Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Incus is affected by unbounded binary import disk exhaustion CVE-2026-41685, GHSA-98vh-x9cx-9cfp, GO-2026-5280 | Medium | Not scored | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd |
Incus has Nil Dereferences on Restore via Malformed YAML CVE-2026-41684, GHSA-x5r6-jr56-89pv, GO-2026-5742 | Medium | Not scored | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd |
Incus has Unbounded YAML Metadata Decode via Parsing CVE-2026-41648, GHSA-67wx-r9xr-x75x, GO-2026-5168 | Medium | Not scored | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd |
Incus has Nil-Pointer Dereference via S3 Bucket Import CVE-2026-41647, GHSA-fwj8-62r8-8p8m, GO-2026-5384 | Medium | Not scored | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd |
Traefik's errors middleware forwards Authorization and Cookie headers to separate error page service CVE-2026-41181, GHSA-p6hg-qh38-555r, GO-2026-5532 | Medium | Not scored | 04 May, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Incus has Blind SSRF via Image Import Preflight HEAD CVE-2026-35527, GHSA-8gw4-p4wq-4hcv, GO-2026-5254 | Medium | Not scored | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd Go github.com/lxc/incus/v7 |
GoBGP has an Integer Underflow Issue CVE-2026-7736, GHSA-hj4w-qr9j-c4cf, GO-2026-5427 | Medium | Not scored | 04 May, 2026 | Go github.com/osrg/gobgp/v4 |
GoBGP has Improper Restriction of Operations within the Bounds of a Memory Buffer CVE-2026-7737, GHSA-w88c-9vg8-cmq8, GO-2026-5699 | Medium | Not scored | 04 May, 2026 | Go github.com/osrg/gobgp Go github.com/osrg/gobgp/v4 |
GoBGP has an Improper Resource Shutdown or Release CVE-2026-7734, GHSA-vm3g-8xwv-mxfp, GO-2026-5665 | Medium | Not scored | 04 May, 2026 | Go github.com/osrg/gobgp/v4 |
Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL CVE-2026-39383, GHSA-5vh4-rgv7-p9g4, GO-2026-5155 | Medium | Not scored | 30 Apr, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
netfoil's optional seccomp sandboxing was not applied GHSA-vjgj-42f6-7997, GO-2026-5664 | Medium | Not scored | 29 Apr, 2026 | Go github.com/tinfoil-factory/netfoil |
Netfoil has incorrect allowlist enforcement GHSA-84g5-x8j3-7235, GO-2026-5240 | Medium | Not scored | 29 Apr, 2026 | Go github.com/tinfoil-factory/netfoil |
Elastic Package Registry has Improper Verification of Cryptographic Signature CVE-2026-33467, GHSA-r727-5pf6-47r2, GO-2026-5611 | Medium | Not scored | 29 Apr, 2026 | Go github.com/elastic/package-registry |
Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters CVE-2026-30246, GHSA-35hp-hqmv-8qg8, GO-2026-5069 | Medium | Not scored | 28 Apr, 2026 | Go github.com/gofiber/fiber/v3 |
Note Mark: Unauthenticated read of notes and assets in soft-deleted public books CVE-2026-41572, GHSA-3gr9-485j-v4xf, GO-2026-5085 | Medium | Not scored | 25 Apr, 2026 | Go github.com/enchant97/note-mark/backend |
Kratos has a Confused Deputy issue CVE-2026-6993, GHSA-jj45-xvq5-rhh9, GO-2026-5471 | Medium | Not scored | 25 Apr, 2026 | Go github.com/go-kratos/kratos/v2 |
PicoClaw has an Injection issue in its Web Launcher Management Plane component CVE-2026-6987, GHSA-6r3x-h84w-fhxx, GO-2026-5187 | Medium | Not scored | 25 Apr, 2026 | Go github.com/sipeed/picoclaw |
gitverify has improper tag signature verification GHSA-h829-5cg7-6hff, GO-2026-5416 | Medium | Not scored | 24 Apr, 2026 | Go github.com/supply-chain-tools/gitverify |
Traefik: A timing side-channel vulnerability allows for valid username enumeration via BasicAuth middleware CVE-2026-41263, GHSA-6x2q-h3cr-8j2h, GO-2026-5195 | Medium | Not scored | 24 Apr, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding CVE-2026-41174, GHSA-xhjw-95fp-8vgq, GO-2026-5760 | Medium | Not scored | 24 Apr, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses CVE-2026-29050, GHSA-98f2-w9h9-7fp9, GO-2026-5279 | Medium | Not scored | 23 Apr, 2026 | Go chainguard.dev/melange |
go-ntlmssp NTLM challenges can panic on malformed payloads CVE-2026-32952, GHSA-pjcq-xvwq-hhpj, GO-2026-5543 | Medium | Not scored | 23 Apr, 2026 | Go github.com/Azure/go-ntlmssp |
goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS CVE-2026-42091, GHSA-rhf7-wvw3-vjvm, GO-2026-5625 | Medium | Not scored | 23 Apr, 2026 | Go github.com/patrickhener/goshs Go github.com/patrickhener/goshs/v2 Go goshs.de/goshs Go goshs.de/goshs/v2 |
Gitea has insecure default SSH settings GHSA-3m6q-h5gj-7mrw, GO-2026-5091 | Medium | Not scored | 22 Apr, 2026 | Go code.gitea.io/gitea |
Nuclei: Environment variable disclosure via Response-Derived DSL Expressions CVE-2026-41282, CVE-2026-41645, GHSA-jm34-66cf-qpvr, GO-2026-5473 | Medium | Not scored | 22 Apr, 2026 | Go github.com/projectdiscovery/nuclei Go github.com/projectdiscovery/nuclei/v2 Go github.com/projectdiscovery/nuclei/v3 |
Nuclei: Local File Read via require() Module Loader Bypass CVE-2026-41646, GHSA-29rg-wmcw-hpf4, GO-2026-4965 | Medium | Not scored | 22 Apr, 2026 | Go github.com/projectdiscovery/nuclei Go github.com/projectdiscovery/nuclei/v2 Go github.com/projectdiscovery/nuclei/v3 |
free5GC AMF: Missing default case in Content-Type switch in HTTPUEContextTransfer CVE-2026-41136, GHSA-r99v-75p9-xqm5, GO-2026-5613 | Medium | Not scored | 22 Apr, 2026 | Go github.com/free5gc/amf |
OpenFGA has Improper Policy Enforcement CVE-2026-41131, GHSA-57j5-qwp2-vqp6, GO-2026-5136 | Medium | Not scored | 22 Apr, 2026 | Go github.com/openfga/openfga |
DDEV has ZipSlip path traversal in tar and zip archive extraction CVE-2026-32885, GHSA-x2xq-qhjf-5mvg, GO-2026-5735 | Medium | Not scored | 22 Apr, 2026 | Go github.com/ddev/ddev |
Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode CVE-2026-25996, GHSA-34r5-6j7w-235f, GO-2026-5068 | Medium | Not scored | 22 Apr, 2026 | Go github.com/inspektor-gadget/inspektor-gadget |
Inspektor Gadget: Command Injection via malicious buildOptions manipulation CVE-2026-24905, GHSA-79qw-g77v-2vfh, GO-2026-5211 | Medium | Not scored | 22 Apr, 2026 | Go github.com/inspektor-gadget/inspektor-gadget |
Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion CVE-2026-40924, GHSA-m2cx-gpqf-qf74, GO-2026-5486 | Medium | Not scored | 21 Apr, 2026 | Go github.com/tektoncd/pipeline |
Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check CVE-2026-40923, GHSA-rx35-6rhx-7858, GO-2026-5643 | Medium | Not scored | 21 Apr, 2026 | Go github.com/tektoncd/pipeline |
free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation CVE-2026-40343, GHSA-jwch-w7wh-gqjm, GO-2026-5482 | Medium | Not scored | 21 Apr, 2026 | Go github.com/free5gc/udr |
OpenBao's SQL Injection in PostgreSQL database secrets engine BIT-openbao-2026-39946, CVE-2026-39946, GHSA-6vgr-cp5c-ffx3, GO-2026-5192 | Medium | Not scored | 21 Apr, 2026 | Go github.com/openbao/openbao |
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching CVE-2026-25542, GHSA-rmx9-2pp3-xhcr, GO-2026-5630 | Medium | Not scored | 21 Apr, 2026 | Go github.com/tektoncd/pipeline |
Amazon EFS CSI Driver has mount option injection via unsanitized volumeHandle and mounttargetip fields CVE-2026-6437, GHSA-mph4-q2vm-w2pw | Medium | Not scored | 18 Apr, 2026 | Go github.com/kubernetes-sigs/aws-efs-csi-driver |
go-git: Credential leak via cross-host redirect in smart HTTP transport CVE-2026-41506, GHSA-3xc5-wrhm-f963, GO-2026-5105 | Medium | Not scored | 17 Apr, 2026 | Go github.com/go-git/go-git/v5 Go github.com/go-git/go-git/v6 |
Mattermost doesn't validate CSRF tokens on an authentication endpoint CVE-2026-28741, GHSA-m7cf-4gh2-v4qg, GO-2026-5495 | Medium | Not scored | 17 Apr, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement CVE-2026-3590, GHSA-mh4x-rmrx-3hp4, GO-2026-5507 | Medium | Not scored | 17 Apr, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
goldmark vulnerable to Cross-site Scripting (XSS) CVE-2026-5160, GHSA-c97m-vxhj-p7j6, GO-2026-5320 | Medium | Not scored | 17 Apr, 2026 | Go github.com/yuin/goldmark Go github.com/yuin/goldmark/renderer/html |
HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS BIT-vault-2026-5052, CVE-2026-5052, GHSA-8r5m-3f66-qpr3, GO-2026-5262 | Medium | Not scored | 17 Apr, 2026 | Go github.com/hashicorp/vault |
Istio: SSRF via RequestAuthentication jwksUri CVE-2026-41413, GHSA-fgw5-hp8f-xfhc, GO-2026-5363 | Medium | Not scored | 16 Apr, 2026 | Go istio.io/istio |
zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records CVE-2026-40304, GHSA-3jpj-v3xr-5h6g, GO-2026-5090 | Medium | Not scored | 16 Apr, 2026 | Go github.com/openziti/zrok Go github.com/openziti/zrok/v2 |
zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering CVE-2026-40302, GHSA-4fxq-2x3x-6xqx, GO-2026-5118 | Medium | Not scored | 16 Apr, 2026 | Go github.com/openziti/zrok Go github.com/openziti/zrok/v2 |
Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots CVE-2026-39350, GHSA-9gcg-w975-3rjh, GO-2026-5289 | Medium | Not scored | 16 Apr, 2026 | Go istio.io/istio |
Grafana Loki Path Traversal - CVE-2021-36156 Bypass CVE-2026-21726, GHSA-497x-rrr9-68jp, GO-2026-5115 | Medium | Not scored | 15 Apr, 2026 | Go github.com/grafana/loki Go github.com/grafana/loki/v3 |
KubeVirt's authorization mechanism improperly truncates subresource names CVE-2026-6383, GHSA-j6cv-3w8p-vrg8, GO-2026-5450 | Medium | Not scored | 15 Apr, 2026 | Go kubevirt.io/kubevirt |
OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims BIT-oauth2-proxy-2026-40574, CVE-2026-40574, GHSA-c5c4-8r6x-56w3, GO-2026-5314 | Medium | Not scored | 15 Apr, 2026 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
frp has an authentication bypass in HTTP vhost routing when routeByHTTPUser is used for access control CVE-2026-40910, GHSA-pq96-pwvg-vrr9, GO-2026-5549 | Medium | Not scored | 14 Apr, 2026 | Go github.com/fatedier/frp |