Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Insufficiently restricted permissions on plugin directories CVE-2021-41103, GHSA-c2h3-6mxw-7mvq, GO-2022-0938 | Medium | 0.5% | 04 Oct, 2021 | Go github.com/containerd/containerd |
Cross-site Scripting in Gitea BIT-gitea-2021-28378, CVE-2021-28378, GHSA-g95p-88p4-76cm, GO-2022-0832 | Medium | 8.8% | 27 Sep, 2021 | Go code.gitea.io/gitea |
Cross-site Scripting in Mattermost CVE-2021-37860, GHSA-hv5f-73mr-7vvj, GO-2022-0604 | Medium | 0.6% | 23 Sep, 2021 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 |
Improperly Implemented path matching for in-toto-golang CVE-2021-41087, GHSA-vrxp-mg9f-hwf3, GO-2022-0936 | Medium | 0.4% | 22 Sep, 2021 | Go github.com/in-toto/in-toto-golang |
Confused Deputy in Kubernetes CVE-2020-8561, GHSA-74j8-88mm-7496 | Medium | 2.1% | 21 Sep, 2021 | Go k8s.io/kubernetes |
Cross-site Scripting in Beego CVE-2021-39391, GHSA-c77f-4rgj-jfr4 | Medium | 0.8% | 15 Sep, 2021 | Go github.com/beego/beego/v2 |
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. BIT-consul-2021-38698, CVE-2021-38698, GHSA-6hw5-6gcx-phmw, GO-2022-0559 | Medium | 1.4% | 08 Sep, 2021 | Go github.com/hashicorp/consul |
Incomplete List of Disallowed Inputs in Kubernetes CVE-2021-25737, GHSA-mfv7-gq43-w965, GO-2022-0908 | Medium | 1.3% | 07 Sep, 2021 | Go k8s.io/kubernetes |
Path traversal in Grafana Loki CVE-2021-36156, GHSA-grj5-8x6q-hc9q | Medium | 1.5% | 02 Sep, 2021 | Go github.com/grafana/loki |
Traefik has an Improper Certificate Handling issue CVE-2020-9321, GHSA-7h6j-2268-fhcm, GO-2022-0808 | Medium | 0.7% | 02 Sep, 2021 | Go github.com/containous/traefik Go github.com/containous/traefik/v2 Go github.com/traefik/traefik |
Path traversal in Grafana Cortex CVE-2021-36157, GHSA-jphm-g89m-v42p | Medium | 1.4% | 02 Sep, 2021 | Go github.com/cortexproject/cortex |
Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault BIT-vault-2021-38554, CVE-2021-38554, GHSA-6239-28c2-9mrm, GO-2022-0632 | Medium | 0.9% | 30 Aug, 2021 | Go github.com/hashicorp/vault |
Ethereum Contains Consensus Flaw During Block Processing CVE-2021-39137, GHSA-9856-9gg9-qcmq, GO-2022-0254 | Medium | 1.3% | 30 Aug, 2021 | Go github.com/ethereum/go-ethereum |
Argo Server TLS requests could be forged by attacker with network access GHSA-6c73-2v8x-qpvm, GO-2022-0388 | Medium | Not scored | 23 Aug, 2021 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
Workflow re-write vulnerability using input parameter BIT-argo-workflows-2021-37914, CVE-2021-37914, GHSA-h563-xh25-x54q, GO-2022-0928 | Medium | 1.0% | 09 Aug, 2021 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
Header dropping in traefik CVE-2021-32813, GHSA-m697-4v8f-55qg, GO-2022-0923 | Medium | 1.1% | 05 Aug, 2021 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 |
