Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-33082An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service (DoS) via a crafted iGo · github.com/open-policy-agent/opa · fixed in 0.42.0
- CVE-2022-31098Weave GitOps leaked cluster credentials into logs on connection errorsGo · github.com/weaveworks/weave-gitops · fixed in 0.8.1-rc.6
- CVE-2022-31077Malicious response from KubeEdge can crash CSI Driver controller serverGo · github.com/kubeedge/kubeedge · fixed in 1.10.1, 1.9.3
- CVE-2022-31076Malicious Message can crash CloudCore in KubeEdgeGo · github.com/kubeedge/kubeedge · fixed in 1.10.1, 1.9.3
- CVE-2022-31036Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-serverGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.1.16, 2.2.10, 2.3.5 and more
- CVE-2022-31035External URLs for Deployments can include javascript in argo-cdGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.1.16, 2.2.10, 2.3.5 and more
- CVE-2022-31034Insecure entropy in argo-cdGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.1.16, 2.2.10, 2.3.5 and more
- CVE-2022-31016Argo CD vulnerable to Uncontrolled Memory ConsumptionGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.1.16, 2.2.10, 2.3.5 and more
- CVE-2022-29526Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment.Go · golang.org/x/sys, stdlib · fixed in 0.0.0-20220412211240-33da011f77ad, 1.17.10, 1.18.2
- CVE-2022-34296In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request.Go · github.com/zalando/skipper · fixed in 0.13.218
- CVE-2022-25856Directory TraversalGo · github.com/argoproj/argo-events · fixed in 1.7.1
- CVE-2022-31066Configuration API in EdgeXFoundry exposes message bus credentials to local unauthenticated usersGo · github.com/edgexfoundry/app-functions-sdk-go, github.com/edgexfoundry/app-functions-sdk-go/v2 +2 · fixed in 2.1.1
- CVE-2022-31054Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo EventsGo · github.com/argoproj/argo-events · fixed in 1.7.1
- CVE-2022-31053Signature forgery in BiscuitGo · github.com/biscuit-auth/biscuit-go · fixed in 2.0.0
- CVE-2022-31045Ill-formed headers may lead to unexpected behavior in IstioGo · istio.io/istio · fixed in 1.12.18, 1.13.5, 1.14.1
- CVE-2022-1986OS Command Injection in gogs/gogsGo · gogs.io/gogs · fixed in 0.12.9
- CVE-2022-31038XSS vulnerability in repository issue list in GogsGo · gogs.io/gogs · fixed in 0.12.9
- CVE-2022-1993Path Traversal in gogs/gogsGo · gogs.io/gogs · fixed in 0.12.9
- CVE-2022-1992Path Traversal in gogs/gogsGo · gogs.io/gogs · fixed in 0.12.9
- CVE-2022-1708A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API.Go · github.com/cri-o/cri-o · fixed in 1.22.5, 1.23.3, 1.24.1
- CVE-2022-28224Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP featureGo · github.com/projectcalico/calico · fixed in 3.22.2, 3.21.5, 3.20.5
- CVE-2022-1996Authorization Bypass Through User-Controlled Key in emicklei/go-restfulGo · github.com/emicklei/go-restful, github.com/emicklei/go-restful/v2 +1 · fixed in 2.16.0+incompatible, 2.16.0, 3.8.0
- CVE-2022-31030containerd CRI plugin: Host memory exhaustion through ExecSyncGo · github.com/containerd/containerd · fixed in 1.5.13, 1.6.6
- CVE-2022-1982A crafted SVG attachment can crash a Mattermost serverGo · github.com/mattermost/mattermost-server · fixed in 6.6.1, 6.5.1, 6.4.3 and more
- CVE-2022-29718Caddy v2.4 was discovered to contain an open redirect vulnerability.Go · github.com/caddyserver/caddy, github.com/caddyserver/caddy/v2 · fixed in 2.5.0
- CVE-2022-31022Missing Role Based Access Control for the REST handlers in bleve/http packageGo · github.com/blevesearch/bleve, github.com/blevesearch/bleve/v2 · fixed in 2.5.0
- CVE-2022-1285Server-Side Request Forgery (SSRF) in gogs/gogsGo · gogs.io/gogs · fixed in 0.12.8
- CVE-2021-32546Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely.Go · gogs.io/gogs · fixed in 0.12.8
- CVE-2022-31011TiDB authentication bypass vulnerabilityGo · github.com/pingcap/tidb · fixed in 5.3.1, 0.0.0-20220221072141-27ffd1126da1, 1.1.0-beta.0.20220221072141-27ffd1126da1
- CVE-2022-1928Cross-site Scripting (XSS) - Stored in go-gitea/giteaGo · code.gitea.io/gitea · fixed in 1.16.9