Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
MarbleRun unauthenticated recovery allows Coordinator impersonation GHSA-w7wm-2425-7p2h, GO-2025-3450 | High | Not scored | 04 Feb, 2025 | Go github.com/edgelesssys/marblerun |
wasmvm: Malicious smart contract can slow down block production GHSA-mx2j-7cmv-353c, GO-2025-3449 | Medium | Not scored | 04 Feb, 2025 | Go github.com/CosmWasm/wasmvm Go github.com/CosmWasm/wasmvm/v2 crates.io cosmwasm-vm |
wasmvm: Malicious smart contract can crash the chain GHSA-23qp-3c2m-xx6w, GO-2025-3448 | Medium | Not scored | 04 Feb, 2025 | Go github.com/CosmWasm/wasmvm Go github.com/CosmWasm/wasmvm/v2 |
CometBFT allows a malicious peer to stall the network by disseminating seemingly valid block parts GHSA-r3r4-g7hq-pq4f, GO-2025-3443 | High | Not scored | 03 Feb, 2025 | Go github.com/cometbft/cometbft |
CometBFT allows a malicious peer to make node stuck in blocksync CVE-2025-24371, GHSA-22qq-3xwm-r5x4, GO-2025-3442 | Medium | 0.5% | 03 Feb, 2025 | Go github.com/cometbft/cometbft |
Grafana Alerting VictorOps integration could be exposed to users with Viewer permission BIT-grafana-2024-11741, CVE-2024-11741, GHSA-wxcc-2f3q-4h58, GO-2025-3438 | Medium | 0.4% | 31 Jan, 2025 | Go github.com/grafana/grafana |
Argo CD does not scrub secret values from patch errors BIT-argo-cd-2025-23216, CVE-2025-23216, GHSA-47g2-qmh2-749v, GO-2025-3433 | Medium | 0.5% | 30 Jan, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
KubeWarden's AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources CVE-2025-24376, GHSA-fc89-jghx-8pvg, GO-2025-3434 | Medium | 0.3% | 30 Jan, 2025 | Go github.com/kubewarden/kubewarden-controller |
Kubewarden-Controller information leak via AdmissionPolicyGroup Resource CVE-2025-24784, GHSA-756x-m4mj-q96c, GO-2025-3435 | Medium | 0.3% | 30 Jan, 2025 | Go github.com/kubewarden/kubewarden-controller |
Go Ethereum vulnerable to DoS via malicious p2p message CVE-2025-24883, GHSA-q26p-9cq4-7fc2, GO-2025-3436 | Medium | 0.7% | 30 Jan, 2025 | Go github.com/ethereum/go-ethereum |
Argo CD GitOps Engine does not scrub secret values from patch errors GHSA-274v-mgcv-cm8j, GO-2025-3437 | Medium | Not scored | 30 Jan, 2025 | Go github.com/argoproj/gitops-engine |
kube-audit-rest's example logging configuration could disclose secret values in the audit log CVE-2025-24884, GHSA-hcr5-wv4p-h2g2, GO-2025-3431 | Medium | 0.2% | 29 Jan, 2025 | Go github.com/RichardoC/kube-audit-rest |
Anubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0 in github.com/Xe/x CVE-2025-24369, GHSA-56w8-8ppj-2p4f, GO-2025-3424 | 0.4% | 29 Jan, 2025 | Go github.com/Xe/x | |
OpenShift GitOps Operator Namespace Isolation Break CVE-2024-13484, GHSA-58fx-7v9q-3g56, GO-2025-3427 | High | 0.2% | 28 Jan, 2025 | Go github.com/redhat-developer/gitops-operator |
CRI-O Path Traversal vulnerability CVE-2025-0750, GHSA-hp5j-2585-qx6g, GO-2025-3426 | Medium | 0.3% | 28 Jan, 2025 | Go github.com/cri-o/cri-o |
Sensitive headers incorrectly sent after cross-domain redirect in net/http BIT-golang-2024-45336, CVE-2024-45336, GO-2025-3420 | 0.7% | 28 Jan, 2025 | Go stdlib | |
