Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
NULL Pointer Dereference on moby image history CVE-2024-36620, GHSA-q59j-vv4j-v33c, GO-2024-3311 | Medium | 0.8% | 29 Nov, 2024 | Go github.com/moby/moby |
Moby Race Condition vulnerability CVE-2024-36621, GHSA-2mj3-vfvx-fc43, GO-2024-3304 | High | 0.6% | 29 Nov, 2024 | Go github.com/moby/moby |
Moby Race Condition vulnerability CVE-2024-36623, GHSA-gh5c-3h97-2f3q, GO-2024-3305 | High | 0.6% | 29 Nov, 2024 | Go github.com/moby/moby |
Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts CVE-2024-53858, GHSA-jwcm-9g39-pmcw, GO-2024-3296 | Medium | 0.3% | 27 Nov, 2024 | Go github.com/cli/cli Go github.com/cli/cli/v2 |
`auth.TokenForHost` violates GitHub host security boundary when sourcing authentication token within a codespace CVE-2024-53859, GHSA-55v3-xh23-96gh, GO-2024-3295 | Medium | 0.5% | 27 Nov, 2024 | Go github.com/cli/go-gh Go github.com/cli/go-gh/v2 |
CRI-O: Maliciously structured checkpoint file can gain arbitrary node access CVE-2024-8676, GHSA-7p9f-6x8j-gxxp, GO-2024-3292 | High | 0.8% | 26 Nov, 2024 | Go github.com/cri-o/cri-o |
Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion CVE-2024-43784, GHSA-hh33-46q4-hwm2, GO-2024-3291 | Medium | 0.4% | 26 Nov, 2024 | Go github.com/treeverse/lakefs |
Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges BIT-cilium-2024-52529, BIT-cilium-operator-2024-52529, BIT-hubble-relay-2024-52529, CVE-2024-52529, GHSA-xg58-75qf-9r67, GO-2024-3290 | Medium | 0.5% | 25 Nov, 2024 | Go github.com/cilium/cilium |
Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws GHSA-7f6p-phw2-8253, GO-2024-3288 | High | Not scored | 25 Nov, 2024 | Go github.com/taurusgroup/multi-party-sig |
OpenShift Console Server Side Request Forgery vulnerability CVE-2024-6538, GHSA-v3w7-g6p2-mpx7, GO-2024-3289 | Medium | 0.6% | 25 Nov, 2024 | Go github.com/openshift/console |
Kubernetes kubelet arbitrary command execution CVE-2024-10220, GHSA-27wf-5967-98gx, GO-2024-3286 | High | 3.0% | 22 Nov, 2024 | Go k8s.io/kubernetes |
Apache Answer: Predictable Authorization Token Using UUIDv1 CVE-2024-45719, GHSA-mr95-vfcf-fx9p, GO-2024-3287 | Low | 0.3% | 22 Nov, 2024 | Go github.com/apache/incubator-answer |
SFTPGo allows administrators to restrict command execution from the EventManager CVE-2024-52309, GHSA-49cc-xrjf-9qf7, GO-2024-3283 | Medium | 0.6% | 21 Nov, 2024 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 Go sftpgo |
Duplicate Advisory: cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs CVE-2024-12401, GHSA-ghw8-3xqw-hhcj, GHSA-r4pg-vg54-wxx4, GO-2024-3282 | Medium | 0.7% | 20 Nov, 2024 | Go github.com/cert-manager/cert-manager |
Rancher Helm Applications may have sensitive values leaked CVE-2024-52282, GHSA-9c5p-35gj-jqp4, GO-2024-3280 | Medium | 0.5% | 20 Nov, 2024 | Go github.com/rancher/rancher |
ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and sdk.Dec can lead to panic GHSA-7225-m954-23v7, GO-2024-3279 | High | Not scored | 20 Nov, 2024 | Go cosmossdk.io/math |
github.com/rancher/steve's users can issue watch commands for arbitrary resources CVE-2024-52280, GHSA-j5hq-5jcr-xwx7, GO-2024-3281 | High | 0.5% | 20 Nov, 2024 | Go github.com/rancher/steve |
CVE-2024-24425 in github.com/magma/magma CVE-2024-24425, GO-2024-3272 | 0.5% | 19 Nov, 2024 | Go github.com/magma/magma | |
CVE-2024-24426 in github.com/magma/magma CVE-2024-24426, GO-2024-3273 | 0.5% | 19 Nov, 2024 | Go github.com/magma/magma | |
Rclone has Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata BIT-rclone-2024-52522, CVE-2024-52522, GHSA-hrxh-9w67-g4cv, GO-2024-3271 | Medium | 0.2% | 19 Nov, 2024 | Go github.com/rclone/rclone |
Stored XSS in Kubeflow Pipeline View in github.com/kubeflow/pipelines CVE-2024-9526, GO-2024-3278 | 0.2% | 19 Nov, 2024 | Go github.com/kubeflow/pipelines | |
Kubernetes Nil pointer dereference in KCM after v1 HPA patch request CVE-2024-0793, GHSA-h7wq-jj8r-qm7p, GO-2024-3277 | High | 0.6% | 17 Nov, 2024 | Go k8s.io/kubernetes |
Remote Code Execution in Gogs CVE-2024-44625, GHSA-phm4-wf3h-pc3r, GO-2024-3275 | High | 16.5% | 15 Nov, 2024 | Go gogs.io/gogs |
Stored XSS using two files in usememos/memos CVE-2023-0109, GHSA-5r2g-59px-3q9w, GO-2024-3274 | Medium | 0.5% | 15 Nov, 2024 | Go github.com/usememos/memos |
Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer CVE-2024-52308, GHSA-p2h2-3vg9-4p87, GO-2024-3269 | High | 0.9% | 14 Nov, 2024 | Go github.com/cli/cli Go github.com/cli/cli/v2 |
Harbor fails to validate the user permissions when updating p2p preheat policies BIT-harbor-2022-31668, CVE-2022-31668, GHSA-3wpx-625q-22j7, GHSA-r864-28pw-8682, GO-2024-3268 | High | 0.3% | 14 Nov, 2024 | Go github.com/goharbor/harbor Go github.com/goharbor/harbor/src |
Zoraxy has an authenticated command injection in the Web SSH feature CVE-2024-52010, GHSA-7hpf-g48v-hw3j, GO-2024-3267 | High | 1.5% | 12 Nov, 2024 | Go github.com/tobychui/zoraxy |
Git credentials are exposed in Atlantis logs CVE-2024-52009, GHSA-gppm-hq3p-h4rp, GO-2024-3265 | High | 0.7% | 08 Nov, 2024 | Go github.com/runatlantis/atlantis |
Hashicorp Nomad Incorrect Authorization vulnerability CVE-2024-10975, GHSA-2w5v-x29g-jw7j, GO-2024-3262 | Medium | 0.4% | 07 Nov, 2024 | Go github.com/hashicorp/nomad |
Devtron has SQL Injection in CreateUser API CVE-2024-45794, GHSA-q78v-cv36-8fxj, GO-2024-3260 | High | 0.7% | 07 Nov, 2024 | Go github.com/devtron-labs/devtron |
CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data GHSA-p7mv-53f2-4cwj, GO-2024-3259 | High | Not scored | 06 Nov, 2024 | Go github.com/cometbft/cometbft |
gitsign may use incorrect Rekor entries during verification CVE-2024-51746, GHSA-8pmp-678w-c8xx, GO-2024-3252 | Low | 0.1% | 05 Nov, 2024 | Go github.com/sigstore/gitsign |
Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE CVE-2024-51735, GHSA-wvv7-wm5v-w2gv, GO-2024-3254 | Critical | 0.5% | 05 Nov, 2024 | Go github.com/j3ssie/osmedeus |
LocalAI Cross-site Scripting vulnerability CVE-2024-48057, GHSA-ghx4-cgxw-7h9p, GO-2024-3253 | Low | 0.2% | 05 Nov, 2024 | Go github.com/mudler/LocalAI |
Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations CVE-2024-51744, GHSA-29wx-vh33-7x7r, GO-2024-3250 | Low | 0.6% | 04 Nov, 2024 | Go github.com/golang-jwt/jwt/v4 |
Safearchive Path Traversal vulnerability CVE-2024-10389, GHSA-q3rp-vvm7-j8jg, GO-2024-3251 | Medium | 0.2% | 04 Nov, 2024 | Go github.com/google/safearchive |
Ollama Out-of-bounds Read CVE-2024-39720, GHSA-95j2-w8x7-hm88, GO-2024-3245 | High | 2.4% | 31 Oct, 2024 | Go github.com/ollama/ollama |
Gnark out-of-memory during deserialization with crafted inputs CVE-2024-50354, GHSA-cph5-3pgr-c82g, GO-2024-3244 | Medium | 0.3% | 31 Oct, 2024 | Go github.com/consensys/gnark |
Hashicorp Vault vulnerable to denial of service through memory exhaustion BIT-openbao-2024-8185, BIT-vault-2024-8185, CVE-2024-8185, GHSA-g233-2p4r-3q7v, GO-2024-3246 | High | 0.5% | 31 Oct, 2024 | Go github.com/hashicorp/vault Go github.com/openbao/openbao |
Hashicorp Consul Path Traversal vulnerability BIT-consul-2024-10005, CVE-2024-10005, GHSA-chgm-7r52-whjj, GO-2024-3243 | High | 0.8% | 31 Oct, 2024 | Go github.com/hashicorp/consul |
Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability BIT-consul-2024-10006, CVE-2024-10006, GHSA-5c4w-8hhh-3c3h, GO-2024-3241 | Medium | 0.5% | 31 Oct, 2024 | Go github.com/hashicorp/consul |
Hashicorp Consul Cross-site Scripting vulnerability BIT-consul-2024-10086, CVE-2024-10086, GHSA-99wr-c2px-grmh, GO-2024-3242 | Medium | 0.4% | 31 Oct, 2024 | Go github.com/hashicorp/consul |
NVIDIA Container Toolkit allows specially crafted container image to create empty files on the host file system CVE-2024-0133, GHSA-f748-7hpg-88ch, GO-2024-3237 | Medium | 0.2% | 29 Oct, 2024 | Go github.com/NVIDIA/nvidia-container-toolkit |
NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability CVE-2024-0132, GHSA-mjjw-553x-87pq, GO-2024-3239 | Critical | 40.8% | 29 Oct, 2024 | Go github.com/NVIDIA/nvidia-container-toolkit |
Grafana org admin can delete pending invites in different org BIT-grafana-2024-10452, CVE-2024-10452, GHSA-66c4-2g2v-54qw, GO-2024-3240 | Low | 0.5% | 29 Oct, 2024 | Go github.com/grafana/grafana |
Kyverno's PolicyException objects can be created in any namespace by default BIT-kyverno-2024-48921, CVE-2024-48921, GHSA-qjvc-p88j-j9rm, GO-2024-3230 | High | 0.6% | 29 Oct, 2024 | Go github.com/kyverno/kyverno |
Mattermost Server allows user to get private channel names CVE-2024-10241, GHSA-6mvp-gh77-7vwh, GO-2024-3232 | Medium | 0.3% | 29 Oct, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery BIT-mattermost-2024-46872, CVE-2024-46872, GHSA-762g-9p7f-mrww, GO-2024-3233 | Medium | 0.2% | 29 Oct, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Server vulnerable to application crash from attacker-generated large response CVE-2024-47401, GHSA-762v-rq7q-ff97, GO-2024-3234 | Medium | 0.5% | 29 Oct, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost server allows authenticated user to delete arbitrary post CVE-2024-50052, GHSA-g376-m3h3-mj4r, GO-2024-3235 | Medium | 0.3% | 29 Oct, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |