Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Grafana Tempo has an Uncontrolled Resource Consumption issue CVE-2026-21728, GHSA-p4r4-xvrq-gvmc, GO-2026-5528 | High | Not scored | 24 Apr, 2026 | Go github.com/grafana/tempo |
Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller BIT-argo-workflows-2026-40886, CVE-2026-40886, GHSA-5jv8-h7qh-rf5p, GO-2026-5148 | High | Not scored | 23 Apr, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 Go github.com/argoproj/argo-workflows/v4 |
SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869) CVE-2026-41894, GHSA-hjh7-r5w8-5872, GO-2026-5429 | High | Not scored | 22 Apr, 2026 | Go github.com/siyuan-note/siyuan/kernel |
monetr: Server-side request forgery in Lunch Flow link creation and refresh CVE-2026-41644, GHSA-29v9-frvh-c426, GO-2026-4966 | High | Not scored | 22 Apr, 2026 | Go github.com/monetr/monetr |
free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service CVE-2026-41135, GHSA-98cp-84m9-q3qp, GO-2026-5278 | High | Not scored | 22 Apr, 2026 | Go github.com/free5gc/pcf |
Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API CVE-2026-41422, GHSA-rw2c-8rfq-gwfv, GO-2026-5640 | High | Not scored | 22 Apr, 2026 | Go github.com/daptin/daptin |
Tekton Pipeline: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE CVE-2026-40938, GHSA-94jr-7pqp-xhcq, GO-2026-5272 | High | Not scored | 21 Apr, 2026 | Go github.com/tektoncd/pipeline |
Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL CVE-2026-40161, GHSA-wjxp-xrpv-xpff, GO-2026-5711 | High | Not scored | 21 Apr, 2026 | Go github.com/tektoncd/pipeline |
Neko has a Self-service Privilege Escalation for Authenticated Users CVE-2026-39386, GHSA-2gw9-c2r2-f5qf, GO-2026-4960 | High | Not scored | 21 Apr, 2026 | Go github.com/m1k1o/neko/server |
Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints CVE-2026-34403, GHSA-78mf-482w-62qj, GO-2026-5210 | High | Not scored | 21 Apr, 2026 | Go github.com/0xJacky/Nginx-UI |
Nginx-UI: Disabled users retain full API access through previously issued bearer tokens CVE-2026-33031, GHSA-x234-x5vq-cc2v, GO-2026-5733 | High | Not scored | 21 Apr, 2026 | Go github.com/0xJacky/Nginx-UI |
OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR CVE-2026-41433, GHSA-8gmg-3w2q-65f4, GO-2026-5253 | High | Not scored | 17 Apr, 2026 | Go go.opentelemetry.io/obi |
Dapr: Service Invocation path traversal ACL bypass CVE-2026-41491, GHSA-85gx-3qv6-4463, GO-2026-5242 | High | Not scored | 17 Apr, 2026 | Go github.com/dapr/dapr |
HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations BIT-vault-2026-5807, CVE-2026-5807, GHSA-88v5-9hxc-f85r, GO-2026-5247 | High | Not scored | 17 Apr, 2026 | Go github.com/hashicorp/vault |
HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service BIT-vault-2026-3605, CVE-2026-3605, GHSA-m2w4-8ggf-rj47, GO-2026-5487 | High | Not scored | 17 Apr, 2026 | Go github.com/hashicorp/vault |
HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization BIT-vault-2026-4525, CVE-2026-4525, GHSA-72gw-fmmr-c4r4, GO-2026-5199 | High | Not scored | 17 Apr, 2026 | Go github.com/hashicorp/vault |
Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak) BIT-kyverno-2026-84195, CVE-2026-84195, GHSA-8wfp-579w-6r25, GO-2026-5268 | High | Not scored | 16 Apr, 2026 | Go github.com/kyverno/kyverno |
Kyverno: ServiceAccount token leaked to external servers via apiCall service URL BIT-kyverno-2026-41323, CVE-2026-41323, GHSA-f9g8-6ppc-pqq4, GO-2026-5351 | High | Not scored | 16 Apr, 2026 | Go github.com/kyverno/kyverno |
Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) BIT-kyverno-2026-41068, CVE-2026-41068, GHSA-cvq5-hhx3-f99p, GO-2026-5337 | High | Not scored | 16 Apr, 2026 | Go github.com/kyverno/kyverno |
ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider CVE-2026-40611, GHSA-qqx8-2xmm-jrv8, GO-2026-5593 | High | Not scored | 16 Apr, 2026 | Go github.com/go-acme/lego Go github.com/go-acme/lego/v3 Go github.com/go-acme/lego/v4 |
zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing CVE-2026-40303, GHSA-cpf9-ph2j-ccr9, GO-2026-5329 | High | Not scored | 16 Apr, 2026 | Go github.com/openziti/zrok Go github.com/openziti/zrok/v2 |
SpdyStream: DOS on CRI CVE-2026-35469, GHSA-pc3f-x583-g7j2, GO-2026-4958 | High | Not scored | 16 Apr, 2026 | Go github.com/moby/spdystream |
OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex BIT-oauth2-proxy-2026-41059, CVE-2026-41059, GHSA-pxq7-h93f-9jrg, GO-2026-5559 | High | Not scored | 15 Apr, 2026 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
NietThijmen ShoppingCart: Command injection in the connect function CVE-2024-53412, GHSA-ggmw-mjhv-75rm, GO-2026-5398 | High | Not scored | 15 Apr, 2026 | Go github.com/NietThijmen/ShoppingCart |
MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads CVE-2026-41145, GHSA-hv4r-mvr4-25vw, GO-2026-5437 | High | Not scored | 14 Apr, 2026 | Go github.com/minio/minio |
Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles CVE-2026-40944, GHSA-7jrq-q4pq-rhm6, GO-2026-5226 | High | Not scored | 14 Apr, 2026 | Go github.com/oxia-db/oxia |
Oxia affected by server crash via race condition in session heartbeat handling CVE-2026-40943, GHSA-5gqc-qhrj-9xw8, GO-2026-5145 | High | Not scored | 14 Apr, 2026 | Go github.com/oxia-db/oxia |
Oxia exposes bearer token in debug log messages on authentication failure CVE-2026-40945, GHSA-pm7q-rjjx-979p, GO-2026-5546 | High | Not scored | 14 Apr, 2026 | Go github.com/oxia-db/oxia |
Go Markdown has an Out-of-bounds Read in SmartypantsRenderer CVE-2026-40890, GHSA-77fj-vx54-gvh7, GO-2026-5208 | High | Not scored | 14 Apr, 2026 | Go github.com/gomarkdown/markdown |
Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access BIT-kyverno-2026-4789, CVE-2026-4789, GHSA-rggm-jjmc-3394, GO-2026-5621 | High | Not scored | 14 Apr, 2026 | Go github.com/kyverno/kyverno |
Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write CVE-2026-40090, GHSA-pj97-4p9w-gx3q, GO-2026-5542 | High | Not scored | 14 Apr, 2026 | Go github.com/defenseunicorns/zarf Go github.com/zarf-dev/zarf |
goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access CVE-2026-40885, GHSA-7h3j-592v-jcrp, GO-2026-5221 | High | Not scored | 14 Apr, 2026 | Go github.com/patrickhener/goshs Go github.com/patrickhener/goshs/v2 |
SFTP root escape via prefix-based path validation in goshs CVE-2026-40876, GHSA-5h6h-7rc9-3824, GO-2026-5146 | High | Not scored | 14 Apr, 2026 | Go github.com/patrickhener/goshs Go github.com/patrickhener/goshs/v2 |
kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token BIT-kyverno-2026-40868, CVE-2026-40868, GHSA-q93q-v844-jrqp, GO-2026-5575 | High | Not scored | 14 Apr, 2026 | Go github.com/kyverno/kyverno |
Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach BIT-kyverno-2026-84199, CVE-2026-84199, GHSA-fmqp-4wfc-w3v7, GO-2026-5371 | High | Not scored | 14 Apr, 2026 | Go github.com/kyverno/kyverno |
Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF BIT-kyverno-2026-84196, CVE-2026-84196, GHSA-qr4g-8hrp-c4rw, GO-2026-5594 | High | Not scored | 14 Apr, 2026 | Go github.com/kyverno/kyverno |
free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions CVE-2026-40248, GHSA-jgq2-qv8v-5cmj, GO-2026-5470 | High | Not scored | 14 Apr, 2026 | Go github.com/free5gc/udr |
free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions CVE-2026-40247, GHSA-x5r2-r74c-3w28, GO-2026-5741 | High | Not scored | 14 Apr, 2026 | Go github.com/free5gc/udr |
free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions CVE-2026-40246, GHSA-g9cw-qwhf-24jp, GO-2026-5396 | High | Not scored | 14 Apr, 2026 | Go github.com/free5gc/udr |
free5gc UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication CVE-2026-40245, GHSA-wrwh-rpq4-87hf, GO-2026-5722 | High | Not scored | 14 Apr, 2026 | Go github.com/free5gc/udr |
MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads CVE-2026-40344, GHSA-9c4q-hq6p-c237, GO-2026-5284 | High | Not scored | 14 Apr, 2026 | Go github.com/minio/minio |
In monetr, unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation CVE-2026-40481, GHSA-v7xq-3wx6-fqc2, GO-2026-5654 | High | Not scored | 14 Apr, 2026 | Go github.com/monetr/monetr |
Note Mark has Stored XSS via Unrestricted Asset Upload CVE-2026-40262, GHSA-9pr4-rf97-79qh, GO-2026-5295 | High | Not scored | 13 Apr, 2026 | Go github.com/enchant97/note-mark/backend |
Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username CVE-2026-40193, GHSA-5835-4gvc-32pc, GO-2026-5137 | High | Not scored | 13 Apr, 2026 | Go github.com/foxcpp/maddy |
External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine CVE-2026-34984, GHSA-r2pg-r6h7-crf3, GO-2026-5602 | High | Not scored | 13 Apr, 2026 | Go github.com/external-secrets/external-secrets |
Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server CVE-2026-34476, GHSA-c4hg-6933-x62x, GO-2026-5310 | High | Not scored | 13 Apr, 2026 | Go github.com/apache/skywalking-mcp |
Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint CVE-2026-40242, GHSA-ff24-4prj-gpmj, GO-2026-5356 | High | Not scored | 10 Apr, 2026 | Go github.com/getarcaneapp/arcane/backend |
goshs is Missing Write Protection for Parametric Data Values CVE-2026-40188, GHSA-2943-crp8-38xx, GO-2026-4953 | High | Not scored | 10 Apr, 2026 | Go github.com/patrickhener/goshs |
Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export CVE-2026-79667, GHSA-4h9q-p5j4-xvvh, GO-2026-5123 | High | Not scored | 10 Apr, 2026 | Go github.com/lin-snow/ech0 |
SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView` CVE-2026-40318, GHSA-vw86-c94w-v3x4, GO-2026-5679 | High | Not scored | 10 Apr, 2026 | Go github.com/siyuan-note/siyuan/kernel |