Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection) CVE-2026-62331, GHSA-48v2-6jcm-fc99 | High | Not scored | 14 hours ago | Go github.com/mtzanidakis/praktor |
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory CVE-2026-118761, GHSA-8fmv-6rg5-5924 | High | Not scored | 4 days ago | Go github.com/kubeflow/pipelines |
Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs CVE-2026-118759, GHSA-wg5q-x4j9-qm54 | High | Not scored | 4 days ago | Go github.com/kubeflow/pipelines |
imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash GHSA-494m-4556-wf5p | High | Not scored | 4 days ago | Go github.com/imgproxy/imgproxy/v3 |
imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field GHSA-mmq5-xm89-9pfg | High | Not scored | 4 days ago | Go github.com/imgproxy/imgproxy/v3 |
cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials BIT-cert-manager-2026-62290, CVE-2026-62290, GHSA-8rvj-mm4h-c258 | High | Not scored | 5 days ago | Go github.com/cert-manager/cert-manager |
Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware CVE-2026-62160, GHSA-rhj7-vh3v-mcq6 | High | Not scored | 5 days ago | Go github.com/daptin/daptin |
Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path CVE-2026-118650, GHSA-375p-5qhx-8wq4 | High | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |