 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS through display name field CVE-2017-18893, GHSA-887v-xh2x-47cm, GO-2026-4296 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes sensitive user status information via REST API version 4 endpoint CVE-2017-18895, GHSA-h742-xx59-r9pq, GO-2026-4295 | Medium | 0.9% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint CVE-2017-18896, GHSA-63wg-qmrv-7q66, GO-2026-4299 | Medium | 0.8% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server mishandles redirect denial action CVE-2017-18897, GHSA-f7c3-7vp3-44p6, GO-2026-4301 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to DoS through maliciously crafted posts CVE-2017-18898, GHSA-9589-mq83-f749, GO-2026-4300 | Medium | 1.1% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to webhook and slash command manipulation CVE-2017-18889, GHSA-jp57-4x34-5v94, GO-2025-4201 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to channel invisibility DoS via misformatted post CVE-2017-18873, GHSA-x6mw-hf2j-vqpc, GO-2026-4282 | Medium | 1.1% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not prevent System Admin from arbitrary file creation CVE-2017-18875, GHSA-9rr5-q43r-ccv4, GO-2025-4186 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to Path Traversal when files are stored locally CVE-2017-18876, GHSA-hjqh-j6rj-gh8q, GO-2025-4187 | Medium | 0.9% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page CVE-2017-18877, GHSA-9x8x-w6g5-hx4w, GO-2025-4190 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows users with a session ID to revoke another users' session CVE-2017-18878, GHSA-h564-6gc2-fcc6, GO-2025-4191 | Medium | 0.8% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |