Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Sensitive Information leak via Log File in Kubernetes CVE-2020-8563, GHSA-5xfg-wv98-264m, GO-2024-2755 | Medium | 0.5% | 24 Apr, 2024 | Go github.com/kubernetes/kubernetes Go k8s.io/kubernetes |
Sensitive Information leak via Log File in Kubernetes CVE-2020-8566, GHSA-5x96-j797-5qqw, GO-2024-2754 | Medium | 0.5% | 24 Apr, 2024 | Go github.com/kubernetes/kubernetes Go k8s.io/kubernetes |
Access Restriction Bypass in go-ipfs CVE-2020-10937, GHSA-r23h-3jmw-q7hr, GO-2024-2779 | High | 1.2% | 24 Apr, 2024 | Go github.com/ipfs/go-ipfs |
Denial of service in Kubernetes CVE-2020-8557, GHSA-55qj-gj3x-jq9r, GO-2024-2753 | Medium | 0.4% | 24 Apr, 2024 | Go k8s.io/kubernetes Go k8s.io/kubernetes/pkg/kubelet |
Privilege Escalation in Kubernetes CVE-2020-8559, GHSA-33c5-9fx5-fvjm, GO-2024-2748 | Medium | 6.1% | 24 Apr, 2024 | Go k8s.io/apimachinery Go k8s.io/kubernetes |
github.com/u-root/u-root/pkg/cpio Arbitrary File Write via Archive Extraction (Zip Slip) CVE-2020-7666, GHSA-mq35-x99r-54fc | High | 1.5% | 24 Apr, 2024 | Go github.com/u-root/u-root/pkg/cpio |
Hugo Markdown titles do not escaped in internal render hooks CVE-2024-32875, GHSA-ppf8-hhpp-f5hj, GO-2024-2747 | Medium | 0.5% | 23 Apr, 2024 | Go github.com/gohugoio/hugo |
Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin CVE-2024-3177, GHSA-pxhw-596r-rwq5, GO-2024-2746 | Low | 2.2% | 23 Apr, 2024 | Go k8s.io/kubernetes |
Arbitrary Code Execution in Gitea BIT-gitea-2020-14144, CVE-2020-14144, GHSA-3h6c-c475-jm7v | High | 95.4% | 22 Apr, 2024 | Go code.gitea.io/gitea |
Moby (Docker Engine) started with non-empty inheritable Linux process capabilities CVE-2022-24769, GHSA-2mm7-x5h6-5pvq, GO-2022-0390 | Medium | 0.5% | 22 Apr, 2024 | Go github.com/docker/docker Go github.com/moby/moby |
Authelia's Group Changes may not have the expected results (YAML file backend) GHSA-x883-2vmg-xwf7, GO-2024-2744 | Low | Not scored | 22 Apr, 2024 | Go github.com/authelia/authelia/v4 |
Apache Answer: XSS vulnerability when changing personal website CVE-2024-29217, GHSA-cvqr-mwh6-2vc6, GO-2024-2743 | Medium | 1.0% | 21 Apr, 2024 | Go github.com/apache/incubator-answer |
IPv6 enabled on IPv4-only network interfaces CVE-2024-32473, GHSA-x84c-p2g9-rqv9, GO-2024-2737 | Medium | 0.4% | 18 Apr, 2024 | Go github.com/docker/docker |
1Panel's password verification is suspected to have a timing attack vulnerability CVE-2024-30257, GHSA-6m9h-2pr2-9j8f, GO-2024-2734 | Low | 0.4% | 18 Apr, 2024 | Go github.com/1Panel-dev/1Panel |
HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches CVE-2024-3817, GHSA-q64h-39hv-4cf7, GO-2024-2800 | Critical | 1.3% | 17 Apr, 2024 | Go github.com/hashicorp/go-getter |
Evmos vulnerable to unauthorized account creation with vesting module GHSA-m99c-q26r-m7m7, GO-2024-2731 | Medium | Not scored | 17 Apr, 2024 | Go github.com/evmos/evmos Go github.com/evmos/evmos/v10 Go github.com/evmos/evmos/v11 Go github.com/evmos/evmos/v12 +10 more |
Evmos vulnerable to DOS and transaction fee expropiation through Authz exploit GHSA-v6rw-hhgg-wc4x, GO-2024-2732 | Critical | Not scored | 17 Apr, 2024 | Go github.com/evmos/evmos Go github.com/evmos/evmos/v10 Go github.com/evmos/evmos/v11 Go github.com/evmos/evmos/v12 +8 more |
OpenFGA Authorization Bypass CVE-2024-31452, GHSA-8cph-m685-6v6r, GO-2024-2729 | High | 0.7% | 16 Apr, 2024 | Go github.com/openfga/openfga |
Argo CD's API server does not enforce project sourceNamespaces BIT-argo-cd-2024-31990, CVE-2024-31990, GHSA-2gvw-w6fj-7m3c, GO-2024-2728 | Medium | 0.4% | 15 Apr, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Traefik affected by HTTP/2 CONTINUATION flood in net/http GHSA-7f4j-64p6-5h5v, GO-2024-2726 | Medium | Not scored | 15 Apr, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Constallation has pods exposed to peers in VPC GHSA-g8fc-vrcg-8vjg, GO-2024-2727 | High | Not scored | 15 Apr, 2024 | Go github.com/edgelesssys/constellation Go github.com/edgelesssys/constellation/v2 |
Traefik vulnerable to denial of service with Content-length header CVE-2024-28869, GHSA-4vwx-54mw-vqfw, GO-2024-2722 | High | 1.0% | 12 Apr, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Apache Solr Operator liveness and readiness probes may leak basic auth credentials CVE-2024-31391, GHSA-g9qx-25vj-rf53, GO-2024-2723 | Medium | 0.8% | 12 Apr, 2024 | Go github.com/apache/solr-operator |
tiagorlampert CHAOS vulnerable to Cross Site Scripting CVE-2024-31839, GHSA-c5rv-hjjc-jv7m, GO-2024-2721 | Medium | 8.1% | 12 Apr, 2024 | Go github.com/tiagorlampert/CHAOS |
tiagorlampert CHAOS vulnerable to command injections CVE-2024-30850, CVE-2024-33434, GHSA-p3j6-f45h-hw5f, GHSA-xfjj-f699-rc79, GO-2024-2822 | Critical | 1.4% | 12 Apr, 2024 | Go github.com/tiagorlampert/CHAOS |
Cosign malicious artifacts can cause machine-wide DoS BIT-cosign-2024-29903, CVE-2024-29903, GHSA-95pr-fxf5-86gv, GO-2024-2719 | Medium | 0.9% | 11 Apr, 2024 | Go github.com/sigstore/cosign Go github.com/sigstore/cosign/v2 |
Cosign malicious attachments can cause system-wide denial of service BIT-cosign-2024-29902, CVE-2024-29902, GHSA-88jx-383q-w4qc, GO-2024-2718 | Medium | 0.7% | 11 Apr, 2024 | Go github.com/sigstore/cosign Go github.com/sigstore/cosign/v2 |
SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used CVE-2024-32001, GHSA-j85q-46hg-36p2, GO-2024-2716 | Low | 0.6% | 10 Apr, 2024 | Go github.com/authzed/spicedb |
Evmos transaction execution not accounting for all state transition after interaction with precompiles CVE-2024-32644, GHSA-3fp5-2xwh-fxm6, GO-2024-2715 | Critical | 0.9% | 10 Apr, 2024 | Go github.com/evmos/evmos Go github.com/evmos/evmos/v10 Go github.com/evmos/evmos/v11 Go github.com/evmos/evmos/v12 +18 more |
LocalAI Command Injection in audioToWav CVE-2024-2029, GHSA-wx43-g55g-2jf4, GO-2024-2717 | Critical | 2.9% | 10 Apr, 2024 | Go github.com/go-skynet/LocalAI |
Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output GHSA-j5vm-7qcc-2wwg, GO-2024-2703 | Low | Not scored | 10 Apr, 2024 | Go github.com/kopia/kopia |
Portainer CE allows username enumeration through authentication response timing CVE-2024-29296, GHSA-87x6-8m9v-g8c2, GO-2026-6619 | Medium | 1.3% | 10 Apr, 2024 | Go github.com/portainer/portainer |
gin-vue-admin background arbitrary code coverage vulnerability CVE-2024-31457, GHSA-gv3w-m57p-3wc4, GO-2024-2702 | High | 0.9% | 09 Apr, 2024 | Go github.com/flipped-aurora/gin-vue-admin/server |
Minder GetRepositoryByName data leak CVE-2024-31455, GHSA-ggp5-28x4-xcj9, GO-2024-2701 | Medium | 0.8% | 09 Apr, 2024 | Go github.com/stacklok/minder |
Ollama DNS rebinding vulnerability CVE-2024-28224, GHSA-5jx5-hqx5-2vrj, GO-2024-2699 | High | 0.4% | 08 Apr, 2024 | Go github.com/jmorganca/ollama Go github.com/ollama/ollama |
Archiver Path Traversal vulnerability CVE-2024-0406, GHSA-rhh4-rh7c-7r5v, GO-2024-2698 | Medium | 0.9% | 06 Apr, 2024 | Go github.com/mholt/archiver Go github.com/mholt/archiver/v3 |
Grafana: Users outside an organization can delete a snapshot with its key BIT-grafana-2024-1313, CVE-2024-1313, GHSA-67rv-qpw2-6qrr, GO-2024-2697 | High | 0.6% | 05 Apr, 2024 | Go github.com/grafana/grafana |
ibc-go: Potential Reentrancy using Timeout Callbacks in ibc-hooks GHSA-j496-crgh-34mx, GO-2024-2694 | Critical | Not scored | 05 Apr, 2024 | Go github.com/cosmos/ibc-go Go github.com/cosmos/ibc-go/v2 Go github.com/cosmos/ibc-go/v3 Go github.com/cosmos/ibc-go/v4 +4 more |
Pebble service manager's file pull API allows access by any user BIT-pebble-2024-3250, CVE-2024-3250, GHSA-4685-2x5r-65pj, GO-2024-2692 | Medium | 0.2% | 05 Apr, 2024 | Go github.com/canonical/pebble |
Mattermost fails to authenticate the source of certain types of post actions BIT-mattermost-2024-2447, CVE-2024-2447, GHSA-wp43-vprh-c3w5, GO-2024-2696 | High | 0.2% | 05 Apr, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Server doesn't limit the number of user preferences BIT-mattermost-2024-28949, CVE-2024-28949, GHSA-mcw6-3256-64gg, GO-2024-2695 | Medium | 0.6% | 05 Apr, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Server Improper Access Control BIT-mattermost-2024-29221, CVE-2024-29221, GHSA-w67v-ph4x-f48q, GO-2024-2706 | Medium | 0.3% | 05 Apr, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Server Improper Access Control BIT-mattermost-2024-21848, CVE-2024-21848, GHSA-xp9j-8p68-9q93, GO-2024-2707 | Low | 0.3% | 05 Apr, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
HashiCorpVault does not correctly validate OCSP responses BIT-vault-2024-2660, CVE-2024-2660, GHSA-j2rp-gmqv-frhv, GO-2024-2690 | Medium | 0.3% | 04 Apr, 2024 | Go github.com/hashicorp/vault |
Temporal Server Denial of Service CVE-2024-2689, GHSA-wmxc-v39r-p9wf, GO-2024-2689 | Medium | 0.5% | 04 Apr, 2024 | Go github.com/temporalio/temporal Go go.temporal.io/server |
net/http, x/net/http2: close connections when receiving too many headers BIT-golang-2023-45288, CVE-2023-45288, GHSA-4v7x-pqxf-cx7m, GO-2024-2687 | Medium | 89.5% | 03 Apr, 2024 | Go golang.org/x/net Go golang.org/x/net/http2 Go net/http Go stdlib |
KubeVirt NULL pointer dereference flaw CVE-2024-31420, GHSA-vjhf-6xfr-5p9g, GO-2024-2688 | Medium | 0.6% | 03 Apr, 2024 | Go kubevirt.io/kubevirt |
Temporal UI Server cross-site scripting vulnerability CVE-2024-2435, GHSA-8f25-w7qj-r7hc, GO-2024-2675 | Medium | 0.4% | 02 Apr, 2024 | Go github.com/temporalio/ui-server Go github.com/temporalio/ui-server/v2 |
CA17 TeamsACS Cross Site Scripting vulnerability CVE-2024-22780, GHSA-hwvw-gh23-qpvq, GO-2024-2684 | Medium | 0.6% | 02 Apr, 2024 | Go github.com/ca17/teamsacs |
QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack CVE-2024-22189, GHSA-c33x-xqrf-c478, GO-2024-2682 | High | 1.1% | 02 Apr, 2024 | Go github.com/quic-go/quic-go |