Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Path traversal on Windows in path/filepath BIT-golang-2022-41722, CVE-2022-41722, GO-2023-1568 | 1.7% | 16 Feb, 2023 | Go stdlib | |
OCI image importer memory exhaustion in github.com/containerd/containerd CVE-2023-25153, GHSA-259w-8hf6-59c2, GO-2023-1573 | Medium | 0.4% | 16 Feb, 2023 | Go github.com/containerd/containerd |
Supplementary groups are not set up properly in github.com/containerd/containerd CVE-2023-25173, GHSA-hmfx-3pcx-653p, GO-2023-1574 | Medium | 0.5% | 16 Feb, 2023 | Go github.com/containerd/containerd |
rttys SQL Injection vulnerability CVE-2022-38867, GHSA-54q4-74p3-mgcw | High | 0.9% | 16 Feb, 2023 | Go github.com/zhaojh329/rttys |
Cross Site Scripting in usememos/memos CVE-2022-25978, GHSA-9w8x-5hv5-r6gw, GO-2023-1566 | Medium | 0.5% | 15 Feb, 2023 | Go github.com/usememos/memos |
Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system CVE-2023-25168, GHSA-66p8-j459-rq63, GO-2023-1555 | Critical | 1.0% | 10 Feb, 2023 | Go github.com/pterodactyl/wings |
Denial of service via HAMT Decoding Panics CVE-2023-23625, GHSA-q264-w97q-q778, GO-2023-1557 | Medium | 0.7% | 10 Feb, 2023 | Go github.com/ipfs/go-unixfs |
IPFS go-unixfsnode subject to DOS via HAMT Decoding Panics CVE-2023-23631, GHSA-4gj3-6r43-3wfc, GO-2023-1559 | High | 0.9% | 10 Feb, 2023 | Go github.com/ipfs/go-unixfsnode |
IPFS go-bitfield vulnerable to DoS via malformed size arguments CVE-2023-23626, GHSA-2h6c-j3gf-xp9r, GO-2023-1558 | Medium | 0.9% | 10 Feb, 2023 | Go github.com/ipfs/go-bitfield |
Argo CD leaks repository credentials in user-facing error messages and in logs BIT-argo-cd-2023-25163, CVE-2023-25163, GHSA-mv6w-j4xc-qpfw, GO-2023-1548 | Medium | 0.8% | 08 Feb, 2023 | Go github.com/argoproj/argo-cd/v2 |
Helm vulnerable to information disclosure via getHostByName Function BIT-helm-2023-25165, CVE-2023-25165, GHSA-pwcw-6f5g-gxf8, GO-2023-1547 | Medium | 0.8% | 08 Feb, 2023 | Go helm.sh/helm/v3 |
otelhttp and otelbeego have DoS vulnerability for high cardinality metrics CVE-2023-25151, GHSA-5r5m-65gx-7vrh, GO-2023-1546 | High | 1.0% | 08 Feb, 2023 | Go go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego Go go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp |
Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set CVE-2023-24827, GHSA-jp7v-3587-2956, GO-2023-1533 | Medium | 0.8% | 08 Feb, 2023 | Go github.com/anchore/syft |
Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following CVE-2023-25152, GHSA-p8r3-83r8-jwj5, GO-2023-1542 | High | 0.7% | 08 Feb, 2023 | Go github.com/pterodactyl/wings |
mrpack-install vulnerable to path traversal with dependency CVE-2023-25307, GHSA-r887-gfxh-m9rr, GO-2023-1543 | High | 0.6% | 08 Feb, 2023 | Go github.com/nothub/mrpack-install |
Cross-site scripting vulnerability found in answerdev/answer CVE-2023-0740, GHSA-65px-4cpf-697r, GO-2023-1541 | Critical | 0.7% | 08 Feb, 2023 | Go github.com/answerdev/answer |
Answer has Cross-site Scripting vulnerability CVE-2023-0741, GHSA-p7wj-c85f-xq9h, GO-2023-1552 | Critical | 0.9% | 08 Feb, 2023 | Go github.com/answerdev/answer |
Answer contains Cross-site Scripting vulnerability CVE-2023-0742, GHSA-rmw8-7823-wp7f, GO-2023-1554 | Critical | 0.9% | 08 Feb, 2023 | Go github.com/answerdev/answer |
Answer subject to Cross-site Scripting vulnerability CVE-2023-0743, GHSA-hjmr-xm25-36mh, GO-2023-1551 | Critical | 0.7% | 08 Feb, 2023 | Go github.com/answerdev/answer |
Answer contains Improper Access Control vulnerability CVE-2023-0744, GHSA-4cwh-8w4g-jxxh, GO-2023-1550 | Critical | 6.4% | 08 Feb, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Race Condition CVE-2023-0739, GHSA-qx34-47fc-vv79, GO-2023-1553 | Medium | 0.7% | 08 Feb, 2023 | Go github.com/answerdev/answer |
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2 GHSA-4xgv-j62q-h3rj, GO-2023-1534 | Medium | Not scored | 07 Feb, 2023 | Go github.com/pion/dtls Go github.com/pion/dtls/v2 |
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2 GHSA-hxp2-xqf3-v83h, GO-2023-1535 | Medium | Not scored | 07 Feb, 2023 | Go github.com/pion/dtls Go github.com/pion/dtls/v2 |
Open Redirect in Caddy CVE-2022-28923, GHSA-qpm3-vr34-h8w8, GO-2023-1567 | Medium | 1.4% | 07 Feb, 2023 | Go github.com/caddyserver/caddy/v2 |
Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injection CVE-2022-45786, GHSA-6p5q-h963-pwwf, GO-2024-2587, PYSEC-2026-769 | High | 1.0% | 04 Feb, 2023 | Go github.com/apache/age/drivers/golang PyPI apache-age-python |
Path Traversal in gin-vue-admin CVE-2022-47762, GHSA-x623-hr8h-7g5v, GO-2023-1560 | High | 0.9% | 03 Feb, 2023 | Go github.com/flipped-aurora/gin-vue-admin |
Paranoidhttp Server-Side Request Forgery vulnerability CVE-2023-24623, GHSA-v9mp-j8g7-2q6m, GO-2023-1526 | High | 0.7% | 30 Jan, 2023 | Go github.com/hakobe/paranoidhttp |
Grafana Spoofing originalUrl of snapshots BIT-grafana-2022-39324, CVE-2022-39324, GHSA-4724-7jwc-3fpw, GO-2024-2867 | Medium | 0.8% | 27 Jan, 2023 | Go github.com/grafana/grafana |
Initial debug-host handler implementation could leak information and facilitate denial of service GHSA-x477-fq37-q5wr, GO-2023-1524 | Medium | Not scored | 27 Jan, 2023 | Go fortio.org/proxy |
github.com/openshift/apiserver-library-go Improper Input Validation vulnerability CVE-2023-0229, GHSA-5465-xc2j-6p84, GO-2023-1549 | Medium | 0.7% | 26 Jan, 2023 | Go github.com/openshift/apiserver-library-go |
JWT audience claim is not verified CVE-2023-22482, GHSA-q9hr-j4rf-8fjc, GO-2023-1520 | Critical | 0.9% | 25 Jan, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Command injection in Git package in Wrangler CVE-2022-31249, GHSA-qrg7-hfx7-95c5, GO-2023-1519 | High | 3.8% | 25 Jan, 2023 | Go github.com/rancher/wrangler |
Denial of service (DoS) when processing Git credentials CVE-2022-43756, GHSA-8fcj-gf77-47mg, GO-2023-1515 | Medium | 0.7% | 25 Jan, 2023 | Go github.com/rancher/wrangler |
Controller reconciles apps outside configured namespaces when sharding is enabled CVE-2023-22736, GHSA-6p4m-hw2h-6gmw, GO-2023-1512 | High | 0.8% | 25 Jan, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Rancher generated tokens not revoked after modifications made to authentication provider GHSA-c45c-39f6-6gw9 | High | Not scored | 25 Jan, 2023 | Go github.com/rancher/rancher |
Plaintext storage of sensitive data in Rancher API and cluster.management.cattle.io objects CVE-2022-43757, GHSA-cq4p-vp5q-4522 | High | 0.6% | 25 Jan, 2023 | Go github.com/rancher/rancher |
Command injection in Rancher Git package CVE-2022-43758, GHSA-34p5-jp77-fcrc | Medium | 1.0% | 25 Jan, 2023 | Go github.com/rancher/rancher |
Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster CVE-2022-21953, GHSA-g25r-gvq3-wrq7 | High | 0.5% | 25 Jan, 2023 | Go github.com/rancher/rancher |
Privilege escalation in project role template binding (PRTB) and -promoted roles CVE-2022-43759, GHSA-7m72-mh5r-6j3r | High | 0.7% | 25 Jan, 2023 | Go github.com/rancher/rancher |
Rancher cattle-token is predictable CVE-2022-43755, GHSA-8c69-r38j-rpfj | High | 1.7% | 25 Jan, 2023 | Go github.com/rancher/rancher |
Path Traversal in github.com/go-sonic/sonic CVE-2022-46959, GHSA-2x48-p6cq-5xcw, GO-2023-1509 | Medium | 0.8% | 23 Jan, 2023 | Go github.com/go-sonic/sonic |
scs-library-client may leak user credentials to third-party service via HTTP redirect CVE-2022-23538, GHSA-7p8m-22h4-9pj7, GO-2023-1497 | Medium | 0.7% | 20 Jan, 2023 | Go github.com/sylabs/scs-library-client |
Kraken has arbitrary file read vulnerability via component testfs CVE-2022-47747, GHSA-hj4g-4w36-x8hp, GO-2023-1505 | High | 0.8% | 20 Jan, 2023 | Go github.com/uber/kraken |
act vulnerable to arbitrary file upload in artifact server CVE-2023-22726, GHSA-pc99-qmg4-rcff, GO-2023-1504 | High | 1.3% | 20 Jan, 2023 | Go github.com/nektos/act |
Velociraptor subject to Path Traversal CVE-2023-0290, GHSA-7jf5-fvgf-48c6, GO-2023-1502 | Medium | 0.8% | 19 Jan, 2023 | Go www.velocidex.com/golang/velociraptor |
Velociraptor vulnerable to Missing Authorization CVE-2023-0242, GHSA-g5vm-525q-r66c, GO-2023-1527 | High | 0.6% | 18 Jan, 2023 | Go www.velocidex.com/golang/velociraptor |
golang.org/x/net/http2/h2c vulnerable to request smuggling attack CVE-2022-41721, GHSA-fxg5-wq6x-vr4w, GO-2023-1495 | High | 1.8% | 13 Jan, 2023 | Go golang.org/x/net |
Bloom Uncontrolled Search Path Element vulnerability CVE-2023-0247, GHSA-fgwp-pwqq-g3w4 | High | 0.4% | 12 Jan, 2023 | Go github.com/bits-and-blooms/bloom |
Zitadel RefreshToken invalidation vulnerability CVE-2023-22492, GHSA-6rrr-78xp-5jp8 | Medium | 0.6% | 11 Jan, 2023 | Go github.com/zitadel/zitadel |
Reflected XSS in Gotify's /docs via import of outdated Swagger UI GHSA-3244-8mff-w398, GO-2023-1471 | Medium | Not scored | 10 Jan, 2023 | Go github.com/gotify/server Go github.com/gotify/server/v2 |