Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mattermost does not validate requesting user permissions before updating admin details CVE-2023-4107, GHSA-6xjj-v76v-fwpj | Medium | 0.5% | 11 Aug, 2023 | Go github.com/mattermost/mattermost-server/v6 |
Mattermost fails to sanitize post metadata CVE-2023-4108, GHSA-9rww-66w7-7vjx | Medium | 0.6% | 11 Aug, 2023 | Go github.com/mattermost/mattermost-server/v6 |
1Panel arbitrary file write vulnerability CVE-2023-39966, GHSA-hf7j-xj3w-87g4, GO-2023-2006 | High | 0.8% | 10 Aug, 2023 | Go github.com/1Panel-dev/1Panel |
1Panel Arbitrary File Download vulnerability CVE-2023-39965, GHSA-85cf-gj29-f555, GO-2023-2005 | Medium | 0.4% | 10 Aug, 2023 | Go github.com/1Panel-dev/1Panel |
1Panel O&M management panel has a background arbitrary file reading vulnerability CVE-2023-39964, GHSA-pv7q-v9mv-9mh5, GO-2023-2004 | High | 1.0% | 10 Aug, 2023 | Go github.com/1Panel-dev/1Panel |
Blst has logical error in SigValidate in Go bindings GHSA-8c37-7qx3-4c4p, GO-2023-2003 | Medium | Not scored | 09 Aug, 2023 | Go github.com/supranational/blst |
Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers BIT-consul-2023-3518, CVE-2023-3518, GHSA-9rhf-q362-77mx, GO-2024-2704 | High | 0.4% | 09 Aug, 2023 | Go github.com/hashicorp/consul |
libp2p nodes vulnerable to attack using large RSA keys CVE-2023-39533, GHSA-876p-8259-xjgg, GO-2023-2000 | High | 1.5% | 08 Aug, 2023 | Go github.com/libp2p/go-libp2p |
Gitea erroneous repo clones BIT-gitea-2022-38795, CVE-2022-38795, GHSA-8j3v-68w3-3848, GO-2023-1999 | Medium | 0.6% | 07 Aug, 2023 | Go code.gitea.io/gitea |
Nuclei Path Traversal vulnerability CVE-2023-37896, GHSA-2xx4-jj5v-6mff, GO-2023-1998 | High | 1.0% | 04 Aug, 2023 | Go github.com/projectdiscovery/nuclei Go github.com/projectdiscovery/nuclei/v2 |
Answer has Race Condition within a Thread CVE-2023-4127, GHSA-52h8-c876-989c, GO-2023-1995 | Medium | 0.5% | 03 Aug, 2023 | Go github.com/answerdev/answer |
Answer Missing Authorization vulnerability CVE-2023-4124, GHSA-v9vc-7x69-c2x8, GO-2023-1997 | High | 0.7% | 03 Aug, 2023 | Go github.com/answerdev/answer |
Answer has Weak Password Requirements CVE-2023-4125, GHSA-j63x-f657-2m9g, GO-2023-2001 | High | 0.9% | 03 Aug, 2023 | Go github.com/answerdev/answer |
Answer Insufficient Session Expiration vulnerability CVE-2023-4126, GHSA-ggcf-hwxp-rc77, GO-2023-1996 | Medium | 0.6% | 03 Aug, 2023 | Go github.com/answerdev/answer |
Large RSA keys can cause high CPU usage in crypto/tls BIT-golang-2023-29409, CVE-2023-29409, GO-2023-1987 | 1.6% | 02 Aug, 2023 | Go stdlib | |
Improper rendering of text nodes in golang.org/x/net/html CVE-2023-3978, GHSA-2wrh-6pvc-2jm9, GO-2023-1988 | Medium | 0.9% | 02 Aug, 2023 | Go golang.org/x/net |
Golang TIFF decoder vulnerable to excessive CPU consumption CVE-2023-29407, GHSA-j3p8-6mrq-6g7h, GO-2023-1990 | Medium | 0.9% | 02 Aug, 2023 | Go golang.org/x/image |
Golang TIFF decoder does not place a limit on the size of compressed tile data CVE-2023-29408, GHSA-x92r-3vfx-4cv3, GO-2023-1989 | Medium | 0.9% | 02 Aug, 2023 | Go golang.org/x/image |
HashiCorp Vault and Vault Enterprise vulnerable to user enumeration BIT-vault-2023-3462, CVE-2023-3462, GHSA-9v3w-w2jh-4hff, GO-2023-1986 | Medium | 0.6% | 01 Aug, 2023 | Go github.com/hashicorp/vault |
Denial of service from large image BIT-crossplane-2023-37900, CVE-2023-37900, GHSA-68p4-95xf-7gx8, GO-2023-1979 | Low | 0.6% | 28 Jul, 2023 | Go github.com/crossplane/crossplane |
Possible image tampering from missing image validation for Packages BIT-crossplane-2023-38495, CVE-2023-38495, GHSA-pj4x-2xr5-w87m, GO-2023-1980 | High | 0.8% | 28 Jul, 2023 | Go github.com/crossplane/crossplane |
Ineffective privileges drop when requesting container network CVE-2023-38496, GHSA-mmx5-32m4-wxvx, GO-2023-1965 | Medium | 0.3% | 25 Jul, 2023 | Go github.com/apptainer/apptainer |
KubePi may leak password hash of any user CVE-2023-37916, GHSA-87f6-8gr7-pc6h, GO-2023-1957 | Medium | 0.8% | 21 Jul, 2023 | Go github.com/KubeOperator/kubepi |
KubePi Privilege Escalation vulnerability CVE-2023-37917, GHSA-757p-vx43-fp9r, GO-2023-1956 | Critical | 0.7% | 21 Jul, 2023 | Go github.com/KubeOperator/kubepi |
Dapr API token authentication bypass in HTTP endpoints CVE-2023-37918, GHSA-59m6-82qm-vqgj, GO-2023-1955 | Medium | 1.4% | 21 Jul, 2023 | Go github.com/dapr/dapr |
Nomad Search API Leaks Information About CSI Plugins CVE-2023-3300, GHSA-v5fm-hr72-27hx, GO-2024-2671 | Medium | 0.6% | 20 Jul, 2023 | Go github.com/hashicorp/nomad |
Nomad ACL Policies without Label are Applied to Unexpected Resources CVE-2023-3072, GHSA-rpvr-38xv-xvxq, GO-2024-2670 | Medium | 0.4% | 20 Jul, 2023 | Go github.com/hashicorp/nomad |
Nomad Caller ACL Token’s Secret ID is Exposed to Sentinel CVE-2023-3299, GHSA-9jfx-84v9-2rr2, GO-2024-2669 | Low | 0.6% | 20 Jul, 2023 | Go github.com/hashicorp/nomad |
goproxy Denial of Service vulnerability CVE-2023-37788, GHSA-4r8x-2p26-976p, GO-2023-1941 | High | 1.0% | 18 Jul, 2023 | Go github.com/elazarl/goproxy |
1Panel command injection vulnerability in Firewall ip functionality CVE-2023-37477, GHSA-p9xf-74xh-mhw5, GO-2023-1940 | High | 5.8% | 18 Jul, 2023 | Go github.com/1Panel-dev/1Panel |
CasaOS contains weak JWT secrets CVE-2023-37266, GHSA-m5q5-8mfw-p2hr, GO-2023-1931 | Critical | 6.8% | 17 Jul, 2023 | Go github.com/IceWhaleTech/CasaOS |
CasaOS Gateway vulnerable to incorrect identification of source IP addresses CVE-2023-37265, GHSA-vjh7-5r6x-xh6g, GO-2023-1932 | Critical | 7.4% | 17 Jul, 2023 | Go github.com/IceWhaleTech/CasaOS-Gateway |
avro vulnerable to denial of service via attacker-controlled parameter CVE-2023-37475, GHSA-9x44-9pgq-cf45, GO-2023-1930 | High | 1.0% | 17 Jul, 2023 | Go github.com/hamba/avro Go github.com/hamba/avro/v2 |
Weave GitOps Terraform Controller Information Disclosure Vulnerability CVE-2023-34236, GHSA-6hvv-j432-23cv, GO-2023-1925 | High | 1.0% | 14 Jul, 2023 | Go github.com/weaveworks/tf-controller |
Tokenizer vulnerable to client brute-force of token secrets GHSA-f28g-86hc-823q, GO-2023-1914 | Medium | Not scored | 13 Jul, 2023 | Go github.com/superfly/tokenizer |
mx-chain-go's relayed transactions always increment nonce CVE-2023-34458, GHSA-j494-7x2v-vvvp, GO-2023-1912 | High | 1.3% | 13 Jul, 2023 | Go github.com/multiversx/mx-chain-go |
A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries GHSA-2w8w-qhg4-f78j | Medium | Not scored | 11 Jul, 2023 | Go github.com/jaegertracing/jaeger |
Insufficient sanitization of Host header in net/http BIT-golang-2023-29406, CVE-2023-29406, GO-2023-1878 | 1.5% | 11 Jul, 2023 | Go stdlib | |
iprange may panic when parsing ranges with invalid masks GHSA-f99h-w337-mv56, GO-2023-1857 | Medium | Not scored | 11 Jul, 2023 | Go github.com/malfunkt/iprange |
Pipelines do not validate child UIDs CVE-2023-37264, GHSA-w2h3-vvvq-3m53, GO-2023-1901 | Low | 0.4% | 07 Jul, 2023 | Go github.com/tektoncd/pipeline |
Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables CVE-2023-1296, GHSA-hhvx-8755-4cvw, GO-2023-1899 | Medium | 0.5% | 06 Jul, 2023 | Go github.com/hashicorp/nomad |
Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation BIT-vault-2023-24999, CVE-2023-24999, GHSA-wmg5-g953-qqfw, GO-2023-1900 | High | 0.6% | 06 Jul, 2023 | Go github.com/hashicorp/vault |
HashiCorp Boundary Workers Store Rotated Credentials in Plaintext Even When Key Management Service Configured CVE-2023-0690, GHSA-9vrm-v9xv-x3xr, GO-2023-1898 | High | 0.4% | 06 Jul, 2023 | Go github.com/hashicorp/boundary |
HashiCorp Vault's revocation list not respected BIT-vault-2022-41316, CVE-2022-41316, GHSA-9mh8-9j64-443f, GO-2023-1897 | Medium | 0.5% | 06 Jul, 2023 | Go github.com/hashicorp/vault |
Zinc Cross-site Scripting vulnerability CVE-2022-32171, GHSA-4fgv-8448-gf82, GO-2023-1895 | Medium | 0.7% | 06 Jul, 2023 | Go github.com/zinclabs/zinc Go github.com/zincsearch/zincsearch |
Zinc Cross-site Scripting vulnerability CVE-2022-32172, GHSA-7j6x-42mm-p7jm, GO-2023-1896 | Medium | 0.7% | 06 Jul, 2023 | Go github.com/zinclabs/zinc Go github.com/zincsearch/zincsearch |
1Panel vulnerable to command injection when entering the container terminal CVE-2023-36458, GHSA-7x2c-fgx6-xf9h, GO-2023-1888 | Medium | 2.3% | 05 Jul, 2023 | Go github.com/1Panel-dev/1Panel |
1Panel vulnerable to command injection when adding container repositories CVE-2023-36457, GHSA-q2mx-gpjf-3h8x, GO-2023-1887 | Medium | 2.3% | 05 Jul, 2023 | Go github.com/1Panel-dev/1Panel |
CometBFT may duplicate transactions in the mempool's data structures CVE-2023-34451, GHSA-w24w-wp77-qffm, GO-2023-1883 | High | 0.9% | 05 Jul, 2023 | Go github.com/cometbft/cometbft |
CometBFT PeerState JSON serialization deadlock CVE-2023-34450, GHSA-mvj3-qrqh-cjvr, GO-2023-1882 | Medium | 0.9% | 05 Jul, 2023 | Go github.com/cometbft/cometbft |