Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
quic-go's path validation mechanism can be exploited to cause denial of service CVE-2023-49295, GHSA-ppxx-5m9h-6vxf, GO-2024-2459 | Medium | 1.2% | 10 Jan, 2024 | Go github.com/quic-go/quic-go |
Apache Answer Race Condition vulnerability CVE-2023-49619, GHSA-f899-4mr4-fqpv, GO-2024-2457 | Low | 0.9% | 10 Jan, 2024 | Go github.com/apache/incubator-answer |
Parsing JSON serialized payload without protected field can lead to segfault CVE-2024-21664, GHSA-pvcr-v8j8-j5q3, GO-2024-2454 | Medium | 0.9% | 09 Jan, 2024 | Go github.com/lestrrat-go/jwx Go github.com/lestrrat-go/jwx/v2 |
snapd Race Condition vulnerability CVE-2022-3328, GHSA-cjqf-877p-7m3f, GO-2024-2468 | Critical | 0.4% | 08 Jan, 2024 | Go github.com/snapcore/snapd |
CIRCL's Kyber: timing side-channel (kyberslash2) GHSA-9763-4f94-gfch, GO-2024-2453 | High | Not scored | 08 Jan, 2024 | Go github.com/cloudflare/circl |
Kruise allows leveraging the kruise-daemon pod to list all secrets in the entire cluster CVE-2023-30617, GHSA-437m-7hj5-9mpw | Medium | 0.5% | 05 Jan, 2024 | Go github.com/openkruise/kruise |
The DES/3DES cipher was used as part of the TLS protocol by installation tools GHSA-7xg2-83f8-39mr, GO-2024-2441 | Low | Not scored | 03 Jan, 2024 | Go github.com/karmada-io/karmada |
CubeFS leaks users key in logs CVE-2023-46742, GHSA-vwch-g97w-hfg2, GO-2024-2434 | Medium | 0.3% | 03 Jan, 2024 | Go github.com/cubefs/cubefs |
CubeFS leaks magic secret key when starting Blobstore access service CVE-2023-46741, GHSA-8h2x-gr2c-c275, GO-2024-2433 | Medium | 0.3% | 03 Jan, 2024 | Go github.com/cubefs/cubefs |
Insecure random string generator used for sensitive data CVE-2023-46740, GHSA-4248-p65p-hcrm, GO-2024-2431 | High | 0.4% | 03 Jan, 2024 | Go github.com/cubefs/cubefs |
CubeFS timing attack can leak user passwords CVE-2023-46739, GHSA-8579-7p32-f398, GO-2024-2432 | High | 0.4% | 03 Jan, 2024 | Go github.com/cubefs/cubefs |
Authenticated users can crash the CubeFS servers with maliciously crafted requests CVE-2023-46738, GHSA-qc6v-g3xw-grmx, GO-2024-2430 | High | 0.6% | 03 Jan, 2024 | Go github.com/cubefs/cubefs |
Mattermost viewing archived public channels permissions vulnerability BIT-mattermost-2023-47858, CVE-2023-47858, GHSA-w88v-pjr8-cmv2, GO-2024-2450 | Medium | 0.4% | 02 Jan, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost notified all users in the channel when using WebSockets to respond individually BIT-mattermost-2023-48732, CVE-2023-48732, GHSA-q7rx-w656-fwmv, GO-2024-2448 | Medium | 0.5% | 02 Jan, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows demoted guests to change group names BIT-mattermost-2023-50333, CVE-2023-50333, GHSA-9w97-9rqx-8v4j, GO-2024-2444 | Low | 0.3% | 02 Jan, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Cross-site Scripting vulnerability BIT-mattermost-2023-7113, CVE-2023-7113, GHSA-h3gq-j7p9-x3p4, GO-2024-2446 | Low | 0.3% | 29 Dec, 2023 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
ewen-lbh/ffcss Late-Unicode normalization vulnerability CVE-2023-52081, GHSA-wpmx-564x-h2mh, GO-2023-2426 | Medium | 0.5% | 28 Dec, 2023 | Go github.com/ewen-lbh/ffcss |
Maliciously crafted Git server replies can cause DoS on go-git clients CVE-2023-49568, GHSA-mw99-9chc-xw7r, GO-2024-2466 | High | 0.7% | 27 Dec, 2023 | Go github.com/go-git/go-git/v5 Go gopkg.in/src-d/go-git.v4 |
Deis Workflow Manager race condition vulnerability CVE-2016-15036, GHSA-jpfp-xq3p-4h3r, GO-2023-2422 | High | 0.4% | 23 Dec, 2023 | Go github.com/deis/workflow-manager |
free5GC AMF denial of service vulnerability CVE-2023-49391, GHSA-jcrr-rr6w-8c83 | High | 1.0% | 22 Dec, 2023 | Go github.com/free5gc/amf |
Buildkite Elastic CI for AWS symbolic link following vulnerability CVE-2023-43116, GHSA-7c44-7j7v-w554 | High | 0.3% | 22 Dec, 2023 | Go github.com/buildkite/elastic-ci-stack-for-aws/v6 |
Buildkite Elastic CI for AWS time-of-check-time-of-use race condition vulnerability CVE-2023-43741, GHSA-r5hg-349q-mg2q, GO-2024-2440 | High | 0.2% | 22 Dec, 2023 | Go github.com/buildkite/elastic-ci-stack-for-aws Go github.com/buildkite/elastic-ci-stack-for-aws/v5 Go github.com/buildkite/elastic-ci-stack-for-aws/v6 |
Potential URI resolution path traversal in the AWS SDK for PHP CVE-2023-51651, CVE-2025-69820, GHSA-557v-xcg6-rm5m, GHSA-73jg-4qh6-3f4g, GO-2026-4390 | Medium | 1.0% | 21 Dec, 2023 | Go github.com/beam-cloud/beta9 Packagist aws/aws-sdk-php |
jose2go vulnerable to denial of service via large p2c value CVE-2023-50658, GHSA-6294-6rgp-fr7r, GHSA-mhpq-9638-x6pw, GO-2023-2409 | Medium | 0.8% | 20 Dec, 2023 | Go github.com/dvsekhvalnov/jose2go |
Authentication bypass vulnerability in navidrome's subsonic endpoint CVE-2023-51442, GHSA-wq59-4q6r-635r, GO-2023-2414 | High | 0.7% | 19 Dec, 2023 | Go github.com/navidrome/navidrome |
containerd allows RAPL to be accessible to a container GHSA-7ww5-4wqc-m92c, GO-2023-2412 | Medium | Not scored | 19 Dec, 2023 | Go github.com/containerd/containerd |
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin CVE-2023-48795, GHSA-45x7-px36-x8w8, GO-2023-2402, PYSEC-2026-1758 | Medium | 93.5% | 18 Dec, 2023 | Go golang.org/x/crypto PyPI paramiko crates.io russh |
Elastic Beats inserts sensitive information into log file CVE-2023-49922, GHSA-hj4r-2c9c-29h3, GO-2023-2413 | Medium | 0.7% | 12 Dec, 2023 | Go github.com/elastic/beats Go github.com/elastic/beats/v7 |
Duplicate Advisory: Privilege escalation in sap/cloud-security-client-go CVE-2023-50422, CVE-2023-50424, GHSA-59c9-pxq8-9c73, GHSA-92cg-ghq6-9587, GHSA-m8rw-rcpq-2vp2, GO-2023-2400 | Critical | 1.4% | 12 Dec, 2023 | Go github.com/sap/cloud-security-client-go |
lakeFS logs S3 credentials in plain text GHSA-4rgc-5g6r-2rjf, GO-2023-2398 | High | Not scored | 12 Dec, 2023 | Go github.com/treeverse/lakefs |
User with permission to write actions can impersonate another user when auth token is configured in environment variable GHSA-26hr-q2wp-rvc5, GO-2023-2397 | Medium | Not scored | 12 Dec, 2023 | Go github.com/treeverse/lakefs |
Header spoofing in caddy-geo-ip CVE-2023-50463, GHSA-rxg9-hgq7-8pwx, GO-2023-2394 | Medium | 0.7% | 11 Dec, 2023 | Go github.com/shift72/caddy-geo-ip |
Memory exhaustion in HashiCorp Vault BIT-vault-2023-6337, CVE-2023-6337, GHSA-6p62-6cg9-f5f5, GO-2023-2399 | High | 0.8% | 09 Dec, 2023 | Go github.com/hashicorp/vault |
eventing-gitlab vulnerable to denial of service, caused by improper enforcement of the timeout on individual read operations GHSA-99jv-8292-2hpm | Low | Not scored | 08 Dec, 2023 | Go knative.dev/eventing-gitlab |
Always incorrect control flow in github.com/mojocn/base64Captcha CVE-2023-45292, GHSA-5mmw-p5qv-w3x5, GO-2023-2386 | Medium | 0.3% | 08 Dec, 2023 | Go github.com/mojocn/base64Captcha |
eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations GHSA-v7hc-87jc-qrrr, GO-2023-2388 | Low | Not scored | 06 Dec, 2023 | Go knative.dev/eventing-github |
Command 'go get' may unexpectedly fallback to insecure git in cmd/go BIT-golang-2023-45285, CVE-2023-45285, GO-2023-2383 | 1.1% | 06 Dec, 2023 | Go toolchain | |
Denial of service via chunk extensions in net/http BIT-golang-2023-39326, CVE-2023-39326, GO-2023-2382 | 1.2% | 06 Dec, 2023 | Go stdlib | |
Mattermost Injection vulnerability BIT-mattermost-2023-6458, CVE-2023-6458, GHSA-7664-hcp7-f497 | High | 0.6% | 06 Dec, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server Go github.com/mattermost/mattermost/server/v8 |
Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability BIT-mattermost-2023-6459, CVE-2023-6459, GHSA-63cv-4pc2-4fcf | Medium | 0.5% | 06 Dec, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
pubnub Insufficient Entropy vulnerability CVE-2023-26154, GHSA-5844-q3fc-56rh, GO-2023-2385, PYSEC-2026-1807 | Medium | 1.0% | 06 Dec, 2023 | Go github.com/pubnub/go Go github.com/pubnub/go/v5 Go github.com/pubnub/go/v6 Go github.com/pubnub/go/v7 +10 more |
Canonical LXD documentation improvement to make clear restricted.devices.disk=allow without restricted.devices.disk.paths also allows shift=true GHSA-x9qq-236j-gj97 | Low | Not scored | 05 Dec, 2023 | Go github.com/canonical/lxd |
github.com/ecies/go vulnerable to possible private key restoration CVE-2023-49292, GHSA-8j98-cjfr-qx3h, GO-2023-2380 | High | 0.3% | 05 Dec, 2023 | Go github.com/ecies/go/v2 |
lestrrat-go/jwx's malicious parameters in JWE can cause a DOS CVE-2023-49290, GHSA-7f9x-gw85-8grf, GO-2023-2379 | Medium | 0.7% | 05 Dec, 2023 | Go github.com/lestrrat-go/jwx Go github.com/lestrrat-go/jwx/v2 |
Traefik docker container using 100% CPU CVE-2023-47633, GHSA-6fwg-jrfw-ff7p, GO-2023-2377 | High | 1.3% | 05 Dec, 2023 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Traefik vulnerable to potential DDoS via ACME HTTPChallenge CVE-2023-47124, GHSA-8g85-whqh-cr2f, GO-2023-2381 | Medium | 0.8% | 05 Dec, 2023 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass CVE-2023-47106, GHSA-fvhj-4qfh-q2hm, GO-2023-2376 | Medium | 0.6% | 05 Dec, 2023 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel BIT-golang-2023-45287, CVE-2023-45287, GO-2023-2375 | 1.3% | 05 Dec, 2023 | Go stdlib | |
Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks GHSA-j3rq-4xjw-xg63, GO-2023-2378 | High | Not scored | 04 Dec, 2023 | Go github.com/edgelesssys/marblerun |
ZITADEL Account Takeover via Malicious Host Header Injection CVE-2023-49097, GHSA-2wmj-46rj-qm2w | High | 0.8% | 29 Nov, 2023 | Go github.com/zitadel/zitadel |