Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Markdown vulnerable to Out-of-bounds Read while parsing citations CVE-2023-42821, GHSA-m9xq-6h2j-65r2, GO-2023-2074 | High | 1.3% | 22 Sep, 2023 | Go github.com/gomarkdown/markdown |
Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input CVE-2023-37279, GHSA-x4hh-vjm7-g2jv, GO-2023-2067 | High | 0.9% | 20 Sep, 2023 | Go github.com/contribsys/faktory |
Sender can cause a receiver to overwrite files during ZIP extraction in Croc CVE-2023-43616, GHSA-8c8w-f7wp-2jr2, GO-2023-2071 | Medium | 0.4% | 20 Sep, 2023 | Go github.com/schollz/croc Go github.com/schollz/croc/v6 Go github.com/schollz/croc/v8 Go github.com/schollz/croc/v9 |
Cros secrets may be disclosed to untrusted relay CVE-2023-43617, GHSA-hp56-xvf4-g6wr, GO-2023-2072 | Medium | 0.8% | 20 Sep, 2023 | Go github.com/schollz/croc Go github.com/schollz/croc/v6 Go github.com/schollz/croc/v8 Go github.com/schollz/croc/v9 |
Croc requires senders to provide local IP addresses in cleartext CVE-2023-43618, GHSA-7mp6-929p-pqhj, GO-2023-2070 | Medium | 0.5% | 20 Sep, 2023 | Go github.com/schollz/croc Go github.com/schollz/croc/v6 Go github.com/schollz/croc/v8 Go github.com/schollz/croc/v9 |
Croc sender may send dangerous new files to receiver CVE-2023-43619, GHSA-ppjh-xp5v-46wc, GO-2023-2073 | High | 0.4% | 20 Sep, 2023 | Go github.com/schollz/croc Go github.com/schollz/croc/v6 Go github.com/schollz/croc/v8 Go github.com/schollz/croc/v9 |
Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device CVE-2023-43620, GHSA-364c-vvqx-446c, GO-2023-2068 | High | 0.4% | 20 Sep, 2023 | Go github.com/schollz/croc Go github.com/schollz/croc/v6 Go github.com/schollz/croc/v8 Go github.com/schollz/croc/v9 |
Croc may expose secret to local users CVE-2023-43621, GHSA-7g3v-4ggr-xvjf, GO-2023-2069 | Medium | 0.3% | 20 Sep, 2023 | Go github.com/schollz/croc Go github.com/schollz/croc/v6 Go github.com/schollz/croc/v8 Go github.com/schollz/croc/v9 |
NATS nats-server allows directory traversal via unintended path to a management action CVE-2022-28357, GHSA-vpjc-4jcv-jc29, GO-2023-2066 | Critical | 1.2% | 19 Sep, 2023 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
Cross-Site Request Forgery (CSRF) in usememos/memos CVE-2023-5036, GHSA-2g7r-9xq5-c6hv, GO-2023-2065 | High | 0.3% | 18 Sep, 2023 | Go github.com/usememos/memos |
HashiCorp Vault Improper Input Validation vulnerability BIT-vault-2023-4680, CVE-2023-4680, GHSA-v84f-6r39-cpfc, GO-2023-2063 | Medium | 0.4% | 15 Sep, 2023 | Go github.com/hashicorp/vault |
libwebp: OOB write in BuildHuffmanTable A-299477569, ASB-A-299477569, CVE-2023-4863, CVE-2023-5129, GHSA-j7hp-h8jx-5ppr, PYSEC-2026-1794, RUSTSEC-2023-0060, RUSTSEC-2023-0061 | HighExploited | 100.0% | 12 Sep, 2023 | Go github.com/chai2010/webp NuGet SkiaSharp NuGet magick.net-q16-anycpu NuGet magick.net-q16-hdri-anycpu +10 more |
RKE2 supervisor port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack CVE-2023-32186, GHSA-p45j-vfv5-wprq | High | 0.7% | 11 Sep, 2023 | Go github.com/rancher/rke2 |
K3s apiserver port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack CVE-2023-32187, GHSA-m4hf-6vgr-75r2 | High | 0.7% | 11 Sep, 2023 | Go github.com/k3s-io/k3s |
Argo CD repo-server Denial of Service vulnerability BIT-argo-cd-2023-40584, CVE-2023-40584, GHSA-g687-f2gx-6wm8, GO-2023-2050 | Medium | 1.4% | 11 Sep, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Argo CD cluster secret might leak in cluster details page BIT-argo-cd-2023-40029, CVE-2023-40029, GHSA-fwr2-64vr-xv9m, GO-2023-2049 | Critical | 1.2% | 11 Sep, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Terraform allows arbitrary file write during the `init` operation CVE-2023-4782, GHSA-h626-pv66-hhm7, GO-2023-2055 | Medium | 0.3% | 08 Sep, 2023 | Go github.com/hashicorp/terraform |
Fiber unauthorized access vulnerability in `ctx.IsFromLocal()` CVE-2023-41338, GHSA-3q5p-3558-364f, GO-2023-2052 | Medium | 0.7% | 08 Sep, 2023 | Go github.com/gofiber/fiber Go github.com/gofiber/fiber/v2 |
matrix-media-repo: Unsafe media served inline on download endpoints CVE-2023-41318, GHSA-5crw-6j7v-xc72, GO-2023-2053 | Medium | 0.5% | 08 Sep, 2023 | Go github.com/turt2live/matrix-media-repo |
Panic when processing post-handshake message on QUIC connections in crypto/tls BIT-golang-2023-39321, CVE-2023-39321, GO-2023-2044 | 1.3% | 07 Sep, 2023 | Go stdlib | |
Memory exhaustion in QUIC connection handling in crypto/tls BIT-golang-2023-39322, CVE-2023-39322, GO-2023-2045 | 1.3% | 07 Sep, 2023 | Go stdlib | |
Improper handling of special tags within script contexts in html/template BIT-golang-2023-39319, CVE-2023-39319, GO-2023-2043 | 0.9% | 07 Sep, 2023 | Go stdlib | |
Arbitrary code execution via go.mod toolchain directive in cmd/go BIT-golang-2023-39320, CVE-2023-39320, GO-2023-2042 | 1.8% | 07 Sep, 2023 | Go toolchain | |
Improper handling of HTML-like comments in script contexts in html/template BIT-golang-2023-39318, CVE-2023-39318, GO-2023-2041 | 0.9% | 07 Sep, 2023 | Go stdlib | |
SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced GHSA-6xv5-86q9-7xr8, GO-2023-2048 | Medium | Not scored | 07 Sep, 2023 | Go github.com/cyphar/filepath-securejoin |
Answer Missing Authentication for Critical Function CVE-2023-4815, GHSA-pj2h-85jq-g5vg, GO-2023-2051 | High | 0.8% | 07 Sep, 2023 | Go github.com/answerdev/answer |
Cosmos-SDK Cosmovisor component may be vulnerable to denial of service GHSA-23px-mw2p-46qm | Medium | Not scored | 06 Sep, 2023 | Go github.com/cosmos/cosmos-sdk |
Go-Ethereum vulnerable to denial of service via malicious p2p message CVE-2023-40591, GHSA-ppjg-v974-84cm, GO-2023-2046 | High | 1.1% | 06 Sep, 2023 | Go github.com/ethereum/go-ethereum |
Minio vulnerable to Privilege Escalation on Windows via Path separator manipulation CVE-2023-28433, GHSA-w23q-4hw3-2pp6 | High | 1.0% | 06 Sep, 2023 | Go github.com/minio/minio |
Index out of bounds leading to crash CVE-2023-36307, GHSA-xgmm-3vvr-6c8j | Medium | 0.3% | 05 Sep, 2023 | Go simonwaldherr.de/go/zplgfa |
Crash when processing crafted TIFF files CVE-2023-36308, GHSA-q7pp-wcgr-pffx | Low | 0.4% | 05 Sep, 2023 | Go github.com/disintegration/imaging |
tss-lib leaks secret keys in response to incorrectly constructed Paillier moduli GHSA-h24c-6p6p-m3vx | Critical | Not scored | 01 Sep, 2023 | Go github.com/bnb-chain/tss-lib |
Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos CVE-2023-4696, GHSA-j2gj-g3p9-7mrr, GO-2023-2038 | Critical | 1.1% | 01 Sep, 2023 | Go github.com/usememos/memos |
usememos/memos vulnerable to privilege escalation CVE-2023-4697, GHSA-5j6p-59cj-j6cp, GO-2023-2036 | High | 0.8% | 01 Sep, 2023 | Go github.com/usememos/memos |
usememos/memos vulnerable to improper input validation CVE-2023-4698, GHSA-96gq-6ch5-mm54 | High | 0.9% | 01 Sep, 2023 | Go github.com/usememos/memos |
Improper log output when using GitHub Status Notifications in spinnaker CVE-2023-39348, GHSA-rq5c-hvw6-8pr7 | Medium | 0.4% | 29 Aug, 2023 | Go github.com/spinnaker/spinnaker |
Code injection in ansible semaphore CVE-2023-39059, GHSA-3r32-cp7v-5wq4 | High | 1.7% | 29 Aug, 2023 | Go github.com/ansible-semaphore/semaphore |
OpenFGA Authorization Bypass CVE-2023-40579, GHSA-jcf2-mxr2-gmqp, GO-2023-2028 | Medium | 0.5% | 25 Aug, 2023 | Go github.com/openfga/openfga |
Netmaker Vulnerable to Privilege Escalation From Non Admin To Admin User CVE-2023-32079, GHSA-826j-8wp2-4x6q, GO-2023-2025 | High | 0.9% | 25 Aug, 2023 | Go github.com/gravitl/netmaker |
Netmaker IDOR Allows User to Update Other User's Password CVE-2023-32078, GHSA-256m-j5qw-38f4, GO-2023-2023 | High | 0.7% | 25 Aug, 2023 | Go github.com/gravitl/netmaker |
Netmaker has Hardcoded DNS Secret Key CVE-2023-32077, GHSA-8x8h-hcq8-jwwx, GO-2023-2022 | High | 3.5% | 25 Aug, 2023 | Go github.com/gravitl/netmaker |
libp2p nodes vulnerable to OOM attack CVE-2023-40583, GHSA-gcq9-qqwx-rgj3, GO-2023-2024 | High | 1.0% | 24 Aug, 2023 | Go github.com/libp2p/go-libp2p |
Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint BIT-alertmanager-2023-40577, CVE-2023-40577, GHSA-v86x-5fm3-5p7j, GO-2023-2020 | Medium | 0.6% | 23 Aug, 2023 | Go github.com/prometheus/alertmanager |
Argo CD web terminal session doesn't expire CVE-2023-40025, GHSA-c8xw-vjgf-94hr, GO-2023-2018 | High | 0.6% | 23 Aug, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Weaviate denial of service vulnerability CVE-2023-38976, GHSA-8697-479h-5mfp, GO-2023-2017 | High | 2.1% | 22 Aug, 2023 | Go github.com/weaviate/weaviate |
Woodpecker does not validate webhook before changing any data CVE-2023-40034, GHSA-4gcf-5m39-98mc, GO-2023-2014 | High | 0.9% | 16 Aug, 2023 | Go github.com/woodpecker-ci/woodpecker |
Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading CVE-2023-40023, GHSA-xvhg-w6qc-m3qq, GO-2023-2011 | High | 1.0% | 15 Aug, 2023 | Go github.com/yaklang/yaklang |
lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files GHSA-9phh-r37v-34wh, GO-2023-2012 | Medium | Not scored | 14 Aug, 2023 | Go github.com/treeverse/lakefs |
Mattermost fails to correctly delete attachments CVE-2023-4105, GHSA-g3v6-r8p9-wxg9 | Low | 0.4% | 11 Aug, 2023 | Go github.com/mattermost/mattermost-server/v6 |
Mattermost fails to check if user is a guest before performing actions on public playbooks CVE-2023-4106, GHSA-p267-jjfq-pphf | Medium | 0.4% | 11 Aug, 2023 | Go github.com/mattermost/mattermost-server/v6 |