Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OwnCast remote code execution vulnerability CVE-2023-46480, GHSA-392h-r46j-q24p | Medium | 1.6% | 28 Nov, 2023 | Go github.com/owncast/owncast |
Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler CVE-2023-48713, GHSA-qmvj-4qr9-v547, GO-2023-2355 | Medium | 0.9% | 27 Nov, 2023 | Go knative.dev/serving |
github.com/go-resty/resty/v2 HTTP request body disclosure CVE-2023-45286, GHSA-xwh9-gc39-5298, GO-2023-2328 | Medium | 0.7% | 27 Nov, 2023 | Go github.com/go-resty/resty/v2 |
Mattermost Uncontrolled Resource Consumption vulnerability CVE-2023-48369, GHSA-3487-3j7c-7gwj | Medium | 0.6% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Improper Access Control vulnerability CVE-2023-6202, GHSA-85jj-c9jr-9jhx | Medium | 0.4% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Injection vulnerability CVE-2023-35075, GHSA-jcgv-3pfq-j4hr | Low | 0.4% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Uncontrolled Resource Consumption vulnerability CVE-2023-40703, GHSA-c37r-v8jx-7cv2 | Medium | 0.7% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability CVE-2023-43754, GHSA-jjr7-372r-cx7x | Medium | 0.5% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability CVE-2023-45223, GHSA-p5pr-vm3j-jxxf | Medium | 0.5% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Open Redirect vulnerability CVE-2023-47168, GHSA-4ghx-8jw8-p76q | Medium | 0.4% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Improper Access Control vulnerability CVE-2023-47865, GHSA-jj46-9cgh-qmfx | Medium | 0.4% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Uncontrolled Resource Consumption vulnerability CVE-2023-48268, GHSA-j4c3-3h73-74m9 | Medium | 0.7% | 27 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Capsule Proxy Authentication bypass using an empty token CVE-2023-48312, GHSA-fpvw-6m5v-hqfp, GO-2023-2351 | Critical | 0.6% | 24 Nov, 2023 | Go github.com/clastix/capsule-proxy Go github.com/projectcapsule/capsule-proxy |
SQL injection vulnerability in Meshery CVE-2023-46575, GHSA-9jjc-grg5-67gj | Critical | 1.3% | 24 Nov, 2023 | Go github.com/layer5io/meshery |
Decryption of malicious PBES2 JWE objects can consume unbounded system resources GHSA-2c7c-3mj9-8fqh, GO-2023-2334 | Medium | Not scored | 21 Nov, 2023 | Go github.com/go-jose/go-jose/v3 Go github.com/square/go-jose |
Inefficient Regular Expression Complexity in git-urls CVE-2023-46402, GHSA-3f2q-6294-fmq5 | High | 0.9% | 18 Nov, 2023 | Go github.com/whilp/git-urls |
Free5gc allows a local attacker to cause a denial of service via the free5gc-compose component CVE-2023-47025, GHSA-q27h-hw2v-x5jm | High | 0.3% | 17 Nov, 2023 | Go github.com/free5gc/free5gc |
free5gc Buffer Overflow vulnerability CVE-2023-47345, GHSA-6944-6pmv-6mp2 | High | 0.9% | 16 Nov, 2023 | Go github.com/free5gc/free5gc |
Attacker can cause Kyverno user to unintentionally consume insecure image BIT-kyverno-2023-47630, CVE-2023-47630, GHSA-3hfq-cx9j-923w, GO-2023-2340 | High | 0.3% | 14 Nov, 2023 | Go github.com/kyverno/kyverno |
Kubernetes Improper Input Validation vulnerability CVE-2023-5528, GHSA-hq6q-c2x6-hmch, GO-2023-2341 | High | 4.1% | 14 Nov, 2023 | Go k8s.io/kubernetes |
Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. CVE-2023-47122, GHSA-xvrc-2wvh-49vc, GO-2023-2332 | Medium | 0.4% | 14 Nov, 2023 | Go github.com/sigstore/gitsign |
Fabric vulnerable to crosslinking transaction attack BIT-hyperledger-fabric-orderer-2023-46132, BIT-hyperledger-fabric-peer-2023-46132, BIT-hyperledger-fabric-tools-2023-46132, CVE-2023-46132, GHSA-v9w2-543f-h69m | High | 0.5% | 14 Nov, 2023 | Go github.com/hyperledger/fabric |
gnark's range checker gadget allows wider inputs up to word alignment GHSA-rjjm-x32p-m3f7, GO-2023-2333 | Low | Not scored | 12 Nov, 2023 | Go github.com/consensys/gnark |
otelgrpc DoS vulnerability due to unbound cardinality metrics CVE-2023-47108, GHSA-8pgv-569h-w5rw, GO-2023-2331 | High | 2.0% | 12 Nov, 2023 | Go go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc |
Headscale writes bearer tokens to info-level logs CVE-2023-47390, GHSA-wp76-cf2j-rqq7 | High | 0.7% | 11 Nov, 2023 | Go github.com/juanfont/headscale |
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability BIT-vault-2023-5954, CVE-2023-5954, GHSA-4qhc-v8r6-8vwm, GO-2023-2329 | High | 0.7% | 09 Nov, 2023 | Go github.com/hashicorp/vault |
Incorrect detection of reserved device names on Windows in path/filepath BIT-golang-2023-45284, CVE-2023-45284, GO-2023-2186 | 1.1% | 08 Nov, 2023 | Go stdlib | |
Insecure parsing of Windows paths with a \??\ prefix in path/filepath BIT-golang-2023-45283, CVE-2023-45283, GO-2023-2185 | 3.3% | 08 Nov, 2023 | Go stdlib | |
slsa-verifier vulnerable to mproper validation of npm's publish attestations GHSA-r2xv-vpr2-42m9, GO-2023-2188 | Low | Not scored | 08 Nov, 2023 | Go github.com/slsa-framework/slsa-verifier Go github.com/slsa-framework/slsa-verifier/v2 |
ZITADEL race condition in lockout policy execution CVE-2023-47111, GHSA-7h8m-vrxx-vr4m | High | 0.5% | 08 Nov, 2023 | Go github.com/zitadel/zitadel |
Cosign vulnerable to possible endless data attack from attacker-controlled registry BIT-cosign-2023-46737, CVE-2023-46737, GHSA-vfp6-jrw2-99g9, GO-2023-2181 | Low | 0.6% | 08 Nov, 2023 | Go github.com/sigstore/cosign Go github.com/sigstore/cosign/v2 |
capsule-proxy service discloses Namespaces of colliding tenants to owners of different tenants with the same ServiceAccount name CVE-2023-46254, GHSA-6758-979h-249x | Medium | 0.4% | 07 Nov, 2023 | Go github.com/projectcapsule/capsule Go github.com/projectcapsule/capsule-proxy |
Calico Typha denial of service vulnerability CVE-2023-41378, GHSA-5r5h-q934-cccp | High | 0.7% | 06 Nov, 2023 | Go github.com/projectcalico/calico |
Mattermost denial of service vulnerability CVE-2023-5967, GHSA-xvq6-h898-wcj8 | Medium | 0.5% | 06 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost password hash disclosure vulnerability CVE-2023-5968, GHSA-r67m-mf7v-qp7j | Medium | 0.5% | 06 Nov, 2023 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost vulnerable to excessive memory consumption CVE-2023-5969, GHSA-w496-f5qq-m58j | Medium | 0.5% | 06 Nov, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Kubernetes csi-proxy vulnerable to privilege escalation due to improper input validation CVE-2023-3893, GHSA-r6cc-7wj7-gfx2, GO-2023-2176 | High | 2.5% | 03 Nov, 2023 | Go github.com/kubernetes-csi/csi-proxy Go github.com/kubernetes-csi/csi-proxy/v2 |
SpiceDB leaks information in log files when URI cannot be parsed CVE-2023-46255, GHSA-jg7w-cxjv-98c2, GO-2023-2166 | Medium | 0.4% | 31 Oct, 2023 | Go github.com/authzed/spicedb |
Kubernetes privilege escalation vulnerability CVE-2023-3676, GHSA-7fxm-f474-hf8w, GO-2023-2330 | High | 13.2% | 31 Oct, 2023 | Go k8s.io/kubernetes |
Kubernetes privilege escalation vulnerability CVE-2023-3955, GHSA-q78c-gwqw-jcmc, GO-2023-2170 | High | 3.8% | 31 Oct, 2023 | Go k8s.io/kubernetes Go k8s.io/mount-utils |
xkeys seal encryption used fixed key for all encryption BIT-nats-2023-46129, CVE-2023-46129, GHSA-mr45-rx8q-wcm9, GO-2023-2163 | High | 0.4% | 31 Oct, 2023 | Go github.com/nats-io/nats-server/v2 Go github.com/nats-io/nkeys |
/sys/devices/virtual/powercap accessible by default to containers GHSA-jq35-85cj-fj4p | Medium | Not scored | 30 Oct, 2023 | Go github.com/docker/docker |
quic-go vulnerable to pointer dereference that can lead to panic CVE-2023-46239, GHSA-3q6m-v84f-6p9h, GO-2023-2160 | High | 1.0% | 30 Oct, 2023 | Go github.com/quic-go/quic-go |
Kube-proxy may unintentionally forward traffic CVE-2021-25736, GHSA-35c7-w35f-xwgh, GO-2023-2159 | Medium | 0.9% | 30 Oct, 2023 | Go k8s.io/kubernetes |
HashiCorp Vagrant Insecure Operation on Windows Junction / Mount Point vulnerability CVE-2023-5834, GHSA-47xw-vw6m-w9fq | Low | 0.2% | 28 Oct, 2023 | Go github.com/hashicorp/vagrant |
Flyte Admin SQL Injection in List Filters CVE-2023-41891, GHSA-r847-6w6h-r8g4, GO-2023-2162 | Low | 1.1% | 27 Oct, 2023 | Go github.com/flyteorg/flyteadmin |
Cosmos packet-forward-middleware vulnerable to chain-halt GHSA-w6rp-vxj2-fjhr, GO-2023-2156 | High | Not scored | 26 Oct, 2023 | Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6 |
Ingress nginx annotation injection causes arbitrary command execution CVE-2023-5043, GHSA-5wj4-wffq-3378 | High | 2.5% | 25 Oct, 2023 | Go k8s.io/ingress-nginx |
Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation CVE-2023-5044, GHSA-fp9f-44c2-cw27, GO-2024-2428 | High | 59.6% | 25 Oct, 2023 | Go k8s.io/ingress-nginx |
Ingress-nginx path sanitization can be bypassed CVE-2022-4886, GHSA-gvrm-w2f9-f77q | High | 1.7% | 25 Oct, 2023 | Go k8s.io/ingress-nginx |