Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Integer overflow in chunking helper causes dispatching to miss elements or panic CVE-2024-27101, GHSA-h3m7-rqc4-7h9p, GO-2024-2597 | High | 0.5% | 01 Mar, 2024 | Go github.com/authzed/spicedb |
Mattermost allows attackers access to posts in channels they are not a member of BIT-mattermost-2024-1942, CVE-2024-1942, GHSA-hwjf-4667-gqwx, GO-2024-2592 | Medium | 0.4% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost race condition BIT-mattermost-2024-1949, CVE-2024-1949, GHSA-3g35-v53r-gpxc, GO-2024-2588 | Low | 0.3% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost incorrectly allows access individual posts BIT-mattermost-2024-1952, CVE-2024-1952, GHSA-r4fm-g65h-cr54, GO-2024-2635 | Low | 0.4% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to limit the number of role names BIT-mattermost-2024-1953, CVE-2024-1953, GHSA-vm9m-57jr-4pxh, GO-2024-2594 | Medium | 0.5% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost post fetching without auditing in compliance export CVE-2024-1887, GHSA-fx48-xv6q-6gp3, GO-2024-2591 | High | 0.3% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to check the "invite_guest" permission CVE-2024-1888, GHSA-pfw6-5rx3-xh3c, GO-2024-2593 | Medium | 0.3% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly restrict the access of files attached to posts CVE-2024-23488, GHSA-xgxj-j98c-59rv, GO-2024-2595 | Low | 0.3% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost leaks details of AD/LDAP groups of a teams BIT-mattermost-2024-23493, CVE-2024-23493, GHSA-7v3v-984v-h74r, GO-2024-2590 | Medium | 0.4% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost denial of service through long emoji value BIT-mattermost-2024-24988, CVE-2024-24988, GHSA-6mx3-9qfh-77gj, GO-2024-2589 | Medium | 0.7% | 29 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
ASA-2024-004: Default configuration param for Evidence may limit window of validity GHSA-555p-m4v6-cqxv | Low | Not scored | 28 Feb, 2024 | Go github.com/cometbft/cometbft |
ASA-2024-005: Potential slashing evasion during re-delegation GHSA-86h5-xcpx-cfqc, GO-2024-2584 | Low | Not scored | 27 Feb, 2024 | Go github.com/cosmos/cosmos-sdk |
Transparent TLS may not be applied to Marbles with certain manifest configurations GHSA-x5r5-2qrx-rqj8, GO-2024-2583 | Critical | Not scored | 27 Feb, 2024 | Go github.com/edgelesssys/marblerun |
Minder trusts client-provided mapping from repo name to upstream ID CVE-2024-27093, GHSA-q6h8-4j2v-pjg4, GO-2024-2582 | Medium | 0.6% | 26 Feb, 2024 | Go github.com/stacklok/minder |
User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository GHSA-fvv5-h29g-f6w5, GO-2024-2581 | Medium | Not scored | 22 Feb, 2024 | Go github.com/treeverse/lakefs |
Helm's Missing YAML Content Leads To Panic BIT-helm-2024-26147, CVE-2024-26147, GHSA-r53h-jv2g-vpx6, GO-2024-2575 | High | 0.9% | 22 Feb, 2024 | Go helm.sh/helm/v3 |
Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials CVE-2024-25124, GHSA-fmg4-x8pw-hjhg, GO-2024-2574 | Critical | 0.7% | 22 Feb, 2024 | Go github.com/gofiber/fiber/v2 |
Apache Answer Unrestricted Upload of File with Dangerous Type vulnerability CVE-2024-22393, GHSA-rmqp-mvv2-54c6, GO-2024-2579 | High | 2.5% | 22 Feb, 2024 | Go github.com/apache/incubator-answer |
Apache Answer Cross-site Scripting vulnerability CVE-2024-23349, GHSA-8pf2-qj4v-fj64, GO-2024-2578 | Medium | 1.1% | 22 Feb, 2024 | Go github.com/apache/incubator-answer |
Apache Answer Race Condition vulnerability CVE-2024-26578, GHSA-9q24-hwmc-797x, GO-2024-2580 | Medium | 0.9% | 22 Feb, 2024 | Go github.com/apache/incubator-answer |
ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool` GHSA-2557-x9mg-76w8, GO-2024-2571 | Medium | Not scored | 21 Feb, 2024 | Go github.com/cosmos/cosmos-sdk |
ASA-2024-003: Missing `BlockedAddressed` Validation in Vesting Module GHSA-4j93-fm92-rp4m, GO-2024-2572 | Medium | Not scored | 21 Feb, 2024 | Go github.com/cosmos/cosmos-sdk |
Unencrypted traffic between pods when using Wireguard and an external kvstore BIT-cilium-2024-25631, BIT-cilium-operator-2024-25631, BIT-cilium-proxy-2024-25631, BIT-hubble-2024-25631, BIT-hubble-relay-2024-25631, BIT-hubble-ui-2024-25631, BIT-hubble-ui-backend-2024-25631, CVE-2024-25631, GHSA-x989-52fc-4vr4, GO-2024-2569 | Medium | 0.2% | 20 Feb, 2024 | Go github.com/cilium/cilium |
Unencrypted ingress/health traffic when using Wireguard transparent encryption BIT-cilium-2024-25630, BIT-cilium-operator-2024-25630, BIT-cilium-proxy-2024-25630, BIT-hubble-2024-25630, BIT-hubble-relay-2024-25630, BIT-hubble-ui-2024-25630, BIT-hubble-ui-backend-2024-25630, CVE-2024-25630, GHSA-7496-fgv9-xw82, GO-2024-2568 | Medium | 0.2% | 20 Feb, 2024 | Go github.com/cilium/cilium |
Open Redirect in github.com/greenpau/caddy-security CVE-2024-21497, GHSA-8hp3-rmr7-xh88, GO-2024-2560 | Medium | 0.5% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Server-Side Request Forgery in github.com/greenpau/caddy-security CVE-2024-21498, GHSA-93x8-66j2-wwr5, GO-2024-2561 | Medium | 0.6% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security CVE-2024-21499, GHSA-r969-783f-6jqr, GO-2024-2562 | Medium | 0.5% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Improper Restriction of Excessive Authentication Attempts in github.com/greenpau/caddy-security CVE-2024-21500, GHSA-vfph-hjfv-cpv2, GO-2024-2563 | Medium | 0.5% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Insufficient Session Expiration in github.com/greenpau/caddy-security CVE-2024-21492, GHSA-vp66-gf7w-9m4x, GO-2024-2557 | Medium | 0.7% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Improper Validation of Array Index in github.com/greenpau/caddy-security CVE-2024-21493, GHSA-8h95-jcp5-pjpr, GO-2024-2564 | Medium | 0.7% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Authentication Bypass by Spoofing in github.com/greenpau/caddy-security CVE-2024-21494, GHSA-vj36-3ccr-6563, GO-2024-2558 | Medium | 0.5% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Use of Insufficiently Random Values in github.com/greenpau/caddy-security CVE-2024-21495, GHSA-c7vf-m394-m4x4, GO-2024-2565 | Medium | 0.7% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Cross-site Scripting in github.com/greenpau/caddy-security CVE-2024-21496, GHSA-ff72-ff42-c3gw, GO-2024-2559 | Medium | 0.6% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Helm dependency management path traversal BIT-helm-2024-25620, CVE-2024-25620, GHSA-v53g-5gjp-272r, GO-2024-2554 | Medium | 0.6% | 15 Feb, 2024 | Go helm.sh/helm/v3 |
registry-support: decompress can delete files outside scope via relative paths CVE-2024-1485, GHSA-84xv-jfrm-h4gm, GO-2024-2576 | Medium | 0.9% | 14 Feb, 2024 | Go github.com/devfile/registry-support/registry-library |
Email Validation Bypass And Preventing Sign Up From Email's Owner BIT-grafana-2023-6152, CVE-2023-6152, GHSA-3hv4-r2fm-h27f | Medium | 1.4% | 13 Feb, 2024 | Go github.com/grafana/grafana |
caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting CVE-2023-52430, GHSA-xwmv-cx7p-fqfc, GO-2024-2549 | Medium | 0.4% | 13 Feb, 2024 | Go github.com/greenpau/caddy-security |
Mattermost vulnerable to denial of service via large number of emoji reactions BIT-mattermost-2024-1402, CVE-2024-1402, GHSA-32h7-7j94-8fc2, GO-2024-2541 | Medium | 0.5% | 09 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Jira Plugin does not properly check security levels BIT-mattermost-2024-24774, CVE-2024-24774, GHSA-qr8f-cjw7-838m, GO-2024-2540 | Medium | 0.5% | 09 Feb, 2024 | Go github.com/mattermost/mattermost-plugin-jira |
Mattermost fails to check the required permissions BIT-mattermost-2024-24776, CVE-2024-24776, GHSA-r833-w756-h5p2, GO-2024-2566 | Low | 0.3% | 09 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Jira Plugin vulnerable to Cross-Site Request Forgery BIT-mattermost-2024-23319, CVE-2024-23319, GHSA-4fp6-574p-fc35, GO-2024-2539 | Low | 0.2% | 09 Feb, 2024 | Go github.com/mattermost/mattermost-plugin-jira |
HashiCorp Nomad vulnerable to symlink attacks CVE-2024-1329, GHSA-c866-8gpw-p3mv, GO-2024-2538 | High | 0.6% | 08 Feb, 2024 | Go github.com/hashicorp/nomad |
Rancher API Server Cross-site Scripting Vulnerability CVE-2023-32192, GHSA-833m-37f7-jq55, GO-2024-2534 | High | 0.4% | 08 Feb, 2024 | Go github.com/rancher/apiserver |
Norman API Cross-site Scripting Vulnerability CVE-2023-32193, GHSA-r8f4-hv23-6qp6, GO-2024-2536 | High | 0.5% | 08 Feb, 2024 | Go github.com/rancher/norman |
Rancher 'Audit Log' leaks sensitive information CVE-2023-22649, GHSA-xfj7-qf8w-2gcr, GO-2024-2537 | High | 2.0% | 08 Feb, 2024 | Go github.com/rancher/rancher |
Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core' CVE-2023-32194, GHSA-c85r-fwc7-45vc, GO-2024-2535 | High | 0.4% | 08 Feb, 2024 | Go github.com/rancher/rancher |
APM Server vulnerable to Insertion of Sensitive Information into Log File CVE-2024-23448, GHSA-8r33-q5j5-rh7g, GO-2024-2556 | High | 0.7% | 08 Feb, 2024 | Go github.com/elastic/apm-server |
Boundary vulnerable to session hijacking through TLS certificate tampering CVE-2024-1052, GHSA-vh73-q3rw-qx7w, GO-2024-2532 | High | 0.3% | 05 Feb, 2024 | Go github.com/hashicorp/boundary |
1Panel set-cookie is missing the Secure keyword CVE-2024-24768, GHSA-9xfw-jjq2-7v8h, GO-2024-2531 | Low | 0.3% | 05 Feb, 2024 | Go github.com/1Panel-dev/1Panel |
Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only GHSA-vjg6-93fv-qv64, GO-2024-2530 | Low | Not scored | 03 Feb, 2024 | Go go.etcd.io/etcd Go go.etcd.io/etcd/v3 |