Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Answer vulnerable to Insertion of Sensitive Information Into Sent Data CVE-2023-1975, GHSA-65v8-6pvw-jwvq, GO-2023-1716 | Medium | 0.6% | 11 Apr, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to account takeover because password reset links do not expire CVE-2023-1976, GHSA-j97g-77fj-9c4p, GO-2023-1719 | High | 0.6% | 11 Apr, 2023 | Go github.com/answerdev/answer |
HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation CVE-2023-1782, GHSA-f8r8-h93m-mj77, GO-2023-1707 | High | 0.8% | 05 Apr, 2023 | Go github.com/hashicorp/nomad |
Backticks not treated as string delimiters in html/template BIT-golang-2023-24538, CVE-2023-24538, GO-2023-1703 | 2.3% | 05 Apr, 2023 | Go stdlib | |
Infinite loop in parsing in go/scanner BIT-golang-2023-24537, CVE-2023-24537, GO-2023-1702 | 1.4% | 05 Apr, 2023 | Go stdlib | |
Excessive resource consumption in net/http, net/textproto and mime/multipart BIT-golang-2023-24536, CVE-2023-24536, GO-2023-1705 | 1.5% | 05 Apr, 2023 | Go stdlib | |
Excessive memory allocation in net/http and net/textproto BIT-golang-2023-24534, CVE-2023-24534, GO-2023-1704 | 1.9% | 05 Apr, 2023 | Go stdlib | |
Docker Swarm encrypted overlay network may be unauthenticated CVE-2023-28840, GHSA-232p-vwff-86mp, GO-2023-1699 | High | 2.6% | 04 Apr, 2023 | Go github.com/docker/docker |
Docker Swarm encrypted overlay network traffic may be unencrypted CVE-2023-28841, GHSA-33pg-m6jh-5237, GO-2023-1700 | Medium | 0.7% | 04 Apr, 2023 | Go github.com/docker/docker |
Docker Swarm encrypted overlay network with a single endpoint is unauthenticated CVE-2023-28842, GHSA-6wrf-mxfj-pf5p, GO-2023-1701 | Medium | 1.4% | 04 Apr, 2023 | Go github.com/docker/docker |
Phachon mm-wiki vulnerable to stored cross-site scripting (XSS) CVE-2020-19277, GHSA-f7rp-xx67-4pj9 | Medium | 0.5% | 04 Apr, 2023 | Go github.com/phachon/mm-wiki |
Phachon mm-wiki Cross Site Request Forgery vulnerability CVE-2020-19278, GHSA-f6xp-59jq-r35c | High | 0.5% | 04 Apr, 2023 | Go github.com/phachon/mm-wiki |
Etcd-io Improper Authentication vulnerability BIT-etcd-2021-28235, CVE-2021-28235, GHSA-gmph-wf7j-9gcm | Critical | 1.6% | 04 Apr, 2023 | Go go.etcd.io/etcd/v3 |
sjqzhang go-fastdfs vulnerable to path traversal CVE-2023-1800, GHSA-xq3x-grrj-fj6x, GO-2023-1713 | Critical | 3.6% | 02 Apr, 2023 | Go github.com/sjqzhang/go-fastdfs |
request-baskets vulnerable to Server-Side Request Forgery CVE-2023-27163, GHSA-58g2-vgpg-335q | Medium | 6.5% | 31 Mar, 2023 | Go github.com/darklynx/request-baskets |
Stud42 vulnerable to denial of service GHSA-3hwm-922r-47hw | High | Not scored | 31 Mar, 2023 | Go atomys.codes/stud42 |
Mattermost fails to properly authentication inviter's permissions to private channel BIT-mattermost-2023-1774, CVE-2023-1774, GHSA-9hj7-v56g-rhf6 | Medium | 0.3% | 31 Mar, 2023 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
Mattermost vulnerable to information disclosure BIT-mattermost-2023-1775, CVE-2023-1775, GHSA-8jhh-3jf2-pfwr | Medium | 0.5% | 31 Mar, 2023 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
Mattermost vulnerable to cross-site scripting (XSS) BIT-mattermost-2023-1776, CVE-2023-1776, GHSA-63f2-6959-2pxj | Medium | 0.4% | 31 Mar, 2023 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
Mattermost vulnerable to information disclosure BIT-mattermost-2023-1777, CVE-2023-1777, GHSA-3wq5-3f56-v5xc | Medium | 0.5% | 31 Mar, 2023 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v6 |
runc AppArmor bypass with symlinked /proc CVE-2023-28642, GHSA-g2j6-57v7-gm8c, GO-2023-1683 | Medium | 0.3% | 30 Mar, 2023 | Go github.com/opencontainers/runc |
rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc CVE-2023-25809, GHSA-m8cg-xc2p-r3fc, GO-2023-1682 | Low | 0.3% | 30 Mar, 2023 | Go github.com/opencontainers/runc |
HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File BIT-vault-2023-0620, CVE-2023-0620, GHSA-v3hp-mcj5-pg39, GO-2023-1685 | Medium | 0.4% | 30 Mar, 2023 | Go github.com/hashicorp/vault |
HashiCorp Vault's PKI mount vulnerable to denial of service BIT-vault-2023-0665, CVE-2023-0665, GHSA-hwc3-3qh6-r4gg, GO-2023-1708 | Medium | 0.3% | 30 Mar, 2023 | Go github.com/hashicorp/vault |
HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacks BIT-vault-2023-25000, CVE-2023-25000, GHSA-vq4h-9ghm-qmrr, GO-2023-1709 | Medium | 0.2% | 30 Mar, 2023 | Go github.com/hashicorp/vault |
Podman Time-of-check Time-of-use (TOCTOU) Race Condition CVE-2023-0778, GHSA-qwqv-rqgf-8qh8, GO-2023-1681 | Medium | 0.5% | 27 Mar, 2023 | Go github.com/containers/podman/v4 |
OpenShift Assisted Installer leaks image pull secrets as plaintext in installation logs CVE-2021-3684, GHSA-g8xm-p2h4-v6jp | Medium | 0.2% | 24 Mar, 2023 | Go github.com/openshift/assisted-installer |
Grafana Stored Cross-site Scripting in Graphite FunctionDescription tooltip BIT-grafana-2023-1410, CVE-2023-1410, GHSA-qrrg-gw7w-vp76 | Medium | 1.0% | 23 Mar, 2023 | Go github.com/grafana/grafana |
Non-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled process CVE-2023-28436, GHSA-vfgq-g5x8-g595, GO-2023-1671 | Medium | 0.5% | 23 Mar, 2023 | Go tailscale.com |
Argo CD authenticated but unauthorized users may enumerate Application names via the API CVE-2022-41354, GHSA-2q5c-qw9c-fmvq, GO-2023-1670 | Medium | 0.6% | 23 Mar, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Gophish vulnerable to Denial of Service via crafted payload involving autofocus CVE-2022-45003, GHSA-8gg8-wr4j-v2wr | High | 1.0% | 22 Mar, 2023 | Go github.com/gophish/gophish |
Gophish vulnerable to Cross-site Scripting via crafted landing page CVE-2022-45004, GHSA-55m9-hm92-xm8j | Medium | 0.6% | 22 Mar, 2023 | Go github.com/gophish/gophish |
crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb CVE-2023-28119, GHSA-5mqj-xc49-246p, GO-2023-1664 | High | 1.0% | 22 Mar, 2023 | Go github.com/crewjam/saml |
Privilege Escalation on Linux/MacOS CVE-2023-28434, GHSA-2pxw-r47w-4p8c | HighExploited | 7.9% | 22 Mar, 2023 | Go github.com/minio/minio |
cloudflared's Installer has Local Privilege Escalation Vulnerability CVE-2023-1314, GHSA-7mjv-x3jf-545x, GO-2023-1652 | High | 0.3% | 21 Mar, 2023 | Go github.com/cloudflare/cloudflared |
`cilium-cli` disables etcd authorization for clustermesh clusters CVE-2023-28114, GHSA-6f27-3p6c-p5jc, GO-2023-1653 | Medium | 0.2% | 21 Mar, 2023 | Go github.com/cilium/cilium-cli |
Answer vulnerable to Stored Cross-site Scripting CVE-2023-1535, GHSA-83qr-c7m9-wmgw, GO-2023-1656 | Medium | 0.5% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Stored Cross-site Scripting CVE-2023-1536, GHSA-xvfj-84vc-hrmf, GO-2023-1662 | Medium | 0.5% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Authentication Bypass by Capture-replay CVE-2023-1537, GHSA-hwj7-frgj-7829, GO-2023-1659 | Critical | 0.8% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer has Observable Timing Discrepancy CVE-2023-1538, GHSA-rvjp-8qj4-8p29, GO-2023-1661 | Medium | 0.6% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer has Guessable CAPTCHA CVE-2023-1539, GHSA-g44v-6qfm-f6ch, GO-2023-1657 | Medium | 0.6% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer has Observable Response Discrepancy CVE-2023-1540, GHSA-6x5v-cxpp-pc5x, GO-2023-1654 | Medium | 0.6% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Business Logic Errors CVE-2023-1541, GHSA-h2wg-83fc-xvm9, GO-2023-1658 | Low | 0.6% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Business Logic Errors CVE-2023-1542, GHSA-r95w-7cpx-h5mx, GO-2023-1660 | Medium | 0.8% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Insufficient Session Expiration CVE-2023-1543, GHSA-79hx-g43v-xfmr, GO-2023-1655 | High | 0.8% | 21 Mar, 2023 | Go github.com/answerdev/answer |
imgproxy Cross-site Scripting vulnerability CVE-2023-1496, GHSA-ch9g-x9j7-rcgp, GO-2023-1651 | Medium | 1.6% | 19 Mar, 2023 | Go github.com/imgproxy/imgproxy Go github.com/imgproxy/imgproxy/v2 Go github.com/imgproxy/imgproxy/v3 |
Ansible Semaphore mishandles authentication CVE-2023-28609, GHSA-pmhg-cmjc-3875 | Critical | 0.9% | 18 Mar, 2023 | Go github.com/ansible-semaphore/semaphore |
Cilium eBPF filters may be temporarily removed during agent restart BIT-cilium-2023-27595, BIT-cilium-operator-2023-27595, BIT-cilium-proxy-2023-27595, BIT-hubble-2023-27595, BIT-hubble-relay-2023-27595, BIT-hubble-ui-2023-27595, BIT-hubble-ui-backend-2023-27595, CVE-2023-27595, GHSA-r5x6-w42p-jhpp, GO-2023-1644 | Medium | 0.7% | 17 Mar, 2023 | Go github.com/cilium/cilium |
Potential network policy bypass when routing IPv6 traffic BIT-cilium-2023-27594, BIT-cilium-operator-2023-27594, BIT-cilium-proxy-2023-27594, BIT-hubble-2023-27594, BIT-hubble-relay-2023-27594, BIT-hubble-ui-2023-27594, BIT-hubble-ui-backend-2023-27594, CVE-2023-27594, GHSA-8fg8-jh2h-f2hc, GO-2023-1643 | Medium | 0.6% | 17 Mar, 2023 | Go github.com/cilium/cilium |
cilium-agent container can access the host via `hostPath` mount BIT-cilium-2023-27593, BIT-cilium-operator-2023-27593, BIT-cilium-proxy-2023-27593, BIT-hubble-2023-27593, BIT-hubble-relay-2023-27593, BIT-hubble-ui-2023-27593, BIT-hubble-ui-backend-2023-27593, CVE-2023-27593, GHSA-4hc4-pgfx-3mrx | Medium | 0.2% | 17 Mar, 2023 | Go github.com/cilium/cilium |