Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection) CVE-2026-62331, GHSA-48v2-6jcm-fc99 | High | Not scored | 13 hours ago | Go github.com/mtzanidakis/praktor |
Netfoil doesn't decrement TTL GHSA-9ppr-wfw9-xvr2 | Medium | Not scored | 14 hours ago | Go github.com/tinfoil-factory/netfoil |
Arc has unauthenticated application log disclosure via `/api/v1/logs` GHSA-m3qr-fvp4-78xj | Low | Not scored | 14 hours ago | Go github.com/basekick-labs/arc |
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory CVE-2026-118761, GHSA-8fmv-6rg5-5924 | High | Not scored | 4 days ago | Go github.com/kubeflow/pipelines |
Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs CVE-2026-118759, GHSA-wg5q-x4j9-qm54 | High | Not scored | 4 days ago | Go github.com/kubeflow/pipelines |
Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads CVE-2026-119285, GHSA-g5jq-qmqr-qrwf | Medium | Not scored | 4 days ago | Go github.com/gofiber/fiber/v2 |
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution GHSA-hff9-5pqw-6w9f | Critical | Not scored | 4 days ago | Go github.com/imgproxy/imgproxy Go github.com/imgproxy/imgproxy/v2 Go github.com/imgproxy/imgproxy/v3 |
imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash GHSA-494m-4556-wf5p | High | Not scored | 4 days ago | Go github.com/imgproxy/imgproxy/v3 |
imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field GHSA-mmq5-xm89-9pfg | High | Not scored | 4 days ago | Go github.com/imgproxy/imgproxy/v3 |
anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS GHSA-2wrx-84qj-4pcg | Medium | Not scored | 4 days ago | Go github.com/anacrolix/torrent |
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users GHSA-f3fj-9625-rv3m | Medium | Not scored | 4 days ago | Go github.com/charmbracelet/soft-serve |
charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories GHSA-fgxm-5hvv-x4vh | Medium | Not scored | 4 days ago | Go github.com/charmbracelet/soft-serve |
cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials BIT-cert-manager-2026-62290, CVE-2026-62290, GHSA-8rvj-mm4h-c258 | High | Not scored | 5 days ago | Go github.com/cert-manager/cert-manager |
Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware CVE-2026-62160, GHSA-rhj7-vh3v-mcq6 | High | Not scored | 5 days ago | Go github.com/daptin/daptin |
knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion CVE-2026-54462, GHSA-2hw4-c9m4-f2fj | Medium | Not scored | 6 days ago | Go knative.dev/pkg |
Go JOSE: Panics in JSON parsing CVE-2026-116586, GHSA-vvm8-gf78-28g4 | Medium | Not scored | 6 days ago | Go github.com/go-jose/go-jose/v3 Go github.com/go-jose/go-jose/v4 |
Go JOSE: Panic during CBC-HMAC processing CVE-2026-116585, GHSA-4w3g-jfj2-cw2q | Medium | Not scored | 6 days ago | Go github.com/go-jose/go-jose/v3 Go github.com/go-jose/go-jose/v4 |
Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers CVE-2026-118657, GHSA-2ffq-g2xg-c22p | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Echo static file middleware route protection bypass via encoded dot-dot traversal CVE-2026-118654, GHSA-3pmx-cf9f-34xr | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Echo has a Static Middleware Double-Unescape Path Traversal CVE-2026-118655, GHSA-xwq5-6cqp-vx96 | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI CVE-2026-118656, GHSA-v753-g4cw-jm48 | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto CVE-2026-118658, GHSA-23wf-92cp-8pcj | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path CVE-2026-118650, GHSA-375p-5qhx-8wq4 | High | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob CVE-2026-118652, GHSA-h9g5-28mm-hx3g | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration CVE-2026-118653, GHSA-246p-cpwv-v3jq | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method CVE-2026-118266, GHSA-r7w9-592q-9vg4 | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default CVE-2026-118651, GHSA-99jh-6h7p-pp36 | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through CVE-2026-55458, GHSA-8qx7-j2v2-x6q5 | Low | Not scored | 6 days ago | Go github.com/caddyserver/caddy/v2 |