Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Grafana Stored Cross-site Scripting in Unified Alerting BIT-grafana-2022-31097, CVE-2022-31097, GHSA-vw7q-p2qg-4m5f, GO-2024-2857 | Medium | 70.1% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana proxy Cross-site Scripting BIT-grafana-2022-21702, CVE-2022-21702, GHSA-xc3p-28hw-q24g | Medium | 2.3% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana directory traversal for .cvs files BIT-grafana-2021-43815, CVE-2021-43815, GHSA-7533-c8qv-jm9m | Medium | 1.9% | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Fine-grained access control vulnerability BIT-grafana-2021-41244, CVE-2021-41244, GHSA-mpwp-42x6-4wmx | Critical | 2.9% | 14 May, 2024 | Go github.com/grafana/grafana |
containerd started with non-empty inheritable Linux process capabilities GHSA-c9cp-9c75-9v8c, GO-2024-2846 | Low | Not scored | 14 May, 2024 | Go github.com/containerd/containerd |
NATS server TLS missing ciphersuite settings when CLI flags used CVE-2021-32026, GHSA-jj54-5q2m-q7pj, GO-2024-2850 | Low | Not scored | 14 May, 2024 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
dotmesh arbitrary file read and/or write CVE-2020-26312, GHSA-hf54-fq2m-p9v6, GO-2024-2849 | High | 0.4% | 14 May, 2024 | Go github.com/dotmesh-io/dotmesh |
sshproxy vulnerable to SSH option injection CVE-2024-34713, GHSA-jmqp-37m5-49wh, GO-2024-2836 | Low | 0.4% | 14 May, 2024 | Go github.com/cea-hpc/sshproxy |
github.com/containers/image allows unexpected authenticated registry accesses CVE-2024-3727, GHSA-6wvf-f2vw-3425, GO-2024-2842 | High | 1.3% | 14 May, 2024 | Go github.com/containers/image Go github.com/containers/image/v5 |
octo-sts vulnerable to unauthenticated attacker causing unbounded CPU and memory usage CVE-2024-34079, GHSA-75r6-6jg8-pfcq, GO-2024-2833 | Low | 0.6% | 13 May, 2024 | Go github.com/octo-sts/app |
Previous ATX is not checked to be the newest valid ATX by Smesher when validating incoming ATX CVE-2024-34360, GHSA-jcqq-g64v-gcm7, GO-2024-2831 | High | 0.7% | 10 May, 2024 | Go github.com/spacemeshos/api Go github.com/spacemeshos/api/release/go Go github.com/spacemeshos/go-spacemesh |
1Panel arbitrary file write vulnerability CVE-2024-34352, GHSA-f8ch-w75v-c847, GO-2024-2830 | Medium | 1.3% | 09 May, 2024 | Go github.com/1Panel-dev/1Panel |
Arbitrary code execution during build on Darwin in cmd/go BIT-golang-2024-24787, CVE-2024-24787, GO-2024-2825 | 0.8% | 08 May, 2024 | Go toolchain | |
Vitess vulnerable to infinite memory consumption and vtgate crash CVE-2024-32886, GHSA-649x-hxfx-57j2, GO-2024-2826 | Medium | 0.8% | 08 May, 2024 | Go github.com/vitessio/vitess Go vitess.io/vitess |
Malformed DNS message can cause infinite loop in net BIT-golang-2024-24788, CVE-2024-24788, GO-2024-2824 | 1.0% | 07 May, 2024 | Go stdlib | |
Minder's GitHub Webhook Handler vulnerable to DoS from un-validated requests CVE-2024-34084, GHSA-9c5w-9q3f-3hv7, GO-2024-2821 | High | 0.6% | 07 May, 2024 | Go github.com/stacklok/minder |
go-ethereum vulnerable to DoS via malicious p2p message CVE-2024-32972, GHSA-4xc9-8hmq-j652, GO-2024-2819 | High | 0.8% | 06 May, 2024 | Go github.com/ethereum/go-ethereum |
btcd susceptible to consensus failures CVE-2024-34478, GHSA-3jgf-r68h-xfqm, GO-2024-2818 | Medium | 0.6% | 05 May, 2024 | Go github.com/btcsuite/btcd |
Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull CVE-2024-34068, GHSA-qq22-jj8x-4wwv, GO-2024-2815 | Medium | 0.4% | 03 May, 2024 | Go github.com/pterodactyl/wings |
Pterodactyl Wings vulnerable to Arbitrary File Write/Read CVE-2024-34066, GHSA-gqmf-jqgv-v8fw, GO-2024-2814 | High | 0.5% | 03 May, 2024 | Go github.com/pterodactyl/wings |
piraeus-operator allows attacker to impersonate service account CVE-2024-33398, GHSA-6fg2-hvj9-832f, GO-2024-2811 | High | 0.6% | 03 May, 2024 | Go github.com/piraeusdatastore/piraeus-operator Go github.com/piraeusdatastore/piraeus-operator/v2 |
Some CORS middleware allow untrusted origins GHSA-v84h-653v-4pq9, GO-2024-2812 | Critical | Not scored | 03 May, 2024 | Go github.com/jub0bs/fcors |
Some CORS middleware allow untrusted origins GHSA-vhxv-fg4m-p2w8, GO-2024-2813 | Critical | Not scored | 03 May, 2024 | Go github.com/jub0bs/cors |
karmada vulnerable to arbitrary code execution via a crafted command CVE-2024-33396, GHSA-wccg-v638-j9q2, GO-2024-2817 | High | 0.2% | 02 May, 2024 | Go github.com/karmada-io/karmada |
kubevirt allows a local attacker to execute arbitrary code via a crafted command CVE-2024-33394, GHSA-4q63-mr2m-57hf, GO-2024-2816 | Medium | 0.3% | 02 May, 2024 | Go kubevirt.io/kubevirt |
Firebase vulnerable to CRSF attack CVE-2024-4128, GHSA-rcm2-22f3-pqv3, GO-2024-2808 | Medium | 0.1% | 02 May, 2024 | Go github.com/firebase/firebase-tools npm firebase-tools |
Zitadel exposing internal database user name and host information CVE-2024-32967, GHSA-q5qj-x2h5-3945, GO-2024-2804 | Medium | 0.6% | 01 May, 2024 | Go github.com/zitadel/zitadel |
Navidrome Parameter Tampering vulnerability CVE-2024-32963, GHSA-4jrx-5w4h-3gpm, GO-2024-2803 | Medium | 0.4% | 01 May, 2024 | Go github.com/navidrome/navidrome |
CRI-O vulnerable to an arbitrary systemd property injection CVE-2024-3154, GHSA-2cgq-h8xw-2v5j, GO-2024-2791 | High | 1.4% | 30 Apr, 2024 | Go github.com/cri-o/cri-o |
Calico privilege escalation vulnerability CVE-2024-33522, GHSA-6362-gv4m-53ww, GO-2024-2801 | High | 0.2% | 30 Apr, 2024 | Go github.com/projectcalico/calico Go github.com/projectcalico/calico/v3 |
Buffer Overflow vulnerability in osrg gobgp CVE-2023-46565, GHSA-6rqv-5cg7-m4x3, GO-2024-3124 | High | 0.8% | 29 Apr, 2024 | Go github.com/osrg/gobgp/v3 |
Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences BIT-argo-cd-2024-32476, CVE-2024-32476, GHSA-9m6p-x4h2-6frq, GO-2024-2792 | Medium | 1.0% | 26 Apr, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Mattermost allows team admins to promote guests to team admins CVE-2024-4195, GHSA-5fh7-7mw7-mmx5, GO-2024-2793 | Low | 0.5% | 26 Apr, 2024 | Go github.com/mattermost/mattermost-server |
Mattermost fails to limit the size of a request path CVE-2024-22091, GHSA-p2wq-4ggp-45f3, GO-2024-2796 | Low | 0.5% | 26 Apr, 2024 | Go github.com/mattermost/mattermost-server |
Mattermost's detailed error messages reveal the full file path CVE-2024-32046, GHSA-vx97-8q8q-qgq5, GO-2024-2797 | Medium | 0.5% | 26 Apr, 2024 | Go github.com/mattermost/mattermost-server |
Mattermost crashes web clients via a malformed custom status CVE-2024-4182, GHSA-8f99-g2pj-x8w3, GO-2024-2795 | Medium | 0.6% | 26 Apr, 2024 | Go github.com/mattermost/mattermost-server |
Mattermost fails to limit the number of active sessions CVE-2024-4183, GHSA-wj37-mpq9-xrcm, GO-2024-2798 | Medium | 0.6% | 26 Apr, 2024 | Go github.com/mattermost/mattermost-server |
Mattermost fails to fully validate role changes CVE-2024-4198, GHSA-5qx9-9ffj-5r8f, GO-2024-2794 | Low | 0.5% | 26 Apr, 2024 | Go github.com/mattermost/mattermost-server |
ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass CVE-2024-32868, GHSA-7j7j-66cv-m239, GO-2024-2788 | High | 0.5% | 25 Apr, 2024 | Go github.com/zitadel/zitadel |
CoreDNS may return invalid cache entries CVE-2024-0874, GHSA-m9w6-wp3h-vq8g, GO-2024-2785 | Medium | 0.8% | 25 Apr, 2024 | Go github.com/coredns/coredns |
Withdrawn Advisory: Cluster Monitoring Operator contains a credentials leak CVE-2024-1139, GHSA-x5m7-63c6-fx79, GO-2024-2789 | High | 0.9% | 25 Apr, 2024 | Go github.com/openshift/cluster-monitoring-operator |
Information disclosure in podman CVE-2020-14370, GHSA-c3wv-qmjj-45r6, GO-2024-2766 | Medium | 1.4% | 24 Apr, 2024 | Go github.com/containers/libpod Go github.com/containers/libpod/v2 Go github.com/containers/podman/v2 |
Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources CVE-2021-25318, GHSA-f9xf-jq4j-vqw4, GO-2024-2768 | High | 1.1% | 24 Apr, 2024 | Go github.com/rancher/rancher |
Rancher Privilege escalation vulnerability via malicious "Connection" header CVE-2021-31999, GHSA-pvxj-25m6-7vqr, GO-2024-2778 | High | 1.1% | 24 Apr, 2024 | Go github.com/rancher/rancher |
Rancher's Steve API Component Improper authorization check allows privilege escalation CVE-2021-36776, GHSA-gvh9-xgrq-r8hw, GO-2024-2771 | High | 1.1% | 24 Apr, 2024 | Go github.com/rancher/rancher |
Rancher's Failure to delete orphaned role bindings does not revoke project level access from group based authentication CVE-2021-36775, GHSA-28g7-896h-695v, GO-2024-2760 | High | 1.0% | 24 Apr, 2024 | Go github.com/rancher/rancher |
Improper Access Control in Gitea BIT-gitea-2020-28991, CVE-2020-28991, GHSA-r7h7-chh4-5rvm | Critical | 1.7% | 24 Apr, 2024 | Go github.com/go-gitea/gitea |
Buffer Overflow in gitea BIT-gitea-2021-3382, CVE-2021-3382, GHSA-9f8c-pfvv-p4gm, GO-2024-2757 | High | 1.8% | 24 Apr, 2024 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Privilege Escalation in kubevirt CVE-2020-14316, GHSA-828r-r2c8-rfw3, GO-2024-2756 | Critical | 1.6% | 24 Apr, 2024 | Go kubevirt.io/kubevirt |
Kubelet Incorrect Privilege Assignment CVE-2019-11245, GHSA-r76g-g87f-vw8f, GO-2024-2780 | Medium | 0.6% | 24 Apr, 2024 | Go k8s.io/kubernetes Go k8s.io/kubernetes/cmd/kubelet |