Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Incorrect Permission Assignment for Critical Resource in Singularity CVE-2019-11328, GHSA-557g-r22w-9wvx | High | 2.1% | 20 Dec, 2021 | Go github.com/sylabs/singularity |
"Verify All" Returns Success Despite Validation Failures in Singularity CVE-2020-13846, GHSA-6w7g-p4jh-rf92 | High | 1.3% | 20 Dec, 2021 | Go github.com/sylabs/singularity |
Execution Control List (ECL) Is Insecure in Singularity CVE-2020-13845, GHSA-pmfr-63c2-jr5c | High | 0.5% | 20 Dec, 2021 | Go github.com/sylabs/singularity |
devices resource list treated as a blacklist by default GHSA-g54h-m393-cpwq, GO-2022-0396 | Low | Not scored | 20 Dec, 2021 | Go github.com/opencontainers/runc |
Signature verification failure in Tendermint GHSA-f3w5-v9xx-rp8p | Medium | Not scored | 20 Dec, 2021 | Go github.com/tendermint/tendermint |
Open redirect vulnerability in Sourcegraph CVE-2020-12283, GHSA-mx43-r985-5h4m | Medium | 1.3% | 20 Dec, 2021 | Go github.com/sourcegraph/sourcegraph |
The pattern '/\domain.com' is not disallowed when redirecting, allowing for open redirect BIT-oauth2-proxy-2020-5233, CVE-2020-5233, GHSA-qqxw-m5fj-f7gv | Medium | 1.3% | 20 Dec, 2021 | Go github.com/oauth2-proxy/oauth2-proxy |
Open Redirect in OAuth2 Proxy BIT-oauth2-proxy-2020-11053, CVE-2020-11053, GHSA-j7px-6hwj-hpjg | High | 0.8% | 20 Dec, 2021 | Go github.com/oauth2-proxy/oauth2-proxy |
Open Redirect in OAuth2 Proxy BIT-oauth2-proxy-2020-4037, CVE-2020-4037, GHSA-5m6c-jp6f-2vcv | Medium | 0.9% | 20 Dec, 2021 | Go github.com/oauth2-proxy/oauth2-proxy |
GitLab auth uses full name instead of username as user ID, allowing impersonation BIT-concourse-2020-5415, CVE-2020-5415, GHSA-627p-rr78-99rj | High | 1.2% | 20 Dec, 2021 | Go github.com/concourse/concourse Go github.com/concourse/dex |
Authentication Bypass in dex CVE-2020-26290, CVE-2020-27847, GHSA-2x32-jm95-2cpx, GHSA-m9hp-7r99-94h5 | Critical | 1.7% | 20 Dec, 2021 | Go github.com/dexidp/dex Go github.com/russellhaering/goxmldsig |
Authelia vulnerable to an authentication bypassed with malformed request URI on nginx CVE-2021-32637, GHSA-68wm-pfjf-wqp6 | Critical | 1.9% | 20 Dec, 2021 | Go github.com/authelia/authelia/v4 |
Withdrawn Advisory: Infinite loop in xz BIT-golang-2020-16845, CVE-2020-16845, GHSA-q6gq-997w-f55g, GO-2021-0142 | High | 4.9% | 16 Dec, 2021 | Go github.com/ulikunitz/xz Go stdlib |
Unsafe inline XSS in pasting DOM element into chat CVE-2021-39183, GHSA-2hfj-cxw7-g45p, GO-2022-0291 | High | 0.8% | 14 Dec, 2021 | Go github.com/owncast/owncast |
Improper Authentication in HashiCorp Nomad CVE-2021-43415, GHSA-2jhh-5xm2-j4gf, GO-2022-0573 | High | 1.2% | 10 Dec, 2021 | Go github.com/hashicorp/nomad |
Observable Discrepancy in Argo BIT-argo-cd-2020-11576, CVE-2020-11576, GHSA-vj54-cjrx-x696, GO-2022-0882 | Medium | 2.0% | 09 Dec, 2021 | Go github.com/argoproj/argo-cd |
