Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') CVE-2024-58398, GHSA-wcx9-ccpj-hx3c, GO-2024-3228 | Medium | 0.3% | 28 Oct, 2024 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Argo Workflows Controller: Denial of Service via malicious daemon Workflows BIT-argo-workflows-2024-47827, CVE-2024-47827, GHSA-ghjw-32xw-ffwr, GO-2024-3226 | Medium | 0.4% | 28 Oct, 2024 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
Mattermost incorrectly issues two sessions when using desktop SSO CVE-2024-10214, GHSA-hm57-h27x-599c, GO-2024-3227 | Low | 0.4% | 28 Oct, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Plenti arbitrary file write vulnerability CVE-2024-49380, GHSA-2p96-p7qh-4rgr, GO-2024-3213 | High | 2.7% | 28 Oct, 2024 | Go github.com/plentico/plenti |
Plenti arbitrary file deletion vulnerability CVE-2024-49381, GHSA-6h8w-hrfp-pffx, GO-2024-3214 | High | 0.8% | 28 Oct, 2024 | Go github.com/plentico/plenti |
Graphql: information disclosure via graphql introspection in openshift in github.com/openshift/console CVE-2024-50312, GO-2024-3211 | 0.6% | 28 Oct, 2024 | Go github.com/openshift/console | |
Lack of JWT issuer and signer validation in github.com/awslabs/aws-alb-route-directive-adapter-for-istio CVE-2024-8901, GO-2024-3210 | 0.4% | 28 Oct, 2024 | Go github.com/awslabs/aws-alb-route-directive-adapter-for-istio | |
github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses GHSA-7h65-4p22-39j6, GO-2024-3219 | Critical | Not scored | 25 Oct, 2024 | Go github.com/crossplane/crossplane |
RKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists GHSA-x7xj-jvwp-97rv, GO-2024-3222 | Critical | Not scored | 25 Oct, 2024 | Go github.com/rancher/rke2 |
Rancher Remote Code Execution via Cluster/Node Drivers CVE-2024-22036, GHSA-h99m-6755-rgwc, GO-2024-3221 | Critical | 0.8% | 25 Oct, 2024 | Go github.com/rancher/rancher |
Exposure of vSphere's CPI and CSI credentials in Rancher CVE-2022-45157, GHSA-xj7w-r753-vj8v, GO-2024-3223 | High | 0.4% | 25 Oct, 2024 | Go github.com/rancher/rancher |
User Registration Bypass in Zitadel CVE-2024-49757, GHSA-3rmw-76m6-4gjc, GO-2024-3217 | High | 2.5% | 25 Oct, 2024 | Go github.com/zitadel/zitadel |
Denied Host Validation Bypass in Zitadel Actions CVE-2024-49753, GHSA-6cf5-w9h3-4rqv, GO-2024-3216 | Medium | 0.7% | 25 Oct, 2024 | Go github.com/zitadel/zitadel |
Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse CVE-2023-26248, GHSA-mqr9-hjr8-2m9w, GO-2024-3218 | Medium | 0.2% | 25 Oct, 2024 | Go github.com/libp2p/go-libp2p-kad-dht |
AWS Load Balancer Controller automatically detaches externally associated web ACL from Application Load Balancers GHSA-rjfv-pjvx-mjgv, GO-2024-3212 | Low | Not scored | 24 Oct, 2024 | Go sigs.k8s.io/aws-load-balancer-controller |
Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present BIT-cilium-2024-47825, BIT-cilium-operator-2024-47825, BIT-hubble-relay-2024-47825, CVE-2024-47825, GHSA-3wwx-63fv-pfq6, GO-2024-3208 | Medium | 0.4% | 21 Oct, 2024 | Go github.com/cilium/cilium |
Permissive Regular Expression in tacquito GHSA-p5wf-cmr4-xrwr, GO-2024-3207 | High | Not scored | 18 Oct, 2024 | Go github.com/facebookincubator/tacquito |
