Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generation CVE-2026-6346, GHSA-9p64-jpc7-m2rp, GO-2026-5293 | High | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin CVE-2026-6347, GHSA-82j6-4fq7-fx62, GO-2026-5238 | High | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-plugin-calls Go github.com/mattermost/mattermost-server |
goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request GHSA-mxg3-432p-mr72, GO-2026-5519 | High | Not scored | 15 May, 2026 | Go goshs.de/goshs Go goshs.de/goshs/v2 |
FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files CVE-2026-45062, GHSA-3g8v-8r37-cgjm, GO-2026-5084 | High | Not scored | 15 May, 2026 | Go github.com/dunglas/frankenphp |
Crabbox: authentication bypass vulnerability that allows impersonation of others by spoofing identity headers CVE-2026-8621, GHSA-4g9m-rffv-h6wq, GO-2026-5120 | High | Not scored | 14 May, 2026 | Go github.com/openclaw/crabbox |
go-billy has path traversal vulnerabilities CVE-2026-44973, GHSA-qw64-3x98-g7q2, GO-2026-5597 | High | Not scored | 14 May, 2026 | Go github.com/go-git/go-billy/v5 Go github.com/go-git/go-billy/v6 |
Portainer: JWT accepted in URL query leaks tokens to logs and referers CVE-2026-44883, GHSA-jvp4-q659-95mj, GO-2026-5480 | High | Not scored | 14 May, 2026 | Go github.com/portainer/portainer |
Portainer's Kubernetes middleware continues after token validation failure, bypassing endpoint authorization CVE-2026-44882, GHSA-mgq6-4x29-88r3, GO-2026-5505 | High | Not scored | 14 May, 2026 | Go github.com/portainer/portainer |
Portainer Has an Arbitrary File Read via Git Symlink Injection in Stack Auto-Update CVE-2026-44881, GHSA-rpgq-m5fp-32wr, GO-2026-5633 | High | Not scored | 14 May, 2026 | Go github.com/portainer/portainer |
Portainer has a bind-mount restriction bypass via HostConfig.Mounts CVE-2026-44850, GHSA-7fw3-x4r2-g7wc, GO-2026-5217 | High | Not scored | 14 May, 2026 | Go github.com/portainer/portainer |
Fleet server may terminate unexpectedly when handling certain gRPC requests CVE-2026-26062, GHSA-x67p-9m2r-fxqv, GO-2026-5744 | High | Not scored | 14 May, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet Windows MDM Azure AD JWT Authentication Bypass CVE-2026-24899, GHSA-ffg9-j72f-j6xm, GO-2026-5358 | High | Not scored | 14 May, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet has a Windows MDM management endpoint authentication bypass CVE-2026-23998, GHSA-2rc4-7jc6-qffh, GO-2026-5002 | High | Not scored | 14 May, 2026 | Go github.com/fleetdm/fleet/v4 |
SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs CVE-2026-45371, GHSA-gmmv-4cc5-wr9r, GO-2026-5402 | High | Not scored | 13 May, 2026 | Go github.com/siyuan-note/siyuan/kernel |
uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution CVE-2026-45152, GHSA-qqq4-5773-pmw5, GO-2026-5590 | High | Not scored | 13 May, 2026 | Go gitlab.com/uniget-org/cli |
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload CVE-2026-44697, GHSA-87m7-qffr-542v, GO-2026-5246 | High | Not scored | 13 May, 2026 | Go github.com/klever-io/klever-go |
esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files CVE-2026-44594, GHSA-rg65-45m7-hq57, GO-2026-5620 | High | Not scored | 12 May, 2026 | Go github.com/esm-dev/esm.sh |
esm.sh: Legacy Route Path Traversal Can Lead to RCE CVE-2026-44593, GHSA-3636-h3vx-6465, GO-2026-5071 | High | Not scored | 12 May, 2026 | Go github.com/esm-dev/esm.sh |
HashiCorp Nomad vulnerable to a path traversal CVE-2026-7474, GHSA-hx53-77qj-8663, GO-2026-5445 | High | Not scored | 12 May, 2026 | Go github.com/hashicorp/nomad |
Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode) CVE-2026-45090, GHSA-2g4x-fq3j-cgq4, GO-2026-4999 | High | Not scored | 12 May, 2026 | Go github.com/hahwul/dalfox Go github.com/hahwul/dalfox/v2 |
Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option CVE-2026-45089, GHSA-8hf9-3q64-q2qf, GO-2026-5257 | High | Not scored | 12 May, 2026 | Go github.com/hahwul/dalfox Go github.com/hahwul/dalfox/v2 |
Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` CVE-2026-45088, GHSA-35wr-x7v6-9fv2, GO-2026-5070 | High | Not scored | 12 May, 2026 | Go github.com/hahwul/dalfox Go github.com/hahwul/dalfox/v2 |
Bird-lg-go has a Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding CVE-2026-45047, GHSA-39qr-rc93-vhqm, GO-2026-5077 | High | Not scored | 11 May, 2026 | Go github.com/xddxdd/bird-lg-go |
Local Path Provisioner Vulnerable to HelperPod Template Injection CVE-2026-44543, GHSA-7fxv-8wr2-mfc4, GO-2026-5218 | High | Not scored | 11 May, 2026 | Go github.com/rancher/local-path-provisioner |
Ella Core Vulnerable to UE Downlink Redirection via Forged PDUSessionResourceSetupResponse CVE-2026-44473, GHSA-qfxw-v8qx-vj3v, GO-2026-5581 | High | Not scored | 11 May, 2026 | Go github.com/ellanetworks/core |
go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git CVE-2026-45022, GHSA-389r-gv7p-r3rp, GO-2026-5074 | High | Not scored | 11 May, 2026 | Go github.com/go-git/go-git/v5 Go github.com/go-git/go-git/v6 |
Dozzle's Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpointsbypasses authentication CVE-2026-44985, GHSA-j643-x8pv-8m67, GO-2026-5449 | High | Not scored | 11 May, 2026 | Go github.com/amir20/dozzle |
Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass CVE-2026-42595, GHSA-chwh-f6gm-r836, GO-2026-5324 | High | Not scored | 11 May, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating CVE-2026-44328, GHSA-p9mg-74mg-cwwr, GO-2026-5537 | High | Not scored | 08 May, 2026 | Go github.com/free5gc/smf |
free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types CVE-2026-44325, GHSA-f8qv-7x5w-qr48, GO-2026-5349 | High | Not scored | 08 May, 2026 | Go github.com/free5gc/nrf |
free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference CVE-2026-44322, GHSA-j59f-x285-69jx, GO-2026-5447 | High | Not scored | 08 May, 2026 | Go github.com/free5gc/nef |
free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf) CVE-2026-44321, GHSA-44qj-cghf-9p97, GO-2026-5109 | High | Not scored | 08 May, 2026 | Go github.com/free5gc/smf |
free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path CVE-2026-44320, GHSA-wqfh-gq79-j8mf, GO-2026-5717 | High | Not scored | 08 May, 2026 | Go github.com/free5gc/nef |
free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri) CVE-2026-44319, GHSA-rxrq-fv76-26pr, GO-2026-5647 | High | Not scored | 08 May, 2026 | Go github.com/free5gc/nef |
free5GC's PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference CVE-2026-44316, GHSA-wr8j-6chw-gm6p, GO-2026-5720 | High | Not scored | 08 May, 2026 | Go github.com/free5gc/pcf |
ZITADEL has LDAP Filter Injection in Login Flow CVE-2026-44671, GHSA-rxvx-hhpj-q6px, GO-2026-5648 | High | Not scored | 08 May, 2026 | Go github.com/zitadel/zitadel |
ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI CVE-2026-79664, GHSA-fpw6-hrg5-q5x5, GO-2026-5375 | High | Not scored | 07 May, 2026 | Go github.com/lin-snow/ech0 |
Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft CVE-2026-79662, GHSA-p64j-f4x9-wq66, GO-2026-5531 | High | Not scored | 07 May, 2026 | Go github.com/lin-snow/Ech0 Go github.com/lin-snow/ech0 |
Ech0 has Server-Side Request Forgery (SSRF) via Connect Handler fetchPeerConnectInfo CVE-2026-79659, GHSA-8mc6-xjpr-h98x, GO-2026-5259 | High | Not scored | 07 May, 2026 | Go github.com/lin-snow/ech0 |
Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution CVE-2026-44522, GHSA-g49p-4qxj-88v3, GO-2026-5389 | High | Not scored | 07 May, 2026 | Go github.com/enchant97/note-mark/backend |
Talos Linux has a local privilege escalation from untrusted workloads GHSA-m38g-vww2-mvgx | High | Not scored | 07 May, 2026 | Go github.com/siderolabs/talos |
Free5GC UDM has Improper Input Validation and Generation of Error Messages Containing Sensitive Information CVE-2026-42459, GHSA-585v-hcgf-jhfr, GO-2026-5138 | High | Not scored | 07 May, 2026 | Go github.com/free5gc/udm |
Free5GC PCF: Missing authentication middleware in Npcf_SMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI CVE-2026-42083, GHSA-6rgm-gr97-x3j5, GO-2026-5189 | High | Not scored | 07 May, 2026 | Go github.com/free5gc/pcf |
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect CVE-2026-44503, GHSA-7j59-v9qr-6fq9, GO-2026-5224, PYSEC-2026-2647 | High | 0.6% | 07 May, 2026 | Go github.com/microsoft/kiota-http-go Maven com.microsoft.kiota:microsoft-kiota-abstractions NuGet Microsoft.Kiota.Abstractions PyPI microsoft-kiota-http +1 more |
Rancher Extensions have arbitrary file access via path traversal CVE-2026-25705, GHSA-5v3h-x4wf-5c35, GO-2026-5154 | High | Not scored | 07 May, 2026 | Go github.com/rancher/rancher |
Amazon ECS Container Agent (Windows) is vulnerable to Information Disclosure CVE-2026-7461, GHSA-fc67-c4hg-q653, GO-2026-5353 | High | Not scored | 07 May, 2026 | Go github.com/aws/amazon-ecs-agent |
Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine CVE-2026-42594, GHSA-r33j-c622-r6qp, GO-2026-5605 | High | Not scored | 07 May, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
Gotenberg has a Server-Side Request Forgery (SSRF) Issue CVE-2026-42591, GHSA-rm4c-xj6x-49mw, GO-2026-5627 | High | Not scored | 07 May, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist CVE-2026-42590, GHSA-7v3r-m9c8-r855, GO-2026-5234 | High | Not scored | 07 May, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
opentelemetry-collector-contrib's azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay CVE-2026-42602, GHSA-pjv4-3c63-699f, GO-2026-5544 | High | Not scored | 06 May, 2026 | Go github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension |