Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
LocalAI cross-site request forgery vulnerability CVE-2024-3135, GHSA-jhvf-7c85-3c9g, GO-2024-2705 | Medium | 0.3% | 01 Apr, 2024 | Go github.com/go-skynet/LocalAI |
CasaOS Username Enumeration - Bypass of CVE-2024-24766 CVE-2024-28232, GHSA-hcw2-2r9c-gc6p, GO-2024-2668 | Medium | 0.6% | 01 Apr, 2024 | Go github.com/IceWhaleTech/CasaOS-UserService |
ArgoCD's repo server has Uncontrolled Resource Consumption vulnerability BIT-argo-cd-2024-29893, CVE-2024-29893, GHSA-jhwx-mhww-rgc3, GO-2024-2667 | Medium | 1.0% | 29 Mar, 2024 | Go github.com/argoproj/argo-cd/v2 |
Cilium has insecure IPsec transport encryption BIT-cilium-2024-28860, BIT-cilium-operator-2024-28860, BIT-cilium-proxy-2024-28860, BIT-hubble-2024-28860, BIT-hubble-relay-2024-28860, BIT-hubble-ui-2024-28860, BIT-hubble-ui-backend-2024-28860, CVE-2024-28860, GHSA-pwqm-x5x6-5586, GO-2024-2666 | High | 0.2% | 28 Mar, 2024 | Go github.com/cilium/cilium |
ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass CVE-2024-29891, GHSA-hr5w-cwwq-2v4m, GO-2024-2665 | High | 0.8% | 28 Mar, 2024 | Go github.com/zitadel/zitadel |
ZITADEL's actions can overload reserved claims CVE-2024-29892, GHSA-gp8g-f42f-95q2, GO-2024-2664 | High | 0.8% | 28 Mar, 2024 | Go github.com/zitadel/zitadel |
Memory leaks in code encrypting and verifying RSA payloads CVE-2024-1394, GHSA-78hx-gp6g-7mj6, GO-2024-2660 | High | 1.5% | 20 Mar, 2024 | Go github.com/golang-fips/go Go github.com/golang-fips/openssl/v2 Go github.com/microsoft/go-crypto-openssl Go github.com/microsoft/go-crypto-openssl/openssl |
Moby's external DNS requests from 'internal' networks could lead to data exfiltration CVE-2024-29018, GHSA-mq39-4gv4-mvpx, GO-2024-2659 | Medium | 0.7% | 20 Mar, 2024 | Go github.com/docker/docker |
Improper HTML sanitization in ZITADEL CVE-2024-28855, GHSA-hfrg-4jwr-jfpj, GO-2024-2655 | High | 0.8% | 18 Mar, 2024 | Go github.com/zitadel/zitadel |
Unencrypted traffic between nodes when using WireGuard and L7 policies BIT-cilium-2024-28250, BIT-cilium-operator-2024-28250, BIT-cilium-proxy-2024-28250, BIT-hubble-2024-28250, BIT-hubble-relay-2024-28250, BIT-hubble-ui-2024-28250, BIT-hubble-ui-backend-2024-28250, CVE-2024-28250, GHSA-v6q2-4qr3-5cw6, GO-2024-2657 | Medium | 0.2% | 18 Mar, 2024 | Go github.com/cilium/cilium |
Unencrypted traffic between nodes when using IPsec and L7 policies BIT-cilium-2024-28249, BIT-cilium-operator-2024-28249, BIT-cilium-proxy-2024-28249, BIT-hubble-2024-28249, BIT-hubble-relay-2024-28249, BIT-hubble-ui-2024-28249, BIT-hubble-ui-backend-2024-28249, CVE-2024-28249, GHSA-j89h-qrvr-xc36, GO-2024-2656 | Medium | 0.3% | 18 Mar, 2024 | Go github.com/cilium/cilium |
Intermittent HTTP policy bypass BIT-cilium-2024-28248, BIT-cilium-operator-2024-28248, BIT-cilium-proxy-2024-28248, BIT-hubble-2024-28248, BIT-hubble-relay-2024-28248, BIT-hubble-ui-2024-28248, BIT-hubble-ui-backend-2024-28248, CVE-2024-28248, GHSA-68mj-9pjq-mc85, GO-2024-2653 | High | 0.6% | 18 Mar, 2024 | Go github.com/cilium/cilium |
Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment BIT-argo-cd-2024-21661, CVE-2024-21661, GHSA-6v85-wr92-q4p7, GO-2024-2654 | High | 1.2% | 18 Mar, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Bypassing Rate Limit and Brute Force Protection Using Cache Overflow BIT-argo-cd-2024-21652, BIT-argo-cd-2024-21662, CVE-2024-21652, CVE-2024-21662, GHSA-2vgg-9h6w-m454, GHSA-x32m-mvfj-52xv, GO-2024-2652 | Critical | 0.8% | 18 Mar, 2024 | Go github.com/argoproj/argo-cd/v2 |
Podman affected by CVE-2024-1753 container escape at build time CVE-2024-1753, GHSA-874v-pj72-92f3, GHSA-pmf3-c36m-g5cf, GO-2024-2658 | High | 0.5% | 18 Mar, 2024 | Go github.com/containers/buildah Go github.com/containers/podman/v4 Go github.com/containers/podman/v5 |
CLI for Vela Insecure Variable Substitution GHSA-4jhj-3gv3-c3gr, GO-2024-2647 | High | Not scored | 15 Mar, 2024 | Go github.com/go-vela/cli |
Golang SDK for Vela Insecure Variable Substitution GHSA-v8mx-hp2q-gw85, GO-2024-2650 | High | Not scored | 15 Mar, 2024 | Go github.com/go-vela/sdk-go |
Server/API for Vela Insecure Variable Substitution GHSA-69p4-j5v5-x234, GO-2024-2648 | High | Not scored | 15 Mar, 2024 | Go github.com/go-vela/server |
Types for Vela Insecure Variable Substitution GHSA-7v38-w32m-wx4m, GO-2024-2649 | High | Not scored | 15 Mar, 2024 | Go github.com/go-vela/types |
Cross-site scripting on application summary component BIT-argo-cd-2024-28175, CVE-2024-28175, GHSA-jwv5-8mqv-g387, GO-2024-2646 | Critical | 0.7% | 15 Mar, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Nuclei allows unsigned code template execution through workflows CVE-2024-27920, GHSA-w5wx-6g2r-r78q, GO-2024-2645 | High | 0.4% | 15 Mar, 2024 | Go github.com/projectdiscovery/nuclei Go github.com/projectdiscovery/nuclei/v2 Go github.com/projectdiscovery/nuclei/v3 |
Pterodactyl Wings vulnerable to improper isolation of server file access CVE-2024-27102, GHSA-494h-9924-xww9, GO-2024-2642 | Critical | 0.5% | 15 Mar, 2024 | Go github.com/pterodactyl/wings |
Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime CVE-2023-51699, GHSA-wx8q-4gm9-rj2g, GO-2024-2644 | Medium | 0.6% | 15 Mar, 2024 | Go github.com/fluid-cloudnative/fluid |
Users with `create` but not `override` privileges can perform local sync BIT-argo-cd-2023-50726, CVE-2023-50726, GHSA-g623-jcgg-mhmm, GO-2024-2643 | Medium | 0.5% | 15 Mar, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Mattermost Server Resource Exhaustion BIT-mattermost-2024-28053, CVE-2024-28053, GHSA-qqc8-rv37-79q5, GO-2024-3334 | Low | 0.5% | 15 Mar, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Insecure Variable Substitution in Vela CVE-2024-28236, GHSA-pwx5-6wxg-px5h, GO-2024-2641 | High | 0.7% | 14 Mar, 2024 | Go github.com/go-vela/worker |
ASA-2024-006: ValidateVoteExtensions helper function in Cosmos SDK may allow incorrect voting power assumptions GHSA-95rx-m9m5-m94v, GO-2024-2638 | High | Not scored | 12 Mar, 2024 | Go github.com/cosmos/cosmos-sdk |
Account Takeover via Session Fixation in Zitadel [Bypassing MFA] CVE-2024-28197, GHSA-mq4x-r2w3-j7mr, GO-2024-2637 | High | 0.3% | 11 Mar, 2024 | Go github.com/zitadel/zitadel |
1Panel is vulnerable to command injection CVE-2024-2352, GHSA-x2vg-5wrf-vj6v, GO-2024-2636 | Medium | 3.0% | 10 Mar, 2024 | Go github.com/1Panel-dev/1Panel |
JWX vulnerable to a denial of service attack using compressed JWE message CVE-2024-28122, GHSA-hj3v-m684-v259, GO-2024-2632 | Medium | 0.6% | 08 Mar, 2024 | Go github.com/lestrrat-go/jwx Go github.com/lestrrat-go/jwx/v2 |
Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) CVE-2024-28180, GHSA-c5q2-7r4c-mv6g, GO-2024-2631 | Medium | 2.0% | 07 Mar, 2024 | Go github.com/go-jose/go-jose/v3 Go github.com/go-jose/go-jose/v4 Go gopkg.in/go-jose/go-jose.v2 Go gopkg.in/square/go-jose.v2 |
kubevirt-csi: PersistentVolume allows access to HCP's root node CVE-2024-1725, GHSA-fg9q-5cw2-p6r9, GO-2025-3512 | High | 0.6% | 07 Mar, 2024 | Go github.com/kubevirt/csi-driver |
Grafana's users with permissions to create a data source can CRUD all data sources BIT-grafana-2024-1442, CVE-2024-1442, GHSA-5mxf-42f5-j782, GO-2024-2629 | High | 0.8% | 07 Mar, 2024 | Go github.com/grafana/grafana |
Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials CVE-2024-28110, GHSA-5pf6-2qwx-pxm2, GO-2024-2618 | High | 0.7% | 06 Mar, 2024 | Go github.com/cloudevents/sdk-go/v2 |
1Panel open source panel project has an unauthorized vulnerability. CVE-2024-27288, GHSA-26w3-q4j8-4xjp, GO-2024-2613 | Medium | 0.5% | 06 Mar, 2024 | Go github.com/1Panel-dev/1Panel |
CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability CVE-2024-24767, GHSA-c69x-5xmw-v44x, GO-2024-2614 | High | 1.0% | 06 Mar, 2024 | Go github.com/IceWhaleTech/CasaOS-UserService |
CasaOS Username Enumeration CVE-2024-24766, GHSA-c967-2652-gfjm, GO-2024-2615 | Medium | 0.8% | 06 Mar, 2024 | Go github.com/IceWhaleTech/CasaOS-UserService |
CasaOS-UserService allows unauthorized access to any file CVE-2024-24765, GHSA-h5gf-cmm8-cg7c, GO-2024-2616 | High | 1.0% | 06 Mar, 2024 | Go github.com/IceWhaleTech/CasaOS-UserService |
Errors returned from JSON marshaling may break template escaping in html/template BIT-golang-2024-24785, CVE-2024-24785, GO-2024-2610 | 0.8% | 05 Mar, 2024 | Go stdlib | |
Comments in display names are incorrectly handled in net/mail BIT-golang-2024-24784, CVE-2024-24784, GO-2024-2609 | 1.1% | 05 Mar, 2024 | Go stdlib | |
Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http BIT-golang-2023-45289, CVE-2023-45289, GO-2024-2600 | 1.1% | 05 Mar, 2024 | Go stdlib | |
Memory exhaustion in multipart form parsing in net/textproto and net/http BIT-golang-2023-45290, CVE-2023-45290, GO-2024-2599 | 1.2% | 05 Mar, 2024 | Go stdlib | |
Verify panics on certificates with an unknown public key algorithm in crypto/x509 BIT-golang-2024-24783, CVE-2024-24783, GO-2024-2598 | 0.7% | 05 Mar, 2024 | Go stdlib | |
Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON CVE-2024-24786, GHSA-8r3f-844c-mc37, GO-2024-2611 | Medium | 1.3% | 05 Mar, 2024 | Go google.golang.org/protobuf Go google.golang.org/protobuf/encoding/protojson Go google.golang.org/protobuf/internal/encoding/json |
`GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated user CVE-2024-27916, GHSA-v627-69v2-xx37, GO-2024-2608 | High | 0.7% | 05 Mar, 2024 | Go github.com/stacklok/minder |
Incorrect TLS certificate auth method in Vault BIT-vault-2024-2048, CVE-2024-2048, GHSA-r3w7-mfpm-c2vw, GO-2024-2617 | High | 0.5% | 04 Mar, 2024 | Go github.com/hashicorp/vault |
Coder's OIDC authentication allows email with partially matching domain to register CVE-2024-27918, GHSA-7cc2-r658-7xpf, GO-2024-2602 | High | 1.0% | 04 Mar, 2024 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
pgproto3 SQL Injection via Protocol Message Size Overflow CVE-2024-27304, GHSA-7jwh-3vrq-q3m8, GHSA-mrww-27vc-gghv, GO-2024-2606 | High | 1.1% | 04 Mar, 2024 | Go github.com/jackc/pgproto3 Go github.com/jackc/pgproto3/v2 Go github.com/jackc/pgx Go github.com/jackc/pgx/v4 +1 more |
Authorization Bypass Through User-Controlled Key in go-zero CVE-2024-27302, GHSA-fgxv-gw55-r5fq, GO-2024-2604 | Critical | 0.8% | 04 Mar, 2024 | Go github.com/zeromicro/go-zero |
pgx SQL Injection via Line Comment Creation CVE-2024-27289, GHSA-m7wr-2xf7-cm9p, GO-2024-2605 | High | 0.8% | 04 Mar, 2024 | Go github.com/jackc/pgx Go github.com/jackc/pgx/v4 |