Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Docker CLI leaks private registry credentials to registry-1.docker.io BIT-docker-cli-2021-41092, CVE-2021-41092, GHSA-99pg-grm5-qq3v, GO-2024-2912 | Medium | 1.7% | 10 Jun, 2024 | Go github.com/docker/cli |
`docker cp` allows unexpected chmod of host files in Moby Docker Engine CVE-2021-41089, GHSA-v994-f8vw-g7j4, GO-2024-2913 | Low | 0.3% | 10 Jun, 2024 | Go github.com/docker/docker Go github.com/moby/moby |
go-grpc-compression has a zstd decompression bombing vulnerability GHSA-87m9-rv8p-rgmg, GO-2024-2911 | High | Not scored | 10 Jun, 2024 | Go github.com/mostynb/go-grpc-compression |
Artica Proxy Loopback Services Remotely Accessible Unauthenticated in github.com/gvalkov/tailon CVE-2024-2056, GO-2024-2612 | 16.7% | 10 Jun, 2024 | Go github.com/gvalkov/tailon | |
Unauthenticated Access to sensitive settings in Argo CD BIT-argo-cd-2024-37152, CVE-2024-37152, GHSA-87p9-x75h-p4j2, GO-2024-2902 | Medium | 2.3% | 06 Jun, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 Go github.com/argoproj/argo-cd/v2/server |
Evmos allows unvested token delegations CVE-2024-37154, GHSA-7hrh-v6wp-53vw, GO-2024-2904 | Medium | 0.4% | 06 Jun, 2024 | Go github.com/evmos/evmos Go github.com/evmos/evmos/v10 Go github.com/evmos/evmos/v11 Go github.com/evmos/evmos/v12 +14 more |
Argo-cd authenticated users can enumerate clusters by name BIT-argo-cd-2024-36106, CVE-2024-36106, GHSA-3cqf-953p-h5cp, GO-2024-2898 | Medium | 0.4% | 06 Jun, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Contract balance not updating correctly after interchain transaction CVE-2024-37153, GHSA-xgr7-jgq3-mhmc, GO-2024-2903 | High | 0.6% | 06 Jun, 2024 | Go github.com/evmos/evmos Go github.com/evmos/evmos/v10 Go github.com/evmos/evmos/v11 Go github.com/evmos/evmos/v12 +14 more |
evmos allows transferring unvested tokens after delegations CVE-2024-32873, CVE-2024-37158, CVE-2024-37159, GHSA-pxv8-qhrh-jc7v, GO-2024-2891, GO-2024-2926, GO-2024-2927 | Low | 0.4% | 06 Jun, 2024 | Go github.com/evmos/evmos Go github.com/evmos/evmos/v10 Go github.com/evmos/evmos/v11 Go github.com/evmos/evmos/v12 +14 more |
Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC BIT-opentelemetry-collector-2024-36129, CVE-2024-36129, GHSA-c74f-6mfw-mm4v, GO-2024-2900 | High | 1.2% | 05 Jun, 2024 | Go go.opentelemetry.io/collector/config/configgrpc Go go.opentelemetry.io/collector/config/confighttp |
CVE-2024-32359 in github.com/carina-io/carina CVE-2024-32359, GO-2024-2809 | 0.2% | 05 Jun, 2024 | Go github.com/carina-io/carina | |
MCUboot Injection attack of unprotected TLV values in github.com/mcu-tools/mcuboot CVE-2024-32883, GO-2024-2799 | 0.1% | 05 Jun, 2024 | Go github.com/mcu-tools/mcuboot | |
Wiki.js Stored XSS through Client Side Template Injection in github.com/requarks/wiki CVE-2024-34710, GHSA-xjcj-p2qv-q3rf, GO-2024-2875 | 0.4% | 05 Jun, 2024 | Go github.com/requarks/wiki | |
Files or Directories Accessible to External Parties in ProjectDiscovery CVE-2024-5262, GHSA-q5mg-pc7r-r8cr, GO-2024-2907 | Critical | 0.6% | 05 Jun, 2024 | Go github.com/projectdiscovery/interactsh |
Mishandling of corrupt central directory record in archive/zip BIT-golang-2024-24789, CVE-2024-24789, GO-2024-2888 | 0.4% | 04 Jun, 2024 | Go stdlib | |
Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip BIT-golang-2024-24790, CVE-2024-24790, GO-2024-2887 | 2.0% | 04 Jun, 2024 | Go stdlib | |
malicious container creates symlink "mtab" on the host External CVE-2024-5154, GHSA-j9hf-98c3-wrm8, GO-2024-2919 | High | 1.2% | 04 Jun, 2024 | Go github.com/cri-o/cri-o |
apko Exposure of HTTP basic auth credentials in log output CVE-2024-36127, GHSA-v6mg-7f7p-qmqp, GO-2024-2899 | High | 0.4% | 04 Jun, 2024 | Go chainguard.dev/apko |
Owncast Path Traversal vulnerability CVE-2024-31450, GHSA-9355-27m8-h74v, GO-2024-2741 | Medium | 1.0% | 04 Jun, 2024 | Go github.com/owncast/owncast |
SQL Injection in Harbor scan log API BIT-harbor-2024-22261, CVE-2024-22261, GHSA-vw63-824v-qf2j, GO-2024-2916 | Low | 0.4% | 02 Jun, 2024 | Go github.com/goharbor/harbor |
Open Redirect URL in Harbor BIT-harbor-2024-22244, CVE-2024-22244, GHSA-5757-v49g-f6r7, GO-2024-2915 | Medium | 0.4% | 02 Jun, 2024 | Go github.com/goharbor/harbor |
Ollama does not validate the format of the digest (sha256 with 64 hex digits) CVE-2024-37032, GHSA-8hqg-whrw-pv92, GO-2024-2901 | Medium | 89.6% | 31 May, 2024 | Go github.com/ollama/ollama |
MinIO information disclosure vulnerability CVE-2024-36107, GHSA-95fr-cm4m-q5p9, GO-2024-2886 | Medium | 0.6% | 29 May, 2024 | Go github.com/minio/minio |
Denial of service of Minder Server from maliciously crafted GitHub attestations CVE-2024-35238, GHSA-8fmj-33gw-g7pw, GO-2024-2885 | Medium | 0.5% | 28 May, 2024 | Go github.com/stacklok/minder |
github.com/huandu/facebook may expose access_token in error message. CVE-2024-35232, GHSA-3f65-m234-9mxr, GO-2024-2882 | Low | 0.5% | 24 May, 2024 | Go github.com/huandu/facebook Go github.com/huandu/facebook/v2 |
Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop GHSA-f7cq-5v43-8pwp, GO-2024-2880 | Medium | Not scored | 23 May, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Dapr API Token Exposure CVE-2024-35223, GHSA-284c-x8m7-9w5h, GO-2024-2879 | Medium | 0.4% | 22 May, 2024 | Go github.com/dapr/dapr |
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache BIT-argo-cd-2024-31989, CVE-2024-31989, GHSA-9766-5277-j5hr, GO-2024-2877 | Critical | 1.5% | 21 May, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
github.com/bincyber/go-sqlcrypter vulnerable to IV collision GHSA-2j6r-9vv4-6gf5, GO-2024-2872 | Low | Not scored | 20 May, 2024 | Go github.com/bincyber/go-sqlcrypter |
github.com/cosmos/ibc-go affected by IBC protocol "Huckleberry" vulnerability GHSA-qjcv-rx3v-7mvj, GO-2024-2874 | Medium | Not scored | 20 May, 2024 | Go github.com/cosmos/ibc-go Go github.com/cosmos/ibc-go/v2 Go github.com/cosmos/ibc-go/v3 Go github.com/cosmos/ibc-go/v4 +3 more |
Stacklok Minder vulnerable to denial of service from maliciously crafted templates CVE-2024-35194, GHSA-crgc-2583-rw27, GO-2024-2871 | Medium | 0.4% | 20 May, 2024 | Go github.com/stacklok/minder |
Trivy possibly leaks registry credential when scanning images from malicious registries CVE-2024-35192, GHSA-xcq4-m2r3-cmrj, GO-2024-2870 | Medium | 0.2% | 20 May, 2024 | Go github.com/aquasecurity/trivy |
Submariner Operator sets unnecessary RBAC permissions CVE-2024-5042, GHSA-2rhx-qhxp-5jpw, GO-2024-2866 | Medium | 0.5% | 17 May, 2024 | Go github.com/submariner-io/submariner-operator |
Denial of service of Minder Server with attacker-controlled REST endpoint CVE-2024-35185, GHSA-fjw8-3gp8-4cvx, GO-2024-2864 | Medium | 0.5% | 16 May, 2024 | Go github.com/stacklok/minder |
Stakater Forecastle has a directory traversal vulnerability CVE-2023-40297, GHSA-x8xm-wrjq-5g54, GO-2024-2865 | High | 1.2% | 15 May, 2024 | Go github.com/stakater/Forecastle |
wolfictl leaks GitHub tokens to remote non-GitHub git servers CVE-2024-35183, GHSA-8fg7-hp93-qhvr, GO-2024-2863 | Medium | 0.2% | 15 May, 2024 | Go github.com/wolfi-dev/wolfictl |
goreleaser shows environment by default GHSA-f6mm-5fc7-3g3c, GO-2024-2860 | Medium | Not scored | 15 May, 2024 | Go github.com/goreleaser/goreleaser |
source-controller leaks Azure Storage SAS token into logs CVE-2024-31216, GHSA-v554-xwgw-hc3w, GO-2024-2859 | Medium | 0.2% | 15 May, 2024 | Go github.com/fluxcd/source-controller |
azure-file-csi-driver leaks service account tokens in the logs CVE-2024-3744, GHSA-qjqg-4wg7-957h, GO-2024-2861 | Medium | 0.3% | 15 May, 2024 | Go sigs.k8s.io/azurefile-csi-driver |
sshpiper's enabling of proxy protocol without proper feature flagging allows faking source address CVE-2024-35175, GHSA-4w53-6jvp-gg52, GO-2024-2853 | Medium | 0.3% | 14 May, 2024 | Go github.com/tg123/sshpiper |
Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins BIT-grafana-2022-39201, CVE-2022-39201, GHSA-x744-mm8v-vpgr, GO-2024-2858 | High | 1.7% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana when using email as a username can block other users from signing in BIT-grafana-2022-39229, CVE-2022-39229, GHSA-gj7m-853r-289r, GO-2024-2848 | Medium | 1.1% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Email addresses and usernames can not be trusted BIT-grafana-2022-39306, CVE-2022-39306, GHSA-2x6g-h2hg-rq84, GO-2024-2843 | High | 0.8% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana User enumeration via forget password BIT-grafana-2022-39307, CVE-2022-39307, GHSA-3p62-42x7-gxg5, GO-2024-2844 | High | 0.8% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Race condition allowing privilege escalation BIT-grafana-2022-39328, CVE-2022-39328, GHSA-vqc4-mpj8-jxch, GO-2024-2856 | Critical | 1.3% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Escalation from admin to server admin when auth proxy is used BIT-grafana-2022-35957, CVE-2022-35957, GHSA-ff5c-938w-8c9q, GO-2024-2847 | High | 1.6% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins BIT-grafana-2022-31130, CVE-2022-31130, GHSA-jv32-5578-pxjc, GO-2024-2851 | Medium | 1.3% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Plugin signature bypass BIT-grafana-2022-31123, CVE-2022-31123, GHSA-rhxj-gh46-jvw8, GO-2024-2855 | High | 0.3% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana account takeover via OAuth vulnerability BIT-grafana-2022-31107, CVE-2022-31107, GHSA-mx47-6497-3fv2, GO-2024-2852 | High | 2.9% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana API IDOR BIT-grafana-2022-21713, CVE-2022-21713, GHSA-63g3-9jq3-mccv | Medium | 1.2% | 14 May, 2024 | Go github.com/grafana/grafana |