Instance config inline secret exposure in Grafana CVE-2021-41090, GHSA-9c4x-5hgq-q3wh, GO-2022-0305 | Medium | 0.8% | 08 Dec, 2021 | Go github.com/grafana/agent |
Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration in RunC CVE-2021-43784, GHSA-v95c-p5hm-xq8f, GO-2022-0274 | Medium | 1.8% | 07 Dec, 2021 | Go github.com/opencontainers/runc |
Grafana path traversal BIT-grafana-2021-43798, CVE-2021-43798, GHSA-8pjx-jj86-j47p | HighExploited | 88.5% | 07 Dec, 2021 | Go github.com/grafana/grafana |
HTTP Request Smuggling in github.com/hyperledger/fabric CVE-2021-43669, GHSA-j96p-r523-8r3w | High | 1.1% | 03 Dec, 2021 | Go github.com/hyperledger/fabric |
HashiCorp Vault Incorrect Permission Assignment for Critical Resource BIT-vault-2021-43998, CVE-2021-43998, GHSA-pfmw-vj74-ph8g, GO-2022-0611 | Critical | 1.0% | 02 Dec, 2021 | Go github.com/hashicorp/vault |
Cross-site Scripting in github.com/schollz/rwtxt CVE-2021-20848, GHSA-458f-26r3-x2c3, GO-2022-0231 | Medium | 0.9% | 29 Nov, 2021 | Go github.com/schollz/rwtxt |
Denial of Service in Go-Ethereum CVE-2021-43668, GHSA-5m8f-chrv-7rw5 | Medium | 0.3% | 23 Nov, 2021 | Go github.com/ethereum/go-ethereum |
Broken encryption in EdgeX Foundry CVE-2021-41278, GHSA-6c7m-qwxj-mvhp | Medium | 0.4% | 19 Nov, 2021 | Go github.com/edgexfoundry/app-functions-sdk-go Go github.com/edgexfoundry/app-functions-sdk-go/v2 Go github.com/edgexfoundry/app-service-configurable |
Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki CVE-2021-3978, GHSA-3pqh-p72c-fj85, GO-2022-0580 | High | 0.1% | 19 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Clarify Content-Type handling CVE-2021-41190, GHSA-mc8v-mgrf-8f4m | Low | 2.2% | 18 Nov, 2021 | Go github.com/opencontainers/distribution-spec |
Ambiguous OCI manifest parsing GHSA-5j5w-g665-5m35, GO-2022-0360 | Low | Not scored | 18 Nov, 2021 | Go github.com/containerd/containerd |
Clarify `mediaType` handling GHSA-77vh-xpmg-72qh | Low | Not scored | 18 Nov, 2021 | Go github.com/opencontainers/image-spec |
Authentication bypass issue in the Operator Console CVE-2021-41266, GHSA-4999-659w-mq36, GO-2022-0261 | High | 48.1% | 15 Nov, 2021 | Go github.com/minio/console |
Privilege escalation to cluster admin on multi-tenant environments BIT-kustomize-2021-41254, CVE-2021-41254, GHSA-35rf-v2jv-gfg7, GO-2022-0260 | High | 1.8% | 15 Nov, 2021 | Go github.com/fluxcd/kustomize-controller |
OctoRPKI crashes when processing GZIP bomb returned via malicious repository CVE-2021-3912, GHSA-g9wh-3vrx-r7hg, GO-2022-0253 | Medium | 0.9% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Infinite certificate chain depth results in OctoRPKI running forever CVE-2021-3908, GHSA-g5gj-9ggf-9vmq, GO-2022-0249 | Medium | 0.7% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Infinite open connection causes OctoRPKI to hang forever CVE-2021-3909, GHSA-8cvr-4rrf-f244, GO-2022-0250 | Medium | 1.6% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