Grafana Command Injection And Local File Inclusion Via Sql Expressions BIT-grafana-2024-9264, CVE-2024-9264, GHSA-q99m-qcv4-fpm7, GO-2024-3215 | Critical | 97.6% | 18 Oct, 2024 | Go github.com/grafana/grafana |
Infinite loop in github.com/gomarkdown/markdown CVE-2024-44337, GHSA-xhr3-wf7j-h255, GO-2024-3205 | Medium | 0.5% | 15 Oct, 2024 | Go github.com/gomarkdown/markdown |
VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder CVE-2024-9486, GHSA-9224-ggvw-wh7v, GO-2024-3203 | Critical | 2.2% | 15 Oct, 2024 | Go github.com/kubernetes-sigs/image-builder |
VM images built with Image Builder with some providers use default credentials during builds in github.com/kubernetes-sigs/image-builder CVE-2024-9594, GHSA-8jpg-62jc-hwhr, GO-2024-3204 | Medium | 1.7% | 15 Oct, 2024 | Go github.com/kubernetes-sigs/image-builder |
JWT token compromise can allow malicious actions including Remote Code Execution (RCE) in github.com/neuvector/neuvector CVE-2023-22644, GO-2024-3201 | 0.5% | 15 Oct, 2024 | Go github.com/neuvector/neuvector | |
SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not CVE-2024-48909, GHSA-3c32-4hq9-6wgj, GO-2024-3200 | Low | 0.3% | 14 Oct, 2024 | Go github.com/authzed/spicedb |
Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly GHSA-vv6c-69r6-chg9, GO-2024-3199 | Low | Not scored | 14 Oct, 2024 | Go github.com/landlock-lsm/go-landlock |
KubeSphere IDOR vulnerability CVE-2024-46528, GHSA-p26r-gfgc-c47h, GO-2024-3248 | Medium | 1.6% | 14 Oct, 2024 | Go github.com/kubesphere/kubesphere |
Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory. CVE-2024-47877, GHSA-8rm2-93mq-jqhc, GO-2024-3196 | Medium | 0.5% | 11 Oct, 2024 | Go github.com/codeclysm/extract Go github.com/codeclysm/extract/v3 Go github.com/codeclysm/extract/v4 |
SSOReady has an XML Signature Bypass via differential XML parsing CVE-2024-47832, GHSA-j2hr-q93x-gxvh, GO-2024-3185 | Critical | 0.4% | 11 Oct, 2024 | Go github.com/ssoready/ssoready |
Vault Community Edition privilege escalation vulnerability BIT-openbao-2024-9180, BIT-vault-2024-9180, CVE-2024-9180, GHSA-rr8j-7w34-xp5j, GO-2024-3191 | High | 0.5% | 10 Oct, 2024 | Go github.com/hashicorp/vault Go github.com/openbao/openbao |
Alist reflected Cross-Site Scripting vulnerability CVE-2024-47067, GHSA-8pph-gfhp-w226, GO-2024-3190 | Medium | 0.4% | 10 Oct, 2024 | Go github.com/alist-org/alist Go github.com/alist-org/alist/v3 |
Authd allows attacker-controlled usernames to yield controllable UIDs CVE-2024-9312, GHSA-4gfw-wf7c-w6g2, GO-2024-3188 | Medium | 0.3% | 10 Oct, 2024 | Go github.com/ubuntu/authd |
btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality CVE-2024-38365, GHSA-27vh-h6mc-q6g8, GO-2024-3189 | High | 1.0% | 10 Oct, 2024 | Go github.com/btcsuite/btcd |
Dozzle uses unsafe hash for passwords CVE-2024-47182, GHSA-w7qr-q9fh-fj35, GO-2024-3163 | Low | 0.2% | 09 Oct, 2024 | Go github.com/amir20/dozzle |
Buildah allows arbitrary directory mount CVE-2024-9675, GHSA-586p-749j-fhwp, GO-2024-3186 | Medium | 0.4% | 09 Oct, 2024 | Go github.com/containers/buildah |
Adguard Home arbitrary file read vulnerability CVE-2024-36814, GHSA-9cp9-8gw2-8v7m, GO-2024-3184 | High | 0.8% | 08 Oct, 2024 | Go github.com/AdguardTeam/AdGuardHome |
Vulnerable juju introspection abstract UNIX domain socket CVE-2024-8038, GHSA-xwgj-vpm9-q2rq, GO-2024-3175 | Medium | 0.2% | 03 Oct, 2024 | Go github.com/juju/juju |
Vulnerable juju hook tool abstract UNIX domain socket CVE-2024-8037, GHSA-8v4w-f4r9-7h6x, GO-2024-3174 | Medium | 0.2% | 03 Oct, 2024 | Go github.com/juju/juju |
PAM module may allow accessing with the credentials of another user CVE-2024-9313, GHSA-x5q3-c8rm-w787, GO-2024-3181 | High | 0.6% | 03 Oct, 2024 | Go github.com/ubuntu/authd |
OpenTofu potential leaking of secret variable values when using static evaluation in v1.8 CVE-2024-58375, GHSA-wpr2-j6gr-pjw9, GO-2024-3182 | Low | 0.4% | 03 Oct, 2024 | Go github.com/opentofu/opentofu |
JUJU_CONTEXT_ID is a predictable authentication secret CVE-2024-7558, GHSA-mh98-763h-m9v4, GO-2024-3173 | Medium | 0.5% | 03 Oct, 2024 | Go github.com/juju/juju |
Pomerium service account access token may grant unintended access to databroker API CVE-2024-47616, GHSA-r7rh-jww5-5fjr, GO-2024-3179 | High | 0.6% | 02 Oct, 2024 | Go github.com/pomerium/pomerium |
Portainer improperly uses an encryption algorithm in the AesEncrypt function CVE-2024-33662, GHSA-9mjw-79r6-c9m8, GO-2024-3172 | High | 0.3% | 02 Oct, 2024 | Go github.com/portainer/portainer |
Improper Input Validation in Buildah and Podman CVE-2024-9407, GHSA-fhqq-8f65-5xfc, GO-2024-3169 | Medium | 0.3% | 01 Oct, 2024 | Go github.com/containers/buildah Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 +2 more |
Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability CVE-2024-9355, GHSA-3h3x-2hwv-hr52, GO-2024-3167 | High | 0.3% | 01 Oct, 2024 | Go github.com/golang-fips/openssl |
Link Following in github.com/containers/common CVE-2024-9341, GHSA-mc76-5925-c5p6, GO-2024-3171 | High | 1.0% | 01 Oct, 2024 | Go github.com/containers/common |
Incorrect delegation lookups can make go-tuf download the wrong artifact CVE-2024-47534, GHSA-4f8r-qqr9-fq8j, GO-2024-3166 | High | 0.5% | 01 Oct, 2024 | Go github.com/theupdateframework/go-tuf/v2 |
Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default BIT-openbao-2024-7594, BIT-vault-2024-7594, CVE-2024-7594, GHSA-jg74-mwgw-v6x3, GO-2024-3162 | High | 0.3% | 26 Sep, 2024 | Go github.com/hashicorp/vault Go github.com/openbao/openbao |
Rancher agents can be hijacked by taking over the Rancher Server URL CVE-2024-22030, GHSA-h4h5-9833-v2p4, GO-2024-3161 | High | 0.4% | 26 Sep, 2024 | Go github.com/rancher/rancher |
CVE-2024-47218 in github.com/vesoft-inc/nebula CVE-2024-47218, GO-2024-3155 | 0.6% | 26 Sep, 2024 | Go github.com/vesoft-inc/nebula | |
CVE-2024-47219 in github.com/vesoft-inc/nebula CVE-2024-47219, GO-2024-3156 | 1.2% | 26 Sep, 2024 | Go github.com/vesoft-inc/nebula | |
Ory Kratos's setting required_aal `highest_available` does not properly respect code + mfa credentials CVE-2024-45042, GHSA-wc43-73w7-x2f5, GO-2024-3160 | Medium | 0.3% | 26 Sep, 2024 | Go github.com/ory/kratos |