Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
gRPC-Go HTTP/2 Rapid Reset vulnerability GHSA-m425-mq94-257g, GO-2023-2153 | High | Not scored | 25 Oct, 2023 | Go google.golang.org/grpc |
Jumpserver Koko vulnerable to remote code execution on the host system via MongoDB shell CVE-2023-43651, GHSA-4r5x-x283-wm96 | Medium | 2.1% | 24 Oct, 2023 | Go github.com/jumpserver/koko |
free5GC udm vulnerable to Invalid Curve Attack CVE-2023-46324, GHSA-cqvv-r3g3-26rf | High | 0.5% | 23 Oct, 2023 | Go github.com/free5gc/udm |
ydb-go-sdk token in custom credentials object can leak through logs CVE-2023-45825, GHSA-q24m-6h38-5xj8, GO-2023-2137 | Medium | 0.2% | 19 Oct, 2023 | Go github.com/ydb-platform/ydb-go-sdk/v3 |
Artifact Hub arbitrary file read vulnerability CVE-2023-45823, GHSA-hmq4-c2r4-5q8h, GO-2023-2136 | High | 0.8% | 19 Oct, 2023 | Go github.com/artifacthub/hub |
Artifact Hub allows unsafe rego built-in CVE-2023-45822, GHSA-9pc8-m4vp-ggvf, GO-2023-2134 | Low | 0.6% | 19 Oct, 2023 | Go github.com/artifacthub/hub |
Artifact Hub has Incorrect Docker Hub registry check CVE-2023-45821, GHSA-g6pq-x539-7w4j, GO-2023-2135 | Medium | 0.2% | 19 Oct, 2023 | Go github.com/artifacthub/hub |
NATS.io: Adding accounts for just the system account adds auth bypass CVE-2023-47090, GHSA-fr2g-9hjm-wr23, GO-2023-2133 | High | 0.8% | 19 Oct, 2023 | Go github.com/nats-io/nats-server/v2 |
OpenFGA DoS vulnerability CVE-2023-45810, GHSA-hr4f-6jh8-f2vq, GO-2023-2121 | High | 0.6% | 18 Oct, 2023 | Go github.com/openfga/openfga |
Arduino Create Agent path traversal - arbitrary file deletion vulnerability CVE-2023-43803, GHSA-m5jc-r4gf-c6p8 | Medium | 0.3% | 18 Oct, 2023 | Go github.com/arduino/arduino-create-agent |
Arduino Create Agent path traversal - local privilege escalation vulnerability CVE-2023-43802, GHSA-75j7-w798-cwwx | High | 0.4% | 18 Oct, 2023 | Go github.com/arduino/arduino-create-agent |
Arduino Create Agent path traversal - arbitrary file deletion vulnerability CVE-2023-43801, GHSA-mjq6-pv9c-qppq | Medium | 0.3% | 18 Oct, 2023 | Go github.com/arduino/arduino-create-agent |
Arduino Create Agent Insufficient Verification of Data Authenticity vulnerability CVE-2023-43800, GHSA-4x5q-q7wc-q22p | High | 0.2% | 18 Oct, 2023 | Go github.com/arduino/arduino-create-agent |
go-ethereum vulnerable to denial of service via crafted GraphQL query CVE-2023-42319, GHSA-v9jh-j8px-98vq | High | 1.2% | 18 Oct, 2023 | Go github.com/ethereum/go-ethereum |
Plonk verifier KZG multi point verification GHSA-7p92-x423-vwj6, GO-2023-2119 | Critical | Not scored | 17 Oct, 2023 | Go github.com/consensys/gnark |
Cross-site Scripting via missing Binding syntax validation CVE-2023-45683, GHSA-267v-3v32-g6q5, GO-2023-2114 | High | 0.5% | 17 Oct, 2023 | Go github.com/crewjam/saml |
github.com/kumahq/kuma affected by CVE-2023-44487 GHSA-9wmc-rg4h-28wv | High | Not scored | 17 Oct, 2023 | Go github.com/kumahq/kuma |
Go Fiber CSRF Token Validation Vulnerability CVE-2023-45141, GHSA-mv73-f69x-444p, GO-2023-2116 | High | 0.3% | 17 Oct, 2023 | Go github.com/gofiber/fiber/v2 |
CSRF Token Reuse Vulnerability CVE-2023-45128, GHSA-94w9-97p3-p368, GO-2023-2115 | Critical | 0.4% | 17 Oct, 2023 | Go github.com/gofiber/fiber/v2 |
Traefik vulnerable to HTTP/2 request causing denial of service BIT-golang-2023-54365, CVE-2023-54365, GHSA-7v4p-328v-8v5g | High | 0.8% | 17 Oct, 2023 | Go github.com/traefik/traefik |
OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics CVE-2023-45142, GHSA-rcjv-mgp8-qvmr, GO-2023-2113 | High | 1.6% | 16 Oct, 2023 | Go go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful Go go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin Go go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux Go go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho +3 more |
Google Sheets data source plugin for Grafana information disclosure vulnerability CVE-2023-4457, GHSA-37x5-qpm8-53rq, GO-2023-2158 | Medium | 0.5% | 16 Oct, 2023 | Go github.com/grafana/google-sheets-datasource |
Grafana privilege escalation vulnerability BIT-grafana-2023-4822, CVE-2023-4822, GHSA-fw9c-75hh-89p6 | Medium | 1.3% | 16 Oct, 2023 | Go github.com/grafana/grafana |
kOps privilege escalation vulnerability CVE-2023-1943, GHSA-8gwj-m6vh-2g6j, GO-2023-2125 | High | 0.6% | 12 Oct, 2023 | Go k8s.io/kops |
HTTP/2 rapid reset can cause excessive work in net/http BIT-golang-2023-39325, CVE-2023-39325, GHSA-4374-p667-p6c8, GO-2023-2102 | High | 3.8% | 11 Oct, 2023 | Go golang.org/x/net Go stdlib |
ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting CVE-2023-44399, GHSA-v683-rcxx-vpff | Medium | 0.7% | 10 Oct, 2023 | Go github.com/zitadel/zitadel |
Harbor timing attack risk BIT-harbor-2023-20902, CVE-2023-20902, GHSA-mq6f-5xh5-hgcf, GO-2023-2109 | Medium | 0.5% | 10 Oct, 2023 | Go github.com/goharbor/harbor |
github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset GHSA-vx74-f528-fxqg | High | Not scored | 10 Oct, 2023 | Go github.com/nghttp2/nghttp2 |
HTTP/2 Stream Cancellation Attack BIT-apisix-2023-44487, BIT-aspnet-core-2023-44487, BIT-contour-2023-44487, BIT-dotnet-2023-44487, BIT-dotnet-sdk-2023-44487, BIT-envoy-2023-44487, BIT-golang-2023-44487, BIT-jenkins-2023-44487, BIT-kong-2023-44487, BIT-nginx-2023-44487, BIT-nginx-gateway-2023-44487, BIT-node-2023-44487, BIT-node-min-2023-44487, BIT-solr-2023-44487, BIT-tomcat-2023-44487, BIT-varnish-2023-44487, CVE-2023-44487, GHSA-qppj-fm5r-hxr3 | HighExploited | 100.0% | 10 Oct, 2023 | Go golang.org/x/net Maven com.typesafe.akka:akka-http-core Maven com.typesafe.akka:akka-http-core_2.11 Maven com.typesafe.akka:akka-http-core_2.12 +8 more |
JWT token compromise can allow malicious actions including Remote Code Execution (RCE) CVE-2023-32188, GHSA-622h-h2p8-743x | Critical | 0.6% | 06 Oct, 2023 | Go github.com/neuvector/neuvector |
gnark-crypto's exponentiation in the pairing target group GT using GLV can give incorrect results GHSA-pffg-92cg-xf5c, GO-2023-2101 | Low | Not scored | 05 Oct, 2023 | Go github.com/consensys/gnark-crypto |
Arbitrary code execution during build via line directives in cmd/go BIT-golang-2023-39323, CVE-2023-39323, GO-2023-2095 | 1.9% | 05 Oct, 2023 | Go toolchain | |
gnark unsoundness in variable comparison / non-unique binary decomposition CVE-2023-44378, GHSA-498w-5j49-vqjg, GO-2023-2098 | Medium | 0.2% | 04 Oct, 2023 | Go github.com/consensys/gnark |
Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled CVE-2023-43809, GHSA-mc97-99j4-vm2v, GO-2023-2097 | High | 1.2% | 02 Oct, 2023 | Go github.com/charmbracelet/soft-serve |