Insecure Temporary File usage in github.com/golang/glog CVE-2024-45339, GHSA-6wxm-mpqj-6jpf, GO-2025-3372 | Medium | 0.3% | 28 Jan, 2025 | Go github.com/golang/glog |
GOAUTH credential leak in cmd/go BIT-golang-2024-45340, CVE-2024-45340, GO-2025-3383 | 0.7% | 28 Jan, 2025 | Go toolchain | |
Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509 BIT-golang-2024-45341, CVE-2024-45341, GO-2025-3373 | 0.6% | 28 Jan, 2025 | Go stdlib | |
ParsePKCS1PrivateKey panic with partial keys in crypto/x509 BIT-golang-2025-22865, CVE-2025-22865, GO-2025-3421 | 0.6% | 28 Jan, 2025 | Go stdlib | |
imgproxy is vulnerable to SSRF against 0.0.0.0 CVE-2025-24354, GHSA-j2hp-6m75-v4j4, GO-2025-3422 | Medium | 0.9% | 27 Jan, 2025 | Go github.com/imgproxy/imgproxy Go github.com/imgproxy/imgproxy/v2 Go github.com/imgproxy/imgproxy/v3 |
Updatecli exposes Maven credentials in console output CVE-2025-24355, GHSA-v34r-vj4r-38j6, GO-2025-3419 | High | 0.2% | 24 Jan, 2025 | Go github.com/updatecli/updatecli |
Envoy Admin Interface Exposed through prometheus metrics endpoint BIT-envoy-gateway-2025-24030, CVE-2025-24030, GHSA-j777-63hf-hx76, GO-2025-3418 | High | 0.4% | 23 Jan, 2025 | Go github.com/envoyproxy/gateway |
Cilium has an information leakage via insecure default Hubble UI CORS header BIT-cilium-2025-23047, BIT-cilium-operator-2025-23047, BIT-hubble-relay-2025-23047, CVE-2025-23047, GHSA-h78m-j95m-5356, GO-2025-3416 | Medium | 0.5% | 22 Jan, 2025 | Go github.com/cilium/cilium |
DoS in Cilium agent DNS proxy from crafted DNS responses BIT-cilium-2025-23028, BIT-cilium-operator-2025-23028, BIT-hubble-relay-2025-23028, CVE-2025-23028, GHSA-9m5p-c77c-f9j7, GO-2025-3415 | Medium | 0.5% | 22 Jan, 2025 | Go github.com/cilium/cilium |
Buildah allows build breakout using malicious Containerfiles and concurrent builds CVE-2024-11218, GHSA-5vpc-35f4-r8w6, GO-2025-3414 | High | 0.4% | 21 Jan, 2025 | Go github.com/containers/buildah |
Excessive Platform Resource Consumption within a Loop when unmarshalling Compose file having recursive loop CVE-2024-10846, GHSA-36gq-35j3-p9r9, GO-2025-3412 | Medium | 0.2% | 21 Jan, 2025 | Go github.com/compose-spec/compose-go/v2 |
HashiCorp go-slug Vulnerable to Zip Slip Attack CVE-2025-0377, GHSA-wpfp-cm49-9m9q, GO-2025-3413 | High | 0.7% | 21 Jan, 2025 | Go github.com/hashicorp/go-slug |
Insecure default config access in WriteFreely CVE-2025-24337, GHSA-3qc3-mx6x-267h, GO-2025-3410 | High | 0.2% | 20 Jan, 2025 | Go github.com/writefreely/writefreely |
Zot IdP group membership revocation ignored CVE-2025-23208, GHSA-c9p4-xwr9-rfhx, GO-2025-3409 | High | 0.4% | 17 Jan, 2025 | Go zotregistry.dev/zot |
Gomatrixserverlib Server-Side Request Forgery (SSRF) on redirects and federation CVE-2024-52594, GHSA-4ff6-858j-r822, GO-2025-3396 | Medium | 0.4% | 16 Jan, 2025 | Go github.com/matrix-org/gomatrixserverlib |
Mattermost webapp crash via a crafted post CVE-2025-20621, GHSA-w6xh-c82w-h997, GO-2025-3407 | Medium | 0.5% | 16 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Matrix Media Repo (MMR) allows untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders CVE-2024-56515, GHSA-rcxc-wjgw-579r, GO-2025-3400 | Medium | 0.7% | 16 Jan, 2025 | Go github.com/t2bot/matrix-media-repo |
Matrix Media Repo (MMR) allows Server-Side Request Forgery (SSRF) on redirects and federation CVE-2024-52602, GHSA-r6jg-jfv6-2fjv, GO-2025-3399 | Medium | 0.6% | 16 Jan, 2025 | Go github.com/t2bot/matrix-media-repo |
matrix-media-repo (MMR) allows a denial of service through memory exhaustion CVE-2024-52791, GHSA-gp86-q8hg-fpxj, GO-2025-3398 | Medium | 0.8% | 16 Jan, 2025 | Go github.com/t2bot/matrix-media-repo |
matrix-media-repo (MMR) allows denial of service/high operating costs through unauthenticated downloads CVE-2024-36403, GHSA-vc2m-hw89-qjxf, GO-2025-3401 | Medium | 0.7% | 16 Jan, 2025 | Go github.com/t2bot/matrix-media-repo |
matrix-media-repo (MMR) allows unauthenticated writes to the media repository, which may allow planting of problematic content CVE-2024-36402, GHSA-8vmr-h7h5-cqhg, GO-2025-3397 | Medium | 0.6% | 16 Jan, 2025 | Go github.com/t2bot/matrix-media-repo |
Mattermost fails to properly validate post props CVE-2025-20086, GHSA-5m7j-6gc4-ff5g, GO-2025-3392 | Medium | 0.4% | 15 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly validate post props CVE-2025-20088, GHSA-45v9-w9fh-33j6, GO-2025-3394 | Medium | 0.6% | 15 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Incorrect Type Conversion or Cast CVE-2025-21088, GHSA-8j3q-gc9x-7972, GO-2025-3393 | Medium | 0.6% | 15 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Rancher UI has Stored Cross-site Scripting vulnerability CVE-2024-52281, GHSA-2v2w-8v8c-wcm9, GO-2025-3391 | High | 0.6% | 14 Jan, 2025 | Go github.com/rancher/rancher |
Git LFS permits exfiltration of credentials via crafted HTTP URLs BIT-git-lfs-2024-53263, CVE-2024-53263, GHSA-q6r2-x2cc-vrp7, GO-2025-3390 | High | 1.1% | 14 Jan, 2025 | Go github.com/git-lfs/git-lfs Go github.com/git-lfs/git-lfs/v3 |
OpenFGA Authorization Bypass CVE-2024-56323, GHSA-32q6-rr98-cjqv, GO-2025-3384 | Medium | 0.4% | 13 Jan, 2025 | Go github.com/openfga/openfga |
notation-go's timestamp signature generation lacks certificate revocation check CVE-2024-56138, GHSA-45v3-38pc-874v, GO-2025-3381 | Medium | 0.1% | 13 Jan, 2025 | Go github.com/notaryproject/notation-go |
notation-go has an OS error when setting CRL cache leads to denial of signature verification CVE-2024-51491, GHSA-qjh3-4j3h-vmwp, GO-2025-3382 | Low | 0.2% | 13 Jan, 2025 | Go github.com/notaryproject/notation-go |
JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh CVE-2025-22149, GHSA-675f-rq2r-jw82, GO-2025-3376 | Low | 0.6% | 09 Jan, 2025 | Go github.com/MicahParks/jwkset |
Mattermost Improper Validation of Specified Type of Input vulnerability CVE-2025-20033, GHSA-2549-xh72-qrpm, GO-2025-3379 | Medium | 0.6% | 09 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost has Improper Check for Unusual or Exceptional Conditions CVE-2025-22445, GHSA-7rgp-4j56-fm79, GO-2025-3380 | Low | 0.3% | 09 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Incorrect Authorization vulnerability CVE-2025-22449, GHSA-q8fg-cp3q-5jwm, GO-2025-3377 | Low | 0.3% | 09 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Soft Serve vulnerable to path traversal attacks CVE-2025-22130, GHSA-j4jw-m6xr-fv6c, GO-2025-3374 | Medium | 0.7% | 08 Jan, 2025 | Go github.com/charmbracelet/soft-serve |