Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mattermost Server is vulnerable to XSS through author_link field in Slack attachments CVE-2017-18879, GHSA-498j-wxww-j897, GO-2025-4189 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider CVE-2017-18883, GHSA-w8cc-3h7q-jhc3, GO-2025-4198 | Medium | 1.1% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes team creator's e-mail address to other members CVE-2017-18887, GHSA-35c4-5qfp-wxj6, GO-2025-4199 | Medium | 0.9% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows XSS via redirect URL CVE-2016-11079, GHSA-2j9c-76pp-xc5q, GO-2025-4053 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes account details to any Team Administrator CVE-2016-11080, GHSA-g3f3-p9rc-775p, GO-2025-4063 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes information stored by a web browser CVE-2016-11081, GHSA-5q37-9874-qxcw, GO-2025-4062 | Medium | 0.8% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS through crafted links CVE-2016-11082, GHSA-m78r-2x6w-qqjp, GO-2025-4064 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution CVE-2016-11083, GHSA-rm24-25xm-9454, GO-2025-4065 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows XSS via CSRF CVE-2016-11084, GHSA-vw57-55f8-c73q, GO-2025-4066 | Medium | 0.3% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization CVE-2017-18872, GHSA-hgrp-fgm8-56g8, GO-2025-4075 | Medium | 0.6% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to Directory Traversal by System Admins CVE-2017-18874, GHSA-8qg8-c7mw-6fj7, GO-2025-4148 | Medium | 1.2% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to Uncontrolled Resource Consumption CVE-2016-11067, GHSA-ffcc-qr2v-3qmv, GO-2025-4046 | Medium | 1.1% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to Code Injection through its LDAP fields CVE-2016-11068, GHSA-7vmw-6c7h-rrrv, GO-2025-4048 | Medium | 0.9% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS through customizable theme color-code values CVE-2016-11070, GHSA-h8qw-xqm9-q66j, GO-2025-4050 | Medium | 0.6% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener` CVE-2016-11071, GHSA-h3qg-w9j5-wh3m, GO-2025-4058 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server's Session ID and Session Token are potentially compromised CVE-2016-11072, GHSA-43m6-wvc8-2m7j, GO-2025-4055 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS via a Legal or Support setting CVE-2016-11073, GHSA-9jrx-fgrm-96qh, GO-2025-4056 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes sensitive information about team URLs via an API CVE-2016-11075, GHSA-q3g9-hgrx-hwhx, GO-2025-4061 | Medium | 0.9% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes sensitive information via its System Console UI CVE-2016-11078, GHSA-9w4v-9c99-hv7r, GO-2025-4057 | Medium | 0.9% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Mattermost Server vulnerable to Cross-site Scripting through file preview feature CVE-2016-11063, GHSA-cffj-7w5c-jqjh, GO-2025-4045 | Medium | 0.7% | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
containernetworking/plugins vulnerable to MitM attacks CVE-2020-10749, GHSA-fx6x-h9g4-56f8, GO-2023-1915 | Medium | 2.1% | 24 May, 2022 | Go github.com/containernetworking/plugins |
Grafana XSS via a column style CVE-2018-18624, GHSA-9hv8-4frf-cprf, GO-2024-2516 | Medium | 1.4% | 24 May, 2022 | Go github.com/grafana/grafana |
Grafana XSS via the OpenTSDB datasource BIT-grafana-2020-13430, CVE-2020-13430, GHSA-7m2x-qhrq-rp8h, GO-2024-2515 | Medium | 1.9% | 24 May, 2022 | Go github.com/grafana/grafana |
Grafana XSS in header column rename BIT-grafana-2020-12245, CVE-2020-12245, GHSA-ccmg-w4xm-p28v, GO-2024-2517 | Medium | 2.0% | 24 May, 2022 | Go github.com/grafana/grafana |
Argo Exposure of Sensitive Information CVE-2018-21034, GHSA-xj7v-c82w-92q2, GO-2023-1952 | Medium | 1.4% | 24 May, 2022 | Go github.com/argoproj/argo-cd |
Podman has Files or Directories Accessible to External Parties CVE-2020-1726, GHSA-vmhj-p9hw-vgrf, GO-2023-1544 | Medium | 1.8% | 24 May, 2022 | Go github.com/containers/libpod Go github.com/containers/libpod/v2 Go github.com/containers/podman Go github.com/containers/podman/v2 |
