Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Kyverno vulnerable due to usage of insecure cipher BIT-kyverno-2023-54356, CVE-2023-54356, GHSA-hgv6-w7r3-w4qw, GO-2023-1804 | Medium | 0.2% | 30 May, 2023 | Go github.com/kyverno/kyverno |
Go package pydio/cells vulnerable to authorization bypass CVE-2023-2978, GHSA-mv7x-27pc-8c96, GO-2023-1808 | Medium | 0.7% | 30 May, 2023 | Go github.com/pydio/cells Go github.com/pydio/cells/v4 |
Abstrium Pydio Cells Resource Injection vulnerability CVE-2023-2980, GHSA-j327-c69h-4gh8, GO-2023-2344 | Medium | 1.1% | 30 May, 2023 | Go github.com/pydio/cells Go github.com/pydio/cells/v4 |
go package pydio cells vulnerable to cross-site scripting CVE-2023-2981, GHSA-wmfc-g86p-fjvr, GO-2023-1809 | Medium | 0.7% | 30 May, 2023 | Go github.com/pydio/cells Go github.com/pydio/cells/v4 |
Signature validation bypass in github.com/moov-io/signedxml CVE-2023-34205, GHSA-jqvr-j2vg-gjrv, GO-2023-1826 | Critical | 0.4% | 30 May, 2023 | Go github.com/moov-io/signedxml |
Pomerium vulnerable to Incorrect Authorization with specially crafted requests CVE-2023-33189, GHSA-pvrc-wvj2-f59p, GO-2023-1800 | Critical | 0.9% | 26 May, 2023 | Go github.com/pomerium/pomerium |
malformed proposed intoto entries can cause a panic CVE-2023-33199, GHSA-frqx-jfcm-6jjr, GO-2023-1795 | Medium | 0.7% | 26 May, 2023 | Go github.com/sigstore/rekor |
secrets-store-csi-driver discloses service account tokens in logs CVE-2023-2878, GHSA-g82w-58jf-gcxx, GO-2023-1793 | Medium | 0.4% | 26 May, 2023 | Go sigs.k8s.io/secrets-store-csi-driver |
Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited CVE-2023-33955, GHSA-jv3f-7m33-qp65 | Medium | 0.6% | 26 May, 2023 | Go github.com/minio/console |
kyverno seccomp control can be circumvented CVE-2023-33191, GHSA-33hq-f2mf-jm3c, GO-2023-1801 | Medium | 0.5% | 25 May, 2023 | Go github.com/kyverno/kyverno |
Ingress-nginx `path` sanitization can be bypassed with newline character CVE-2021-25748, GHSA-863x-868h-968x | Medium | 0.7% | 24 May, 2023 | Go k8s.io/ingress-nginx |
nfpm has incorrect default permissions CVE-2023-32698, GHSA-w7jw-q4fg-qc4c, GO-2023-1788 | High | 0.4% | 24 May, 2023 | Go github.com/goreleaser/nfpm Go github.com/goreleaser/nfpm/v2 |
Potential HTTP policy bypass when using header rules in Cilium BIT-cilium-2023-30851, BIT-cilium-operator-2023-30851, BIT-cilium-proxy-2023-30851, BIT-hubble-2023-30851, BIT-hubble-relay-2023-30851, BIT-hubble-ui-2023-30851, BIT-hubble-ui-backend-2023-30851, CVE-2023-30851, GHSA-2h44-x2wx-49f4, GO-2023-1785 | Medium | 0.7% | 22 May, 2023 | Go github.com/cilium/cilium |
ginuerzh/gost vulnerable to Timing Attack CVE-2023-32691, GHSA-qjrq-hm79-49ww | Medium | 0.6% | 22 May, 2023 | Go github.com/ginuerzh/gost |
Dgraph Audit Log Encryption Vulnerability CVE-2023-31135, GHSA-92wq-q9pq-gw47 | Medium | 0.2% | 17 May, 2023 | Go github.com/dgraph-io/dgraph |
etcd Key name can be accessed via LeaseTimeToLive API BIT-etcd-2023-32082, CVE-2023-32082, GHSA-3p4g-rcw5-8298 | Low | 0.7% | 12 May, 2023 | Go github.com/etcd-io/etcd |
