Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Helm Controller denial of service BIT-flux-2022-36049, BIT-helm-2022-36049, CVE-2022-36049, GHSA-p2g7-xwvr-rrw3 | High | 1.5% | 16 Sep, 2022 | Go github.com/fluxcd/flux2 Go github.com/fluxcd/helm-controller |
Talos worker join token can be used to get elevated access level to the Talos API CVE-2022-36103, GHSA-7hgc-php5-77qq, GO-2022-0995 | High | 0.7% | 16 Sep, 2022 | Go github.com/talos-systems/talos |
nftables binding to an already bound chain GHSA-jr8j-2jhp-m67v | Medium | Not scored | 16 Sep, 2022 | Go github.com/siderolabs/talos |
Talos vulnerable dependency due to race condition in Linux kernel's IP framework XFRM GHSA-34vw-m4rh-r36p | High | Not scored | 16 Sep, 2022 | Go github.com/talos-systems/talos |
Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata GHSA-3633-5h82-39pq, GO-2022-1004 | Low | Not scored | 16 Sep, 2022 | Go github.com/theupdateframework/go-tuf |
Netmaker vulnerable to Insufficient Granularity of Access Control CVE-2022-36110, GHSA-ggf6-638m-vqmg, GO-2022-0986 | High | 0.9% | 15 Sep, 2022 | Go github.com/gravitl/netmaker |
Dendrite signature checks not applied to some retrieved missing events CVE-2022-39200, GHSA-pfw4-xjgm-267c, GO-2022-0989 | High | 0.4% | 15 Sep, 2022 | Go github.com/matrix-org/dendrite |
ouqiang gocron Cross-site scripting vulnerability CVE-2022-40365, GHSA-r947-2crg-xc39 | Medium | 0.6% | 15 Sep, 2022 | Go github.com/ouqiang/gocron |
Podman's incorrect handling of the supplementary groups may lead to data disclosure, modification CVE-2022-2989, GHSA-4wjj-jwc9-2x96 | High | 0.3% | 14 Sep, 2022 | Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 |
Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification CVE-2022-2990, GHSA-fjm8-m7m6-2fjp, GO-2022-1008 | High | 0.3% | 14 Sep, 2022 | Go github.com/containers/buildah |
OPA Compiler: Bypass of WithUnsafeBuiltins using "with" keyword to mock functions CVE-2022-36085, GHSA-f524-rf33-2jjr, GO-2022-0978 | High | 1.6% | 13 Sep, 2022 | Go github.com/open-policy-agent/opa |
Failure to strip relative path components in net/url BIT-golang-2022-32190, CVE-2022-32190, GO-2022-0988 | 2.2% | 12 Sep, 2022 | Go stdlib | |
Gophish before 0.12.0 vulnerable to Open Redirect CVE-2022-25295, GHSA-hvw3-p9px-gpc9, GO-2022-0987 | Medium | 0.7% | 12 Sep, 2022 | Go github.com/gophish/gophish |
Casdoor arbitrary file write vulnerability CVE-2022-38638, GHSA-9vm3-r8gq-cr6x, GO-2022-1006, PYSEC-2022-43190 | Critical | 1.3% | 09 Sep, 2022 | Go github.com/casdoor/casdoor PyPI casdoor |
Harbor fails to validate the user permissions when reading job execution logs through the P2P preheat execution logs BIT-harbor-2022-31671, CVE-2022-31671, GHSA-q76q-q8hw-hmpw | Medium | 0.5% | 09 Sep, 2022 | Go github.com/goharbor/harbor |
x/crypto/ssh vulnerable to panic via malformed packets CVE-2021-43565, GHSA-gwc9-m7rh-j2ww, GO-2022-0968 | High | 1.2% | 07 Sep, 2022 | Go golang.org/x/crypto |
golang.org/x/net/http2 Denial of Service vulnerability BIT-golang-2022-27664, CVE-2022-27664, GHSA-69cg-p879-7622, GO-2022-0969 | High | 3.5% | 07 Sep, 2022 | Go golang.org/x/net Go golang.org/x/net/http2 Go stdlib |
Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing GHSA-74fp-r6jw-h4mp, GO-2022-0965 | High | Not scored | 02 Sep, 2022 | Go k8s.io/apimachinery |
Binary vulnerable to Slice Memory Allocation with Excessive Size Value CVE-2022-36078, GHSA-4p6f-m4f9-ch88, GO-2022-0963 | High | 1.2% | 02 Sep, 2022 | Go github.com/gagliardetto/binary |
elrond-go MultiESDTNFTTransfer call on a SC address with missing function name CVE-2022-36058, GHSA-qf7j-25g9-r63f, GO-2022-0970 | High | 1.3% | 01 Sep, 2022 | Go github.com/ElrondNetwork/elrond-go |
Pinniped Supervisor Insufficient Session Expiration vulnerability BIT-pinniped-2022-31677, CVE-2022-31677, GHSA-rp4v-hhm6-rcv9, GO-2022-0981 | Medium | 0.5% | 01 Sep, 2022 | Go go.pinniped.dev |
Flux CLI Workload Injection BIT-flux-2022-36035, CVE-2022-36035, GHSA-xwf3-6rgv-939r, GO-2022-0960 | High | 0.3% | 01 Sep, 2022 | Go github.com/fluxcd/flux2 |
Broken Authorization in ZITADEL Actions CVE-2022-36051, GHSA-c8fj-4pm8-mp2c | High | 1.0% | 30 Aug, 2022 | Go github.com/zitadel/zitadel |
Helm Vulnerable to denial of service through string value parsing BIT-helm-2022-36055, CVE-2022-36055, GHSA-7hfp-qfw3-5jxh, GO-2022-0962 | Medium | 1.1% | 30 Aug, 2022 | Go helm.sh/helm/v3 |
Network Policies & (Clusterwide) Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels GHSA-pfhr-pccp-hwmh, GO-2022-0959 | Medium | Not scored | 30 Aug, 2022 | Go github.com/cilium/cilium |
yaml package for Go can consume excessive amounts of CPU or memory CVE-2022-3064, GHSA-6q6q-88xp-6f2r, GO-2022-0956 | High | 1.9% | 29 Aug, 2022 | Go gopkg.in/yaml.v2 |
Improper token validation leading to code execution in Teleport CVE-2022-36633, GHSA-6xf3-5hp7-xqqg | High | 50.3% | 25 Aug, 2022 | Go github.com/gravitational/teleport |
gomatrixserverlib and Dendrite vulnerable to incorrect parsing of the event default power level in event auth CVE-2022-36009, GHSA-grvv-h2f9-7v9c, GO-2022-0952 | Medium | 0.9% | 22 Aug, 2022 | Go github.com/matrix-org/dendrite Go github.com/matrix-org/gomatrixserverlib |
Ethermint vulnerable to DoS through unintended Contract Selfdestruct CVE-2022-35936, GHSA-f92v-grc2-w2fg, GO-2022-0760 | High | 1.5% | 18 Aug, 2022 | Go github.com/Kava-Labs/kava Go github.com/crypto-org-chain/cronos Go github.com/evmos/ethermint Go github.com/evmos/evmos +7 more |
Duplicate Advisory: KubeVirt arbitrary host file read from the VM CVE-2022-1798, GHSA-cvx8-ppmc-78hm, GHSA-qv98-3369-g364, GO-2022-1000 | High | 0.4% | 18 Aug, 2022 | Go kubevirt.io/kubevirt |
HashiCorp Consul Template could reveal Vault secret contents in error messages CVE-2022-38149, GHSA-8449-7gc2-pwrp, GO-2022-0980 | High | 0.9% | 18 Aug, 2022 | Go github.com/hashicorp/consul-template |
Gitea allowed assignment of private issues BIT-gitea-2022-38183, CVE-2022-38183, GHSA-fhv8-m4j4-cww2, GO-2024-2769 | Medium | 0.9% | 13 Aug, 2022 | Go code.gitea.io/gitea |
Cronos vulnerable to DoS through unintended Contract Selfdestruct GHSA-gwj5-wp6r-5q9f, GO-2022-0829 | High | Not scored | 11 Aug, 2022 | Go github.com/crypto-org-chain/cronos |
cosign's `cosign verify-attestaton --type` can report a false positive if any attestation exists BIT-cosign-2022-35929, CVE-2022-35929, GHSA-vjxv-45g9-9296, GO-2022-0758 | High | 0.7% | 10 Aug, 2022 | Go github.com/sigstore/cosign |
PolicyController before 0.2.1 may bypass attestation verification CVE-2022-35930, GHSA-739f-hw6h-7wq8, GO-2022-0759 | High | 0.7% | 10 Aug, 2022 | Go github.com/sigstore/policy-controller |
Remote command execution via "go get" command with "-insecure" option in cmd/go CVE-2018-7187, GO-2022-0203 | 63.0% | 09 Aug, 2022 | Go toolchain | |
Remote command execution via "go get" command with cgo in cmd/go CVE-2018-6574, GO-2022-0201 | 7.6% | 09 Aug, 2022 | Go toolchain | |
Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks CVE-2022-37450, GHSA-rqmg-hrg4-fm69 | Medium | 1.3% | 06 Aug, 2022 | Go github.com/ethereum/go-ethereum |
graphql-go has infinite recursion in the type definition parser CVE-2022-37315, GHSA-h3qm-jrrf-cgj3, GO-2022-0942 | High | 1.2% | 02 Aug, 2022 | Go github.com/graphql-go/graphql |
Panic when decoding Float and Rat types in math/big BIT-golang-2022-32189, CVE-2022-32189, GO-2022-0537 | 2.8% | 01 Aug, 2022 | Go stdlib | |
Incorrect access control in the go command in cmd/go/internal/modfetch BIT-golang-2022-23773, CVE-2022-23773, GO-2022-0318 | 2.7% | 01 Aug, 2022 | Go toolchain | |
Atlantis Events vulnerable to Timing Attack CVE-2022-24912, GHSA-jxqv-jcvh-7gr4, GO-2022-0534 | High | 1.2% | 30 Jul, 2022 | Go github.com/runatlantis/atlantis |
Path traversal via Clean on Windows in path/filepath BIT-golang-2022-29804, CVE-2022-29804, GO-2022-0533 | 2.4% | 28 Jul, 2022 | Go stdlib | |
Session tickets lack random ticket_age_add in crypto/tls BIT-golang-2022-30629, CVE-2022-30629, GO-2022-0531 | 1.2% | 28 Jul, 2022 | Go stdlib | |
Arbitrary code execution via the go command with cgo in cmd/go BIT-golang-2020-28367, CVE-2020-28367, GO-2022-0476 | 2.4% | 28 Jul, 2022 | Go toolchain | |
Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo BIT-golang-2020-28366, CVE-2020-28366, GO-2022-0475 | 2.3% | 28 Jul, 2022 | Go toolchain | |
Exposure of client IP addresses in net/http BIT-golang-2022-32148, CVE-2022-32148, GO-2022-0520 | 1.5% | 28 Jul, 2022 | Go stdlib | |
Empty Cmd.Path can trigger unintended binary in os/exec on Windows BIT-golang-2022-30580, CVE-2022-30580, GO-2022-0532 | 0.7% | 26 Jul, 2022 | Go stdlib | |
Improper sanitization of Transfer-Encoding headers in net/http BIT-golang-2022-1705, CVE-2022-1705, GO-2022-0525 | 1.5% | 25 Jul, 2022 | Go stdlib | |
Stack exhaustion in Glob on certain paths in io/fs BIT-golang-2022-30630, CVE-2022-30630, GO-2022-0527 | 2.2% | 20 Jul, 2022 | Go stdlib |