Kubernetes ingress exposes sensitive information CVE-2018-1002104, GHSA-p3x5-5xpx-9phm | Medium | 1.1% | 24 May, 2022 | Go k8s.io/ingress-nginx |
Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access CVE-2019-11255, GHSA-f4w6-3rh6-6q4q | Medium | 2.0% | 24 May, 2022 | Go github.com/kubernetes-csi/external-provisioner Go github.com/kubernetes-csi/external-resizer Go github.com/kubernetes-csi/external-snapshotter/v6 |
Podman Symlink Vulnerability CVE-2019-18466, GHSA-r34v-gqmw-qvgj, GO-2023-1942 | Medium | 1.4% | 24 May, 2022 | Go github.com/containers/libpod Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 +1 more |
Gophish XSS Vulnerability CVE-2019-16146, GHSA-9h9f-9q8g-6764, GO-2023-1936 | Medium | 0.7% | 24 May, 2022 | Go github.com/gophish/gophish |
cnlh nps vulnerable to file overwrite by local user CVE-2019-15119, GHSA-2vp2-8m5j-4rjx, GO-2025-3625 | Medium | 1.0% | 24 May, 2022 | Go ehang.io/nps Go github.com/cnlh/nps |
Gitea XSS Vulnerability CVE-2019-1010261, GHSA-5rh7-6gfj-mc87, GO-2023-1922 | Medium | 0.8% | 24 May, 2022 | Go code.gitea.io/gitea |
Gitea XSS Vulnerability in Repository Description CVE-2019-1010314, GHSA-hqx2-j33x-9fc4 | Medium | 0.8% | 24 May, 2022 | Go code.gitea.io/gitea |
Grafana Cross-site Scripting vulnerability CVE-2019-13068, GHSA-7phr-6cc9-4m5q | Medium | 51.9% | 24 May, 2022 | Go github.com/grafana/grafana |
Rancher Login Parameter Can Be Edited CVE-2019-11881, GHSA-2p4g-jrmx-r34m, GO-2024-2761 | Medium | 2.0% | 24 May, 2022 | Go github.com/rancher/rancher |
Golang/x/crypto message forgery vulnerability CVE-2019-11841, GHSA-x3jr-pf6g-c48f, GO-2023-1992 | Medium | 2.0% | 24 May, 2022 | Go golang.org/x/crypto |
golang.org/x/crypto/salsa20/salsa uses insufficiently random values CVE-2019-11840, GHSA-r5c5-pr8j-pfp7, GO-2022-0209 | Medium | 3.5% | 24 May, 2022 | Go golang.org/x/crypto |
Login screen allows message spoofing if SSO is enabled CVE-2022-24905, GHSA-xmg8-99r8-jc2j, GO-2022-0454 | Medium | 1.3% | 24 May, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server CVE-2022-24904, GHSA-6gcg-hp2x-q54h, GO-2022-0453 | Medium | 1.2% | 23 May, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
HashiCorp Vault improper configuration of multi factor authentication BIT-vault-2022-30689, CVE-2022-30689, GHSA-c5wc-v287-82pc, GO-2022-0590 | Medium | 1.2% | 18 May, 2022 | Go github.com/hashicorp/vault |
tar-split memory exhaustion CVE-2017-14992, GHSA-hqwh-8xv9-42hw, GO-2025-3640 | Medium | 2.5% | 17 May, 2022 | Go github.com/vbatts/tar-split |
Docker Moby /proc/scsi Path Exposure Allows Host Data Loss (SCSI MICDROP) CVE-2017-16539, GHSA-vfjc-2qcw-j95j | Medium | 1.8% | 17 May, 2022 | Go github.com/moby/moby |
Gogs XSS Vulnerability CVE-2018-17031, GHSA-px5r-fqj6-r2f8, GO-2023-1972 | Medium | 0.9% | 14 May, 2022 | Go gogs.io/gogs |
Grafana XSS Vulnerability CVE-2018-1000816, GHSA-x5fh-fvvr-892f | Medium | 0.7% | 14 May, 2022 | Go github.com/grafana/grafana |
HashiCorp Consul can use cleartext agent-to-agent RPC communication CVE-2018-19653, GHSA-4qvx-qq5w-695p, GO-2023-1850 | Medium | 1.2% | 14 May, 2022 | Go github.com/hashicorp/consul |
Helm Path Traversal CVE-2019-1000008, GHSA-xrxm-mvqm-r553, GO-2023-1948 | Medium | 1.5% | 14 May, 2022 | Go helm.sh/helm |
Hydra has Reflected XSS via error_hint parameter CVE-2019-8400, GHSA-7v6r-w4r6-mhch, GO-2026-4861 | Medium | 1.3% | 14 May, 2022 | Go github.com/ory/hydra |
github.com/gofiber/fiber/v2 vulnerable to Origin Validation Error CVE-2018-20744, GHSA-927h-x4qj-r242, GO-2023-1792 | Medium | 0.7% | 14 May, 2022 | Go github.com/gofiber/fiber/v2 Go github.com/rs/cors |
Singularity Incorrect Access Control CVE-2018-12021, GHSA-4x32-h296-rg6j | Medium | 1.5% | 14 May, 2022 | Go github.com/hpcng/singularity |
Kubernetes arbitrary file overwrite CVE-2017-1002102, GHSA-mm7g-f2gg-cw8g, GO-2023-1977 | Medium | 1.1% | 13 May, 2022 | Go k8s.io/kubernetes |