Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Daptin fuzzy search injects unvalidated column name into raw SQL CVE-2026-44349, GHSA-pwqg-q8pg-pp6r, GO-2026-5555 | High | Not scored | 06 May, 2026 | Go github.com/daptin/daptin |
Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS CVE-2025-71261, GHSA-pgh9-mpwc-8jjf, GO-2026-5538 | High | Not scored | 06 May, 2026 | Go github.com/harvester/harvester |
Mezo: ERC-20 bridgeOut burn can be erased by a stale StateDB overwrite leading to full L1 bridge drain GHSA-6447-269v-g68m, GO-2026-5165 | High | Not scored | 06 May, 2026 | Go github.com/mezo-org/mezod |
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 CVE-2026-42339, GHSA-v5c3-6wvc-pc2q, GO-2026-5652 | High | Not scored | 06 May, 2026 | Go github.com/QuantumNous/new-api |
DevSpace UI Server WebSocket CheckOrigin does not validate source CVE-2026-42283, GHSA-hqwm-7x7x-8379, GO-2026-5433 | High | Not scored | 06 May, 2026 | Go github.com/loft-sh/devspace |
Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover CVE-2026-42222, GHSA-mxqh-q9h6-v8pq, GO-2026-5521 | High | Not scored | 06 May, 2026 | Go github.com/0xJacky/nginx-ui |
Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim CVE-2026-42221, GHSA-h27v-ph7w-m9fp, GO-2026-5412 | High | Not scored | 06 May, 2026 | Go github.com/0xJacky/Nginx-UI |
authd: Primary group ID is incorrectly set to value of UID CVE-2026-6970, GHSA-fg3j-5w9g-hmg7, GO-2026-5361 | High | Not scored | 05 May, 2026 | Go github.com/canonical/authd |
Hysteria: A specially constructed quic package can crash the server OOM when the sniff is enabled GHSA-9fw6-xgg2-mq9q, GO-2026-5288 | High | Not scored | 05 May, 2026 | Go github.com/apernet/hysteria/core Go github.com/apernet/hysteria/core/v2 |
GoBGP has a panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) CVE-2026-42285, GHSA-p3w2-64xm-833j, GO-2026-5525 | High | Not scored | 05 May, 2026 | Go github.com/osrg/gobgp/v4 |
Prometheus: Remote read endpoint allows denial of service via crafted snappy payload BIT-prometheus-2026-42154, CVE-2026-42154, GHSA-8rm2-7qqf-34qm, GO-2026-5264 | High | Not scored | 05 May, 2026 | Go github.com/prometheus/prometheus Go github.com/prometheus/prometheus/v2 |
Prometheus Azure AD remote write OAuth client secret exposed via config API BIT-prometheus-2026-42151, CVE-2026-42151, GHSA-wg65-39gg-5wfj, GO-2026-5710 | High | Not scored | 05 May, 2026 | Go github.com/prometheus/prometheus |
Hashicorp Boundary workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes CVE-2026-7776, GHSA-7x9r-wcgg-w86f, GO-2026-5237 | High | Not scored | 05 May, 2026 | Go github.com/hashicorp/boundary |
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) CVE-2026-42575, GHSA-hcwr-pq9g-rq3m, GO-2026-5422 | High | Not scored | 04 May, 2026 | Go chainguard.dev/apko |
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root CVE-2026-42574, GHSA-qq3r-w4hj-gjp6, GO-2026-5589 | High | Not scored | 04 May, 2026 | Go chainguard.dev/apko |
Argo vulnerable to exposure of artifact repository credentials BIT-argo-workflows-2026-42295, CVE-2026-42295, GHSA-7vf8-2cr6-54mf, GO-2026-5235 | High | Not scored | 04 May, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 Go github.com/argoproj/argo-workflows/v4 |
Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure BIT-argo-workflows-2026-42296, CVE-2026-42296, GHSA-3775-99mw-8rp4, GO-2026-5072 | High | Not scored | 04 May, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 Go github.com/argoproj/argo-workflows/v4 |
Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor BIT-argo-workflows-2026-42294, CVE-2026-42294, GHSA-jcc8-g2q4-9fxq, GO-2026-5462 | High | Not scored | 04 May, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 Go github.com/argoproj/argo-workflows/v4 |
Argo has Missing Authorization in its Sync ConfigMap Provider BIT-argo-workflows-2026-42297, CVE-2026-42297, GHSA-xchc-cqwg-g76q, GO-2026-5751 | High | Not scored | 04 May, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 Go github.com/argoproj/argo-workflows/v4 |
Kata Container has CopyFile Policy Subversion via Symlinks CVE-2026-41326, GHSA-q49m-57vm-c8cc, GO-2026-5563 | High | Not scored | 04 May, 2026 | Go github.com/kata-containers/kata-containers |
Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and Move CVE-2026-40893, GHSA-62p3-hvxx-fxg4, GO-2026-5162 | High | Not scored | 04 May, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
Incus Vulnerable to Panic via Snapshot Bounds Check CVE-2026-40251, GHSA-4m88-wxj4-9qj6, GO-2026-5127 | High | Not scored | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd Go github.com/lxc/incus/v7 |
GoBGP has an out-of-bounds read in the ParseIP6Extended function CVE-2026-37461, GHSA-wmvj-f67g-qg4g, GO-2026-5713 | High | Not scored | 04 May, 2026 | Go github.com/osrg/gobgp/v4 |
Incus has a Nil-Pointer Dereference via Custom Volume Import CVE-2026-40197, GHSA-r7w7-mmxr-47r9, GO-2026-5612 | High | Not scored | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd Go github.com/lxc/incus/v7 |
