Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Kubean vulnerable to cluster-level privilege escalation CVE-2024-41820, GHSA-3wfj-3x8q-hrpg, GO-2024-3039 | High | 0.4% | 05 Aug, 2024 | Go github.com/kubean-io/kubean |
In regclient, pinned manifest digests may be ignored CVE-2025-24882, GHSA-qv35-3gw6-8q4j, GO-2024-3038 | Medium | 0.2% | 05 Aug, 2024 | Go github.com/regclient/regclient |
APM Server vulnerable to Insertion of Sensitive Information into Log File CVE-2024-37286, GHSA-f6cj-4h3g-hwq4, GO-2024-3037 | Medium | 0.5% | 03 Aug, 2024 | Go github.com/elastic/apm-server |
Podman vulnerable to memory-based denial of service CVE-2024-3056, GHSA-rpcc-p8xm-rc6p, GO-2024-3042 | High | 0.5% | 02 Aug, 2024 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 +1 more |
soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests CVE-2024-41956, GHSA-m445-w3xr-vp2f, GO-2024-3019 | High | 0.5% | 02 Aug, 2024 | Go github.com/charmbracelet/soft-serve |
Navidrome uses MD5 hashing algorithm CVE-2024-41259, GHSA-hrmx-8jjv-g758, GO-2024-3029 | Medium | 0.4% | 01 Aug, 2024 | Go github.com/navidrome/navidrome |
NetBird uses a static initialization vector (IV) CVE-2024-41260, GHSA-9v35-4xcr-w9ph, GO-2024-3057 | High | 0.5% | 01 Aug, 2024 | Go github.com/netbirdio/netbird |
casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification CVE-2024-41264, GHSA-67fw-w8f2-88wp, GO-2024-3026 | Medium | 0.5% | 01 Aug, 2024 | Go github.com/casdoor/casdoor |
cortex establishes TLS connections with `InsecureSkipVerify` set to `true` CVE-2024-41265, GHSA-vw7g-3cc7-7rmh, GO-2024-3036 | High | 0.3% | 01 Aug, 2024 | Go github.com/cortexlabs/cortex Go github.com/cortexproject/cortex |
Mattermost allows unsolicited invites to expose access to local channels CVE-2024-39777, GHSA-q22q-2rrf-m27p, GO-2024-3092 | Critical | 0.4% | 01 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows a remote actor to permanently delete local data by abusing dangerous error handling CVE-2024-39832, GHSA-762m-4cx6-6mf4, GO-2024-3020 | Medium | 0.5% | 01 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost did not properly restrict channel creation BIT-mattermost-2024-39837, CVE-2024-39837, GHSA-vvpg-55p7-5h8w, GO-2024-3032 | Low | 0.3% | 01 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows a user on a remote to set their remote username prop to an arbitrary string BIT-mattermost-2024-39839, CVE-2024-39839, GHSA-vg6q-84p8-qvqh, GO-2024-3024 | Medium | 0.3% | 01 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows remote actor to create/update/delete posts in arbitrary channels BIT-mattermost-2024-41144, CVE-2024-41144, GHSA-vg67-chm7-8m3j, GO-2024-3023 | High | 0.4% | 01 Aug, 2024 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Mattermost allows a remote actor to make an arbitrary local channel read-only BIT-mattermost-2024-41162, CVE-2024-41162, GHSA-jr9x-3x7m-4j75, GO-2024-3031 | Medium | 0.3% | 01 Aug, 2024 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Mattermost allows remote actor to set arbitrary RemoteId values for synced users BIT-mattermost-2024-41926, CVE-2024-41926, GHSA-9fpw-c9x7-cv3j, GO-2024-3022 | Medium | 0.2% | 01 Aug, 2024 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Mattermost failed to properly validate synced reactions CVE-2024-29977, GHSA-jq3g-xqpx-37x3, GO-2024-3030 | Medium | 0.3% | 01 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost failed to disallow the modification of local users when syncing users in shared channels CVE-2024-36492, GHSA-56mc-f9w7-2wxq, GO-2024-3025 | Medium | 0.3% | 01 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel CVE-2024-39274, GHSA-cmc8-222c-vqp9, GO-2024-3028 | Critical | 0.3% | 01 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Malicious code in github.com/PromonLogicalis/asn1 GO-2024-3012 | Not scored | 31 Jul, 2024 | Go github.com/PromonLogicalis/asn1 | |
Beego privilege escalation vulnerability CVE-2024-40464, GHSA-r6qh-j42j-pw64, GO-2024-3016 | High | 0.6% | 31 Jul, 2024 | Go github.com/beego/beego/v2 |
Beego privilege escalation vulnerability CVE-2024-40465, GHSA-wr3p-r5fj-wf97 | High | 0.4% | 31 Jul, 2024 | Go github.com/beego/beego/v2 |
Filestash configured to skip TLS certificate verification when using the FTPS protocol CVE-2024-41255, GHSA-4jmm-c6jw-g796, GO-2024-3033 | High | 0.3% | 31 Jul, 2024 | Go github.com/mickael-kerjean/filestash |
Filestash skips TLS certificate verification process when sending out email verification codes CVE-2024-41256, GHSA-mpvx-whpp-99xj, GO-2024-3035 | High | 0.2% | 31 Jul, 2024 | Go github.com/mickael-kerjean/filestash |
ZITADEL "ignoring unknown usernames" vulnerability CVE-2024-41952, GHSA-567v-6hmg-6qg7, GO-2024-3014 | Medium | 0.6% | 31 Jul, 2024 | Go github.com/zitadel/zitadel |
ZITADEL has improper HTML sanitization in emails and Console UI CVE-2024-41953, GHSA-v333-7h2p-5fhv, GO-2024-3015 | Medium | 0.7% | 31 Jul, 2024 | Go github.com/zitadel/zitadel |
Harbor fails to validate the user permissions when updating project configurations BIT-harbor-2024-22278, CVE-2024-22278, GHSA-hw28-333w-qxp3, GO-2024-3013 | High | 0.4% | 31 Jul, 2024 | Go github.com/goharbor/harbor |
pREST vulnerable to jwt bypass + sql injection GHSA-wm25-j4gw-6vr3, GO-2024-3011 | Critical | Not scored | 30 Jul, 2024 | Go github.com/prest/prest |
Authz zero length regression CVE-2024-41110, GHSA-v23v-6jw2-98fq, GO-2024-3005 | Critical | 16.5% | 29 Jul, 2024 | Go github.com/docker/docker Go github.com/moby/moby |
snapd failed to restrict writes to the $HOME/bin path CVE-2024-1724, GHSA-4mh8-9689-38vr, GO-2024-3007 | Medium | 0.3% | 25 Jul, 2024 | Go github.com/snapcore/snapd |
snapd failed to properly check the file type when extracting a snap CVE-2024-29068, GHSA-64jh-cjwc-w8q6, GO-2024-3008 | Medium | 0.2% | 25 Jul, 2024 | Go github.com/snapcore/snapd |
snapd failed to properly check the destination of symbolic links when extracting a snap CVE-2024-29069, GHSA-69p6-gp5x-j269, GO-2024-3009 | Low | 0.2% | 25 Jul, 2024 | Go github.com/snapcore/snapd |
Volcano has insecure permissions CVE-2024-36533, GHSA-5g3x-8g2v-r8x8, GO-2024-3034 | Critical | 0.5% | 24 Jul, 2024 | Go github.com/volcano-sh/volcano Go volcano.sh/volcano |
fabedge has insecure permissions CVE-2024-36536, GHSA-c9cm-5j82-m6pj, GO-2024-3027 | Critical | 0.5% | 24 Jul, 2024 | Go github.com/fabedge/fabedge |
The Argo CD web terminal session does not handle the revocation of user permissions properly BIT-argo-cd-2024-41666, CVE-2024-41666, GHSA-v8wx-v5jq-qhhw, GO-2024-3006 | Medium | 0.7% | 24 Jul, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration CVE-2024-6717, GHSA-5mqx-rpxv-mvxj, GO-2026-4278 | High | 0.4% | 23 Jul, 2024 | Go github.com/hashicorp/nomad |
CVE-2024-21527 in github.com/gotenberg/gotenberg CVE-2024-21527, GO-2024-2996 | 0.6% | 22 Jul, 2024 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 | |
Linkerd potential access to the shutdown endpoint in github.com/linkerd/linkerd2 CVE-2024-40632, GHSA-6v94-gj6x-jqj7, GO-2024-2984 | 0.4% | 22 Jul, 2024 | Go github.com/linkerd/linkerd2 | |
1Panel SQL injection in github.com/1Panel-dev/1Panel CVE-2024-39911, GHSA-7m53-pwp6-v3f5, GO-2024-2992 | 4.5% | 22 Jul, 2024 | Go github.com/1Panel-dev/1Panel | |
Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint BIT-argo-cd-2024-40634, CVE-2024-40634, GHSA-jmvp-698c-4x3w, GO-2024-3002 | High | 1.4% | 22 Jul, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Woodpecker's custom workspace allow to overwrite plugin entrypoint executable CVE-2024-41121, GHSA-xw35-rrcp-g7xm, GO-2024-2999 | High | 0.7% | 19 Jul, 2024 | Go go.woodpecker-ci.org/woodpecker Go go.woodpecker-ci.org/woodpecker/v2 |
Woodpecker's custom environment variables allow to alter execution flow of plugins CVE-2024-41122, GHSA-3wf2-2pq4-4rvc, GO-2024-2998 | Medium | 0.6% | 19 Jul, 2024 | Go go.woodpecker-ci.org/woodpecker Go go.woodpecker-ci.org/woodpecker/v2 |
github.com/gitpod-io/gitpod vulnerable to Cookie Tossing CVE-2024-21583, GHSA-8pgc-65mj-53h5, GO-2024-2997 | Medium | 0.6% | 19 Jul, 2024 | Go github.com/gitpod-io/gitpod Go github.com/gitpod-io/gitpod/components/server/go Go github.com/gitpod-io/gitpod/components/ws-proxy Go github.com/gitpod-io/gitpod/install/installer |
Kubernetes sets incorrect permissions on Windows containers logs CVE-2024-5321, GHSA-82m2-cv7p-4m75, GO-2024-2994 | High | 0.3% | 18 Jul, 2024 | Go k8s.io/kubernetes |
Sliver Allows Authenticated Operator-to-Server Remote Code Execution CVE-2024-41111, GHSA-hc5w-gxxr-w8x8, GO-2024-2993 | High | 0.7% | 18 Jul, 2024 | Go github.com/bishopfox/sliver |
1Panel has an SQL injection issue related to the orderBy clause CVE-2024-39907, GHSA-5grx-v727-qmq6, GO-2024-2990 | Critical | 29.2% | 18 Jul, 2024 | Go github.com/1Panel-dev/1Panel |
projectdiscovery/nuclei allows unsigned code template execution through workflows CVE-2024-40641, GHSA-c3q9-c27p-cw9h, GO-2024-2989 | High | 0.3% | 17 Jul, 2024 | Go github.com/projectdiscovery/nuclei Go github.com/projectdiscovery/nuclei/v2 Go github.com/projectdiscovery/nuclei/v3 |
Skupper uses a static cookie secret for the openshift oauth-proxy CVE-2024-6535, GHSA-w799-v85j-88pg, GO-2024-2987 | High | 0.5% | 17 Jul, 2024 | Go github.com/skupperproject/skupper |
ZITADEL Go's GRPC example code vulnerability - GO-2024-2687 HTTP/2 CONTINUATION flood in net/http GHSA-qc6v-5g5m-8cw2 | Medium | Not scored | 15 Jul, 2024 | Go github.com/zitadel/zitadel-go/v3 |
SQL Injection in the KubeClarity REST API CVE-2024-39909, GHSA-5248-h45p-9pgw, GO-2024-2981 | High | 0.4% | 12 Jul, 2024 | Go github.com/openclarity/kubeclarity/backend |