Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
libp2p DoS vulnerability from lack of resource management CVE-2022-23492, GHSA-j7qp-mfxf-8xjw, GO-2022-1148 | High | 1.1% | 07 Dec, 2022 | Go github.com/libp2p/go-libp2p |
Restricted file access on Windows in os and net/http BIT-golang-2022-41720, CVE-2022-41720, GO-2022-1143 | 1.3% | 07 Dec, 2022 | Go stdlib | |
Casdoor arbitrary file deletion vulnerability via uploadFile function CVE-2022-44942, GHSA-f93f-55c2-8c89, GO-2022-1153 | High | 0.9% | 07 Dec, 2022 | Go github.com/casdoor/casdoor |
teler dashboard vulnerable to DOM-based cross-site scripting (XSS) CVE-2022-23466, GHSA-xr7p-8q82-878q | Low | 0.4% | 06 Dec, 2022 | Go teler.app |
Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace CVE-2022-46167, GHSA-x45c-cvp8-q4fm, GO-2022-1135 | High | 0.9% | 05 Dec, 2022 | Go github.com/clastix/capsule |
Prometheus vulnerable to basic authentication bypass GHSA-4v48-4q5m-8vx4 | High | Not scored | 05 Dec, 2022 | Go github.com/prometheus/prometheus Go github.com/prometheus/prometheus/v2 |
kube-httpcache is vulnerable to Cross-Site Request Forgery (CSRF) GHSA-47xh-qxqv-mgvg | Medium | Not scored | 02 Dec, 2022 | Go github.com/mittwald/kube-httpcache |
owncast is vulnerable to SQL Injection CVE-2022-3751, GHSA-cvh4-cjc9-84qm, GO-2022-1138 | Critical | 1.0% | 29 Nov, 2022 | Go github.com/owncast/owncast |
crewjam/saml vulnerable to signature bypass via multiple Assertion elements due to improper authentication CVE-2022-41912, GHSA-j2jp-wvqg-wc2g, GO-2022-1129 | Critical | 2.3% | 29 Nov, 2022 | Go github.com/crewjam/saml |
Prometheus Exporter-Toolkit is vulnerable to authentication bypass CVE-2022-46146, GHSA-7rg2-cxvp-9p7p, GO-2022-1130 | Medium | 1.3% | 29 Nov, 2022 | Go github.com/prometheus/exporter-toolkit |
KubeView vulnerable to full cluster takeover due to improper authentication CVE-2022-45933, GHSA-22vc-5pgw-644q | Critical | 51.7% | 27 Nov, 2022 | Go github.com/benc-uk/kubeview |
Denial of service in Mattermost CVE-2022-4045, GHSA-v42f-hq78-8c5m | Medium | 0.6% | 23 Nov, 2022 | Go github.com/mattermost/mattermost-server |
Denial of service in Mattermost CVE-2022-4044, GHSA-5jph-wrq7-v9hf | Medium | 1.1% | 23 Nov, 2022 | Go github.com/mattermost/mattermost-server |
Tailscale daemon is vulnerable to information disclosure via CSRF CVE-2022-41925, GHSA-qccm-wmcq-pwr6, GO-2022-1119 | Low | 0.6% | 21 Nov, 2022 | Go tailscale.com Go tailscale.com/cmd |
Tailscale Windows daemon is vulnerable to RCE via CSRF CVE-2022-41924, GHSA-vqp6-rc3h-83cp, GO-2022-1120 | Critical | 1.9% | 21 Nov, 2022 | Go tailscale.com |
Lancet vulnerable to path traversal when unzipping files CVE-2022-41920, GHSA-pp3f-xrw5-q5j4, GO-2022-1114 | High | 0.9% | 21 Nov, 2022 | Go github.com/duke-git/lancet Go github.com/duke-git/lancet/v2 |
Lack of proper validation of server UUID can be used by the server to trick the client to accept invalid proofs CVE-2022-39199, GHSA-6cqj-6969-p57x, GO-2022-1118 | Medium | 0.3% | 21 Nov, 2022 | Go github.com/codenotary/immudb |
