Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Stack exhaustion when decoding certain messages in encoding/gob BIT-golang-2022-30635, CVE-2022-30635, GO-2022-0526 | 1.9% | 20 Jul, 2022 | Go stdlib | |
Stack exhaustion when reading certain archives in compress/gzip BIT-golang-2022-30631, CVE-2022-30631, GO-2022-0524 | 2.2% | 20 Jul, 2022 | Go stdlib | |
Stack exhaustion when unmarshaling certain documents in encoding/xml BIT-golang-2022-30633, CVE-2022-30633, GO-2022-0523 | 2.2% | 20 Jul, 2022 | Go stdlib | |
Stack exhaustion on crafted paths in path/filepath BIT-golang-2022-30632, CVE-2022-30632, GO-2022-0522 | 2.2% | 20 Jul, 2022 | Go stdlib | |
Stack exhaustion from deeply nested XML documents in encoding/xml BIT-golang-2022-28131, CVE-2022-28131, GO-2022-0521 | 2.6% | 20 Jul, 2022 | Go stdlib | |
Stack exhaustion due to deeply nested types in go/parser BIT-golang-2022-1962, CVE-2022-1962, GO-2022-0515 | 0.9% | 20 Jul, 2022 | Go stdlib | |
Shoutrrr util package DoS via sending 2000, 4000, or 6000 character messages CVE-2022-25891, GHSA-477v-w82m-634j, GO-2022-0528, SNYK-GOLANG-GITHUBCOMCONTAINRRRSHOUTRRRPKGUTIL-2849059 | High | 1.6% | 16 Jul, 2022 | Go github.com/containrrr/shoutrrr |
go.uuid has Predictable UUID Identifiers CVE-2021-3538, GHSA-33m6-q9v5-62r7, GO-2022-0244 | Critical | 2.3% | 15 Jul, 2022 | Go github.com/satori/go.uuid |
Cilium host policy bypass in endpoint-routes mode with dual-stack GHSA-wc5v-r48v-g4vh | Low | Not scored | 15 Jul, 2022 | Go github.com/cilium/cilium |
FlyteAdmin Insufficient AccessToken Expiration Check CVE-2022-31145, GHSA-qwrj-9hmp-gpxh, GO-2022-0519 | Medium | 1.0% | 15 Jul, 2022 | Go github.com/flyteorg/flyteadmin |
Mattermost users could access some sensitive information via API call BIT-mattermost-2022-2401, CVE-2022-2401, GHSA-7ggc-5r84-xf54, GO-2022-0540 | Medium | 0.8% | 15 Jul, 2022 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9 CVE-2022-2385, GHSA-pp3f-98qg-5g75, GO-2022-0547 | High | 1.1% | 13 Jul, 2022 | Go sigs.k8s.io/aws-iam-authenticator |
Argo CD SSO users vulnerable to Cross-site Scripting CVE-2022-31102, GHSA-pmjg-52h9-72qv, GO-2022-0517 | Low | 0.6% | 12 Jul, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Argo CD certificate verification is skipped for connections to OIDC providers CVE-2022-31105, GHSA-7943-82jg-wmw5, GO-2022-0518 | High | 0.8% | 12 Jul, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
DoS in KubeEdge's Websocket Client in package Viaduct CVE-2022-31080, GHSA-6wvc-6pww-qr4r, GO-2022-0512 | Medium | 0.7% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
KubeEdge Cloud Stream and Edge Stream DoS from large stream message CVE-2022-31079, GHSA-wrcr-x4qj-j543, GO-2022-0511 | Medium | 0.7% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
KubeEdge CloudCore Router memory exhaustion vulnerability CVE-2022-31078, GHSA-qpx3-9565-5xwm, GO-2022-0510 | Medium | 0.7% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
KubeEdge DoS when signing the CSR from EdgeCore CVE-2022-31075, GHSA-x3px-2p95-f6jr, GO-2022-0509 | Medium | 1.0% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
KubeEdge Cloud AdmissionController component DoS CVE-2022-31074, GHSA-w52j-3457-q9wr, GO-2022-0508 | Medium | 0.8% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
KubeEdge Edge ServiceBus module DoS CVE-2022-31073, GHSA-vwm6-qc77-v2rh, GO-2022-0507 | Medium | 1.7% | 11 Jul, 2022 | Go github.com/kubeedge/kubeedge |
Hyperledger Fabric vulnerable to Improper Input Validation in orderer/common/cluster consensus request BIT-hyperledger-fabric-orderer-2022-31121, BIT-hyperledger-fabric-peer-2022-31121, BIT-hyperledger-fabric-tools-2022-31121, CVE-2022-31121, GHSA-72x4-cq6r-jp4p | High | 2.1% | 08 Jul, 2022 | Go github.com/hyperledger/fabric |
Insecure cookies in Openshift Origin CVE-2015-3207, GHSA-rqph-25q9-9jhp, GO-2022-0505 | Medium | 0.8% | 07 Jul, 2022 | Go github.com/openshift/origin |
DOS and excessive memory usage when passing untrusted user input to to dag import GHSA-f2gr-7299-487h | Medium | Not scored | 06 Jul, 2022 | Go github.com/ipfs/go-ipfs |
Malformed CAR panics and excessive memory usage GHSA-9x4h-8wgm-8xfg, GO-2022-0503 | Medium | Not scored | 06 Jul, 2022 | Go github.com/ipld/go-car Go github.com/ipld/go-car/v2 |
Insufficient Session Expiration in Nakama CVE-2022-2306, GHSA-xv59-gc3r-rf92 | High | 0.9% | 06 Jul, 2022 | Go github.com/heroiclabs/nakama |
Path Traversal in Beego CVE-2022-31836, GHSA-95f9-94vc-665h, GO-2022-0569 | Critical | 1.7% | 06 Jul, 2022 | Go github.com/astaxie/beego Go github.com/beego/beego Go github.com/beego/beego/v2 |
Improper Restriction of Excessive Authentication Attempts CVE-2022-2321, GHSA-8r94-4h3c-939f | Critical | 1.6% | 06 Jul, 2022 | Go github.com/heroiclabs/nakama/v3 |
Incorrect parsing validation in net/url CVE-2019-14809, GO-2022-0211 | 8.4% | 01 Jul, 2022 | Go stdlib | |
Denial of service in Open Policy Agent CVE-2022-33082, GHSA-2m4x-4q9j-w97g, GO-2022-0574 | High | 1.7% | 01 Jul, 2022 | Go github.com/open-policy-agent/opa |
CloudCore UDS Server: Malicious Message can crash CloudCore CVE-2022-31076, GHSA-8f4f-v9x5-cg6j, GO-2022-0500 | Medium | 0.6% | 25 Jun, 2022 | Go github.com/kubeedge/kubeedge |
Path traversal mitigation bypass in OctoRPKI GHSA-3jhm-87m6-x959, GO-2022-0496 | High | Not scored | 25 Jun, 2022 | Go github.com/cloudflare/cfrpki |
CloudCore CSI Driver: Malicious response from KubeEdge can crash CSI Driver controller server CVE-2022-31077, GHSA-x938-fvfw-7jh5, GO-2022-0501 | Medium | 0.8% | 25 Jun, 2022 | Go github.com/kubeedge/kubeedge |
Query predicate bypass in Zalando Skipper CVE-2022-34296, GHSA-qx2j-85q5-ffp8, GO-2022-0494 | High | 1.1% | 24 Jun, 2022 | Go github.com/zalando/skipper |
golang.org/x/sys/unix has Incorrect privilege reporting in syscall BIT-golang-2022-29526, CVE-2022-29526, GHSA-p782-xgp4-8hr8, GO-2022-0493 | Medium | 3.0% | 24 Jun, 2022 | Go golang.org/x/sys Go stdlib |
Weave GitOps leaked cluster credentials into logs on connection errors CVE-2022-31098, GHSA-xggc-qprg-x6mw, GO-2022-0502 | Critical | 1.3% | 23 Jun, 2022 | Go github.com/weaveworks/weave-gitops |
DoS through large manifest files in Argo CD CVE-2022-31016, GHSA-jhqp-vf4w-rpwq, GO-2022-0495 | Medium | 0.9% | 21 Jun, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server CVE-2022-31036, GHSA-q4w5-4gq2-98vm, GO-2022-0499 | Medium | 0.9% | 21 Jun, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Argo CD's external URLs for Deployments can include JavaScript CVE-2022-31035, GHSA-h4w9-6x78-8vrj, GO-2022-0498 | Critical | 1.0% | 21 Jun, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params CVE-2022-31034, GHSA-2m7h-86qq-fp4v, GO-2022-0497 | High | 1.0% | 21 Jun, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Configuration API in EdgeXFoundry 2.1.0 and earlier exposes message bus credentials to local unauthenticated users CVE-2022-31066, GHSA-g63h-q855-vp3q, GO-2022-0491 | Medium | 0.3% | 17 Jun, 2022 | Go github.com/edgexfoundry/app-functions-sdk-go Go github.com/edgexfoundry/app-functions-sdk-go/v2 Go github.com/edgexfoundry/device-sdk-go Go github.com/edgexfoundry/device-sdk-go/v2 |
Insecure path traversal in Git Trigger Source can lead to arbitrary file read CVE-2022-25856, GHSA-qpgx-64h2-gc3c, GO-2022-0492, SNYK-GOLANG-GITHUBCOMARGOPROJARGOEVENTSSENSORSARTIFACTS-2864522 | High | 1.9% | 17 Jun, 2022 | Go github.com/argoproj/argo-events |
Uses of deprecated API can be used to cause DoS in user-facing endpoints CVE-2022-31054, GHSA-5q86-62xr-3r57, GO-2022-0490 | High | 1.6% | 17 Jun, 2022 | Go github.com/argoproj/argo-events |
Signature forgery in Biscuit CVE-2022-31053, GHSA-75rw-34q6-72cr, GO-2022-0564, HSEC-2023-0002 | Critical | 1.0% | 17 Jun, 2022 | Go github.com/biscuit-auth/biscuit-go Maven com.clever-cloud:biscuit-java crates.io biscuit-auth |
Ill-formed headers may lead to unexpected behavior in Istio CVE-2022-31045, GHSA-xwx5-5c9g-x68x | Medium | 1.2% | 10 Jun, 2022 | Go istio.io/istio |
Indefinite hang with large buffers on Windows in crypto/rand BIT-golang-2022-30634, CVE-2022-30634, GO-2022-0477 | 2.3% | 09 Jun, 2022 | Go stdlib | |
Authorization Bypass Through User-Controlled Key in go-restful CVE-2022-1996, GHSA-r48q-9g5r-8q2h, GO-2022-0619 | Critical | 3.1% | 09 Jun, 2022 | Go github.com/emicklei/go-restful Go github.com/emicklei/go-restful/v2 Go github.com/emicklei/go-restful/v3 |
Path Traversal in Git HTTP endpoints in Gogs CVE-2022-1993, GHSA-6vcc-v9vw-g2x5, GO-2022-0562 | High | 36.7% | 08 Jun, 2022 | Go gogs.io/gogs |
OS Command Injection in file editor in Gogs CVE-2022-1986, GHSA-67mx-jc2f-jgjm, GO-2022-0556 | Critical | 4.2% | 08 Jun, 2022 | Go gogs.io/gogs |
Cross-site Scripting vulnerability in repository issue list in Gogs CVE-2022-31038, GHSA-xq4v-vrp9-vcf2, GO-2022-0483 | Medium | 0.7% | 08 Jun, 2022 | Go gogs.io/gogs |
Path Traversal in file editor on Windows in Gogs CVE-2022-1992, GHSA-994f-7g86-qr56, GO-2022-0570 | Critical | 2.3% | 08 Jun, 2022 | Go gogs.io/gogs |