NUL character in ROA causes OctoRPKI to crash CVE-2021-3910, GHSA-5mxh-2qfv-4g7j, GO-2022-0251 | High | 1.2% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Path traversal in github.com/cloudflare/cfrpki/cmd/octorpki CVE-2021-3907, GHSA-8459-6rc9-8vf8, GHSA-cqh2-vc2f-q4fh, GO-2022-0248 | High | 4.2% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Misconfigured IP address field in ROA leads to OctoRPKI crash CVE-2021-3911, GHSA-w6ww-fmfx-2x22, GO-2022-0252 | Medium | 0.9% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server CVE-2021-22565, GHSA-wx8q-rgfr-cf6v, GO-2022-0270 | Medium | 0.4% | 10 Nov, 2021 | Go github.com/google/exposure-notifications-verification-server |
OIDC claims not updated from Identity Provider in Pomerium CVE-2021-41230, GHSA-j6wp-3859-vxfg, GO-2021-0258 | Medium | 0.9% | 10 Nov, 2021 | Go github.com/pomerium/pomerium |
Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker CVE-2021-41232, GHSA-26cm-qrc6-mfgj, GO-2022-0939 | High | 1.5% | 08 Nov, 2021 | Go github.com/StevenWeathers/thunderdome-planning-poker Go github.com/stevenweathers/thunderdome-planning-poker |
Files or Directories Accessible to External Parties in kubernetes CVE-2021-25741, GHSA-f5f7-6478-qm6p, GO-2022-0910 | High | 8.0% | 01 Nov, 2021 | Go k8s.io/kubernetes |
Improper Access Control in github.com/treeverse/lakefs GHSA-m836-gxwq-j2pm, GO-2022-0375 | Medium | Not scored | 28 Oct, 2021 | Go github.com/treeverse/lakefs |
Duplicate Advisory: ReDoS via crafted JSON input in GJSON CVE-2021-42248, CVE-2021-42836, GHSA-c9gm-7rfj-8w5h, GHSA-ppj4-34rq-v8j9, GO-2021-0265 | High | 2.4% | 25 Oct, 2021 | Go github.com/tidwall/gjson |
Geth Node Vulnerable to DoS via maliciously crafted p2p message CVE-2021-41173, GHSA-59hh-656j-3p7v, GO-2022-0256 | Medium | 1.2% | 25 Oct, 2021 | Go github.com/ethereum/go-ethereum |
Authz Module Non-Determinism CVE-2021-41135, GHSA-2p6r-37p9-89p2 | Medium | 1.7% | 21 Oct, 2021 | Go github.com/cosmos/cosmos-sdk |
Policies not properly enforced in bluemonday CVE-2021-42576, GHSA-x95h-979x-cf3j, GO-2022-0588, PYSEC-2021-849 | Critical | 1.6% | 18 Oct, 2021 | Go github.com/microcosm-cc/bluemonday PyPI pybluemonday |
Email relay in Apache Traffic Control CVE-2021-42009, GHSA-gw97-f6h8-gm94, GO-2022-0602 | Medium | 2.8% | 13 Oct, 2021 | Go github.com/apache/trafficcontrol |
Incorrect Privilege Assignment in HashiCorp Vault BIT-vault-2021-42135, CVE-2021-42135, GHSA-362v-wg5p-64w2, GO-2022-0578 | High | 0.8% | 12 Oct, 2021 | Go github.com/hashicorp/vault |
Hashicorp Vault Privilege Escalation Vulnerability BIT-vault-2021-41802, CVE-2021-41802, GHSA-qv95-g3gm-x542, GO-2022-0618 | Low | 0.6% | 12 Oct, 2021 | Go github.com/hashicorp/vault |
MD5 hash support in github.com/foxcpp/maddy GHSA-qh54-9vc5-m9fg, GO-2022-0378 | Low | Not scored | 12 Oct, 2021 | Go github.com/foxcpp/maddy |
golang.org/x/text/language Out-of-bounds Read vulnerability CVE-2021-38561, GHSA-ppp9-7jff-5vj2, GO-2021-0113 | High | 1.5% | 06 Oct, 2021 | Go golang.org/x/text |