Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Calico vulnerable to pod route hijacking CVE-2022-28224, GHSA-9394-xfq9-6qrp | Medium | 0.6% | 07 Jun, 2022 | Go github.com/projectcalico/calico |
containerd CRI plugin: Host memory exhaustion through ExecSync CVE-2022-31030, GHSA-5ffw-gxpp-mxpf, GO-2022-0482 | Medium | 0.4% | 06 Jun, 2022 | Go github.com/containerd/containerd |
Node DOS by way of memory exhaustion through ExecSync request in CRI-O CVE-2022-1708, GHSA-fcm2-6c3h-pg6j, GO-2022-0480 | High | 3.2% | 06 Jun, 2022 | Go github.com/cri-o/cri-o |
TiDB authentication bypass vulnerability CVE-2022-31011, GHSA-4whx-7p29-mq22 | High | 0.3% | 06 Jun, 2022 | Go github.com/pingcap/tidb |
Missing Role Based Access Control for the REST handlers in bleve/http package CVE-2022-31022, GHSA-9w9f-6mg8-jp7w, GO-2022-0470 | Medium | 0.3% | 03 Jun, 2022 | Go github.com/blevesearch/bleve Go github.com/blevesearch/bleve/v2 |
Server-Side Request Forgery in gogs webhook CVE-2022-1285, GHSA-w689-557m-2cvq, GO-2022-0583 | High | 1.1% | 03 Jun, 2022 | Go gogs.io/gogs |
Privilege escalation in Hashicorp Nomad CVE-2022-30324, GHSA-526x-rm7j-v389, GO-2022-0732 | Critical | 1.4% | 03 Jun, 2022 | Go github.com/hashicorp/nomad |
Uncontrolled Resource Consumption in Mattermost server BIT-mattermost-2022-1982, CVE-2022-1982, GHSA-gwpf-95jc-63rv | Medium | 0.9% | 03 Jun, 2022 | Go github.com/mattermost/mattermost-server |
Open redirect in caddy CVE-2022-29718, GHSA-2927-hv3p-f3vp | Medium | 1.1% | 03 Jun, 2022 | Go github.com/caddyserver/caddy Go github.com/caddyserver/caddy/v2 |
OS Command Injection in gogs CVE-2021-32546, GHSA-56j7-2pm8-rgmx, GO-2022-0471 | Critical | 2.2% | 02 Jun, 2022 | Go gogs.io/gogs |
OS Command Injection in gogs CVE-2022-1884, GHSA-958j-443g-7mm7, GO-2022-0749 | Critical | 1.8% | 02 Jun, 2022 | Go gogs.io/gogs |
Cross site scripting via cookies in gogs GHSA-pj96-4jhv-v792, GO-2022-0473 | Low | Not scored | 02 Jun, 2022 | Go gogs.io/gogs |
Stored Cross-site Scripting in gitea BIT-gitea-2022-1928, CVE-2022-1928, GHSA-ph3w-2843-72mx, GO-2022-0612 | Medium | 0.8% | 30 May, 2022 | Go code.gitea.io/gitea |
Arbitrary command execution in Minidoc CVE-2022-29637, GHSA-f7ff-xf87-f22q | High | 0.9% | 27 May, 2022 | Go github.com/mindoc-org/mindoc |
HashiCorp go-getter unsafe downloads could lead to asymmetric resource exhaustion CVE-2022-26945, CVE-2022-30321, CVE-2022-30322, CVE-2022-30323, GHSA-28r2-q6m8-9hpx, GHSA-cjr4-fv6c-f3mv, GHSA-fcgg-rvwg-jv58, GHSA-x24g-9w7v-vprh, GO-2022-0586 | Critical | 3.1% | 26 May, 2022 | Go github.com/hashicorp/go-getter Go github.com/hashicorp/go-getter/gcs/v2 Go github.com/hashicorp/go-getter/s3/v2 Go github.com/hashicorp/go-getter/v2 |
Path traversal in ginadmin CVE-2022-30427, GHSA-9pg5-3pjc-f8wm | High | 1.5% | 26 May, 2022 | Go github.com/gphper/ginadmin |
Arbitrary file read in ginadmin CVE-2022-30428, GHSA-5824-6jfv-xr3r | High | 1.1% | 26 May, 2022 | Go github.com/gphper/ginadmin |
Ignition config accessible to unprivileged software on VMware CVE-2022-1706, GHSA-hj57-j5cw-2mwp, GO-2022-0451 | Medium | 1.3% | 25 May, 2022 | Go github.com/coreos/ignition Go github.com/coreos/ignition/v2 |
Pion/DLTS Accepts Client Certificates Without CertificateVerify CVE-2022-29222, GHSA-w45j-f832-hxvh, GO-2022-0462 | Medium | 0.8% | 25 May, 2022 | Go github.com/pion/dtls Go github.com/pion/dtls/v2 |
NULL Pointer Dereference in HyperLedger Fabric CVE-2021-43667, GHSA-vjj6-5m9f-wqjw | High | 1.3% | 25 May, 2022 | Go github.com/hyperledger/fabric |
DLL injection on Windows in runtime and syscall CVE-2019-9634, GO-2022-0220 | 3.1% | 25 May, 2022 | Go stdlib | |
Pion DTLS Header reconstruction method can be thrown into an infinite loop CVE-2022-29190, GHSA-cm8f-h6j3-p25c, GO-2022-0460 | High | 1.7% | 24 May, 2022 | Go github.com/pion/dtls Go github.com/pion/dtls/v2 |
Pion/DTLS contains buffer for inbound DTLS fragments with no limit CVE-2022-29189, GHSA-cx94-mrg9-rq4j, GO-2022-0461 | Medium | 2.1% | 24 May, 2022 | Go github.com/pion/dtls Go github.com/pion/dtls/v2 |
Smokescreen SSRF via deny list bypass (square brackets) CVE-2022-29188, GHSA-qwrf-gfpj-qvj6, GO-2022-0459 | Medium | 0.9% | 24 May, 2022 | Go github.com/stripe/smokescreen |
gitjacker arbitrary code execution CVE-2021-29417, GHSA-4j5x-f394-xx79, GO-2023-1911 | Critical | 3.8% | 24 May, 2022 | Go github.com/liamg/gitjacker |
openark/orchestrator cross-site scripting vulnerability CVE-2021-27940, GHSA-752c-vfpf-cp2w | Medium | 1.2% | 24 May, 2022 | Go github.com/openark/orchestrator |
Token leases could outlive their TTL in HashiCorp Vault BIT-vault-2020-25816, CVE-2020-25816, GHSA-57gg-cj55-q5g2, GO-2024-2514 | Critical | 1.0% | 24 May, 2022 | Go github.com/hashicorp/vault |
Helm Unsafe Link Following CVE-2019-18658, GHSA-p5pc-m4q7-7qm9, GO-2023-1938 | Critical | 1.7% | 24 May, 2022 | Go helm.sh/helm |
Istio vulnerable to denial of service CVE-2019-18817, GHSA-vc7h-cmp3-4hw5 | High | 1.2% | 24 May, 2022 | Go istio.io/istio |
Improper Privilege Management in Cilium BIT-cilium-2022-29179, BIT-cilium-operator-2022-29179, BIT-cilium-proxy-2022-29179, BIT-hubble-2022-29179, BIT-hubble-relay-2022-29179, BIT-hubble-ui-2022-29179, BIT-hubble-ui-backend-2022-29179, CVE-2022-29179, GHSA-fmrf-gvjp-5j5g, GO-2022-0458 | High | 0.4% | 24 May, 2022 | Go github.com/cilium/cilium |
Access to Unix domain socket can lead to privileges escalation in Cilium BIT-cilium-2022-29178, BIT-cilium-operator-2022-29178, BIT-cilium-proxy-2022-29178, BIT-hubble-2022-29178, BIT-hubble-relay-2022-29178, BIT-hubble-ui-2022-29178, BIT-hubble-ui-backend-2022-29178, CVE-2022-29178, GHSA-6p8v-8cq8-v2r3, GO-2022-0457 | High | 0.3% | 24 May, 2022 | Go github.com/cilium/cilium |
Server-Side Request Forgery in charm CVE-2022-29180, GHSA-4wpp-w5r4-7v5v, GO-2022-0449 | Critical | 0.8% | 24 May, 2022 | Go github.com/charmbracelet/charm |
DoS via malicious p2p message in Go Ethereum CVE-2022-29177, GHSA-wjxw-gh3m-7pm5, GO-2022-0456 | Medium | 1.2% | 24 May, 2022 | Go github.com/ethereum/go-ethereum |
