Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions BIT-vault-2024-6468, CVE-2024-6468, GHSA-2qmw-pvf7-4mw6, GO-2024-2982 | High | 0.5% | 11 Jul, 2024 | Go github.com/hashicorp/vault |
NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects CVE-2022-29946, GHSA-2h2x-8hh2-mfq8, GO-2024-2980 | High | 0.5% | 11 Jul, 2024 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 Go github.com/nats-io/nats-streaming-server |
Cache driver GetBlob() allows read access to any blob without access control check CVE-2024-39897, GHSA-55r9-5mx9-qq7r, GO-2024-2979 | Medium | 0.3% | 09 Jul, 2024 | Go zotregistry.dev/zot Go zotregistry.io/zot |
Evmos vulnerable to exploit of smart contract account and vesting CVE-2024-39696, GHSA-q6hg-6m9x-5g9c, GO-2024-2974 | High | 0.5% | 09 Jul, 2024 | Go github.com/evmos/evmos Go github.com/evmos/evmos/v10 Go github.com/evmos/evmos/v11 Go github.com/evmos/evmos/v12 +15 more |
Bypassing IP allow-lists in traefik via HTTP/3 early data requests in QUIC 0-RTT handshakes CVE-2024-39321, GHSA-gxrv-wf35-62w9, GO-2024-2973 | High | 0.6% | 05 Jul, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go GHSA-xr7q-jx4m-x55m, GO-2024-2978 | Low | Not scored | 05 Jul, 2024 | Go google.golang.org/grpc |
ZITADEL Vulnerable to Session Information Leakage CVE-2024-39683, GHSA-cvw9-c57h-3397, GO-2024-2968 | Medium | 0.6% | 05 Jul, 2024 | Go github.com/zitadel/zitadel |
Gogs allows argument injection during the previewing of changes CVE-2024-39932, GHSA-9pp6-wq8c-3w2c, GHSA-hf29-9hfh-w63j, GO-2024-2971 | Critical | 16.3% | 04 Jul, 2024 | Go github.com/gogs/gogs Go gogs.io/gogs |
Duplicate Advisory: Gogs allows argument injection during the tagging of a new release CVE-2024-39933, GHSA-8mm6-wmpp-mmm3, GHSA-m27m-h5gj-wwmg, GO-2024-2972 | High | 0.7% | 04 Jul, 2024 | Go github.com/gogs/gogs Go gogs.io/gogs |
Duplicate Advisory: github.com/gogs/gogs affected by CVE-2024-39930 CVE-2024-39930, GHSA-p69r-v3h4-rj4f, GHSA-vm62-9jw3-c8w3, GO-2024-2969 | Critical | 7.7% | 04 Jul, 2024 | Go github.com/gogs/gogs Go gogs.io/gogs |
Duplicate Advisory: Gogs allows deletion of internal files CVE-2024-39931, GHSA-2vgj-3pvg-xh4w, GHSA-ccqv-43vm-4f3w, GO-2024-2970 | Critical | 52.7% | 04 Jul, 2024 | Go github.com/gogs/gogs Go gogs.io/gogs |
github.com/google/nftable IP addresses were encoded in the wrong byte order CVE-2024-6284, GHSA-qjvf-8748-9w7h, GO-2024-2977 | Medium | 0.3% | 04 Jul, 2024 | Go github.com/google/nftables |
Missing key verification in gost CVE-2024-39223, GHSA-8wxx-35qc-vp6r, GO-2024-3224 | Critical | 0.7% | 03 Jul, 2024 | Go github.com/ginuerzh/gost |
Pomerium exposed OAuth2 access and ID tokens in user info endpoint response CVE-2024-39315, GHSA-rrqr-7w59-637v, GO-2024-2965 | Medium | 0.4% | 03 Jul, 2024 | Go github.com/pomerium/pomerium |
Denial of service due to improper 100-continue handling in net/http BIT-golang-2024-24791, CVE-2024-24791, GO-2024-2963 | 1.4% | 02 Jul, 2024 | Go stdlib | |
Limited directory traversal vulnerability on Windows in golang.org/x/crypto CVE-2022-30636, GO-2024-2961 | 0.6% | 02 Jul, 2024 | Go golang.org/x/crypto | |
Output of "go env" does not sanitize values in cmd/go BIT-golang-2023-24531, CVE-2023-24531, GO-2024-2962 | 0.8% | 02 Jul, 2024 | Go toolchain | |
Panic in Pipeline when PgConn is busy or closed in github.com/jackc/pgx GHSA-fqpg-rq76-99pq, GO-2024-2567 | Medium | Not scored | 02 Jul, 2024 | Go github.com/jackc/pgx/v5 |
Denial of service via malicious preflight requests in github.com/rs/cors CVE-2025-47908, GHSA-mh55-gqvf-xfwm, GO-2024-2883 | Medium | 0.6% | 02 Jul, 2024 | Go github.com/rs/cors |
Potential memory exhaustion attack due to sparse slice deserialization CVE-2024-37298, GHSA-3669-72x9-r9p3, GO-2024-2958 | High | 1.1% | 01 Jul, 2024 | Go github.com/gorilla/schema |
Session Middleware Token Injection Vulnerability CVE-2024-38513, GHSA-98j2-3j3p-fw2v, GO-2024-2959 | Critical | 0.7% | 01 Jul, 2024 | Go github.com/gofiber/fiber Go github.com/gofiber/fiber/v2 Go github.com/gofiber/fiber/v2/middleware/session |
Gin mishandles a wildcard at the end of an origin string CVE-2019-25211, GHSA-869c-j7wc-8jqv, GO-2024-2955 | Critical | 0.4% | 29 Jun, 2024 | Go github.com/gin-contrib/cors Go github.com/gin-gonic/gin |
SQL injection vulnerability in Gin-vue-admin in github.com/flipped-aurora/gin-vue-admin CVE-2024-37896, GHSA-gf3r-h744-mqgp, GO-2024-2928 | 0.5% | 28 Jun, 2024 | Go github.com/flipped-aurora/gin-vue-admin | |
Openshift/telemeter: iss check during jwt authentication can be bypassed in github.com/openshift/telemeter CVE-2024-5037, GO-2024-2905 | 0.8% | 28 Jun, 2024 | Go github.com/openshift/telemeter | |
Improper trust check in Bazel Build intellij plugin in github.com/bazelbuild/intellij CVE-2024-5899, GHSA-hh9f-wmhw-46vg, GO-2024-2933 | 0.1% | 28 Jun, 2024 | Go github.com/bazelbuild/intellij | |
CometBFT is unstability during blocksync when syncing from malicious peer GHSA-hg58-rf2h-6rr7, GO-2024-2951 | Medium | Not scored | 28 Jun, 2024 | Go github.com/cometbft/cometbft |
Panic when parsing invalid palette-color images in golang.org/x/image CVE-2024-24792, GHSA-9phm-fm57-rhg8, GO-2024-2937 | High | 0.7% | 25 Jun, 2024 | Go golang.org/x/image |
PingCAP TiDB nil pointer dereference CVE-2024-37820, GHSA-9g6g-xqv5-8g5w, GO-2024-3284 | Medium | 0.4% | 25 Jun, 2024 | Go github.com/pingcap/tidb |
HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation CVE-2024-6257, GHSA-xfhp-jf8p-mh5w, GO-2024-2948 | High | 1.0% | 25 Jun, 2024 | Go github.com/hashicorp/go-getter |
go-retryablehttp can leak basic auth credentials to log files CVE-2024-6104, GHSA-v6v8-xj6m-xwqh, GO-2024-2947 | Medium | 0.4% | 24 Jun, 2024 | Go github.com/hashicorp/go-retryablehttp |
Lightning Network Daemon (LND)'s onion processing logic leads to a denial of service CVE-2024-38359, GHSA-9gxx-58q6-42p7, GO-2024-2943 | High | 0.6% | 20 Jun, 2024 | Go github.com/lightningnetwork/lnd |
SpiceDB exclusions can result in no permission returned when permission expected CVE-2024-38361, GHSA-grjv-gjgr-66g2, GO-2024-2939 | Medium | 0.4% | 20 Jun, 2024 | Go github.com/authzed/spicedb |
ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability GHSA-rvj4-q8q5-8grf, GO-2024-2941 | Medium | Not scored | 20 Jun, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
SFTPGo has insufficient access control for password reset CVE-2024-37897, GHSA-hw5f-6wvv-xcrh, GO-2024-2940 | Medium | 0.3% | 20 Jun, 2024 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |
LocalAI path traversal vulnerability CVE-2024-5182, GHSA-cpcx-r2gq-x893, GO-2024-2938 | High | 25.5% | 20 Jun, 2024 | Go github.com/go-skynet/LocalAI |
PocketBase performs password auth and OAuth2 unverified email linking CVE-2024-38351, GHSA-m93w-4fxv-r35v, GO-2024-2936 | Medium | 0.3% | 18 Jun, 2024 | Go github.com/pocketbase/pocketbase |
Minder affected by denial of service from maliciously configured Git repository CVE-2024-37904, GHSA-hpcg-xjq5-g666, GO-2024-2934 | Medium | 0.5% | 18 Jun, 2024 | Go github.com/stacklok/minder |
Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec CVE-2024-22032, GHSA-q6c7-56cq-g2wm, GO-2024-2932 | High | 0.4% | 17 Jun, 2024 | Go github.com/rancher/rancher |
Rancher's External RoleTemplates can lead to privilege escalation CVE-2023-32196, CVE-2023-32197, GHSA-64jq-m7rq-768h, GHSA-7h8m-pvw3-5gh4, GO-2024-2929, GO-2024-3220 | Critical | 0.6% | 17 Jun, 2024 | Go github.com/rancher/rancher |
rke's credentials are stored in the RKE1 Cluster state ConfigMap CVE-2023-32191, GHSA-6gr4-52w6-vmqx, GO-2024-2930 | Critical | 0.7% | 17 Jun, 2024 | Go github.com/rancher/rke |
Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider CVE-2023-22650, GHSA-9ghh-mmcq-8phc, GO-2024-2931 | High | 0.6% | 17 Jun, 2024 | Go github.com/rancher/rancher |
CVE-2024-5138: snapd snapctl auth bypass CVE-2024-5138, GHSA-p9v8-q5m4-pf46, GO-2024-2906 | Medium | 0.8% | 14 Jun, 2024 | Go github.com/snapcore/snapd |
AdGuardHome privilege escalation vulnerability CVE-2024-36586, GHSA-7jp9-vgmq-c8r5, GO-2024-2924 | High | 0.2% | 13 Jun, 2024 | Go github.com/AdguardTeam/AdGuardHome |
Vulnerabilities with the k8sGPT GHSA-85rg-8m6h-825p, GO-2024-2923 | High | Not scored | 13 Jun, 2024 | Go github.com/k8sgpt-ai/k8sgpt |
Cilium leaks sensitive information in cilium-bugtool BIT-cilium-2024-37307, BIT-cilium-operator-2024-37307, BIT-cilium-proxy-2024-37307, BIT-hubble-2024-37307, BIT-hubble-relay-2024-37307, BIT-hubble-ui-2024-37307, BIT-hubble-ui-backend-2024-37307, CVE-2024-37307, GHSA-wh78-7948-358j, GO-2024-2922 | High | 0.2% | 13 Jun, 2024 | Go github.com/cilium/cilium |
gqlparser denial of service vulnerability via the parserDirectives function CVE-2023-49559, GHSA-2hmf-46v7-v6fx, GO-2024-2920 | Medium | 0.6% | 12 Jun, 2024 | Go github.com/vektah/gqlparser Go github.com/vektah/gqlparser/v2 |
HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims BIT-vault-2024-5798, CVE-2024-5798, GHSA-32cj-5wx4-gq8p, GO-2024-2921 | Low | 0.3% | 12 Jun, 2024 | Go github.com/hashicorp/vault |
Traefik has unexpected behavior with IPv4-mapped IPv6 addresses GHSA-7jmw-8259-q9jx, GO-2024-2917 | Medium | Not scored | 11 Jun, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-35255, GHSA-m5vv-6r4h-3vj9, GO-2024-2918, PYSEC-2026-1209 | Medium | 0.8% | 11 Jun, 2024 | Go github.com/Azure/azure-sdk-for-go/sdk/azidentity Maven com.azure:azure-identity Maven com.microsoft.azure:msal4j NuGet Azure.Identity +4 more |
Moby (Docker Engine) is vulnerable to Ambiguous OCI manifest parsing GHSA-xmmx-7jpf-fx42, GO-2024-2914 | Medium | Not scored | 10 Jun, 2024 | Go github.com/docker/docker Go github.com/moby/moby |