Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
code.gitea.io/gitea Open Redirect vulnerability BIT-gitea-2023-3515, CVE-2023-3515, GHSA-cf6v-9j57-v6r6, GO-2023-1894 | Low | 0.5% | 05 Jul, 2023 | Go code.gitea.io/gitea |
kube-apiserver vulnerable to policy bypass CVE-2023-2727, GHSA-qc2g-gmh6-95p4, GO-2023-1891 | Medium | 1.1% | 03 Jul, 2023 | Go k8s.io/kubernetes |
Kubernetes mountable secrets policy bypass CVE-2023-2728, GHSA-cgcv-5272-97pr, GO-2023-1892 | Medium | 2.2% | 03 Jul, 2023 | Go k8s.io/kubernetes |
github.com/cosmos/cosmos-sdk's x/crisis does not charge ConstantFee GHSA-w5w5-2882-47pc, GO-2023-1881 | Low | Not scored | 30 Jun, 2023 | Go github.com/cosmos/cosmos-sdk |
Sealos billing system permission control defect CVE-2023-36815, GHSA-vpxf-q44g-w34w | High | 0.5% | 30 Jun, 2023 | Go github.com/labring/sealos |
Improper configuration of RBAC permissions obtaining cluster control permissions CVE-2023-33190, GHSA-74j8-w7f9-pp62 | Critical | 0.7% | 30 Jun, 2023 | Go github.com/labring/sealos |
Temporal Server vulnerable to Incorrect Authorization and Insecure Default Initialization of Resource BIT-temporal-2023-3485, CVE-2023-3485, GHSA-gm2g-2xr9-pxxj, GO-2023-1879 | Low | 0.2% | 30 Jun, 2023 | Go go.temporal.io/server |
OpenFGA vulnerable to denial of service due to circular relationship CVE-2023-35933, GHSA-hr9r-8phq-5x8j, GO-2023-1872 | Medium | 1.1% | 28 Jun, 2023 | Go github.com/openfga/openfga |
SpiceDB's LookupResources may return partial results CVE-2023-35930, GHSA-m54h-5x5f-5m6r, GO-2023-1871 | Low | 0.4% | 28 Jun, 2023 | Go github.com/authzed/spicedb |
Coraza has potential denial of service vulnerability CVE-2023-40586, GHSA-c2pj-v37r-2p6h, GO-2023-1874 | High | 0.7% | 26 Jun, 2023 | Go github.com/corazawaf/coraza/v2 Go github.com/corazawaf/coraza/v3 |
Grafana vulnerable to Authentication Bypass by Spoofing BIT-grafana-2023-3128, CVE-2023-3128, GHSA-gxh2-6vvc-rrgp, GHSA-mpv3-g8m3-3fjc | Critical | 4.0% | 22 Jun, 2023 | Go github.com/grafana/grafana |
Barberry Security Advisory - regarding x/auth periodic vesting accounts GHSA-j2cr-jc39-wpx5, GHSA-w44m-8mv2-v78h, GO-2023-1861 | Medium | Not scored | 22 Jun, 2023 | Go github.com/cosmos/cosmos-sdk |
Casdoor Cross-Site Request Forgery vulnerability CVE-2023-34927, GHSA-rwcp-qrwg-56cg | Medium | 3.1% | 22 Jun, 2023 | Go github.com/casdoor/casdoor |
Silver vulnerable to MitM attack against implants due to a cryptography vulnerability CVE-2023-34758, CVE-2023-35170, GHSA-8jxm-xp43-qh3q, GO-2023-1866 | Critical | 0.6% | 21 Jun, 2023 | Go github.com/bishopfox/sliver |
Vega's validators able to submit duplicate transactions CVE-2023-35163, GHSA-8rc9-vxjh-qjf2, GO-2023-1865 | Medium | 0.5% | 20 Jun, 2023 | Go code.vegaprotocol.io/vega |
Cilium vulnerable to information leakage via incorrect ReferenceGrant handling BIT-cilium-2023-34242, BIT-cilium-operator-2023-34242, BIT-cilium-proxy-2023-34242, BIT-hubble-2023-34242, BIT-hubble-relay-2023-34242, BIT-hubble-ui-2023-34242, BIT-hubble-ui-backend-2023-34242, CVE-2023-34242, GHSA-r7wr-4w5q-55m6, GO-2023-1862 | Low | 0.3% | 16 Jun, 2023 | Go github.com/cilium/cilium |