Improper Validation of Integrity Check Value in go-tuf CVE-2022-29173, GHSA-66x3-6cw3-v5gj, GO-2022-0444 | High | 0.6% | 24 May, 2022 | Go github.com/theupdateframework/go-tuf |
Cross-site Scripting in Gogs CVE-2022-1464, GHSA-ff28-f46g-r9g8, GO-2022-0597 | Medium | 0.7% | 24 May, 2022 | Go gogs.io/gogs |
Argo CD will blindly trust JWT claims if anonymous access is enabled CVE-2022-29165, GHSA-r642-gv9p-2wjj, GO-2022-0455 | Critical | 2.1% | 24 May, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Buffer overflow in WASM modules in misc/wasm and cmd/link BIT-golang-2021-38297, CVE-2021-38297, GO-2022-0247 | 11.0% | 24 May, 2022 | Go toolchain | |
Panic on invalid DSA public keys in crypto/dsa CVE-2019-17596, GO-2022-0213 | 4.7% | 24 May, 2022 | Go stdlib | |
Apache Traffic Control Traffic Ops Vulnerable to LDAP Injection CVE-2021-43350, GHSA-mg2c-rc36-p594, GO-2024-2776 | Critical | 4.8% | 24 May, 2022 | Go github.com/apache/trafficcontrol |
golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion BIT-golang-2021-31525, CVE-2021-31525, GHSA-h86h-8ppg-mxmh, GO-2022-0236 | Medium | 3.7% | 24 May, 2022 | Go golang.org/x/net Go stdlib |
HashiCorp Consul Cross-site Scripting vulnerability BIT-consul-2020-25864, CVE-2020-25864, GHSA-8xmx-h8rq-h94j, GO-2023-1851 | Medium | 6.1% | 24 May, 2022 | Go github.com/hashicorp/consul |
MongoDB Tools Improper Certificate Validation vulnerability CVE-2020-7924, GHSA-6cwm-wm82-hgrw, GO-2024-2550 | Medium | 0.7% | 24 May, 2022 | Go github.com/mongodb/mongo-tools |
Rancher Cross-site Scripting Vulnerability CVE-2021-25313, GHSA-6m8r-jh89-rq7h | Medium | 1.5% | 24 May, 2022 | Go github.com/rancher/rancher |
Kubernetes Secrets Store CSI Driver plugins arbitrary file write CVE-2020-8567, GHSA-2v35-wj4r-rcmv, GO-2024-2750 | Low | 1.5% | 24 May, 2022 | Go github.com/Azure/secrets-store-csi-driver-provider-azure Go github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp Go github.com/hashicorp/vault-csi-provider |
Default inheritable capabilities for linux container should be empty CVE-2022-29162, GHSA-f3fp-gc8g-vw66, GO-2022-0452 | Medium | 0.4% | 24 May, 2022 | Go github.com/opencontainers/runc |
Heketi logs sensitive information CVE-2020-10763, GHSA-rm7c-x6gj-2mr8 | Medium | 0.4% | 24 May, 2022 | Go github.com/heketi/heketi |
Grafana XSS via a query alias for the ElasticSearch datasource BIT-grafana-2020-24303, CVE-2020-24303, GHSA-mvpr-q6rh-8vrp, GO-2024-2520 | Medium | 2.1% | 24 May, 2022 | Go github.com/grafana/grafana |
Gophish vulnerable to Server-Side Request Forgery CVE-2020-24710, GHSA-9c9w-9pq7-f35h, GO-2023-1982 | Medium | 1.3% | 24 May, 2022 | Go github.com/gophish/gophish |
ingress-nginx component for Kubernetes allows file overwrite CVE-2020-8553, GHSA-hhpm-74pm-hf35 | Medium | 0.9% | 24 May, 2022 | Go k8s.io/ingress-nginx |
Grafana stored XSS BIT-grafana-2020-11110, CVE-2020-11110, GHSA-xr3x-62qw-vc4w, GO-2024-2523 | Medium | 9.6% | 24 May, 2022 | Go github.com/grafana/grafana |