Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Authz zero length regression CVE-2024-41110, GHSA-v23v-6jw2-98fq, GO-2024-3005 | Critical | Not scored | 29 Jul, 2024 | Go github.com/docker/docker Go github.com/moby/moby |
Volcano has insecure permissions CVE-2024-36533, GHSA-5g3x-8g2v-r8x8, GO-2024-3034 | Critical | Not scored | 24 Jul, 2024 | Go github.com/volcano-sh/volcano Go volcano.sh/volcano |
fabedge has insecure permissions CVE-2024-36536, GHSA-c9cm-5j82-m6pj, GO-2024-3027 | Critical | Not scored | 24 Jul, 2024 | Go github.com/fabedge/fabedge |
1Panel has an SQL injection issue related to the orderBy clause CVE-2024-39907, GHSA-5grx-v727-qmq6, GO-2024-2990 | Critical | Not scored | 18 Jul, 2024 | Go github.com/1Panel-dev/1Panel |
Gogs allows argument injection during the previewing of changes CVE-2024-39932, GHSA-9pp6-wq8c-3w2c, GHSA-hf29-9hfh-w63j, GO-2024-2971 | Critical | Not scored | 04 Jul, 2024 | Go github.com/gogs/gogs Go gogs.io/gogs |
Duplicate Advisory: github.com/gogs/gogs affected by CVE-2024-39930 CVE-2024-39930, GHSA-p69r-v3h4-rj4f, GHSA-vm62-9jw3-c8w3, GO-2024-2969 | Critical | Not scored | 04 Jul, 2024 | Go github.com/gogs/gogs Go gogs.io/gogs |
Duplicate Advisory: Gogs allows deletion of internal files CVE-2024-39931, GHSA-2vgj-3pvg-xh4w, GHSA-ccqv-43vm-4f3w, GO-2024-2970 | Critical | Not scored | 04 Jul, 2024 | Go github.com/gogs/gogs Go gogs.io/gogs |
Missing key verification in gost CVE-2024-39223, GHSA-8wxx-35qc-vp6r, GO-2024-3224 | Critical | Not scored | 03 Jul, 2024 | Go github.com/ginuerzh/gost |
Session Middleware Token Injection Vulnerability CVE-2024-38513, GHSA-98j2-3j3p-fw2v, GO-2024-2959 | Critical | Not scored | 01 Jul, 2024 | Go github.com/gofiber/fiber Go github.com/gofiber/fiber/v2 Go github.com/gofiber/fiber/v2/middleware/session |
Gin mishandles a wildcard at the end of an origin string CVE-2019-25211, GHSA-869c-j7wc-8jqv, GO-2024-2955 | Critical | Not scored | 29 Jun, 2024 | Go github.com/gin-contrib/cors Go github.com/gin-gonic/gin |
Rancher's External RoleTemplates can lead to privilege escalation CVE-2023-32196, CVE-2023-32197, GHSA-64jq-m7rq-768h, GHSA-7h8m-pvw3-5gh4, GO-2024-2929, GO-2024-3220 | Critical | Not scored | 17 Jun, 2024 | Go github.com/rancher/rancher |
rke's credentials are stored in the RKE1 Cluster state ConfigMap CVE-2023-32191, GHSA-6gr4-52w6-vmqx, GO-2024-2930 | Critical | Not scored | 17 Jun, 2024 | Go github.com/rancher/rke |
Files or Directories Accessible to External Parties in ProjectDiscovery CVE-2024-5262, GHSA-q5mg-pc7r-r8cr, GO-2024-2907 | Critical | Not scored | 05 Jun, 2024 | Go github.com/projectdiscovery/interactsh |
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache BIT-argo-cd-2024-31989, CVE-2024-31989, GHSA-9766-5277-j5hr, GO-2024-2877 | Critical | Not scored | 21 May, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Grafana Race condition allowing privilege escalation BIT-grafana-2022-39328, CVE-2022-39328, GHSA-vqc4-mpj8-jxch, GO-2024-2856 | Critical | Not scored | 14 May, 2024 | Go github.com/grafana/grafana |
Grafana Fine-grained access control vulnerability BIT-grafana-2021-41244, CVE-2021-41244, GHSA-mpwp-42x6-4wmx | Critical | Not scored | 14 May, 2024 | Go github.com/grafana/grafana |
Some CORS middleware allow untrusted origins GHSA-v84h-653v-4pq9, GO-2024-2812 | Critical | Not scored | 03 May, 2024 | Go github.com/jub0bs/fcors |
