Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via `/api/av/removeUnusedAttributeView` CVE-2026-40259, GHSA-7m5h-w69j-qggg, GO-2026-5229 | High | Not scored | 10 Apr, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering CVE-2026-40107, GHSA-w95v-4h65-j455, GO-2026-5702 | High | Not scored | 10 Apr, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Vikunja vulnerable to Privilege Escalation via Project Reparenting CVE-2026-35595, GHSA-2vq4-854f-5c72, GO-2026-4952 | High | Not scored | 10 Apr, 2026 | Go code.vikunja.io/api |
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install BIT-helm-2026-35205, CVE-2026-35205, GHSA-q5jf-9vfq-h4h7, GO-2026-5566 | High | Not scored | 10 Apr, 2026 | Go helm.sh/helm/v4 |
Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory BIT-helm-2026-35204, CVE-2026-35204, GHSA-vmx8-mqv2-9gmg, GO-2026-5666 | High | Not scored | 10 Apr, 2026 | Go helm.sh/helm/v4 |
Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path CVE-2026-34727, GHSA-8jvc-mcx6-r4cg, GO-2026-5258 | High | Not scored | 10 Apr, 2026 | Go code.vikunja.io/api |
MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing CVE-2026-39414, GHSA-h749-fxx7-pwpg, GO-2026-5415 | High | Not scored | 09 Apr, 2026 | Go github.com/minio/minio |
HashiCorp's go-getter library may allow arbitrary file reads CVE-2026-4660, GHSA-92mm-2pjq-r785, GO-2026-5058 | High | Not scored | 09 Apr, 2026 | Go github.com/hashicorp/go-getter |
mercure has Topic Selector Cache Key Collision CVE-2026-39972, GHSA-hwr4-mq23-wcv5, GO-2026-5444 | High | Not scored | 08 Apr, 2026 | Go github.com/dunglas/mercure |
opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking CVE-2026-39883, GHSA-hfvc-g4fc-pqhx, GO-2026-5426 | High | Not scored | 08 Apr, 2026 | Go go.opentelemetry.io/otel/sdk |
Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit CVE-2026-27806, GHSA-rphv-h674-5hp2, GO-2026-5634 | High | Not scored | 08 Apr, 2026 | Go github.com/fleetdm/fleet/v4 |
kcp's cache server is accessible without authentication or authorization checks CVE-2026-39429, GHSA-3j3q-wp9x-585p, GO-2026-5088 | High | Not scored | 08 Apr, 2026 | Go github.com/kcp-dev/kcp |
File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands CVE-2026-35607, GHSA-7526-j432-6ppp, GO-2026-5205 | High | Not scored | 08 Apr, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser share links remain accessible after Share/Download permissions are revoked CVE-2026-35604, GHSA-v9w4-gm2x-6rvf, GO-2026-5659 | High | Not scored | 08 Apr, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser has a Command Injection via Hook Runner CVE-2026-35585, GHSA-jvpw-637p-h3pw, GO-2026-5481 | High | Not scored | 08 Apr, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) CVE-2026-29181, GHSA-mh2q-q3fh-2475, GO-2026-5506 | High | Not scored | 07 Apr, 2026 | Go go.opentelemetry.io/otel |
Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags GHSA-qmwh-9m9c-h36m, GO-2026-5587 | High | Not scored | 07 Apr, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
Gotenberg Vulnerable to ReDoS via extraHttpHeaders scope feature CVE-2026-35458, GHSA-fmwg-qcqh-m992, GO-2026-5372 | High | Not scored | 07 Apr, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation CVE-2026-4740, GHSA-q4gv-pjmh-c735, GO-2026-5564 | High | Not scored | 07 Apr, 2026 | Go open-cluster-management.io/ocm |
Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri GHSA-x3f4-v83f-7wp2, GO-2026-5737 | High | Not scored | 06 Apr, 2026 | Go github.com/authorizerdev/authorizer |
Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation GHSA-jfwg-rxf3-p7r9, GO-2026-5467 | High | Not scored | 06 Apr, 2026 | Go github.com/authorizerdev/authorizer |
Distribution: stale blob access resurrection via repo-scoped redis descriptor cache invalidation BIT-distribution-2026-35172, CVE-2026-35172, GHSA-f2g3-hh2r-cwgc, GO-2026-4942 | High | Not scored | 06 Apr, 2026 | Go github.com/distribution/distribution Go github.com/distribution/distribution/v3 |
Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm CVE-2026-33540, GHSA-3p65-76g6-3w7r, GO-2026-5094 | High | Not scored | 06 Apr, 2026 | Go github.com/distribution/distribution Go github.com/distribution/distribution/v3 |
Code Extension Marketplace: Zip Slip Path Traversal CVE-2026-35454, GHSA-8x9r-hvwg-c55h, GO-2026-5270 | High | Not scored | 04 Apr, 2026 | Go github.com/coder/code-marketplace |
Juju has a resource poisoning vulnerability CVE-2025-68153, GHSA-245v-p8fj-vwm2, GO-2026-4924 | High | Not scored | 03 Apr, 2026 | Go github.com/juju/juju |
Focalboard doesn't sanitize category IDs before incorporating them into dynamic SQL statements CVE-2026-25773, GHSA-p32q-v29x-wq9r, GO-2026-5524 | High | Not scored | 03 Apr, 2026 | Go github.com/mattermost/focalboard |
Antrea has Missing Encryption of Sensitive Data CVE-2026-34992, GHSA-qcmw-8mm4-4p28, GO-2026-5579 | High | Not scored | 03 Apr, 2026 | Go antrea.io/antrea |
Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata CVE-2026-35037, GHSA-cqgf-f4x7-g6wc, GO-2026-5331 | High | Not scored | 03 Apr, 2026 | Go github.com/lin-snow/ech0 |
Ech0 has Unauthenticated Server-Side Request Forgery in Website Preview Feature CVE-2026-35036, GHSA-wc4h-2348-jc3p, GO-2026-5704 | High | Not scored | 03 Apr, 2026 | Go github.com/lin-snow/ech0 |
Go JOSE Panics in JWE decryption CVE-2026-34986, GHSA-78h2-9frx-2jm8, GO-2026-4945 | High | Not scored | 03 Apr, 2026 | Go github.com/go-jose/go-jose Go github.com/go-jose/go-jose/v3 Go github.com/go-jose/go-jose/v4 |
listmonk's active sessions remain valid after password reset and password change CVE-2026-34828, GHSA-h5j9-cvrw-v5qh, GO-2026-5414 | High | Not scored | 01 Apr, 2026 | Go github.com/knadh/listmonk |
Ferret: Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites CVE-2026-34783, GHSA-j6v5-g24h-vg4j, GO-2026-5452 | High | Not scored | 01 Apr, 2026 | Go github.com/MontFerret/ferret Go github.com/MontFerret/ferret/v2 |
KubeAI: OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods CVE-2026-34940, GHSA-324q-cwx9-7crr, GO-2026-4920 | High | Not scored | 01 Apr, 2026 | Go github.com/kubeai-project/kubeai |
DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost CVE-2026-34742, GHSA-xw59-hvm2-8pj6, GO-2026-5771 | High | Not scored | 01 Apr, 2026 | Go github.com/modelcontextprotocol/go-sdk |
goshs has Auth Bypass via Share Token CVE-2026-34581, GHSA-jgfx-74g2-9r6g, GO-2026-5469 | High | Not scored | 01 Apr, 2026 | Go github.com/patrickhener/goshs |
Tinyauth has OAuth account confusion via shared mutable state on singleton service instances CVE-2026-33544, GHSA-9q5m-jfc4-wc92, GO-2026-5296 | High | Not scored | 01 Apr, 2026 | Go github.com/steveiliop56/tinyauth |
SiYuan vulnerable to reflected XSS via SVG namespace prefix bypass in SanitizeSVG (getDynamicIcon, unauthenticated) CVE-2026-34605, GHSA-73g7-86qr-jrg3, GO-2026-5201 | High | Not scored | 01 Apr, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan Desktop: Stored XSS in imported .sy.zip content leads to arbitrary command execution CVE-2026-34585, GHSA-ff66-236v-p4fg, GO-2026-5357 | High | Not scored | 01 Apr, 2026 | Go github.com/siyuan-note/siyuan/kernel |
File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution CVE-2026-34528, GHSA-x8jc-jvqm-pm3f, GO-2026-5747 | High | Not scored | 31 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file CVE-2026-34529, GHSA-5vpr-4fgw-f69h, GO-2026-5156 | High | Not scored | 31 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark CVE-2026-34453, GHSA-c77m-r996-jr3q, GO-2026-5318 | High | Not scored | 31 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding) CVE-2026-25726, GHSA-f8xp-wvcx-p6f4, GO-2026-5350 | High | Not scored | 31 Mar, 2026 | Go github.com/cloudreve/Cloudreve Go github.com/cloudreve/Cloudreve/v3 Go github.com/cloudreve/Cloudreve/v4 |
nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys CVE-2026-33030, GHSA-5hf2-vhj6-gj9m, GO-2026-4901 | High | Not scored | 30 Mar, 2026 | Go github.com/0xJacky/nginx-ui |
nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse CVE-2026-33028, GHSA-m468-xcm6-fxg4, GO-2026-4906 | High | Not scored | 30 Mar, 2026 | Go github.com/0xJacky/Nginx-UI Go github.com/uozi-tech/cosy |
Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3) CVE-2026-27018, GHSA-jjwv-57xh-xr6r, GO-2026-4905 | High | Not scored | 30 Mar, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186) GHSA-46wh-3698-f2cx, GO-2026-4897 | High | Not scored | 29 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Sliver: Nil Pointer Dereference in tunnelCloseHandler causes panic when a reverse tunnel (rportfwd) close is attempted GHSA-c279-989m-238f, GO-2026-4899 | High | Not scored | 29 Mar, 2026 | Go github.com/bishopfox/sliver |
MinIO is Vulnerable to SSE Metadata Injection via Replication Headers CVE-2026-34204, GHSA-3rh2-v3gr-35p9, GO-2026-4896 | High | Not scored | 27 Mar, 2026 | Go github.com/minio/minio |
Flannel has cross-node remote code execution via extension backend BackendData injection CVE-2026-32241, GHSA-vchx-5pr6-ffx2, GO-2026-4894 | High | Not scored | 27 Mar, 2026 | Go github.com/flannel-io/flannel |
act: actions/cache server allows malicious cache injection CVE-2026-34042, GHSA-x34h-54cw-9825, GO-2026-4890 | High | Not scored | 27 Mar, 2026 | Go github.com/nektos/act |