Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Etcd embed auto compaction retention negative value causing a compaction loop or a crash GHSA-pm3m-32r3-7mfh, GO-2024-2529 | Low | Not scored | 03 Feb, 2024 | Go go.etcd.io/etcd Go go.etcd.io/etcd/v3 |
Etcd Gateway TLS endpoint validation only confirms TCP reachability GHSA-j86v-2vjr-fg8f, GO-2024-2528 | Medium | Not scored | 03 Feb, 2024 | Go go.etcd.io/etcd Go go.etcd.io/etcd/v3 |
Etcd pkg Insecure ciphers are allowed by default GHSA-5x4g-q5rc-36jp, GO-2024-2527 | Low | Not scored | 03 Feb, 2024 | Go go.etcd.io/etcd Go go.etcd.io/etcd/client/pkg/v3 |
Talos Linux ships runc vulnerable to the escape to the host attack GHSA-g5p6-327m-3fxx | High | Not scored | 02 Feb, 2024 | Go github.com/siderolabs/talos |
Classic builder cache poisoning CVE-2024-24557, GHSA-xw73-rw38-6vjc, GO-2024-2512 | Medium | 0.3% | 01 Feb, 2024 | Go github.com/docker/docker Go github.com/moby/moby |
Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation CVE-2024-24747, GHSA-xx8w-mq23-29g4, GO-2024-2499 | High | 34.1% | 01 Feb, 2024 | Go github.com/minio/minio |
Hashicorp Vault may expose sensitive log information BIT-vault-2024-0831, CVE-2024-0831, GHSA-vgh3-mwxq-rcp8, GO-2024-2511 | Medium | 0.8% | 01 Feb, 2024 | Go github.com/hashicorp/vault |
Grafana Cross Site Request Forgery (CSRF) BIT-grafana-2022-21703, CVE-2022-21703, GHSA-cmf4-h3xc-jw8w | Medium | 2.3% | 01 Feb, 2024 | Go github.com/grafana/grafana/pkg/web |
Moby (Docker Engine) Insufficiently restricted permissions on data directory CVE-2021-41091, GHSA-3fwx-pjgw-3558, GO-2024-2500 | Medium | 2.8% | 31 Jan, 2024 | Go github.com/docker/docker Go github.com/moby/moby |
containerd environment variable leak CVE-2021-21334, GHSA-6g2q-w5j3-fwh4 | Medium | 1.9% | 31 Jan, 2024 | Go github.com/containerd/containerd |
Improper Authentication in HashiCorp Vault BIT-vault-2021-3282, CVE-2021-3282, GHSA-rq95-xf66-j689, GO-2024-2509 | High | 1.3% | 31 Jan, 2024 | Go github.com/hashicorp/vault |
moby docker daemon crash during image pull of malicious image CVE-2021-21285, GHSA-6fj5-m822-rqx8 | Medium | 3.3% | 31 Jan, 2024 | Go github.com/moby/moby |
moby Access to remapped root allows privilege escalation to real root CVE-2021-21284, GHSA-7452-xqpj-6rpc | Medium | 1.1% | 31 Jan, 2024 | Go github.com/moby/moby |
Path Traversal in Moby builder CVE-2020-27534, GHSA-6hwg-w5jg-9c6x | Medium | 1.8% | 31 Jan, 2024 | Go github.com/docker/docker Go github.com/moby/moby |
Enumeration of users in HashiCorp Vault BIT-vault-2020-35177, CVE-2020-35177, GHSA-rpgp-9hmg-j25x, GO-2024-2508 | Medium | 1.3% | 31 Jan, 2024 | Go github.com/hashicorp/vault |
Privilege Escalation in HashiCorp Consul BIT-consul-2020-28053, CVE-2020-28053, GHSA-6m72-467w-94rh, GO-2024-2505 | Medium | 1.5% | 31 Jan, 2024 | Go github.com/hashicorp/consul |
Denial of service in HashiCorp Consul BIT-consul-2020-25201, CVE-2020-25201, GHSA-496g-fr33-whrf, GO-2024-2501 | High | 2.6% | 31 Jan, 2024 | Go github.com/hashicorp/consul |
Grafana Arbitrary File Read CVE-2019-19499, GHSA-4pwp-cx67-5cpx, GO-2024-2661 | Medium | 3.5% | 31 Jan, 2024 | Go github.com/grafana/grafana |
runc vulnerable to container breakout through process.cwd trickery and leaked fds CVE-2024-21626, GHSA-xr7r-f8xq-vfvv, GO-2024-2491 | High | 18.9% | 31 Jan, 2024 | Go github.com/opencontainers/runc |
BuildKit vulnerable to possible panic when incorrect parameters sent from frontend CVE-2024-23650, GHSA-9p26-698r-w4hx, GO-2024-2492 | Medium | 1.1% | 31 Jan, 2024 | Go github.com/moby/buildkit |
BuildKit vulnerable to possible race condition with accessing subpaths from cache mounts CVE-2024-23651, GHSA-m3r6-h7wv-7xxv, GO-2024-2493 | High | 0.9% | 31 Jan, 2024 | Go github.com/moby/buildkit |
BuildKit vulnerable to possible host system access from mount stub cleaner CVE-2024-23652, GHSA-4v98-7qmw-rqr8, GO-2024-2494 | Critical | 2.5% | 31 Jan, 2024 | Go github.com/moby/buildkit |
Buildkit's interactive containers API does not validate entitlements check CVE-2024-23653, GHSA-wr6v-9f75-vh2g, GO-2024-2497 | Critical | 3.4% | 31 Jan, 2024 | Go github.com/moby/buildkit |
stereoscope vulnerable to tar path traversal when processing OCI tar archives CVE-2024-24579, GHSA-hpxr-w9w7-g4gv, GO-2024-2490 | Medium | 0.4% | 31 Jan, 2024 | Go github.com/anchore/stereoscope |
Apache ServiceComb Service-Center Exposure of Sensitive Information to an Unauthorized Actor vulnerability CVE-2023-44312, GHSA-r8xp-52mq-rmm8, GO-2024-2496 | Medium | 0.8% | 31 Jan, 2024 | Go github.com/apache/servicecomb-service-center |
Apache ServiceComb Service-Center Server-Side Request Forgery vulnerability CVE-2023-44313, GHSA-9xc9-xq7w-vpcr, GO-2024-2495 | High | 3.5% | 31 Jan, 2024 | Go github.com/apache/servicecomb-service-center |
HashiCorp Vault Authentication bypass BIT-vault-2020-16251, CVE-2020-16251, GHSA-4mp7-2m29-gqxf, GO-2024-2488 | High | 2.8% | 31 Jan, 2024 | Go github.com/hashicorp/vault |
Etcd Gateway TLS authentication only applies to endpoints detected in DNS SRV records CVE-2020-15136, GHSA-wr2v-9rpq-c35q | Medium | 1.7% | 31 Jan, 2024 | Go go.etcd.io/etcd |
Etcd Gateway can include itself as an endpoint resulting in resource exhaustion CVE-2020-15114, GHSA-2xhq-gv6c-p224 | High | 1.1% | 31 Jan, 2024 | Go go.etcd.io/etcd |
Improper Preservation of Permissions in etcd BIT-etcd-2020-15113, CVE-2020-15113, GHSA-chh6-ppwq-jh92 | Medium | 0.2% | 30 Jan, 2024 | Go github.com/etcd-io/etcd |
HashiCorp Vault Improper Privilege Management BIT-vault-2020-10660, CVE-2020-10660, GHSA-m979-w9wj-qfj9, GO-2024-2486 | Medium | 0.8% | 30 Jan, 2024 | Go github.com/hashicorp/vault |
HashiCorp Vault Improper Privilege Management BIT-vault-2020-10661, CVE-2020-10661, GHSA-j6vv-vv26-rh7c, GO-2024-2485 | Critical | 1.1% | 30 Jan, 2024 | Go github.com/hashicorp/vault |
`goreleaser release --debug` shows secrets CVE-2024-23840, GHSA-h3q2-8whx-c29h, GO-2024-2482 | Medium | 0.3% | 30 Jan, 2024 | Go github.com/goreleaser/goreleaser |
IV collision in github.com/bincyber/go-sqlcrypter GO-2024-2451 | Not scored | 30 Jan, 2024 | Go github.com/bincyber/go-sqlcrypter | |
Authentik vulnerable to PKCE downgrade attack BIT-authentik-2024-23647, CVE-2024-23647, GHSA-mrx3-gxjx-hjqj, GO-2024-2479 | High | 0.5% | 29 Jan, 2024 | Go goauthentik.io |
Nginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF CVE-2024-23828, GHSA-qcjq-7f7v-pvc8, GO-2024-2480 | High | 1.1% | 29 Jan, 2024 | Go github.com/0xJacky/Nginx-UI |
Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature CVE-2024-23827, GHSA-xvq9-4vpv-227m, GO-2024-2481 | Critical | 0.7% | 29 Jan, 2024 | Go github.com/0xJacky/Nginx-UI |
OpenFGA denial of service CVE-2024-23820, GHSA-rxpw-85vw-fx87, GO-2024-2477 | Medium | 0.7% | 26 Jan, 2024 | Go github.com/openfga/openfga |
Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers CVE-2024-23656, GHSA-gr79-9v6v-gc9r, GO-2024-2476 | High | 0.4% | 26 Jan, 2024 | Go github.com/dexidp/dex |
chasquid HTTP Request/Response Smuggling vulnerability CVE-2023-52354, GHSA-g4x3-mfpj-f335, GO-2024-2478 | High | 0.5% | 22 Jan, 2024 | Go blitiri.com.ar/go/chasquid Go github.com/albertito/chasquid |
Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry CVE-2024-23332, GHSA-57wx-m636-g3g8, GO-2024-2472 | Medium | 0.3% | 19 Jan, 2024 | Go github.com/notaryproject/notation |
github.com/argoproj/argo-cd Cross-Site Request Forgery vulnerability CVE-2024-22424, GHSA-92mw-q256-5vwg | High | 0.5% | 19 Jan, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Validation of `VoteExtensionsEnableHeight` can cause chain halt in Go package github.com/cometbft/cometbft GHSA-qr8r-m495-7hc4, GO-2024-2471 | High | Not scored | 19 Jan, 2024 | Go github.com/cometbft/cometbft |
crystals-go vulnerable to KyberSlash (timing side-channel attack for Kyber) GHSA-f6jh-hvg2-9525, GO-2024-2469 | High | Not scored | 17 Jan, 2024 | Go github.com/kudelskisecurity/crystals-go |
Django Template Engine Vulnerable to XSS CVE-2024-22199, GHSA-4mq2-gc4j-cmw6, GO-2024-2461 | Critical | 0.5% | 11 Jan, 2024 | Go github.com/gofiber/template/django/v3 |
Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268) CVE-2024-22198, GHSA-8r25-68wm-jw35, GO-2024-2462 | High | 4.1% | 11 Jan, 2024 | Go github.com/0xJacky/Nginx-UI |
Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269) CVE-2024-22197, GHSA-pxmr-q2x3-9x9m, GO-2024-2464 | High | 1.5% | 11 Jan, 2024 | Go github.com/0xJacky/Nginx-UI |
Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270) CVE-2024-22196, GHSA-h374-mm57-879c, GO-2024-2463 | High | 0.6% | 11 Jan, 2024 | Go github.com/0xJacky/Nginx-UI |
Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients CVE-2023-49569, GHSA-449p-3h89-pw88, GO-2024-2456 | Critical | 1.5% | 10 Jan, 2024 | Go github.com/go-git/go-git/v5 Go gopkg.in/src-d/go-git.v4 |
CRI-O's pods can break out of resource confinement on cgroupv2 CVE-2023-6476, GHSA-p4rx-7wvg-fwrc, GO-2024-2458 | Medium | 0.9% | 10 Jan, 2024 | Go github.com/cri-o/cri-o |