Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
NULL Pointer Dereference in Kubernetes CSI snapshot-controller CVE-2020-8569, GHSA-hwrr-rhmm-vcvf | Medium | 2.2% | 15 Feb, 2022 | Go github.com/kubernetes-csi/external-snapshotter/v2 Go github.com/kubernetes-csi/external-snapshotter/v3 |
Denial of service in Grafana BIT-grafana-2021-27358, CVE-2021-27358, GHSA-h5rh-w6vm-9ghc | Medium | 83.0% | 15 Feb, 2022 | Go github.com/grafana/grafana |
On Windows, `git-sizer` might run a `git` executable within the repository being analyzed GHSA-57q7-rxqq-7vgp, GO-2022-0424 | Medium | Not scored | 15 Feb, 2022 | Go github.com/github/git-sizer |
Improper input validation in umoci CVE-2021-29136, GHSA-9m95-8hx6-7p9v, GO-2022-0815 | Medium | 0.3% | 15 Feb, 2022 | Go github.com/opencontainers/umoci |
HashiCorp Nomad Artifact Download Race Condition CVE-2022-24686, GHSA-gwmc-6795-qghj, GO-2022-0600 | Medium | 0.9% | 15 Feb, 2022 | Go github.com/hashicorp/nomad |
Symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations in dbdeployer CVE-2020-26277, GHSA-47wr-426j-fr82, GO-2022-0787 | Medium | 1.2% | 12 Feb, 2022 | Go github.com/datacharmer/dbdeployer |
"catalog's registry v2 api exposed on unauthenticated path in Harbor" BIT-harbor-2020-29662, CVE-2020-29662, GHSA-38r5-34mr-mvm7, GO-2022-0785 | Medium | 0.7% | 12 Feb, 2022 | Go github.com/goharbor/harbor |
Improper Validation of Certificate with Host Mismatch in mellium.im/xmpp/websocket CVE-2022-24968, GHSA-h289-x5wc-xcv8, GHSA-m658-p24x-p74r, GO-2022-0370 | Medium | 0.5% | 12 Feb, 2022 | Go mellium.im/xmpp |
GitHub CLI can execute a git binary from the current directory GHSA-fqfh-778m-2v32, GO-2022-0395 | Medium | Not scored | 11 Feb, 2022 | Go github.com/cli/cli |
containerd v1.2.x can be coerced into leaking credentials during image pull CVE-2020-15157, GHSA-742w-89gc-8m9c, GO-2022-0803 | Medium | 2.3% | 11 Feb, 2022 | Go github.com/containerd/containerd |
CBC padding oracle issue in AWS S3 Crypto SDK for golang CVE-2020-8911, GHSA-f5pg-7wfw-84q9, GO-2022-0646 | Medium | 0.3% | 11 Feb, 2022 | Go github.com/aws/aws-sdk-go |
AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field CVE-2022-2582, GHSA-6jvc-q2x7-pchv, GHSA-76wf-9vgp-pj7w, GO-2022-0391 | Medium | 0.5% | 11 Feb, 2022 | Go github.com/aws/aws-sdk-go |
Traefik vulnerable to Open Redirect via handling of X-Forwarded-Prefix header CVE-2020-15129, GHSA-6qq8-5wq3-86rp | Medium | 8.0% | 11 Feb, 2022 | Go github.com/containous/traefik Go github.com/containous/traefik/api Go github.com/containous/traefik/v2 Go github.com/containous/traefik/v2/pkg/api +4 more |
Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030) CVE-2019-19030, GHSA-q9x4-q76f-5h5j, GO-2022-0704 | Medium | 2.0% | 11 Feb, 2022 | Go github.com/goharbor/harbor |
Incorrect Permission Assignment for Critical Resource in CRI-O CVE-2022-0532, GHSA-jqmc-79gx-7g8p, GO-2022-0608 | Medium | 0.8% | 11 Feb, 2022 | Go github.com/cri-o/cri-o |
Cross-site Scripting in Gitea BIT-gitea-2021-45329, CVE-2021-45329, GHSA-r3gq-wxqf-q4gh, GO-2022-0314 | Medium | 0.8% | 10 Feb, 2022 | Go github.com/go-gitea/gitea |
User object created with invalid provider data in GoTrue GHSA-wpfr-6297-9v57, GO-2022-0365 | Medium | Not scored | 09 Feb, 2022 | Go github.com/netlify/gotrue |
Incorrect Calculation in github.com/open-policy-agent/opa CVE-2022-23628, GHSA-hcw3-j74m-qc58, GO-2022-0316 | Medium | 1.0% | 09 Feb, 2022 | Go github.com/open-policy-agent/opa |
Gitea displaying raw OpenID error in UI BIT-gitea-2021-45325, CVE-2021-45325, GHSA-8h8p-x289-vvqr, GO-2022-0308 | Medium | 1.0% | 09 Feb, 2022 | Go github.com/go-gitea/gitea |
Open redirect in Gitea BIT-gitea-2021-45328, CVE-2021-45328, GHSA-36h2-95gj-w488, GO-2022-0579 | Medium | 1.0% | 09 Feb, 2022 | Go github.com/go-gitea/gitea |
Unverified Ownership in Kubernetes CVE-2020-8554, GHSA-j9wf-vvm6-4r9w | Medium | 8.7% | 08 Feb, 2022 | Go k8s.io/kubernetes |
Limited ability to spoof SAML authentication with missing audience verification in Fleet CVE-2022-23600, GHSA-ch68-7cf4-35vr | Medium | 0.9% | 07 Feb, 2022 | Go github.com/fleetdm/fleet/v4 |
Command injection in gh-ost CVE-2022-21687, GHSA-rrp4-2xx3-mv29, GO-2022-0298 | Medium | 1.0% | 01 Feb, 2022 | Go github.com/github/gh-ost |
Go-Attestation Improper Input Validation with attacker-controlled TPM Quote CVE-2022-0317, GHSA-99cg-575x-774p, GO-2022-0294 | Medium | 0.1% | 01 Feb, 2022 | Go github.com/google/go-attestation |
SQL injection in github.com/navidrome/navidrome CVE-2022-23857, GHSA-pmcr-2rhp-36hr, GO-2022-0302 | Medium | 0.9% | 27 Jan, 2022 | Go github.com/navidrome/navidrome |
Denial of Service in graphql-go CVE-2022-21708, GHSA-mh3m-8c74-74xh, GO-2022-0300 | Medium | 1.2% | 27 Jan, 2022 | Go github.com/graph-gophers/graphql-go |
Subdomain Takeover in Interactsh server CVE-2023-36474, GHSA-m36x-mgfh-8g78, GO-2022-0372 | Medium | 0.5% | 27 Jan, 2022 | Go github.com/projectdiscovery/interactsh |
Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman CVE-2021-4024, GHSA-3cf2-x423-x582, GO-2022-0281 | Medium | 1.1% | 06 Jan, 2022 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 |
Information Exposure in RunC CVE-2016-9962, GHSA-gp4j-w3vj-7299, GO-2022-0835 | Medium | 0.4% | 20 Dec, 2021 | Go github.com/opencontainers/runc |
Signature verification failure in Tendermint GHSA-f3w5-v9xx-rp8p | Medium | Not scored | 20 Dec, 2021 | Go github.com/tendermint/tendermint |
Open redirect vulnerability in Sourcegraph CVE-2020-12283, GHSA-mx43-r985-5h4m | Medium | 1.3% | 20 Dec, 2021 | Go github.com/sourcegraph/sourcegraph |
Open Redirect in oauth2_proxy CVE-2017-1000070, GHSA-jm34-xm8m-w958 | Medium | 1.0% | 20 Dec, 2021 | Go github.com/bitly/oauth2_proxy |
The pattern '/\domain.com' is not disallowed when redirecting, allowing for open redirect BIT-oauth2-proxy-2020-5233, CVE-2020-5233, GHSA-qqxw-m5fj-f7gv | Medium | 1.3% | 20 Dec, 2021 | Go github.com/oauth2-proxy/oauth2-proxy |
Open Redirect in OAuth2 Proxy BIT-oauth2-proxy-2020-4037, CVE-2020-4037, GHSA-5m6c-jp6f-2vcv | Medium | 0.9% | 20 Dec, 2021 | Go github.com/oauth2-proxy/oauth2-proxy |
Observable Discrepancy in Argo BIT-argo-cd-2020-11576, CVE-2020-11576, GHSA-vj54-cjrx-x696, GO-2022-0882 | Medium | 2.0% | 09 Dec, 2021 | Go github.com/argoproj/argo-cd |
Instance config inline secret exposure in Grafana CVE-2021-41090, GHSA-9c4x-5hgq-q3wh, GO-2022-0305 | Medium | 0.8% | 08 Dec, 2021 | Go github.com/grafana/agent |
Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration in RunC CVE-2021-43784, GHSA-v95c-p5hm-xq8f, GO-2022-0274 | Medium | 1.8% | 07 Dec, 2021 | Go github.com/opencontainers/runc |
Cross-site Scripting in github.com/schollz/rwtxt CVE-2021-20848, GHSA-458f-26r3-x2c3, GO-2022-0231 | Medium | 0.9% | 29 Nov, 2021 | Go github.com/schollz/rwtxt |
Denial of Service in Go-Ethereum CVE-2021-43668, GHSA-5m8f-chrv-7rw5 | Medium | 0.3% | 23 Nov, 2021 | Go github.com/ethereum/go-ethereum |
Broken encryption in EdgeX Foundry CVE-2021-41278, GHSA-6c7m-qwxj-mvhp | Medium | 0.4% | 19 Nov, 2021 | Go github.com/edgexfoundry/app-functions-sdk-go Go github.com/edgexfoundry/app-functions-sdk-go/v2 Go github.com/edgexfoundry/app-service-configurable |
OctoRPKI crashes when processing GZIP bomb returned via malicious repository CVE-2021-3912, GHSA-g9wh-3vrx-r7hg, GO-2022-0253 | Medium | 0.9% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Infinite certificate chain depth results in OctoRPKI running forever CVE-2021-3908, GHSA-g5gj-9ggf-9vmq, GO-2022-0249 | Medium | 0.7% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Infinite open connection causes OctoRPKI to hang forever CVE-2021-3909, GHSA-8cvr-4rrf-f244, GO-2022-0250 | Medium | 1.6% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Misconfigured IP address field in ROA leads to OctoRPKI crash CVE-2021-3911, GHSA-w6ww-fmfx-2x22, GO-2022-0252 | Medium | 0.9% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server CVE-2021-22565, GHSA-wx8q-rgfr-cf6v, GO-2022-0270 | Medium | 0.4% | 10 Nov, 2021 | Go github.com/google/exposure-notifications-verification-server |
OIDC claims not updated from Identity Provider in Pomerium CVE-2021-41230, GHSA-j6wp-3859-vxfg, GO-2021-0258 | Medium | 0.9% | 10 Nov, 2021 | Go github.com/pomerium/pomerium |
Improper Access Control in github.com/treeverse/lakefs GHSA-m836-gxwq-j2pm, GO-2022-0375 | Medium | Not scored | 28 Oct, 2021 | Go github.com/treeverse/lakefs |
Geth Node Vulnerable to DoS via maliciously crafted p2p message CVE-2021-41173, GHSA-59hh-656j-3p7v, GO-2022-0256 | Medium | 1.2% | 25 Oct, 2021 | Go github.com/ethereum/go-ethereum |
Authz Module Non-Determinism CVE-2021-41135, GHSA-2p6r-37p9-89p2 | Medium | 1.7% | 21 Oct, 2021 | Go github.com/cosmos/cosmos-sdk |
Email relay in Apache Traffic Control CVE-2021-42009, GHSA-gw97-f6h8-gm94, GO-2022-0602 | Medium | 2.8% | 13 Oct, 2021 | Go github.com/apache/trafficcontrol |