CometBFT's default for `BlockParams.MaxBytes` consensus parameter may increase block times and affect consensus participation GHSA-hq58-p9mv-338c | Low | Not scored | 29 Sep, 2023 | Go github.com/cometbft/cometbft |
Mattermost Incorrect Authorization vulnerability CVE-2023-5159, GHSA-rp65-jpc7-8h8p | Low | 0.4% | 29 Sep, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Incorrect Authorization vulnerability CVE-2023-5193, GHSA-h8wh-f7gw-fwpr | Low | 0.6% | 29 Sep, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Incorrect Authorization vulnerability CVE-2023-5194, GHSA-h69v-mvh9-hfrq | Medium | 0.4% | 29 Sep, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Incorrect Authorization vulnerability CVE-2023-5195, GHSA-9hwp-cj7m-wjw4 | Medium | 0.5% | 29 Sep, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Uncontrolled Resource Consumption vulnerability CVE-2023-5196, GHSA-33r7-wjfc-7w98 | Medium | 0.7% | 29 Sep, 2023 | Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability BIT-vault-2023-5077, CVE-2023-5077, GHSA-86c6-3g63-5w64, GO-2023-2088 | High | 0.5% | 29 Sep, 2023 | Go github.com/hashicorp/vault |
OpenFGA Vulnerable to DoS from circular relationship definitions CVE-2023-43645, GHSA-2hm9-h873-pgqh, GO-2023-2084 | Medium | 0.9% | 28 Sep, 2023 | Go github.com/openfga/openfga |
Duplicate Advisory: Consensys gnark-crypto allows Signature Malleability CVE-2023-44273, GHSA-9xfq-8j3r-xp5g, GHSA-fr8m-434r-g3xp, GO-2023-2096, GO-2025-4027 | Critical | 1.1% | 28 Sep, 2023 | Go github.com/Consensys/gnark-crypto Go github.com/consensys/gnark-crypto |
Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server CVE-2023-40026, GHSA-6jqw-jwf5-rp8h, GO-2023-2085 | Medium | 0.6% | 27 Sep, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy BIT-cilium-2023-41333, BIT-cilium-operator-2023-41333, BIT-cilium-proxy-2023-41333, BIT-hubble-2023-41333, BIT-hubble-relay-2023-41333, BIT-hubble-ui-2023-41333, BIT-hubble-ui-backend-2023-41333, CVE-2023-41333, GHSA-4xp2-w642-7mcx, GO-2023-2080 | Medium | 0.5% | 27 Sep, 2023 | Go github.com/cilium/cilium |
Specific Cilium configurations vulnerable to DoS via Kubernetes annotations BIT-cilium-2023-41332, BIT-cilium-operator-2023-41332, BIT-cilium-proxy-2023-41332, BIT-hubble-2023-41332, BIT-hubble-relay-2023-41332, BIT-hubble-ui-2023-41332, BIT-hubble-ui-backend-2023-41332, CVE-2023-41332, GHSA-24m5-r6hv-ccgp, GO-2023-2079 | Low | 0.5% | 27 Sep, 2023 | Go github.com/cilium/cilium |
sing-box vulnerable to improper authentication in the SOCKS inbound CVE-2023-43644, GHSA-r5hm-mp3j-285g, GO-2023-2077 | Critical | 0.8% | 26 Sep, 2023 | Go github.com/sagernet/sing Go github.com/sagernet/sing-box |
Kubernetes users may update Pod labels to bypass network policy BIT-cilium-2023-39347, BIT-cilium-operator-2023-39347, BIT-cilium-proxy-2023-39347, BIT-hubble-2023-39347, BIT-hubble-relay-2023-39347, BIT-hubble-ui-2023-39347, BIT-hubble-ui-backend-2023-39347, CVE-2023-39347, GHSA-gj2r-phwg-6rww, GO-2023-2078 | Medium | 0.6% | 26 Sep, 2023 | Go github.com/cilium/cilium |
kube-apiserver authentication bypass vulnerability CVE-2023-1260, GHSA-92hx-3mh6-hc49 | High | 1.6% | 24 Sep, 2023 | Go github.com/openshift/apiserver-library-go |
Kiali content spoofing vulnerability CVE-2022-3962, GHSA-6f4m-j56w-55c3, GO-2023-2075 | Medium | 0.7% | 23 Sep, 2023 | Go github.com/kiali/kiali |