Some CORS middleware allow untrusted origins GHSA-vhxv-fg4m-p2w8, GO-2024-2813 | Critical | Not scored | 03 May, 2024 | Go github.com/jub0bs/cors |
Improper Access Control in Gitea BIT-gitea-2020-28991, CVE-2020-28991, GHSA-r7h7-chh4-5rvm | Critical | Not scored | 24 Apr, 2024 | Go github.com/go-gitea/gitea |
Privilege Escalation in kubevirt CVE-2020-14316, GHSA-828r-r2c8-rfw3, GO-2024-2756 | Critical | Not scored | 24 Apr, 2024 | Go kubevirt.io/kubevirt |
HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches CVE-2024-3817, GHSA-q64h-39hv-4cf7, GO-2024-2800 | Critical | Not scored | 17 Apr, 2024 | Go github.com/hashicorp/go-getter |
Evmos vulnerable to DOS and transaction fee expropiation through Authz exploit GHSA-v6rw-hhgg-wc4x, GO-2024-2732 | Critical | Not scored | 17 Apr, 2024 | Go github.com/evmos/evmos Go github.com/evmos/evmos/v10 Go github.com/evmos/evmos/v11 Go github.com/evmos/evmos/v12 +8 more |
tiagorlampert CHAOS vulnerable to command injections CVE-2024-30850, CVE-2024-33434, GHSA-p3j6-f45h-hw5f, GHSA-xfjj-f699-rc79, GO-2024-2822 | Critical | Not scored | 12 Apr, 2024 | Go github.com/tiagorlampert/CHAOS |
Evmos transaction execution not accounting for all state transition after interaction with precompiles CVE-2024-32644, GHSA-3fp5-2xwh-fxm6, GO-2024-2715 | Critical | Not scored | 10 Apr, 2024 | Go github.com/evmos/evmos Go github.com/evmos/evmos/v10 Go github.com/evmos/evmos/v11 Go github.com/evmos/evmos/v12 +18 more |
LocalAI Command Injection in audioToWav CVE-2024-2029, GHSA-wx43-g55g-2jf4, GO-2024-2717 | Critical | Not scored | 10 Apr, 2024 | Go github.com/go-skynet/LocalAI |
ibc-go: Potential Reentrancy using Timeout Callbacks in ibc-hooks GHSA-j496-crgh-34mx, GO-2024-2694 | Critical | Not scored | 05 Apr, 2024 | Go github.com/cosmos/ibc-go Go github.com/cosmos/ibc-go/v2 Go github.com/cosmos/ibc-go/v3 Go github.com/cosmos/ibc-go/v4 +4 more |
Bypassing Rate Limit and Brute Force Protection Using Cache Overflow BIT-argo-cd-2024-21652, BIT-argo-cd-2024-21662, CVE-2024-21652, CVE-2024-21662, GHSA-2vgg-9h6w-m454, GHSA-x32m-mvfj-52xv, GO-2024-2652 | Critical | Not scored | 18 Mar, 2024 | Go github.com/argoproj/argo-cd/v2 |
Cross-site scripting on application summary component BIT-argo-cd-2024-28175, CVE-2024-28175, GHSA-jwv5-8mqv-g387, GO-2024-2646 | Critical | Not scored | 15 Mar, 2024 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Pterodactyl Wings vulnerable to improper isolation of server file access CVE-2024-27102, GHSA-494h-9924-xww9, GO-2024-2642 | Critical | Not scored | 15 Mar, 2024 | Go github.com/pterodactyl/wings |
Authorization Bypass Through User-Controlled Key in go-zero CVE-2024-27302, GHSA-fgxv-gw55-r5fq, GO-2024-2604 | Critical | Not scored | 04 Mar, 2024 | Go github.com/zeromicro/go-zero |
Transparent TLS may not be applied to Marbles with certain manifest configurations GHSA-x5r5-2qrx-rqj8, GO-2024-2583 | Critical | Not scored | 27 Feb, 2024 | Go github.com/edgelesssys/marblerun |
Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials CVE-2024-25124, GHSA-fmg4-x8pw-hjhg, GO-2024-2574 | Critical | Not scored | 22 Feb, 2024 | Go github.com/gofiber/fiber/v2 |
BuildKit vulnerable to possible host system access from mount stub cleaner CVE-2024-23652, GHSA-4v98-7qmw-rqr8, GO-2024-2494 | Critical | Not scored | 31 Jan, 2024 | Go github.com/moby/buildkit |
