Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events BIT-mattermost-2024-47003, CVE-2024-47003, GHSA-59hf-mpf8-pqjh, GO-2024-3164 | Medium | 0.6% | 26 Sep, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Grafana Alloy on Windows has Unquoted Search Path or Element vulnerability BIT-grafana-alloy-2024-8975, CVE-2024-8975, GHSA-chqx-36rm-rf8h, GO-2024-3168 | Medium | 0.3% | 25 Sep, 2024 | Go github.com/grafana/alloy |
Grafana Agent (Flow mode) on Windows has Unquoted Search Path or Element vulnerability CVE-2024-8996, GHSA-m5gv-m5f9-wgv4, GO-2024-3170 | Medium | 0.3% | 25 Sep, 2024 | Go github.com/grafana/agent |
Apache Answer: Avatar URL leaked user email addresses CVE-2024-40761, GHSA-48cr-j2cx-mcr8, GO-2024-3158 | Medium | 0.7% | 25 Sep, 2024 | Go github.com/apache/incubator-answer |
Mellium allows Authentication Bypass by Spoofing CVE-2024-46957, GHSA-98hf-m87w-cq6h, GO-2024-3157 | Critical | 0.6% | 25 Sep, 2024 | Go mellium.im/xmpp |
Navidrome has Multiple SQL Injections and ORM Leak CVE-2024-47062, GHSA-58vj-cv5w-v4v6, GO-2024-3153 | Critical | 4.5% | 20 Sep, 2024 | Go github.com/navidrome/navidrome |
ZITADEL Allows Unauthorized Access After Organization or Project Deactivation CVE-2024-47060, GHSA-jj94-6f5c-65r8, GO-2024-3138 | High | 0.4% | 19 Sep, 2024 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
ZITADEL's Service Users Deactivation not Working CVE-2024-47000, GHSA-qr2h-7pwm-h393, GO-2024-3139 | High | 0.4% | 19 Sep, 2024 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
ZITADEL's User Grant Deactivation not Working CVE-2024-46999, GHSA-2w5j-qfvw-2hf5, GO-2024-3137 | High | 0.4% | 19 Sep, 2024 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
HTTP client can manipulate custom HTTP headers that are added by Traefik CVE-2024-45410, GHSA-62c8-mh53-4cqv, GO-2024-3135 | Critical | 1.5% | 19 Sep, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Dragonfly2 has hard coded cyptographic key CVE-2023-27584, GHSA-hpc8-7wpm-889w, GO-2024-3136 | Critical | 33.9% | 19 Sep, 2024 | Go d7y.io/dragonfly/v2 |
Grafana plugin SDK Information Leakage CVE-2024-8986, GHSA-xxxw-3j6h-q7h6, GO-2024-3140 | Critical | 0.5% | 19 Sep, 2024 | Go github.com/grafana/grafana-plugin-sdk-go |
CoreDNS Cache Poisoning via a birthday attack CVE-2023-30464, GHSA-h92q-fgpp-qhrq, GO-2024-3134 | Medium | 0.4% | 18 Sep, 2024 | Go github.com/coredns/coredns |
Chaosblade vulnerable to OS command execution CVE-2023-47105, GHSA-723h-x37g-f8qm, GO-2024-3133 | Critical | 1.7% | 18 Sep, 2024 | Go github.com/chaosblade-io/chaosblade |
SpiceDB having multiple caveats on resources of the same type may improperly result in no permission CVE-2024-46989, GHSA-jhg6-6qrx-38mr, GO-2024-3131 | Medium | 0.3% | 18 Sep, 2024 | Go github.com/authzed/spicedb |
CoreDNS vulnerable to TuDoor Attacks CVE-2023-28452, GHSA-hfmw-7g3m-gj6q, GO-2024-3130 | High | 0.6% | 18 Sep, 2024 | Go github.com/coredns/coredns |
OpenShift Controller Manager Improper Privilege Management CVE-2024-45496, GHSA-j8gh-87rx-c7w9, GO-2024-3128 | Medium | 1.0% | 17 Sep, 2024 | Go github.com/openshift/openshift-controller-manager |
OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer CVE-2024-7387, GHSA-qqv8-ph7f-h3f7, GO-2024-3129 | Medium | 2.3% | 17 Sep, 2024 | Go github.com/openshift/builder |
External Secrets Operator vulnerable to privilege escalation CVE-2024-45041, GHSA-qwgc-rr35-h4x9, GO-2024-3126 | High | 0.6% | 09 Sep, 2024 | Go github.com/external-secrets/external-secrets |
Gouniverse GoLang CMS vulnerable to Cross-site Scripting CVE-2024-8572, GHSA-pv7h-hg6m-82j8, GO-2024-3125 | Medium | 0.4% | 08 Sep, 2024 | Go github.com/gouniverse/cms |
gnark's Groth16 commitment extension unsound for more than one commitment CVE-2024-45039, GHSA-q3hw-3gm4-w5cr, GO-2024-3122 | Medium | 0.2% | 06 Sep, 2024 | Go github.com/consensys/gnark |
gnark commitments to private witnesses in Groth16 as implemented break zero-knowledge property CVE-2024-45040, GHSA-9xcg-3q8v-7fq6, GO-2024-3123 | High | 0.4% | 06 Sep, 2024 | Go github.com/consensys/gnark |
Stack exhaustion in all Parse functions in go/parser BIT-golang-2024-34155, CVE-2024-34155, GO-2024-3105 | 0.8% | 06 Sep, 2024 | Go stdlib | |
Stack exhaustion in Decoder.Decode in encoding/gob BIT-golang-2024-34156, CVE-2024-34156, GO-2024-3106 | 1.1% | 06 Sep, 2024 | Go stdlib | |
Stack exhaustion in Parse in go/build/constraint BIT-golang-2024-34158, CVE-2024-34158, GO-2024-3107 | 1.0% | 06 Sep, 2024 | Go stdlib | |
Interchain Security: The signers of ICS messages do not need to match the provider address GHSA-7q74-g774-7x3g, GO-2024-3121 | High | Not scored | 05 Sep, 2024 | Go github.com/cosmos/interchain-security Go github.com/cosmos/interchain-security/v2 Go github.com/cosmos/interchain-security/v3 Go github.com/cosmos/interchain-security/v4 +1 more |
Path traversal vulnerability in stripe-cli CVE-2024-45401, GHSA-fv4g-gwpj-74gr, GO-2024-3119 | Low | 0.2% | 05 Sep, 2024 | Go github.com/stripe/stripe-cli |
Windmill HTTP Request users.rs excessive authentication in github.com/windmill-labs/windmill CVE-2024-8462, GHSA-g6q4-w3j3-jfc4, GO-2024-3118 | Medium | 0.5% | 05 Sep, 2024 | Go github.com/windmill-labs/windmill |
sigstore-go has an unbounded loop over untrusted input can lead to endless data attack CVE-2024-45395, GHSA-cq38-jh5f-37mq, GO-2024-3116 | Low | 0.5% | 04 Sep, 2024 | Go github.com/sigstore/sigstore-go |
Nuclei Template Signature Verification Bypass CVE-2024-43405, GHSA-7h5p-mmpp-hgmm, GO-2024-3114 | Medium | 1.1% | 04 Sep, 2024 | Go github.com/projectdiscovery/nuclei Go github.com/projectdiscovery/nuclei/v2 Go github.com/projectdiscovery/nuclei/v3 |
Hoverfly allows an arbitrary file read in the `/api/v2/simulation` endpoint (`GHSL-2023-274`) CVE-2024-45388, GHSA-6xx4-x46f-f897, GO-2024-3108 | High | 55.6% | 03 Sep, 2024 | Go github.com/SpectoLabs/hoverfly Go github.com/spectolabs/hoverfly |
The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD CVE-2024-43803, GHSA-pqfh-xh7w-7h3p, GO-2024-3109 | Medium | 0.6% | 03 Sep, 2024 | Go github.com/metal3-io/baremetal-operator |
CometBFT's state syncing validator from malicious node may lead to a chain split GHSA-g5xx-c4hv-9ccc, GO-2024-3112 | Low | Not scored | 03 Sep, 2024 | Go github.com/cometbft/cometbft Go github.com/cometbft/cometbft/light |
runc can be confused to create empty files/directories on the host CVE-2024-45310, GHSA-jfvp-7x6p-h2pv, GO-2024-3110 | Medium | 0.3% | 03 Sep, 2024 | Go github.com/opencontainers/runc |
Vault Leaks Client Token and Token Accessor in Audit Devices BIT-vault-2024-8365, CVE-2024-8365, GHSA-jjxf-26c9-77gm, GO-2024-3113 | Medium | 0.5% | 02 Sep, 2024 | Go github.com/hashicorp/vault |
OPA for Windows has an SMB force-authentication vulnerability CVE-2024-8260, GHSA-c77r-fh37-x2px, GO-2024-3141 | Medium | 0.3% | 30 Aug, 2024 | Go github.com/open-policy-agent/opa |
Hwameistor Potential Permission Leakage of Cluster Level CVE-2024-45054, GHSA-mgwr-h7mv-fh29, GO-2024-3103 | Medium | 0.3% | 29 Aug, 2024 | Go github.com/hwameistor/hwameistor |
OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability CVE-2024-45043, GHSA-prf6-xjxh-p698, GO-2024-3102 | Medium | 0.5% | 29 Aug, 2024 | Go github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver |
Ollama can extract members of a ZIP archive outside of the parent directory CVE-2024-45436, GHSA-846m-99qv-67mg, GO-2024-3104 | High | 2.6% | 29 Aug, 2024 | Go github.com/ollama/ollama |
CWA-2023-004: Excessive number of function parameters in compiled Wasm GHSA-75qh-gg76-p2w4, GO-2024-3101, RUSTSEC-2024-0366 | Medium | Not scored | 27 Aug, 2024 | Go github.com/CosmWasm/wasmvm crates.io cosmwasm-vm |
Chisel's AUTH environment variable not respected in server entrypoint CVE-2024-43798, GHSA-38jh-8h67-m7mj, GO-2024-3100 | High | 0.4% | 27 Aug, 2024 | Go github.com/jpillora/chisel |
req may send an unintended request when a malformed URL is provided CVE-2024-45258, GHSA-cj55-gc7m-wvcq, GO-2024-3098 | Medium | 0.7% | 26 Aug, 2024 | Go github.com/imroc/req Go github.com/imroc/req/v2 Go github.com/imroc/req/v3 |
Hyperledger Fabric does not verify request has a timestamp within the expected time window BIT-hyperledger-fabric-orderer-2024-45244, BIT-hyperledger-fabric-peer-2024-45244, BIT-hyperledger-fabric-tools-2024-45244, CVE-2024-45244, GHSA-48gg-32q2-4r6m, GO-2024-3099 | Medium | 0.6% | 25 Aug, 2024 | Go github.com/hyperledger/fabric |
Mattermost Plugin Channel Export excessive resource consumption CVE-2024-43105, GHSA-869f-px86-vj84, GO-2024-3095 | Medium | 0.4% | 23 Aug, 2024 | Go github.com/mattermost/mattermost-plugin-channel-export |
Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams BIT-mattermost-2024-42497, CVE-2024-42497, GHSA-fxq9-6946-34q7, GO-2024-3091 | High | 0.3% | 22 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows guest user with read access to upload files to a channel BIT-mattermost-2024-43780, CVE-2024-43780, GHSA-2jhx-w3vc-w59g, GO-2024-3089 | Medium | 0.3% | 22 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows team admin user without "Add Team Members" permission to disable invite URL BIT-mattermost-2024-40884, CVE-2024-40884, GHSA-3j95-8g47-fpwh, GO-2024-3090 | Medium | 0.4% | 22 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
memos CORS Misconfiguration in server.go (GHSL-2024-034) CVE-2024-41659, GHSA-p4fx-qf2h-jpmj, GO-2024-3088 | High | 0.6% | 22 Aug, 2024 | Go github.com/usememos/memos |
Casdoor has reflected XSS in QrCodePage.js (GHSL-2024-036) CVE-2024-41658, GHSA-gv2p-4mvg-g32h, GO-2024-3086 | Medium | 0.4% | 22 Aug, 2024 | Go github.com/casdoor/casdoor |
Casdoor CORS misconfiguration (GHSL-2024-035) CVE-2024-41657, GHSA-mchx-7j67-8mcf, GO-2024-3087 | High | 0.8% | 22 Aug, 2024 | Go github.com/casdoor/casdoor |