Kubelet vulnerable to bypass of seccomp profile enforcement CVE-2023-2431, GHSA-xc8m-28vv-4pjc, GO-2023-1864 | Medium | 0.3% | 16 Jun, 2023 | Go k8s.io/kubernetes |
Mattermost Server Missing Authorization vulnerability CVE-2023-2783, GHSA-455c-vqrf-mghr | Medium | 0.4% | 16 Jun, 2023 | Go github.com/mattermost/mattermost-server/v6 |
IBC protocol "Huckleberry" vulnerability in github.com/cosmos/ibc-go GO-2023-1860 | Not scored | 15 Jun, 2023 | Go github.com/cosmos/ibc-go/v4 Go github.com/cosmos/ibc-go/v5 Go github.com/cosmos/ibc-go/v6 Go github.com/cosmos/ibc-go/v7 | |
github.com/lestrrat-go/jwx vulnerable to Potential Padding Oracle Attack GHSA-rm8v-mxj3-5rmq, GO-2023-1859 | Medium | Not scored | 14 Jun, 2023 | Go github.com/lestrrat-go/jwx Go github.com/lestrrat-go/jwx/v2 |
hjson stack exhaustion vulnerability CVE-2023-34620, GHSA-5wfc-hjrc-gq87, GO-2026-5157 | High | 0.8% | 14 Jun, 2023 | Go github.com/hjson/hjson-go Go github.com/hjson/hjson-go/v4 Maven org.hjson:hjson Packagist laktak/hjson |
Grafana has Broken Access Control in Alert manager: Viewer can send test alerts BIT-grafana-2023-2183, CVE-2023-2183, GHSA-cvm3-pp2j-chr3 | Medium | 1.0% | 12 Jun, 2023 | Go github.com/grafana/grafana |
cheqd-node subject to Cosmos SDK "Barberry" vulnerability GHSA-8qxh-2gh8-r923 | High | Not scored | 12 Jun, 2023 | Go github.com/cheqd/cheqd-node |
HashiCorp Consul Incorrect Access Control vulnerability CVE-2019-12291, GHSA-h65h-v7fw-4p38, GO-2023-1852 | High | 1.2% | 09 Jun, 2023 | Go github.com/hashicorp/consul |
Snowflake Golang Driver vulnerable to Command Injection CVE-2023-34231, GHSA-fwv2-65wh-2w8c | High | 2.0% | 09 Jun, 2023 | Go github.com/snowflakedb/gosnowflake |
Hashicorp Vault vulnerable to Cross-site Scripting BIT-vault-2023-2121, CVE-2023-2121, GHSA-gq98-53rq-qr5h, GO-2023-1849 | Medium | 0.4% | 09 Jun, 2023 | Go github.com/hashicorp/vault |
Code injection via go command with cgo in cmd/go BIT-golang-2023-29402, CVE-2023-29402, GO-2023-1839 | 1.7% | 08 Jun, 2023 | Go toolchain | |
Unsafe behavior in setuid/setgid binaries in runtime BIT-golang-2023-29403, CVE-2023-29403, GO-2023-1840 | 0.4% | 08 Jun, 2023 | Go stdlib | |
Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go BIT-golang-2023-29405, CVE-2023-29405, GO-2023-1842 | 1.7% | 08 Jun, 2023 | Go toolchain | |
Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go BIT-golang-2023-29404, CVE-2023-29404, GO-2023-1841 | 1.8% | 08 Jun, 2023 | Go toolchain | |
alist Incorrect Access Control vulnerability CVE-2023-33498, GHSA-hh54-53m7-7ffj | High | 0.7% | 07 Jun, 2023 | Go github.com/alist-org/alist/v3 |
Grafana Missing Synchronization vulnerability BIT-grafana-2023-2801, CVE-2023-2801, GHSA-x2w4-c67p-g44j | High | 0.7% | 06 Jun, 2023 | Go github.com/grafana/grafana |
notation-go's verification bypass can cause users to verify the wrong artifact CVE-2023-33959, GHSA-xhg5-42rf-296r, GO-2023-1832 | High | 0.4% | 06 Jun, 2023 | Go github.com/notaryproject/notation-go |
