Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly GHSA-vv6c-69r6-chg9, GO-2024-3199 | Low | Not scored | 14 Oct, 2024 | Go github.com/landlock-lsm/go-landlock |
Dozzle uses unsafe hash for passwords CVE-2024-47182, GHSA-w7qr-q9fh-fj35, GO-2024-3163 | Low | Not scored | 09 Oct, 2024 | Go github.com/amir20/dozzle |
OpenTofu potential leaking of secret variable values when using static evaluation in v1.8 CVE-2024-58375, GHSA-wpr2-j6gr-pjw9, GO-2024-3182 | Low | Not scored | 03 Oct, 2024 | Go github.com/opentofu/opentofu |
Path traversal vulnerability in stripe-cli CVE-2024-45401, GHSA-fv4g-gwpj-74gr, GO-2024-3119 | Low | Not scored | 05 Sep, 2024 | Go github.com/stripe/stripe-cli |
sigstore-go has an unbounded loop over untrusted input can lead to endless data attack CVE-2024-45395, GHSA-cq38-jh5f-37mq, GO-2024-3116 | Low | Not scored | 04 Sep, 2024 | Go github.com/sigstore/sigstore-go |
CometBFT's state syncing validator from malicious node may lead to a chain split GHSA-g5xx-c4hv-9ccc, GO-2024-3112 | Low | Not scored | 03 Sep, 2024 | Go github.com/cometbft/cometbft Go github.com/cometbft/cometbft/light |
Trufflehog vulnerable to Blind SSRF in some Detectors CVE-2024-43379, GHSA-3r74-v83p-f4f4, GO-2024-3076 | Low | Not scored | 19 Aug, 2024 | Go github.com/trufflesecurity/trufflehog Go github.com/trufflesecurity/trufflehog/v3 |
Mattermost did not properly restrict channel creation BIT-mattermost-2024-39837, CVE-2024-39837, GHSA-vvpg-55p7-5h8w, GO-2024-3032 | Low | Not scored | 01 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
snapd failed to properly check the destination of symbolic links when extracting a snap CVE-2024-29069, GHSA-69p6-gp5x-j269, GO-2024-3009 | Low | Not scored | 25 Jul, 2024 | Go github.com/snapcore/snapd |
Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go GHSA-xr7q-jx4m-x55m, GO-2024-2978 | Low | Not scored | 05 Jul, 2024 | Go google.golang.org/grpc |
HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims BIT-vault-2024-5798, CVE-2024-5798, GHSA-32cj-5wx4-gq8p, GO-2024-2921 | Low | Not scored | 12 Jun, 2024 | Go github.com/hashicorp/vault |
`docker cp` allows unexpected chmod of host files in Moby Docker Engine CVE-2021-41089, GHSA-v994-f8vw-g7j4, GO-2024-2913 | Low | Not scored | 10 Jun, 2024 | Go github.com/docker/docker Go github.com/moby/moby |
evmos allows transferring unvested tokens after delegations CVE-2024-32873, CVE-2024-37158, CVE-2024-37159, GHSA-pxv8-qhrh-jc7v, GO-2024-2891, GO-2024-2926, GO-2024-2927 | Low | Not scored | 06 Jun, 2024 | Go github.com/evmos/evmos Go github.com/evmos/evmos/v10 Go github.com/evmos/evmos/v11 Go github.com/evmos/evmos/v12 +14 more |
SQL Injection in Harbor scan log API BIT-harbor-2024-22261, CVE-2024-22261, GHSA-vw63-824v-qf2j, GO-2024-2916 | Low | Not scored | 02 Jun, 2024 | Go github.com/goharbor/harbor |
github.com/huandu/facebook may expose access_token in error message. CVE-2024-35232, GHSA-3f65-m234-9mxr, GO-2024-2882 | Low | Not scored | 24 May, 2024 | Go github.com/huandu/facebook Go github.com/huandu/facebook/v2 |
github.com/bincyber/go-sqlcrypter vulnerable to IV collision GHSA-2j6r-9vv4-6gf5, GO-2024-2872 | Low | Not scored | 20 May, 2024 | Go github.com/bincyber/go-sqlcrypter |
containerd started with non-empty inheritable Linux process capabilities GHSA-c9cp-9c75-9v8c, GO-2024-2846 | Low | Not scored | 14 May, 2024 | Go github.com/containerd/containerd |
NATS server TLS missing ciphersuite settings when CLI flags used CVE-2021-32026, GHSA-jj54-5q2m-q7pj, GO-2024-2850 | Low | Not scored | 14 May, 2024 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
sshproxy vulnerable to SSH option injection CVE-2024-34713, GHSA-jmqp-37m5-49wh, GO-2024-2836 | Low | Not scored | 14 May, 2024 | Go github.com/cea-hpc/sshproxy |
octo-sts vulnerable to unauthenticated attacker causing unbounded CPU and memory usage CVE-2024-34079, GHSA-75r6-6jg8-pfcq, GO-2024-2833 | Low | Not scored | 13 May, 2024 | Go github.com/octo-sts/app |
Mattermost allows team admins to promote guests to team admins CVE-2024-4195, GHSA-5fh7-7mw7-mmx5, GO-2024-2793 | Low | Not scored | 26 Apr, 2024 | Go github.com/mattermost/mattermost-server |
Mattermost fails to limit the size of a request path CVE-2024-22091, GHSA-p2wq-4ggp-45f3, GO-2024-2796 | Low | Not scored | 26 Apr, 2024 | Go github.com/mattermost/mattermost-server |
Mattermost fails to fully validate role changes CVE-2024-4198, GHSA-5qx9-9ffj-5r8f, GO-2024-2794 | Low | Not scored | 26 Apr, 2024 | Go github.com/mattermost/mattermost-server |
Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin CVE-2024-3177, GHSA-pxhw-596r-rwq5, GO-2024-2746 | Low | Not scored | 23 Apr, 2024 | Go k8s.io/kubernetes |
Authelia's Group Changes may not have the expected results (YAML file backend) GHSA-x883-2vmg-xwf7, GO-2024-2744 | Low | Not scored | 22 Apr, 2024 | Go github.com/authelia/authelia/v4 |
1Panel's password verification is suspected to have a timing attack vulnerability CVE-2024-30257, GHSA-6m9h-2pr2-9j8f, GO-2024-2734 | Low | Not scored | 18 Apr, 2024 | Go github.com/1Panel-dev/1Panel |
SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used CVE-2024-32001, GHSA-j85q-46hg-36p2, GO-2024-2716 | Low | Not scored | 10 Apr, 2024 | Go github.com/authzed/spicedb |
Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output GHSA-j5vm-7qcc-2wwg, GO-2024-2703 | Low | Not scored | 10 Apr, 2024 | Go github.com/kopia/kopia |
Mattermost Server Improper Access Control BIT-mattermost-2024-21848, CVE-2024-21848, GHSA-xp9j-8p68-9q93, GO-2024-2707 | Low | Not scored | 05 Apr, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Server Resource Exhaustion BIT-mattermost-2024-28053, CVE-2024-28053, GHSA-qqc8-rv37-79q5, GO-2024-3334 | Low | Not scored | 15 Mar, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost race condition BIT-mattermost-2024-1949, CVE-2024-1949, GHSA-3g35-v53r-gpxc, GO-2024-2588 | Low | Not scored | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost incorrectly allows access individual posts BIT-mattermost-2024-1952, CVE-2024-1952, GHSA-r4fm-g65h-cr54, GO-2024-2635 | Low | Not scored | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly restrict the access of files attached to posts CVE-2024-23488, GHSA-xgxj-j98c-59rv, GO-2024-2595 | Low | Not scored | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
ASA-2024-004: Default configuration param for Evidence may limit window of validity GHSA-555p-m4v6-cqxv | Low | Not scored | 28 Feb, 2024 | Go github.com/cometbft/cometbft |
ASA-2024-005: Potential slashing evasion during re-delegation GHSA-86h5-xcpx-cfqc, GO-2024-2584 | Low | Not scored | 27 Feb, 2024 | Go github.com/cosmos/cosmos-sdk |
Mattermost fails to check the required permissions BIT-mattermost-2024-24776, CVE-2024-24776, GHSA-r833-w756-h5p2, GO-2024-2566 | Low | Not scored | 09 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Jira Plugin vulnerable to Cross-Site Request Forgery BIT-mattermost-2024-23319, CVE-2024-23319, GHSA-4fp6-574p-fc35, GO-2024-2539 | Low | Not scored | 09 Feb, 2024 | Go github.com/mattermost/mattermost-plugin-jira |
1Panel set-cookie is missing the Secure keyword CVE-2024-24768, GHSA-9xfw-jjq2-7v8h, GO-2024-2531 | Low | Not scored | 05 Feb, 2024 | Go github.com/1Panel-dev/1Panel |
Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only GHSA-vjg6-93fv-qv64, GO-2024-2530 | Low | Not scored | 03 Feb, 2024 | Go go.etcd.io/etcd Go go.etcd.io/etcd/v3 |
Etcd embed auto compaction retention negative value causing a compaction loop or a crash GHSA-pm3m-32r3-7mfh, GO-2024-2529 | Low | Not scored | 03 Feb, 2024 | Go go.etcd.io/etcd Go go.etcd.io/etcd/v3 |
Etcd pkg Insecure ciphers are allowed by default GHSA-5x4g-q5rc-36jp, GO-2024-2527 | Low | Not scored | 03 Feb, 2024 | Go go.etcd.io/etcd Go go.etcd.io/etcd/client/pkg/v3 |
Apache Answer Race Condition vulnerability CVE-2023-49619, GHSA-f899-4mr4-fqpv, GO-2024-2457 | Low | Not scored | 10 Jan, 2024 | Go github.com/apache/incubator-answer |
The DES/3DES cipher was used as part of the TLS protocol by installation tools GHSA-7xg2-83f8-39mr, GO-2024-2441 | Low | Not scored | 03 Jan, 2024 | Go github.com/karmada-io/karmada |
Mattermost allows demoted guests to change group names BIT-mattermost-2023-50333, CVE-2023-50333, GHSA-9w97-9rqx-8v4j, GO-2024-2444 | Low | Not scored | 02 Jan, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Cross-site Scripting vulnerability BIT-mattermost-2023-7113, CVE-2023-7113, GHSA-h3gq-j7p9-x3p4, GO-2024-2446 | Low | Not scored | 29 Dec, 2023 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
eventing-gitlab vulnerable to denial of service, caused by improper enforcement of the timeout on individual read operations GHSA-99jv-8292-2hpm | Low | Not scored | 08 Dec, 2023 | Go knative.dev/eventing-gitlab |
eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations GHSA-v7hc-87jc-qrrr, GO-2023-2388 | Low | Not scored | 06 Dec, 2023 | Go knative.dev/eventing-github |
Canonical LXD documentation improvement to make clear restricted.devices.disk=allow without restricted.devices.disk.paths also allows shift=true GHSA-x9qq-236j-gj97 | Low | Not scored | 05 Dec, 2023 | Go github.com/canonical/lxd |
Mattermost Injection vulnerability CVE-2023-35075, GHSA-jcgv-3pfq-j4hr | Low | Not scored | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
gnark's range checker gadget allows wider inputs up to word alignment GHSA-rjjm-x32p-m3f7, GO-2023-2333 | Low | Not scored | 12 Nov, 2023 | Go github.com/consensys/gnark |