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata CVE-2026-40195, GHSA-gc7j-g665-rxr9, GO-2026-5397 | High | Not scored | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd Go github.com/lxc/incus/v7 |
Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader CVE-2026-7482, GHSA-x8qc-fggm-mpqg, GO-2026-5748 | High | Not scored | 04 May, 2026 | Go github.com/ollama/ollama |
Contras Affected by CopyFile Policy Subversion via Symlinks CVE-2026-100838, GHSA-rh99-wc69-c255, GO-2026-5624 | High | Not scored | 30 Apr, 2026 | Go github.com/edgelesssys/contrast |
Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets) CVE-2026-42461, GHSA-cxx3-hr75-4q96, GO-2026-5340 | High | Not scored | 30 Apr, 2026 | Go github.com/getarcaneapp/arcane/backend |
Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection CVE-2026-40280, GHSA-5q7p-7jgv-ww56, GO-2026-5151 | High | Not scored | 30 Apr, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services CVE-2026-44015, GHSA-wr32-99hh-6f35, GO-2026-5719 | High | Not scored | 29 Apr, 2026 | Go github.com/0xJacky/Nginx-UI |
GoBGP has Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE CVE-2026-41643, GHSA-8rxh-r2p6-7f2q, GO-2026-5266 | High | Not scored | 29 Apr, 2026 | Go github.com/osrg/gobgp/v4 |
GoBGP has Remote Denial of Service (Panic) via Malformed Well-known Path Attribute CVE-2026-41642, GHSA-7235-89m6-f4px, GO-2026-5198 | High | Not scored | 29 Apr, 2026 | Go github.com/osrg/gobgp/v4 |
CoreDNS has TSIG authentication bypass on gRPC and QUIC transports CVE-2026-35579, GHSA-vp29-5652-4fw9, GO-2026-5667 | High | Not scored | 28 Apr, 2026 | Go github.com/coredns/coredns |
CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC CVE-2026-33190, GHSA-qhmp-q7xh-99rh, GO-2026-5583 | High | Not scored | 28 Apr, 2026 | Go github.com/coredns/coredns |
CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass) CVE-2026-33489, GHSA-h8mm-c463-wjq3, GO-2026-5417 | High | Not scored | 28 Apr, 2026 | Go github.com/coredns/coredns |
CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification CVE-2026-32936, GHSA-63cw-r7xf-jmwr, GO-2026-5164 | High | Not scored | 28 Apr, 2026 | Go github.com/coredns/coredns |
CoreDNS' DoQ worker pool does not bound stream backlog CVE-2026-32934, GHSA-2wpx-qpw2-g5h5, GO-2026-4969 | High | Not scored | 28 Apr, 2026 | Go github.com/coredns/coredns |
Apache Thrift TFramedTransport Go language implementation has an Integer Overflow or Wraparound vulnerability BIT-thrift-2026-41602, CVE-2026-41602, GHSA-wf45-q9ch-q8gh | High | Not scored | 28 Apr, 2026 | Go github.com/apache/thrift |
Cillium exposes sensitive information included in the cilium-bugtool debug archive BIT-cilium-2026-41520, BIT-cilium-operator-2026-41520, BIT-hubble-relay-2026-41520, CVE-2026-41520, GHSA-gj49-89wh-h4gj, GO-2026-5400 | High | Not scored | 25 Apr, 2026 | Go github.com/cilium/cilium |
zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write CVE-2026-42275, GHSA-74m3-9qvm-rp9h, GO-2026-5203 | High | Not scored | 25 Apr, 2026 | Go github.com/openziti/zrok Go github.com/openziti/zrok/v2 |
Heimdall has an authorization bypass via path normalization mismatch CVE-2026-42274, GHSA-3q34-rx83-r6mq, GO-2026-5097 | High | Not scored | 25 Apr, 2026 | Go github.com/dadrus/heimdall |
Heimdall: Case-sensitive host matching may lead to policy bypass CVE-2026-42273, GHSA-72h4-mxfc-jx37, GO-2026-5200 | High | Not scored | 25 Apr, 2026 | Go github.com/dadrus/heimdall |
Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation CVE-2026-42272, GHSA-43jv-5j4x-qv67, GO-2026-5108 | High | Not scored | 25 Apr, 2026 | Go github.com/dadrus/heimdall |
Kyverno Controller Denial of Service via forEach Mutation Panic BIT-kyverno-2026-41485, CVE-2026-41485, GHSA-fpjq-c37h-cqcv, GO-2026-5374 | High | Not scored | 24 Apr, 2026 | Go github.com/kyverno/kyverno |
Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath Desync CVE-2026-40912, GHSA-6jwx-7vp4-9847, GO-2026-5180 | High | Not scored | 24 Apr, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
k8sGPT has Prompt Injection through its k8sGPT-Operator GHSA-rp7v-4384-hfrp, GO-2026-5631 | High | Not scored | 24 Apr, 2026 | Go github.com/k8sgpt-ai/k8sgpt |
Traefik: Pre-authentication decision bypass due to forwarded alias spoofing CVE-2026-39858, GHSA-5m6w-wvh7-57vm, GO-2026-5149 | High | Not scored | 24 Apr, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication CVE-2026-35051, GHSA-6384-m2mw-rf54, GO-2026-5163 | High | Not scored | 24 Apr, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud CVE-2026-41432, GHSA-xff3-5c9p-2mr4, GO-2026-5753 | High | Not scored | 24 Apr, 2026 | Go github.com/QuantumNous/new-api |
Contour has Lua code injection via Cookie Path Rewrite Policy BIT-contour-2026-41246, CVE-2026-41246, GHSA-x4mj-7f9g-29h4, GO-2026-5738 | High | Not scored | 24 Apr, 2026 | Go github.com/projectcontour/contour |