Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
GoAuthentik vulnerable to Insufficient Authorization for several API endpoints BIT-authentik-2024-42490, CVE-2024-42490, GHSA-qxqc-27pr-wgc8, GO-2024-3085 | Critical | 0.5% | 22 Aug, 2024 | Go goauthentik.io |
Mattermost doesn't redact remote users' original email addresses CVE-2024-32939, GHSA-4ww8-fprq-cq34, GO-2024-3093 | Medium | 0.2% | 22 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows remote/synthetic users to create sessions, reset passwords CVE-2024-39836, GHSA-c6vp-jjgv-38wj, GO-2024-3096 | Medium | 0.3% | 22 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Cross-Site Request Forgery vulnerability CVE-2024-40886, GHSA-hrf9-rm95-fpf3, GO-2024-3097 | Medium | 0.2% | 22 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't restrict which roles can promote a user as system admin CVE-2024-8071, GHSA-5263-pm2h-m7hw, GO-2024-3094 | Medium | 0.3% | 22 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
CWA-2024-006: wasmd non-deterministic module_query_safe query GHSA-fpgj-cr28-fvpx, GO-2024-3081 | Medium | Not scored | 21 Aug, 2024 | Go github.com/CosmWasm/wasmd |
CWA-2024-005: Stackoverflow in wasmd GHSA-g8w7-7vgg-x7xg, GO-2024-3082 | High | Not scored | 21 Aug, 2024 | Go github.com/CosmWasm/wasmd |
Default installation of `synthetic-monitoring-agent` exposes sensitive information CVE-2022-46156, GHSA-9j4f-f249-q5w8, GO-2022-1132 | Medium | 0.5% | 21 Aug, 2024 | Go github.com/grafana/synthetic-monitoring-agent Go github.com/grafana/synthetic-monitoring-agent/cmd/synthetic-monitoring-agent |
Exposure of debug and metrics endpoints in Pomerium CVE-2022-24797, GHSA-q98f-2x4p-prjr, GO-2022-0413 | Medium | 1.4% | 21 Aug, 2024 | Go github.com/pomerium/pomerium |
Denial of service from malicious manifest in kyverno in github.com/kyverno/kyverno CVE-2023-42813, GHSA-wc3x-5rfv-hh5v, GO-2023-2335 | 0.7% | 21 Aug, 2024 | Go github.com/kyverno/kyverno | |
Denial of service from malicious image manifest in kyverno in github.com/kyverno/kyverno CVE-2023-42814, GHSA-9g37-h7p2-2c6r, GO-2023-2336 | 0.7% | 21 Aug, 2024 | Go github.com/kyverno/kyverno | |
Denial of service from malicious image manifest in kyverno in github.com/kyverno/kyverno CVE-2023-42815, GHSA-hjpv-68f4-2262, GO-2023-2337 | 0.7% | 21 Aug, 2024 | Go github.com/kyverno/kyverno | |
Denial of service from malicious signature in kyverno in github.com/kyverno/kyverno CVE-2023-42816, GHSA-4mp4-46gq-hv3r, GO-2023-2338 | 0.5% | 21 Aug, 2024 | Go github.com/kyverno/kyverno | |
Openshift Console insufficient entropy vulnerability CVE-2024-6508, GHSA-4crf-28c7-v4gr, GO-2024-3083 | Medium | 0.7% | 21 Aug, 2024 | Go github.com/openshift/console |
Withdrawn Advisory: Kanister vulnerable to cluster-level privilege escalation CVE-2024-43403, GHSA-h27c-6xm3-mcqp, GO-2024-3080 | Medium | 0.5% | 20 Aug, 2024 | Go github.com/kanisterio/kanister |
Capsule tenant owner with "patch namespace" permission can hijack system namespaces CVE-2024-39690, GHSA-mq69-4j5w-3qwp, GO-2024-3077 | High | 0.5% | 20 Aug, 2024 | Go github.com/projectcapsule/capsule |
