Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Authorization Bypass Through User-Controlled Key play-with-docker CVE-2023-28109, GHSA-vq59-5x26-h639 | Medium | 0.7% | 17 Mar, 2023 | Go github.com/play-with-docker/play-with-docker |
Go-huge-util vulnerable to path traversal when unzipping files CVE-2023-28105, GHSA-5g39-ppwg-6xx8, GO-2023-1640 | High | 0.6% | 16 Mar, 2023 | Go github.com/dablelv/go-huge-util |
Authelia allows open redirects on the logout endpoint CVE-2021-29456, GHSA-36f2-fcrx-fp4j | Medium | 0.5% | 16 Mar, 2023 | Go github.com/authelia/authelia/v4 |
On a compromised node, the virt-handler service account can be used to modify all node specs CVE-2023-26484, GHSA-cp96-jpmq-xrr2 | High | 0.6% | 16 Mar, 2023 | Go kubevirt.io/kubevirt |
Full authentication bypass if SASL authorization username is specified CVE-2023-27582, GHSA-4g76-w3xw-2x6w, GO-2023-1630 | Critical | 1.0% | 14 Mar, 2023 | Go github.com/foxcpp/maddy |
google.golang.org/protobuf vulnerable to panic leading to denial of service CVE-2023-24535, GHSA-hw7c-3rfg-p46j, GO-2023-1631 | High | 1.1% | 14 Mar, 2023 | Go google.golang.org/protobuf |
Nomad Job Submitter Privilege Escalation Using Workload Identity CVE-2023-1299, GHSA-rqm8-q8j9-662f, GO-2023-1633 | High | 0.5% | 14 Mar, 2023 | Go github.com/hashicorp/nomad |
fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime CVE-2023-27483, GHSA-vfvj-3m3g-m532, GO-2023-1623 | Medium | 0.8% | 13 Mar, 2023 | Go github.com/crossplane/crossplane-runtime |
Crossplane-runtime contains Improper Input Validation via Compositions CVE-2023-27484, GHSA-v829-x6hh-cqfq | Medium | 0.7% | 10 Mar, 2023 | Go github.com/crossplane/crossplane |
Constellation allows Emergency shell access during initramfs boot phase GHSA-6w5f-5wgr-qjg5, GO-2023-1622 | High | Not scored | 09 Mar, 2023 | Go github.com/edgelesssys/constellation Go github.com/edgelesssys/constellation/v2 |
Consul Server Panic when Ingress and API Gateways Configured with Peering Connections BIT-consul-2023-0845, CVE-2023-0845, GHSA-wj6x-hcc2-f32j, GO-2023-1639 | Medium | 1.0% | 09 Mar, 2023 | Go github.com/hashicorp/consul |
Incorrect calculation on P256 curves in crypto/internal/nistec BIT-golang-2023-24532, CVE-2023-24532, GO-2023-1621 | 0.8% | 08 Mar, 2023 | Go stdlib | |
Goutil vulnerable to path traversal when unzipping files CVE-2023-27475, GHSA-fx2v-qfhr-4chv, GO-2023-1611 | High | 0.8% | 07 Mar, 2023 | Go github.com/gookit/goutil |
Buildkit credentials inlined to Git URLs could end up in provenance attestation CVE-2023-26054, GHSA-gc89-7gcr-jxqc | Medium | 1.0% | 07 Mar, 2023 | Go github.com/moby/buildkit |
Answer vulnerable to Cross-site Scripting CVE-2023-1237, GHSA-9v4v-9fj5-p982, GO-2023-1616 | Medium | 0.4% | 07 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Cross-site Scripting CVE-2023-1238, GHSA-5w78-v688-cx9q, GO-2023-1614 | Medium | 0.6% | 07 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Cross-site Scripting CVE-2023-1239, GHSA-vxhr-p2vp-7gf8, GO-2023-1620 | Medium | 0.5% | 07 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Cross-site Scripting CVE-2023-1240, GHSA-55vm-3vq3-4jpc, GO-2023-1613 | Medium | 0.6% | 07 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Cross-site Scripting CVE-2023-1241, GHSA-ff27-hrmr-ggpj, GO-2023-1617 | Medium | 0.6% | 07 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Cross-site Scripting CVE-2023-1242, GHSA-qrwm-xqfr-4vhv, GO-2023-1619 | Medium | 0.6% | 07 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Cross-site Scripting CVE-2023-1243, GHSA-8jh8-33f5-cgfp, GO-2023-1615 | Medium | 0.5% | 07 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Cross-site Scripting CVE-2023-1244, GHSA-h85v-cx5m-78wj, GO-2023-1618 | Medium | 0.5% | 07 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Cross-site Scripting CVE-2023-1245, GHSA-6c32-3x46-m9rh, GO-2023-1612 | Medium | 0.5% | 07 Mar, 2023 | Go github.com/answerdev/answer |
Yapscan Denial of Service vulnerability in report server GHSA-wxwq-525w-hcqx, GO-2023-1607 | High | Not scored | 03 Mar, 2023 | Go github.com/fkie-cad/yapscan |
Opencontainers runc Incorrect Authorization vulnerability CVE-2023-27561, GHSA-vpvm-3wq2-2wvm, GO-2023-1627 | High | 0.4% | 03 Mar, 2023 | Go github.com/opencontainers/runc |
coreDNS vulnerable to Improper Restriction of Communication Channel to Intended Endpoints CVE-2022-2835, GHSA-ch7v-37xg-75ph | Medium | 0.2% | 03 Mar, 2023 | Go github.com/coredns/coredns |
coreDNS vulnerable to Improper Restriction of Communication Channel to Intended Endpoints CVE-2022-2837, GHSA-h828-v5pv-33qx | Medium | 0.4% | 03 Mar, 2023 | Go github.com/coredns/coredns |
gosaml2 vulnerable to Denial Of Service Via Deflate Decompression Bomb CVE-2023-26483, GHSA-6gc3-crp7-25w5, GO-2023-1602 | Medium | 1.0% | 02 Mar, 2023 | Go github.com/russellhaering/gosaml2 |
Kubernetes vulnerable to path traversal CVE-2022-3162, GHSA-2394-5535-8j88, GO-2023-1628 | Medium | 1.4% | 01 Mar, 2023 | Go github.com/kubernetes/kubernetes Go k8s.io/kubernetes |
Kubernetes vulnerable to validation bypass CVE-2022-3294, GHSA-jh36-q97c-9928, GO-2023-1629 | High | 1.6% | 01 Mar, 2023 | Go github.com/kubernetes/kubernetes Go k8s.io/kubernetes |
Grafana vulnerable to Stored Cross-site Scripting in Text plugin BIT-grafana-2023-22462, CVE-2023-22462, GHSA-7rqg-hjwc-6mjf | Medium | 1.6% | 01 Mar, 2023 | Go github.com/grafana/grafana |
teler-waf contains detection rule bypass via Entities payload CVE-2023-26047, GHSA-p2pf-g8cq-3gq5, GO-2023-1600 | Medium | 0.5% | 01 Mar, 2023 | Go github.com/kitabisa/teler-waf |
teler-waf subject to Bypass of Common Web Attack Threat Rule with HTML Entities Payload CVE-2023-26046, GHSA-9f95-hhg4-pg4f, GO-2023-1597 | Medium | 0.5% | 01 Mar, 2023 | Go github.com/kitabisa/teler-waf |
Juju controller - Arbitrary file reading vulnerability CVE-2023-0092, GHSA-x5rv-w9pm-8qp8 | Medium | 0.6% | 01 Mar, 2023 | Go github.com/juju/juju |
Grafana vulnerable to Cross-site Scripting BIT-grafana-2023-0594, CVE-2023-0594, GHSA-xw5p-hw8j-xg4q | Medium | 9.2% | 01 Mar, 2023 | Go github.com/grafana/grafana |
Grafana vulnerable to Cross-site Scripting BIT-grafana-2023-0507, CVE-2023-0507, GHSA-hjv9-hm2f-rpcj | Medium | 15.5% | 01 Mar, 2023 | Go github.com/grafana/grafana |
nistec has Incorrect Calculation in Multiplication of unreduced P-256 scalars CVE-2023-24533, GHSA-f6hc-9g49-xmx7, GO-2023-1595 | High | 0.7% | 28 Feb, 2023 | Go filippo.io/nistec |
Gogs OS Command Injection vulnerability CVE-2022-2024, GHSA-pfvh-p8qp-9ww9, GO-2023-1596 | Critical | 97.8% | 28 Feb, 2023 | Go gogs.io/gogs |
notation-go has excessive memory allocation on verification CVE-2023-25656, GHSA-87x9-7grx-m28v, GO-2023-1589 | High | 0.4% | 22 Feb, 2023 | Go github.com/notaryproject/notation-go |
Excessive resource consumption in mime/multipart BIT-golang-2022-41725, CVE-2022-41725, GO-2023-1569 | 1.2% | 21 Feb, 2023 | Go stdlib | |
GoPistolet vulnerable to Improper Resource Shutdown or Release CVE-2015-10085, GHSA-wr8h-w969-36m8, GO-2023-1590 | High | 0.9% | 21 Feb, 2023 | Go github.com/gopistolet/gopistolet |
Answer vulnerable to Cross-site Scripting CVE-2023-0934, GHSA-6cvf-m58q-h9wf, GO-2023-1592 | Medium | 0.4% | 21 Feb, 2023 | Go github.com/answerdev/answer |
User data in TPM attestation vulnerable to MITM GHSA-r2h5-3hgw-8j34, GO-2023-1583 | High | Not scored | 17 Feb, 2023 | Go github.com/edgelesssys/constellation Go github.com/edgelesssys/constellation/v2 |
Privilege escalation in MOSN CVE-2021-32163, GHSA-5vx9-j5cw-47vq, GO-2023-1582 | Critical | 0.9% | 17 Feb, 2023 | Go mosn.io/mosn |
Uncontrolled Resource Consumption in Hashicorp Nomad CVE-2023-0821, GHSA-w479-w22g-cffh, GO-2023-1581 | Medium | 0.8% | 17 Feb, 2023 | Go github.com/hashicorp/nomad |
golang.org/x/net vulnerable to Uncontrolled Resource Consumption BIT-golang-2022-41723, CVE-2022-41723, GHSA-vvpx-j8f3-3w6h, GO-2023-1571 | High | 4.6% | 16 Feb, 2023 | Go golang.org/x/net Go stdlib |
Uncontrolled Resource Consumption in golang.org/x/image CVE-2022-41727, GHSA-qgc7-mgm3-q253, GO-2023-1572 | Medium | 0.3% | 16 Feb, 2023 | Go golang.org/x/image |
Panic on large handshake records in crypto/tls BIT-golang-2022-41724, CVE-2022-41724, GO-2023-1570 | 1.1% | 16 Feb, 2023 | Go stdlib | |
Data Amplification in HashiCorp go-getter CVE-2023-0475, GHSA-jpxj-2jvg-6jv9, GO-2023-1578 | Medium | 0.5% | 16 Feb, 2023 | Go github.com/hashicorp/go-getter Go github.com/hashicorp/go-getter/v2 |
Users with any cluster secret update access may update out-of-bounds cluster secrets CVE-2023-23947, GHSA-3jfq-742w-xg8j, GO-2023-1577 | Critical | 0.7% | 16 Feb, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |