Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
slsa-verifier vulnerable to mproper validation of npm's publish attestations GHSA-r2xv-vpr2-42m9, GO-2023-2188 | Low | Not scored | 08 Nov, 2023 | Go github.com/slsa-framework/slsa-verifier Go github.com/slsa-framework/slsa-verifier/v2 |
Cosign vulnerable to possible endless data attack from attacker-controlled registry BIT-cosign-2023-46737, CVE-2023-46737, GHSA-vfp6-jrw2-99g9, GO-2023-2181 | Low | Not scored | 08 Nov, 2023 | Go github.com/sigstore/cosign Go github.com/sigstore/cosign/v2 |
HashiCorp Vagrant Insecure Operation on Windows Junction / Mount Point vulnerability CVE-2023-5834, GHSA-47xw-vw6m-w9fq | Low | Not scored | 28 Oct, 2023 | Go github.com/hashicorp/vagrant |
Flyte Admin SQL Injection in List Filters CVE-2023-41891, GHSA-r847-6w6h-r8g4, GO-2023-2162 | Low | Not scored | 27 Oct, 2023 | Go github.com/flyteorg/flyteadmin |
Artifact Hub allows unsafe rego built-in CVE-2023-45822, GHSA-9pc8-m4vp-ggvf, GO-2023-2134 | Low | Not scored | 19 Oct, 2023 | Go github.com/artifacthub/hub |
gnark-crypto's exponentiation in the pairing target group GT using GLV can give incorrect results GHSA-pffg-92cg-xf5c, GO-2023-2101 | Low | Not scored | 05 Oct, 2023 | Go github.com/consensys/gnark-crypto |
CometBFT's default for `BlockParams.MaxBytes` consensus parameter may increase block times and affect consensus participation GHSA-hq58-p9mv-338c | Low | Not scored | 29 Sep, 2023 | Go github.com/cometbft/cometbft |
Mattermost Incorrect Authorization vulnerability CVE-2023-5159, GHSA-rp65-jpc7-8h8p | Low | Not scored | 29 Sep, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Incorrect Authorization vulnerability CVE-2023-5193, GHSA-h8wh-f7gw-fwpr | Low | Not scored | 29 Sep, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Specific Cilium configurations vulnerable to DoS via Kubernetes annotations BIT-cilium-2023-41332, BIT-cilium-operator-2023-41332, BIT-cilium-proxy-2023-41332, BIT-hubble-2023-41332, BIT-hubble-relay-2023-41332, BIT-hubble-ui-2023-41332, BIT-hubble-ui-backend-2023-41332, CVE-2023-41332, GHSA-24m5-r6hv-ccgp, GO-2023-2079 | Low | Not scored | 27 Sep, 2023 | Go github.com/cilium/cilium |
Crash when processing crafted TIFF files CVE-2023-36308, GHSA-q7pp-wcgr-pffx | Low | Not scored | 05 Sep, 2023 | Go github.com/disintegration/imaging |
Mattermost fails to correctly delete attachments CVE-2023-4105, GHSA-g3v6-r8p9-wxg9 | Low | Not scored | 11 Aug, 2023 | Go github.com/mattermost/mattermost-server/v6 |
Denial of service from large image BIT-crossplane-2023-37900, CVE-2023-37900, GHSA-68p4-95xf-7gx8, GO-2023-1979 | Low | Not scored | 28 Jul, 2023 | Go github.com/crossplane/crossplane |
Nomad Caller ACL Token’s Secret ID is Exposed to Sentinel CVE-2023-3299, GHSA-9jfx-84v9-2rr2, GO-2024-2669 | Low | Not scored | 20 Jul, 2023 | Go github.com/hashicorp/nomad |
Pipelines do not validate child UIDs CVE-2023-37264, GHSA-w2h3-vvvq-3m53, GO-2023-1901 | Low | Not scored | 07 Jul, 2023 | Go github.com/tektoncd/pipeline |
code.gitea.io/gitea Open Redirect vulnerability BIT-gitea-2023-3515, CVE-2023-3515, GHSA-cf6v-9j57-v6r6, GO-2023-1894 | Low | Not scored | 05 Jul, 2023 | Go code.gitea.io/gitea |
github.com/cosmos/cosmos-sdk's x/crisis does not charge ConstantFee GHSA-w5w5-2882-47pc, GO-2023-1881 | Low | Not scored | 30 Jun, 2023 | Go github.com/cosmos/cosmos-sdk |
Temporal Server vulnerable to Incorrect Authorization and Insecure Default Initialization of Resource BIT-temporal-2023-3485, CVE-2023-3485, GHSA-gm2g-2xr9-pxxj, GO-2023-1879 | Low | Not scored | 30 Jun, 2023 | Go go.temporal.io/server |
SpiceDB's LookupResources may return partial results CVE-2023-35930, GHSA-m54h-5x5f-5m6r, GO-2023-1871 | Low | Not scored | 28 Jun, 2023 | Go github.com/authzed/spicedb |
Cilium vulnerable to information leakage via incorrect ReferenceGrant handling BIT-cilium-2023-34242, BIT-cilium-operator-2023-34242, BIT-cilium-proxy-2023-34242, BIT-hubble-2023-34242, BIT-hubble-relay-2023-34242, BIT-hubble-ui-2023-34242, BIT-hubble-ui-backend-2023-34242, CVE-2023-34242, GHSA-r7wr-4w5q-55m6, GO-2023-1862 | Low | Not scored | 16 Jun, 2023 | Go github.com/cilium/cilium |
cheqd-node affected by Inter-blockchain Communication (IBC) protocol "Huckleberry" vulnerability GHSA-7c94-gvvj-r3mg | Low | Not scored | 05 Jun, 2023 | Go github.com/cheqd/cheqd-node |
Go package github.com/cosmos/cosmos-sdk module x/crisis does NOT cause chain halt GHSA-qfc5-6r3j-jj22, GO-2023-1821 | Low | Not scored | 02 Jun, 2023 | Go github.com/cosmos/cosmos-sdk |
In Lima, a malicious disk image could read a single file on the host filesystem as a qcow2/vmdk backing file CVE-2023-32684, GHSA-f7qw-jj9c-rpq9, GO-2023-1803 | Low | Not scored | 31 May, 2023 | Go github.com/lima-vm/lima |
etcd Key name can be accessed via LeaseTimeToLive API BIT-etcd-2023-32082, CVE-2023-32082, GHSA-3p4g-rcw5-8298 | Low | Not scored | 12 May, 2023 | Go github.com/etcd-io/etcd |
Answer Missing Authorization vulnerability CVE-2023-2590, GHSA-qmqw-r4x6-3w2q, GO-2023-1774 | Low | Not scored | 09 May, 2023 | Go github.com/answerdev/answer |
Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints CVE-2023-30844, GHSA-jmp2-wc4p-wfh2, GO-2023-1764 | Low | Not scored | 05 May, 2023 | Go github.com/mutagen-io/mutagen Go github.com/mutagen-io/mutagen-compose |
Under-validated ComSpec and cmd.exe resolution in Mutagen projects GHSA-fwj4-72fm-c93g, GO-2023-1758 | Low | Not scored | 05 May, 2023 | Go github.com/mutagen-io/mutagen |
Hop-by-hop abuse to malform header mutator GHSA-w9mr-28mw-j8hg, GO-2023-1747 | Low | Not scored | 26 Apr, 2023 | Go github.com/ory/oathkeeper |
rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc CVE-2023-25809, GHSA-m8cg-xc2p-r3fc, GO-2023-1682 | Low | Not scored | 30 Mar, 2023 | Go github.com/opencontainers/runc |
Answer vulnerable to Business Logic Errors CVE-2023-1541, GHSA-h2wg-83fc-xvm9, GO-2023-1658 | Low | Not scored | 21 Mar, 2023 | Go github.com/answerdev/answer |
Buildah (as part of Podman) vulnerable to Path Traversal CVE-2022-4123, GHSA-rprg-4v7q-87v7, GO-2022-1159 | Low | Not scored | 08 Dec, 2022 | Go github.com/containers/podman/v4 |
Traefik may display authorization header in the debug logs CVE-2022-23469, GHSA-h2ph-vhm7-g4hp, GO-2022-1154 | Low | Not scored | 08 Dec, 2022 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 |
teler dashboard vulnerable to DOM-based cross-site scripting (XSS) CVE-2022-23466, GHSA-xr7p-8q82-878q | Low | Not scored | 06 Dec, 2022 | Go teler.app |
Tailscale daemon is vulnerable to information disclosure via CSRF CVE-2022-41925, GHSA-qccm-wmcq-pwr6, GO-2022-1119 | Low | Not scored | 21 Nov, 2022 | Go tailscale.com Go tailscale.com/cmd |
Container build can leak any path on the host into the container GHSA-vp35-85q5-9f25, GO-2022-1107 | Low | Not scored | 11 Nov, 2022 | Go github.com/docker/docker |
HashiCorp Nomad vulnerable to Insufficient Session Expiration CVE-2022-3867, GHSA-9fmc-5fq4-5jwh, GO-2022-1106 | Low | Not scored | 10 Nov, 2022 | Go github.com/hashicorp/nomad |
etcd having a negative value for cluster node size results in an index out-of-bound panic during service discovery GHSA-9gp7-6833-wv89 | Low | Not scored | 06 Oct, 2022 | Go go.etcd.io/etcd/client/v3 |
etcd user credentials are stored in WAL logs in plaintext GHSA-528j-9r78-wffx | Low | Not scored | 06 Oct, 2022 | Go go.etcd.io/etcd/client/v3 |
etcd vulnerable to TOCTOU of gateway endpoint authentication GHSA-h8g9-6gvh-5mrc | Low | Not scored | 06 Oct, 2022 | Go go.etcd.io/etcd/v3 |
Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata GHSA-3633-5h82-39pq, GO-2022-1004 | Low | Not scored | 16 Sep, 2022 | Go github.com/theupdateframework/go-tuf |
Cilium host policy bypass in endpoint-routes mode with dual-stack GHSA-wc5v-r48v-g4vh | Low | Not scored | 15 Jul, 2022 | Go github.com/cilium/cilium |
Argo CD SSO users vulnerable to Cross-site Scripting CVE-2022-31102, GHSA-pmjg-52h9-72qv, GO-2022-0517 | Low | Not scored | 12 Jul, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Cross site scripting via cookies in gogs GHSA-pj96-4jhv-v792, GO-2022-0473 | Low | Not scored | 02 Jun, 2022 | Go gogs.io/gogs |
Kubernetes Secrets Store CSI Driver plugins arbitrary file write CVE-2020-8567, GHSA-2v35-wj4r-rcmv, GO-2024-2750 | Low | Not scored | 24 May, 2022 | Go github.com/Azure/secrets-store-csi-driver-provider-azure Go github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp Go github.com/hashicorp/vault-csi-provider |
Mattermost Server allows System Admin to modify LDAP account names and email addresses CVE-2016-11077, GHSA-mj8v-773w-5qhj, GO-2025-4060 | Low | Not scored | 24 May, 2022 | Go github.com/mattermost/mattermost-server |
Caddy allows enumeration of Certificates and Hostnames CVE-2018-19148, GHSA-jf2w-mq6r-56v8 | Low | Not scored | 14 May, 2022 | Go github.com/caddyserver/caddy |
Kubernetes in OpenShift3 Access Control Misconfiguration CVE-2015-7561, GHSA-2h9c-34v6-3qmr, GO-2023-1985 | Low | Not scored | 13 May, 2022 | Go k8s.io/kubernetes |
Exposure of SSH credentials in Rancher/Fleet GHSA-wm2r-rp98-8pmh | Low | Not scored | 27 Apr, 2022 | Go github.com/rancher/rancher |
Improper Certificate Validation in Cosign BIT-cosign-2022-23649, CVE-2022-23649, GHSA-ccxc-vr6p-4858, GO-2022-0326 | Low | Not scored | 22 Feb, 2022 | Go github.com/sigstore/cosign |
Duplicate Advisory: GoBase Race Condition vulnerability CVE-2022-2583, GHSA-4348-x292-h437, GHSA-h2x7-2ff6-v32p, GO-2022-0400 | Low | Not scored | 11 Feb, 2022 | Go github.com/ntbosscher/gobase |