Attack on Kubernetes via Misconfigured Argo Workflows GHSA-rc7p-gmvh-xfx2 | Medium | Not scored | 02 Aug, 2021 | Go github.com/argoproj/argo-workflows |
Incorrect Authorization in HashiCorp Consul BIT-consul-2020-7955, CVE-2020-7955, GHSA-r9w6-rhh9-7v53, GO-2022-0874 | Medium | 1.4% | 28 Jul, 2021 | Go github.com/hashicorp/consul |
Archive package allows chmod of file outside of unpack target directory CVE-2021-32760, GHSA-c72p-9xmj-rx3w, GO-2022-0921 | Medium | 1.6% | 26 Jul, 2021 | Go github.com/containerd/containerd |
Buildah processes using chroot isolation may leak environment values to intermediate processes CVE-2021-3602, GHSA-7638-r9r3-rmjj, GO-2022-0345 | Medium | 0.3% | 19 Jul, 2021 | Go github.com/containers/buildah |
Open Redirect in github.com/AndrewBurian/powermux CVE-2021-32721, GHSA-mj9r-wwm8-7q52, GO-2021-0237 | Medium | 0.6% | 01 Jul, 2021 | Go github.com/AndrewBurian/powermux |
Cross-site scripting in Dutchcoders transfer.sh CVE-2021-33496, GHSA-w3jx-wv97-67ph, GO-2022-0924 | Medium | 1.0% | 29 Jun, 2021 | Go github.com/dutchcoders/transfer.sh |
CRLF vulnerability in Fiber CVE-2020-15111, GHSA-9cx9-x2gp-9qvh, GO-2021-0108 | Medium | 0.9% | 29 Jun, 2021 | Go github.com/gofiber/fiber |
Consensus flaw during block processing in github.com/ethereum/go-ethereum CVE-2020-26265, GHSA-xw37-57qp-9mm4, GO-2021-0105 | Medium | 0.9% | 29 Jun, 2021 | Go github.com/ethereum/go-ethereum |
Denial of service in geth CVE-2020-26242, GHSA-jm5c-rv3w-w83m, GO-2021-0103 | Medium | 1.5% | 29 Jun, 2021 | Go github.com/ethereum/go-ethereum Go github.com/holiman/uint256 |
Shallow copy bug in geth CVE-2020-26241, GHSA-69v6-xc2j-r2jf, GO-2022-0771 | Medium | 1.2% | 29 Jun, 2021 | Go github.com/ethereum/go-ethereum |
Erroneous Proof of Work calculation in geth CVE-2020-26240, GHSA-v592-xf75-856p, GO-2022-0775 | Medium | 1.9% | 29 Jun, 2021 | Go github.com/ethereum/go-ethereum |
Open Redirect CVE-2018-15178, GHSA-cpgw-2wxr-pww3, GO-2022-0822 | Medium | 1.3% | 29 Jun, 2021 | Go gogs.io/gogs |
Improper network isolation in Hashicorp Nomad CVE-2021-32575, GHSA-vf6q-9f2f-mwhv, GO-2022-0709 | Medium | 0.5% | 24 Jun, 2021 | Go github.com/hashicorp/nomad |
Improper Neutralization of Special Elements in Output in helm.sh/helm/v3 BIT-helm-2021-21303, CVE-2021-21303, GHSA-c38g-469g-cmgx, GO-2022-1040 | Medium | 1.1% | 23 Jun, 2021 | Go helm.sh/helm/v3 |
Helm passes repository credentials to alternate domain BIT-helm-2021-32690, CVE-2021-32690, GHSA-56hp-xqp3-w2jf, GHSA-7jr6-prv4-5wf5, GO-2022-0384 | Medium | 1.4% | 23 Jun, 2021 | Go helm.sh/helm/v3 |
Unchecked hostname resolution could allow access to local network resources by users outside the local network GHSA-6rg3-8h8x-5xfv, GO-2022-0389 | Medium | Not scored | 23 Jun, 2021 | Go github.com/pterodactyl/wings |
Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings CVE-2021-32699, GHSA-jj6m-r8jc-2gp7, GO-2022-0919 | Medium | 0.3% | 23 Jun, 2021 | Go github.com/pterodactyl/wings |
Access Control Bypass CVE-2018-20321, GHSA-9qq2-xhmc-h9qr, GO-2022-0644 | Medium | 1.8% | 23 Jun, 2021 | Go github.com/rancher/rancher |
Incorrect Permission Assignment for Critical Resource in Hashicorp Consul BIT-consul-2020-12797, CVE-2020-12797, GHSA-hwqm-x785-qh8p, GO-2022-0847 | Medium | 1.5% | 23 Jun, 2021 | Go github.com/hashicorp/consul |
Control character injection in console output in github.com/ipfs/go-ipfs CVE-2020-26283, GHSA-r4gv-vj59-cccm, GO-2022-0873 | Medium | 1.5% | 23 Jun, 2021 | Go github.com/ipfs/go-ipfs |
Improper input validation in CNCF Cortex CVE-2021-31232, GHSA-m45g-f45x-vv22, GO-2022-0915 | Medium | 0.4% | 23 Jun, 2021 | Go github.com/cortexproject/cortex |
Cache Manipulation Attack in Apache Traffic Control CVE-2020-17522, GHSA-pw59-4qgf-jxr8 | Medium | 4.0% | 18 Jun, 2021 | Go github.com/apache/trafficcontrol |
go.mongodb.org/mongo-driver improperly validates cstrings when marshalling Go objects into BSON CVE-2021-20329, GHSA-f6mq-5m25-4r72, GO-2021-0112 | Medium | 0.9% | 15 Jun, 2021 | Go go.mongodb.org/mongo-driver |
Improper Input Validation CVE-2021-3499, GHSA-57v4-m9jx-mh8r | Medium | 0.8% | 08 Jun, 2021 | Go github.com/ovn-org/ovn-kubernetes |
Kiali Authentication Bypass vulnerability CVE-2021-20278, GHSA-ggjr-2f7v-vhq4, GO-2022-0700 | Medium | 0.8% | 01 Jun, 2021 | Go github.com/kiali/kiali |
Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint CVE-2021-32635, GHSA-5mv9-q7fq-9394 | Medium | 1.4% | 01 Jun, 2021 | Go github.com/sylabs/singularity |
Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint GHSA-jq42-hfch-42f3 | Medium | Not scored | 01 Jun, 2021 | Go github.com/hpcng/singularity |
Permissions bypass in KubeVirt CVE-2020-1701, GHSA-849r-8wvp-4wwg, GO-2024-2765 | Medium | 0.7% | 01 Jun, 2021 | Go kubevirt.io/kubevirt |
Access Restriction Bypass in kube-apiserver CVE-2021-25735, GHSA-g42g-737j-qx6j, GO-2022-0907 | Medium | 5.4% | 28 May, 2021 | Go k8s.io/kubernetes |
Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements CVE-2020-11091, GHSA-59qg-grp7-5r73, GO-2022-0794 | Medium | 0.9% | 27 May, 2021 | Go github.com/weaveworks/weave |
Authentication Bypass in hydra CVE-2020-5300, GHSA-3p3g-vpw6-4w66, GO-2022-0786 | Medium | 1.0% | 27 May, 2021 | Go github.com/ory/hydra |
In github.com/pion/webrtc, failed DTLS certificate verification doesn't stop data channel communication CVE-2021-28681, GHSA-74xm-qj29-cq8p, GO-2021-0104 | Medium | 0.7% | 25 May, 2021 | Go github.com/pion/webrtc/v3 |
Denial-of-Service within Docker container CVE-2020-26213, GHSA-jhj6-5mh6-4pvf, GO-2022-0903 | Medium | 1.4% | 24 May, 2021 | Go ktbs.dev/teler |
containerd-shim API Exposed to Host Network Containers CVE-2020-15257, GHSA-36xw-fx78-c5r4, GO-2022-0784 | Medium | 3.1% | 24 May, 2021 | Go github.com/containerd/containerd |