Insufficient Verification of Proofs generated by the immudb server in client SDK. CVE-2022-36111, GHSA-672p-m5jq-mrh8, GO-2022-1117 | Medium | 0.4% | 21 Nov, 2022 | Go github.com/codenotary/immudb |
Free5gc vulnerable to uncontrolled resource consumption CVE-2022-38871, GHSA-m74x-fxjh-3qh9 | High | 0.8% | 19 Nov, 2022 | Go github.com/free5gc/free5gc |
Witness Block Parsing DoS Vulnerability CVE-2022-39389, GHSA-hc82-w9v8-83pr | High | 1.1% | 18 Nov, 2022 | Go github.com/lightningnetwork/lnd |
KubeVela VelaUX APIserver has SSRF vulnerability CVE-2022-39383, GHSA-m5xf-x7q6-3rm7, GO-2022-1113 | Medium | 0.4% | 18 Nov, 2022 | Go github.com/oam-dev/kubevela |
Missing Authorization in HashiCorp Consul BIT-consul-2022-3920, CVE-2022-3920, GHSA-gw2g-hhc9-wgjh, GO-2022-1121 | High | 0.7% | 16 Nov, 2022 | Go github.com/hashicorp/consul |
Container build can leak any path on the host into the container GHSA-vp35-85q5-9f25, GO-2022-1107 | Low | Not scored | 11 Nov, 2022 | Go github.com/docker/docker |
MessagePack for Golang subject to DoS via Unmarshal panic CVE-2022-41719, GHSA-jr77-8gx4-h5qh, GO-2022-0972 | High | 1.1% | 10 Nov, 2022 | Go github.com/shamaton/msgpack/v2 |
mm-wiki is vulnerable to Cross-Site Scripting (XSS) CVE-2021-40289, GHSA-99g5-5643-xphp | Medium | 0.5% | 10 Nov, 2022 | Go github.com/phachon/mm-wiki |
HashiCorp Nomad vulnerable to non-sensitive metadata exposure CVE-2022-3866, GHSA-7wg4-8m5p-hrfg, GO-2022-1105 | Medium | 0.6% | 10 Nov, 2022 | Go github.com/hashicorp/nomad |
HashiCorp Nomad vulnerable to Insufficient Session Expiration CVE-2022-3867, GHSA-9fmc-5fq4-5jwh, GO-2022-1106 | Low | 0.5% | 10 Nov, 2022 | Go github.com/hashicorp/nomad |
Istio may allow identity impersonation if user has localhost access CVE-2022-39388, GHSA-6c6p-h79f-g6p4 | High | 0.5% | 09 Nov, 2022 | Go github.com/istio/istio |
Vela Insecure Defaults CVE-2022-39395, GHSA-2w78-ffv6-p46w, GHSA-5m7g-pj8w-7593, GHSA-xf39-98m2-889v, GO-2022-1100 | Critical | 1.2% | 09 Nov, 2022 | Go github.com/go-vela/server Go github.com/go-vela/worker |
OpenFGA Authorization Bypass CVE-2022-39352, GHSA-3gfj-fxx4-f22w, GO-2022-1099 | Medium | 0.5% | 08 Nov, 2022 | Go github.com/openfga/openfga |
btcd mishandles witness size checking CVE-2022-44797, GHSA-2chg-86hq-7w38, GO-2022-1098 | Critical | 1.6% | 07 Nov, 2022 | Go github.com/btcsuite/btcd Go github.com/lightningnetwork/lnd |
TiDB vulnerable to Use of Externally-Controlled Format String CVE-2022-3023, GHSA-7fxj-fr3v-r9gj | Critical | 0.7% | 04 Nov, 2022 | Go github.com/pingcap/tidb |
Unsanitized NUL in environment variables on Windows in syscall and os/exec BIT-golang-2022-41716, CVE-2022-41716, GO-2022-1095 | 1.0% | 01 Nov, 2022 | Go stdlib | |
IBAX go-ibax vulnerable to SQL injection CVE-2022-3798, GHSA-mgqh-3qm7-gx82, GO-2024-2777 | High | 0.6% | 01 Nov, 2022 | Go github.com/IBAX-io/go-ibax |
IBAX go-ibax vulnerable to SQL injection CVE-2022-3799, GHSA-fcgf-j8cf-h2rm, GO-2024-2759 | High | 0.8% | 01 Nov, 2022 | Go github.com/IBAX-io/go-ibax |
IBAX go-ibax vulnerable to SQL injection CVE-2022-3800, GHSA-rwcf-gq22-ph83, GO-2024-2783 | High | 3.1% | 01 Nov, 2022 | Go github.com/IBAX-io/go-ibax |
IBAX go-ibax vulnerable to SQL injection CVE-2022-3801, GHSA-m738-584h-26p6, GO-2024-2775 | High | 30.1% | 01 Nov, 2022 | Go github.com/IBAX-io/go-ibax |
IBAX go-ibax vulnerable to SQL injection CVE-2022-3802, GHSA-g23g-mw97-65c8, GO-2024-2770 | High | 0.6% | 01 Nov, 2022 | Go github.com/IBAX-io/go-ibax |
OctoRPKI crashes when max iterations is reached CVE-2022-3616, GHSA-pmw9-567p-68pc, GO-2022-1089 | Medium | 0.5% | 31 Oct, 2022 | Go github.com/cloudflare/cfrpki |
Hashicorp Boundary vulnerable to clickjacking CVE-2022-36182, GHSA-xqv2-3vvq-qg6r | Medium | 0.7% | 27 Oct, 2022 | Go github.com/hashicorp/boundary |
Gin-vue-admin subject to Remote Code Execution via file upload vulnerability CVE-2022-39345, GHSA-7gc4-r5jr-9hxv | Critical | 1.7% | 25 Oct, 2022 | Go github.com/flipped-aurora/gin-vue-admin/server |
Skipper vulnerable to SSRF via X-Skipper-Proxy CVE-2022-38580, GHSA-f2rj-m42r-6jm2, GO-2022-1086 | Critical | 15.9% | 25 Oct, 2022 | Go github.com/zalando/skipper |
OpenFGA Authorization Bypass via tupleset wildcard CVE-2022-39341, GHSA-vj4m-83m8-xpw5, GO-2022-1080 | Medium | 1.1% | 25 Oct, 2022 | Go github.com/openfga/openfga |
OpenFGA Authorization Bypass CVE-2022-39342, GHSA-f4mm-2r69-mg5f, GO-2022-1081 | Medium | 1.1% | 25 Oct, 2022 | Go github.com/openfga/openfga |
OpenFGA subject to Information Disclosure via streamed-list-objects endpoint CVE-2022-39340, GHSA-95x7-mh78-7w2r, GO-2022-1079 | Medium | 0.9% | 25 Oct, 2022 | Go github.com/openfga/openfga |
free5GC vulnerable to malformed NGAP message crashing the AMF and NGAP decoders CVE-2022-43677, GHSA-59hj-62f5-fgmc, GO-2022-1083 | Medium | 0.8% | 24 Oct, 2022 | Go github.com/free5gc/aper Go github.com/free5gc/free5gc |
Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollution BIT-concourse-2022-31683, CVE-2022-31683, GHSA-5jp2-vwrj-99rf | Medium | 0.5% | 19 Oct, 2022 | Go github.com/concourse/concourse |
Improper use of metav1.Duration allows for Denial of Service BIT-flux-2022-39272, BIT-kustomize-2022-39272, CVE-2022-39272, GHSA-f4p5-x4vc-mh4v, GO-2022-1071 | Medium | 0.8% | 19 Oct, 2022 | Go github.com/fluxcd/flux2 Go github.com/fluxcd/helm-controller Go github.com/fluxcd/helm-controller/api Go github.com/fluxcd/image-automation-controller +9 more |
Bifrost vulnerable to authentication check flaw that leads to authentication bypass CVE-2022-39267, GHSA-mxrx-fg8p-5p5j, GO-2022-1067 | High | 0.9% | 18 Oct, 2022 | Go github.com/brokercap/Bifrost |
Potential inter-blockchain communication (IBC) protocol compromise via "Dragonberry" vulnerability in cheqd GHSA-j92c-mmf7-j5x5, GO-2022-1066 | High | Not scored | 18 Oct, 2022 | Go github.com/cheqd/cheqd-node |