Buildkit's interactive containers API does not validate entitlements check CVE-2024-23653, GHSA-wr6v-9f75-vh2g, GO-2024-2497 | Critical | Not scored | 31 Jan, 2024 | Go github.com/moby/buildkit |
HashiCorp Vault Improper Privilege Management BIT-vault-2020-10661, CVE-2020-10661, GHSA-j6vv-vv26-rh7c, GO-2024-2485 | Critical | Not scored | 30 Jan, 2024 | Go github.com/hashicorp/vault |
Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature CVE-2024-23827, GHSA-xvq9-4vpv-227m, GO-2024-2481 | Critical | Not scored | 29 Jan, 2024 | Go github.com/0xJacky/Nginx-UI |
Django Template Engine Vulnerable to XSS CVE-2024-22199, GHSA-4mq2-gc4j-cmw6, GO-2024-2461 | Critical | Not scored | 11 Jan, 2024 | Go github.com/gofiber/template/django/v3 |
Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients CVE-2023-49569, GHSA-449p-3h89-pw88, GO-2024-2456 | Critical | Not scored | 10 Jan, 2024 | Go github.com/go-git/go-git/v5 Go gopkg.in/src-d/go-git.v4 |
snapd Race Condition vulnerability CVE-2022-3328, GHSA-cjqf-877p-7m3f, GO-2024-2468 | Critical | Not scored | 08 Jan, 2024 | Go github.com/snapcore/snapd |
Duplicate Advisory: Privilege escalation in sap/cloud-security-client-go CVE-2023-50422, CVE-2023-50424, GHSA-59c9-pxq8-9c73, GHSA-92cg-ghq6-9587, GHSA-m8rw-rcpq-2vp2, GO-2023-2400 | Critical | Not scored | 12 Dec, 2023 | Go github.com/sap/cloud-security-client-go |
Capsule Proxy Authentication bypass using an empty token CVE-2023-48312, GHSA-fpvw-6m5v-hqfp, GO-2023-2351 | Critical | Not scored | 24 Nov, 2023 | Go github.com/clastix/capsule-proxy Go github.com/projectcapsule/capsule-proxy |
SQL injection vulnerability in Meshery CVE-2023-46575, GHSA-9jjc-grg5-67gj | Critical | Not scored | 24 Nov, 2023 | Go github.com/layer5io/meshery |
Plonk verifier KZG multi point verification GHSA-7p92-x423-vwj6, GO-2023-2119 | Critical | Not scored | 17 Oct, 2023 | Go github.com/consensys/gnark |
CSRF Token Reuse Vulnerability CVE-2023-45128, GHSA-94w9-97p3-p368, GO-2023-2115 | Critical | Not scored | 17 Oct, 2023 | Go github.com/gofiber/fiber/v2 |
JWT token compromise can allow malicious actions including Remote Code Execution (RCE) CVE-2023-32188, GHSA-622h-h2p8-743x | Critical | Not scored | 06 Oct, 2023 | Go github.com/neuvector/neuvector |
Duplicate Advisory: Consensys gnark-crypto allows Signature Malleability CVE-2023-44273, GHSA-9xfq-8j3r-xp5g, GHSA-fr8m-434r-g3xp, GO-2023-2096, GO-2025-4027 | Critical | Not scored | 28 Sep, 2023 | Go github.com/Consensys/gnark-crypto Go github.com/consensys/gnark-crypto |
sing-box vulnerable to improper authentication in the SOCKS inbound CVE-2023-43644, GHSA-r5hm-mp3j-285g, GO-2023-2077 | Critical | Not scored | 26 Sep, 2023 | Go github.com/sagernet/sing Go github.com/sagernet/sing-box |
NATS nats-server allows directory traversal via unintended path to a management action CVE-2022-28357, GHSA-vpjc-4jcv-jc29, GO-2023-2066 | Critical | Not scored | 19 Sep, 2023 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
Argo CD cluster secret might leak in cluster details page BIT-argo-cd-2023-40029, CVE-2023-40029, GHSA-fwr2-64vr-xv9m, GO-2023-2049 | Critical | Not scored | 11 Sep, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
tss-lib leaks secret keys in response to incorrectly constructed Paillier moduli GHSA-h24c-6p6p-m3vx | Critical | Not scored | 01 Sep, 2023 | Go github.com/bnb-chain/tss-lib |