Grafana plugin data sources vulnerable to access control bypass BIT-grafana-2024-6322, CVE-2024-6322, GHSA-hh8p-374f-qgr5, GO-2024-3079 | Medium | 0.3% | 20 Aug, 2024 | Go github.com/grafana/grafana |
LF Edge eKuiper has a SQL Injection in sqlKvStore CVE-2024-43406, GHSA-r5ph-4jxm-6j9p, GO-2024-3078, PYSEC-2024-72 | High | 0.9% | 20 Aug, 2024 | Go github.com/lf-edge/ekuiper PyPI ekuiper |
Trufflehog vulnerable to Blind SSRF in some Detectors CVE-2024-43379, GHSA-3r74-v83p-f4f4, GO-2024-3076 | Low | 0.3% | 19 Aug, 2024 | Go github.com/trufflesecurity/trufflehog Go github.com/trufflesecurity/trufflehog/v3 |
Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia GHSA-83qr-9v2h-qxp4, GO-2024-3068 | Not scored | 19 Aug, 2024 | Go github.com/cosmos/gaia/v14 Go github.com/cosmos/gaia/v15 Go github.com/cosmos/gaia/v16 Go github.com/cosmos/gaia/v17 | |
CVE-2024-7646 in github.com/kubernetes/ingress-nginx CVE-2024-7646, GO-2024-3075 | 27.0% | 19 Aug, 2024 | Go github.com/kubernetes/ingress-nginx | |
Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API BIT-cilium-2024-42486, BIT-cilium-operator-2024-42486, BIT-hubble-relay-2024-42486, CVE-2024-42486, GHSA-vwf8-q6fw-4wcm, GO-2024-3074 | Medium | 0.6% | 16 Aug, 2024 | Go github.com/cilium/cilium |
Gateway API route matching order contradicts specification BIT-cilium-2024-42487, BIT-cilium-operator-2024-42487, BIT-hubble-relay-2024-42487, CVE-2024-42487, GHSA-qcm3-7879-xcww, GO-2024-3071 | Medium | 0.5% | 15 Aug, 2024 | Go github.com/cilium/cilium |
Policy bypass for Host Firewall policy due to race condition in Cilium agent BIT-cilium-2024-42488, BIT-cilium-operator-2024-42488, BIT-hubble-relay-2024-42488, CVE-2024-42488, GHSA-q7w8-72mr-vpgw, GO-2024-3072 | Medium | 0.5% | 15 Aug, 2024 | Go github.com/cilium/cilium |
SQL injection in github.com/stashapp/stash CVE-2024-32231, GHSA-75jf-52jg-qqh4, GO-2024-3070 | Critical | 1.2% | 15 Aug, 2024 | Go github.com/stashapp/stash |
Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking CVE-2024-7625, GHSA-25qx-vfw2-fw8r, GO-2024-3073 | Medium | 0.3% | 15 Aug, 2024 | Go github.com/hashicorp/nomad |
open-telemetry has an Observable Timing Discrepancy CVE-2024-42368, GHSA-rfxf-mf63-cpqv, GO-2024-3066 | Medium | 0.6% | 13 Aug, 2024 | Go github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension |
RBAC Roles for `etcd` created by Kamaji are not disjunct CVE-2024-42480, GHSA-6r4j-4rjc-8vw5, GO-2024-3063 | Critical | 0.6% | 12 Aug, 2024 | Go github.com/clastix/kamaji |
Apache Answer: The link for resetting user password is not Single-Use CVE-2024-41888, GHSA-v3x9-wrq5-868j, GO-2024-3065 | Medium | 1.2% | 12 Aug, 2024 | Go github.com/apache/incubator-answer |
Apache Answer: The link to reset the user's password will remain valid after sending a new link CVE-2024-41890, GHSA-gvpv-r32v-9737, GO-2024-3064 | Medium | 1.1% | 12 Aug, 2024 | Go github.com/apache/incubator-answer |
OpenFGA Authorization Bypass CVE-2024-42473, GHSA-3f6g-m4hr-59h8, GO-2024-3061 | High | 0.5% | 09 Aug, 2024 | Go github.com/openfga/openfga |
CosmWasm wasmd has large address count in ValidateBasic GHSA-m3rh-cvr5-x6q4, GO-2024-3059 | Medium | Not scored | 08 Aug, 2024 | Go github.com/CosmWasm/wasmd |
Gas mispricing in cosmwasm-vm GHSA-rg2q-2jh9-447q, RUSTSEC-2024-0361 | Medium | Not scored | 08 Aug, 2024 | Go github.com/CosmWasm/wasmvm Go github.com/CosmWasm/wasmvm/v2 crates.io cosmwasm-vm |
Gorush uses deprecated TLS versions CVE-2024-41270, GHSA-p3pf-mff8-3h47, GO-2024-3058 | Medium | 0.3% | 06 Aug, 2024 | Go github.com/appleboy/gorush |
Gitea Cross-site Scripting Vulnerability CVE-2024-6886, GHSA-4h4p-553m-46qh, GO-2024-3056 | Critical | 33.0% | 06 Aug, 2024 | Go code.gitea.io/gitea |
rudder-server is vulnerable to SQL injection CVE-2023-30625, GHSA-3jmm-f6jj-rcc3, GO-2023-1863 | Critical | 85.8% | 05 Aug, 2024 | Go github.com/rudderlabs/rudder-server |
CasaOS Command Injection vulnerability CVE-2023-37469, GHSA-92vc-4fcw-g68q, GO-2023-2026 | Critical | 1.6% | 05 Aug, 2024 | Go github.com/IceWhaleTech/CasaOS |
Meshery SQL Injection vulnerability CVE-2024-35181, GHSA-9f24-jrv4-f8g5, GO-2024-3050 | Medium | 1.6% | 05 Aug, 2024 | Go github.com/layer5io/meshery |
Meshery SQL Injection vulnerability CVE-2024-35182, GHSA-h7cm-jvpp-69xf, GO-2024-3051 | Medium | 1.6% | 05 Aug, 2024 | Go github.com/layer5io/meshery |
gotortc Cross-site Scripting vulnerability CVE-2024-29191, GHSA-wv8x-3w6r-6h7v, GO-2024-3055 | Medium | 0.4% | 05 Aug, 2024 | Go github.com/AlexxIT/go2rtc |
gotortc vulnerable to Cross-Site Request Forgery CVE-2024-29192, GHSA-qgj8-g9q4-7f2p, GO-2024-3052 | High | 0.5% | 05 Aug, 2024 | Go github.com/AlexxIT/go2rtc |
gotortc Cross-site Scripting vulnerability CVE-2024-29193, GHSA-rh4r-f7f7-r99m, GO-2024-3053 | Medium | 0.5% | 05 Aug, 2024 | Go github.com/AlexxIT/go2rtc |
memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta CVE-2024-29028, GHSA-6fcf-g3mp-xj2x, GO-2024-3047 | Medium | 1.0% | 05 Aug, 2024 | Go github.com/usememos/memos |
memos vulnerable to Server-Side Request Forgery and Cross-site Scripting CVE-2024-29029, GHSA-9cqm-mgv9-vv9j, GO-2024-3049 | Medium | 1.1% | 05 Aug, 2024 | Go github.com/usememos/memos |
memos vulnerable to Server-Side Request Forgery in /api/resource CVE-2024-29030, GHSA-65fm-2jgr-j7qq, GO-2024-3046 | Medium | 1.1% | 05 Aug, 2024 | Go github.com/usememos/memos |
Meshery SQL Injection vulnerability CVE-2024-29031, GHSA-652r-q29p-m25h, GO-2024-3045 | High | 1.0% | 05 Aug, 2024 | Go github.com/layer5io/meshery |
RobotsAndPencils go-saml authentication bypass vulnerability CVE-2023-48703, GHSA-6h53-q94j-348w, GO-2024-3048 | High | 0.6% | 05 Aug, 2024 | Go github.com/RobotsAndPencils/go-saml |
Owncast Cross-Site Request Forgery vulnerability CVE-2024-29026, GHSA-v99w-r56h-g23v, GO-2024-3054 | High | 0.4% | 05 Aug, 2024 | Go github.com/owncast/owncast |
lorawan-stack Open Redirect vulnerability CVE-2023-26494, GHSA-5fwq-9x7j-2qpg, GO-2024-3044 | Medium | 0.6% | 05 Aug, 2024 | Go go.thethings.network/lorawan-stack Go go.thethings.network/lorawan-stack/v3 |
Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm CVE-2024-6984, GHSA-6vjm-54vp-mxhx, GO-2024-3010, GO-2024-3040 | High | 0.4% | 05 Aug, 2024 | Go github.com/juju/juju |