Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Netfoil doesn't decrement TTL GHSA-9ppr-wfw9-xvr2 | Medium | Not scored | 14 hours ago | Go github.com/tinfoil-factory/netfoil |
Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads CVE-2026-119285, GHSA-g5jq-qmqr-qrwf | Medium | Not scored | 4 days ago | Go github.com/gofiber/fiber/v2 |
anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS GHSA-2wrx-84qj-4pcg | Medium | Not scored | 4 days ago | Go github.com/anacrolix/torrent |
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users GHSA-f3fj-9625-rv3m | Medium | Not scored | 4 days ago | Go github.com/charmbracelet/soft-serve |
charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories GHSA-fgxm-5hvv-x4vh | Medium | Not scored | 4 days ago | Go github.com/charmbracelet/soft-serve |
knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion CVE-2026-54462, GHSA-2hw4-c9m4-f2fj | Medium | Not scored | 6 days ago | Go knative.dev/pkg |
Go JOSE: Panics in JSON parsing CVE-2026-116586, GHSA-vvm8-gf78-28g4 | Medium | Not scored | 6 days ago | Go github.com/go-jose/go-jose/v3 Go github.com/go-jose/go-jose/v4 |
Go JOSE: Panic during CBC-HMAC processing CVE-2026-116585, GHSA-4w3g-jfj2-cw2q | Medium | Not scored | 6 days ago | Go github.com/go-jose/go-jose/v3 Go github.com/go-jose/go-jose/v4 |
Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers CVE-2026-118657, GHSA-2ffq-g2xg-c22p | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Echo static file middleware route protection bypass via encoded dot-dot traversal CVE-2026-118654, GHSA-3pmx-cf9f-34xr | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Echo has a Static Middleware Double-Unescape Path Traversal CVE-2026-118655, GHSA-xwq5-6cqp-vx96 | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI CVE-2026-118656, GHSA-v753-g4cw-jm48 | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto CVE-2026-118658, GHSA-23wf-92cp-8pcj | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob CVE-2026-118652, GHSA-h9g5-28mm-hx3g | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration CVE-2026-118653, GHSA-246p-cpwv-v3jq | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method CVE-2026-118266, GHSA-r7w9-592q-9vg4 | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |
Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default CVE-2026-118651, GHSA-99jh-6h7p-pp36 | Medium | Not scored | 6 days ago | Go github.com/labstack/echo/v4 Go github.com/labstack/echo/v5 |