Mattermost Incorrect Authorization vulnerability BIT-mattermost-2023-2515, CVE-2023-2515, GHSA-7g2v-2frm-rg94 | High | 0.5% | 12 May, 2023 | Go github.com/mattermost/mattermost-server/v6 |
Improper random reading in CIRCL CVE-2023-1732, GHSA-2q89-485c-9j2x, GO-2023-1765 | Medium | 0.4% | 11 May, 2023 | Go github.com/cloudflare/circl |
github.com/ipfs/kubo affected by DOS Bitswap unbounded persistent memory leak GHSA-qvqg-6rp8-4p9h | Medium | Not scored | 11 May, 2023 | Go github.com/ipfs/kubo |
distribution catalog API endpoint can lead to OOM via malicious user input CVE-2023-2253, GHSA-hqxw-f8mx-cpmw, GO-2023-1772 | High | 0.9% | 11 May, 2023 | Go github.com/distribution/distribution Go github.com/docker/distribution |
Boxo bitswap/server: DOS unbounded persistent memory leak CVE-2023-25568, GHSA-m974-xj4j-7qv5, GHSA-q3j6-22wf-3jh9, GO-2023-1766 | High | 0.9% | 11 May, 2023 | Go github.com/ipfs/go-bitswap Go github.com/ipfs/go-libipfs |
Wings vulnerable to escape to host from installation container CVE-2023-32080, GHSA-p744-4q6p-hvc2, GO-2023-1768 | Critical | 0.9% | 11 May, 2023 | Go github.com/pterodactyl/wings |
VTAdmin users that can create shards can deny access to other functions CVE-2023-29195, GHSA-pqj7-jx24-wj7w | Medium | 1.0% | 11 May, 2023 | Go vitess.io/vitess |
Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment function CVE-2023-29401, GHSA-2c4m-59x9-fr2g, GO-2023-1737 | Medium | 0.5% | 11 May, 2023 | Go github.com/gin-gonic/gin |
On a compromised node, the fluid-csi service account can be used to modify node specs CVE-2023-30840, GHSA-93xx-cvmc-9w3v, GO-2023-1763 | Medium | 0.2% | 09 May, 2023 | Go github.com/fluid-cloudnative/fluid |
Answer Missing Authorization vulnerability CVE-2023-2590, GHSA-qmqw-r4x6-3w2q, GO-2023-1774 | Low | 0.5% | 09 May, 2023 | Go github.com/answerdev/answer |
imgproxy is vulnerable to Server-Side Request Forgery CVE-2023-30019, GHSA-9x7h-ggc3-xg47, GO-2023-1761 | Medium | 2.2% | 08 May, 2023 | Go github.com/imgproxy/imgproxy Go github.com/imgproxy/imgproxy/v2 Go github.com/imgproxy/imgproxy/v3 |
Improper handling of empty HTML attributes in html/template BIT-golang-2023-29400, CVE-2023-29400, GO-2023-1753 | 1.0% | 05 May, 2023 | Go stdlib | |
Improper handling of JavaScript whitespace in html/template BIT-golang-2023-24540, CVE-2023-24540, GO-2023-1752 | 1.6% | 05 May, 2023 | Go stdlib | |
Improper sanitization of CSS values in html/template BIT-golang-2023-24539, CVE-2023-24539, GO-2023-1751 | 1.0% | 05 May, 2023 | Go stdlib | |
libheif vulnerable to segmentation fault via floating point exception CVE-2023-29659, GHSA-22fx-6r9m-r8h9 | Medium | 0.9% | 05 May, 2023 | Go github.com/strukturag/libheif |
Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints CVE-2023-30844, GHSA-jmp2-wc4p-wfh2, GO-2023-1764 | Low | 0.7% | 05 May, 2023 | Go github.com/mutagen-io/mutagen Go github.com/mutagen-io/mutagen-compose |
Under-validated ComSpec and cmd.exe resolution in Mutagen projects GHSA-fwj4-72fm-c93g, GO-2023-1758 | Low | Not scored | 05 May, 2023 | Go github.com/mutagen-io/mutagen |
Improper input validation in github.com/gin-gonic/gin CVE-2023-26125, GHSA-3vp4-m3rf-835h | Medium | 0.9% | 04 May, 2023 | Go github.com/gin-gonic/gin |
Rekor's compressed archives can result in OOM conditions CVE-2023-30551, GHSA-2h5h-59f5-c5x9, GO-2023-1754 | High | 1.1% | 03 May, 2023 | Go github.com/sigstore/rekor |
Ironic and ironic-inspector may expose as ConfigMaps CVE-2023-30841, GHSA-9wh7-397j-722m | Medium | 0.2% | 26 Apr, 2023 | Go github.com/metal3-io/baremetal-operator |
Hop-by-hop abuse to malform header mutator GHSA-w9mr-28mw-j8hg, GO-2023-1747 | Low | Not scored | 26 Apr, 2023 | Go github.com/ory/oathkeeper |
Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer CVE-2023-30549, GHSA-j4rf-7357-f4cg, GO-2023-1738 | High | 0.4% | 25 Apr, 2023 | Go github.com/apptainer/apptainer |
Rancher Webhook is misconfigured during upgrade process CVE-2023-22651, GHSA-6m9f-pj6w-w87g | Critical | 0.8% | 24 Apr, 2023 | Go github.com/rancher/rancher |
A potential risk in clusternet which can be leveraged to make a cluster-level privilege escalation CVE-2023-30622, GHSA-833c-xh79-p429, GO-2023-1735 | Medium | 0.2% | 21 Apr, 2023 | Go github.com/clusternet/clusternet |
IO FinNet tss-lib vulnerable to replay attacks involving proofs CVE-2022-47930, GHSA-c58h-qv6g-fw74, GO-2023-1867 | Medium | 0.5% | 21 Apr, 2023 | Go github.com/binance-chain/tss-lib Go github.com/bnb-chain/tss-lib |
IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar multiplication CVE-2023-26556, GHSA-3w84-4mjc-rjw7, GO-2023-1732 | Critical | 0.9% | 21 Apr, 2023 | Go github.com/binance-chain/tss-lib Go github.com/bnb-chain/tss-lib |
IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar arithmetic CVE-2023-26557, GHSA-mjqv-xhgm-gx8c, GO-2023-1733 | High | 0.9% | 21 Apr, 2023 | Go github.com/binance-chain/tss-lib Go github.com/bnb-chain/tss-lib |
Debug mode leaks confidential data in Cilium BIT-cilium-2023-29002, BIT-cilium-operator-2023-29002, BIT-cilium-proxy-2023-29002, BIT-hubble-2023-29002, BIT-hubble-relay-2023-29002, BIT-hubble-ui-2023-29002, BIT-hubble-ui-backend-2023-29002, CVE-2023-29002, GHSA-pg5p-wwp8-97g8, GO-2023-1730 | High | 0.2% | 19 Apr, 2023 | Go github.com/cilium/cilium |
SpiceDB binding metrics port to untrusted networks and can leak command-line flags CVE-2023-29193, GHSA-cjr9-mr35-7xh6, GO-2023-1723 | High | 0.8% | 13 Apr, 2023 | Go github.com/authzed/spicedb |
OpenFeature Operator vulnerable to Cluster-level Privilege Escalation CVE-2023-29018, GHSA-cwf6-xj49-wp83, GO-2023-1721 | High | 0.7% | 12 Apr, 2023 | Go github.com/open-feature/open-feature-operator |
CubeFS allows Kubernetes cluster-level privilege escalation CVE-2023-30512, GHSA-9337-8c6c-c2xg | Medium | 0.5% | 12 Apr, 2023 | Go github.com/cubefs/cubefs |
vitess allows users to create keyspaces that can deny access to already existing keyspaces CVE-2023-29194, GHSA-735r-hv67-g38f, GO-2023-1717 | Medium | 0.8% | 11 Apr, 2023 | Go vitess.io/vitess |
Traefik HTTP header parsing could cause a denial of service CVE-2023-29013, GHSA-7hj9-rv74-5g92 | High | 1.1% | 11 Apr, 2023 | Go github.com/traefik/traefik/v2 |
Answer vulnerable to Exposure of Sensitive Information Through Metadata CVE-2023-1974, GHSA-8jg3-rx43-3fv4, GO-2023-1718 | Medium | 0.6% | 11 Apr, 2023 | Go github.com/answerdev/answer |