Notation's default `maxSignatureAttempts` in `notation verify` enables an endless data attack CVE-2023-33958, GHSA-rvrx-rrwh-r9p6, GO-2023-1831 | Medium | 0.5% | 06 Jun, 2023 | Go github.com/notaryproject/notation |
Notation vulnerable to denial of service from high number of artifact signatures CVE-2023-33957, GHSA-9m3v-v4r5-ppx7, GO-2023-1829 | Medium | 0.5% | 06 Jun, 2023 | Go github.com/notaryproject/notation |
syncthing vulnerable to Cross-site Scripting (XSS) in Web GUI BIT-syncthing-2022-46165, CVE-2022-46165, GHSA-9rp6-23gf-4c3h | Medium | 0.8% | 06 Jun, 2023 | Go github.com/syncthing/syncthing |
Rancher vulnerable to Privilege Escalation via manipulation of Secrets CVE-2023-22647, GHSA-p976-h52c-26p6 | Critical | 0.7% | 06 Jun, 2023 | Go github.com/rancher/rancher |
Rancher UI has multiple Cross-Site Scripting (XSS) issues CVE-2022-43760, GHSA-46v3-ggjg-qq3x | Medium | 0.7% | 06 Jun, 2023 | Go github.com/rancher/rancher |
Rancher users retain access after moving namespaces into projects they don't have access to CVE-2020-10676, GHSA-8vhc-hwhc-cpj4 | High | 1.0% | 06 Jun, 2023 | Go github.com/rancher/rancher |
SQL injection when using MySQL/PostgreSQL data checking CVE-2023-33967, GHSA-4c32-w6c7-77x4 | High | 0.7% | 06 Jun, 2023 | Go github.com/megaease/easeprobe |
Brook's tproxy server is vulnerable to a drive-by command injection. CVE-2023-33965, GHSA-vfrj-fv6p-3cpf | Critical | 1.6% | 06 Jun, 2023 | Go github.com/txthinking/brook |
cheqd-node affected by Inter-blockchain Communication (IBC) protocol "Huckleberry" vulnerability GHSA-7c94-gvvj-r3mg | Low | Not scored | 05 Jun, 2023 | Go github.com/cheqd/cheqd-node |
Kyverno resource with a deletionTimestamp may allow policy circumvention CVE-2023-34091, GHSA-hq4m-4948-64cc, GO-2023-1819 | Medium | 0.5% | 05 Jun, 2023 | Go github.com/kyverno/kyverno |
Gitpod vulnerable to Cross-site Scripting CVE-2023-32766, GHSA-gqx9-h3w2-fprg | Medium | 0.6% | 05 Jun, 2023 | Go github.com/gitpod-io/gitpod |
Hashicorp Consul vulnerable to denial of service BIT-consul-2023-1297, CVE-2023-1297, GHSA-c57c-7hrj-6q6v, GO-2023-1827 | Medium | 0.8% | 03 Jun, 2023 | Go github.com/hashicorp/consul |
Hashicorp Consul allows user with service:write permissions to patch remote proxy instances BIT-consul-2023-2816, CVE-2023-2816, GHSA-rqjq-ww83-wv5c, GO-2023-1828 | High | 0.6% | 03 Jun, 2023 | Go github.com/hashicorp/consul |
mx-chain-go does not treat invalid transaction with wrong username correctly CVE-2023-33964, GHSA-7xpv-4pm9-xch2, GO-2023-1806 | High | 0.6% | 02 Jun, 2023 | Go github.com/multiversx/mx-chain-go |
Go package github.com/cosmos/cosmos-sdk module x/crisis does NOT cause chain halt GHSA-qfc5-6r3j-jj22, GO-2023-1821 | Low | Not scored | 02 Jun, 2023 | Go github.com/cosmos/cosmos-sdk |
In Lima, a malicious disk image could read a single file on the host filesystem as a qcow2/vmdk backing file CVE-2023-32684, GHSA-f7qw-jj9c-rpq9, GO-2023-1803 | Low | 0.3% | 31 May, 2023 | Go github.com/lima-vm/lima |
Algernon engine and themes vulnerable to Cross-site Scripting CVE-2023-26131, GHSA-g47h-fgcw-g4ph | Medium | 0.7% | 31 May, 2023 | Go github.com/xyproto/algernon |