Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SiYuan has incomplete fix for CVE-2026-33066: XSS CVE-2026-40922, GHSA-8q5w-mmxf-48jg, GO-2026-5260 | Medium | Not scored | 14 Apr, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs CVE-2026-40091, GHSA-jf4f-rr2c-9m58, GO-2026-5465 | Medium | Not scored | 14 Apr, 2026 | Go github.com/authzed/spicedb |
PowerShell Command Injection in Podman HyperV Machine CVE-2026-33414, GHSA-hc8w-h2mf-hp59, GO-2026-5421 | Medium | Not scored | 14 Apr, 2026 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 +1 more |
goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation CVE-2026-40883, GHSA-jrq5-hg6x-j6g3, GO-2026-5479 | Medium | Not scored | 14 Apr, 2026 | Go github.com/patrickhener/goshs Go github.com/patrickhener/goshs/v2 |
free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors CVE-2026-40249, GHSA-gx38-8h33-pmxr, GO-2026-5407 | Medium | Not scored | 14 Apr, 2026 | Go github.com/free5gc/udr |
Sigstore Timestamp Authority has Improper Certificate Validation in verifier CVE-2026-39984, GHSA-xm5m-wgh2-rrg3, GO-2026-5763 | Medium | Not scored | 14 Apr, 2026 | Go github.com/sigstore/timestamp-authority Go github.com/sigstore/timestamp-authority/v2 |
Note Mark has Broken Access Control on Asset Download CVE-2026-40265, GHSA-p5w6-75f9-cc2p, GO-2026-5530 | Medium | Not scored | 13 Apr, 2026 | Go github.com/enchant97/note-mark/backend |
Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer BIT-prometheus-2026-40179, CVE-2026-40179, GHSA-vffh-x6r8-xx99, GO-2026-5662 | Medium | Not scored | 13 Apr, 2026 | Go github.com/prometheus/prometheus |
Temporal does not enforce authentication and authorization for the streaming AdminService/StreamWorkflowReplicationMessages endpoint CVE-2026-5724, GHSA-q98v-9f9w-f49q, GO-2026-5578 | Medium | Not scored | 10 Apr, 2026 | Go go.temporal.io/server |
Juju: In-Memory Token Store for Discharge Tokens Lacks Concurrency Safety and Persistence CVE-2026-5774, GHSA-7m55-2hr4-pw78, GO-2026-5228 | Medium | Not scored | 10 Apr, 2026 | Go github.com/juju/juju |
Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload CVE-2026-79670, GHSA-69hx-63pv-f8f4, GO-2026-5172 | Medium | Not scored | 10 Apr, 2026 | Go github.com/lin-snow/ech0 |
Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation CVE-2026-79671, GHSA-r2x7-427f-rq69, GO-2026-5603 | Medium | Not scored | 10 Apr, 2026 | Go github.com/lin-snow/ech0 |
Ech0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure CVE-2026-79669, GHSA-w8jj-cwmc-wgq2, GO-2026-5701 | Medium | Not scored | 10 Apr, 2026 | Go github.com/lin-snow/ech0 |
Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass CVE-2026-79672, GHSA-fwg7-53p4-g33c, GO-2026-5382 | Medium | Not scored | 10 Apr, 2026 | Go github.com/lin-snow/ech0 |
Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session CVE-2026-79673, GHSA-hm2h-wwwh-g49x, GO-2026-5431 | Medium | Not scored | 10 Apr, 2026 | Go github.com/lin-snow/ech0 |
Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs CVE-2026-79666, GHSA-cp79-9mwr-wr49, GO-2026-5328 | Medium | Not scored | 10 Apr, 2026 | Go github.com/lin-snow/ech0 |
Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource CVE-2026-39961, GHSA-99j8-wv67-4c72, GO-2026-5283 | Medium | Not scored | 10 Apr, 2026 | Go github.com/aiven/aiven-operator |
Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds CVE-2026-40103, GHSA-v479-vf79-mg83, GO-2026-5650 | Medium | Not scored | 10 Apr, 2026 | Go code.vikunja.io/api |
Vikunja has File Size Limit Bypass via Vikunja Import CVE-2026-35602, GHSA-qh78-rvg3-cv54, GO-2026-5582 | Medium | Not scored | 10 Apr, 2026 | Go code.vikunja.io/api |
Vikunja has iCalendar Property Injection via CRLF in CalDAV Task Output CVE-2026-35601, GHSA-2g7h-7rqr-9p4r, GO-2026-4951 | Medium | Not scored | 10 Apr, 2026 | Go code.vikunja.io/api |
Vikunja has HTML Injection via Task Titles in Overdue Email Notifications CVE-2026-35600, GHSA-45q4-x4r9-8fqj, GO-2026-5111 | Medium | Not scored | 10 Apr, 2026 | Go code.vikunja.io/api |
Vikunja has Algorithmic Complexity DoS in Repeating Task Handler CVE-2026-35599, GHSA-r4fg-73rc-hhh7, GO-2026-5608 | Medium | Not scored | 10 Apr, 2026 | Go code.vikunja.io/api |
Vikunja Missing Authorization on CalDAV Task Read CVE-2026-35598, GHSA-48ch-p4gq-x46x, GO-2026-5114 | Medium | Not scored | 10 Apr, 2026 | Go code.vikunja.io/api |
Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout CVE-2026-35597, GHSA-fgfv-pv97-6cmj, GO-2026-5362 | Medium | Not scored | 10 Apr, 2026 | Go code.vikunja.io/api |
Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug CVE-2026-35596, GHSA-hj5c-mhh2-g7jq, GO-2026-5428 | Medium | Not scored | 10 Apr, 2026 | Go code.vikunja.io/api |
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment BIT-helm-2026-35206, CVE-2026-35206, GHSA-hr2v-4r36-88hr, GO-2026-5435 | Medium | Not scored | 10 Apr, 2026 | Go helm.sh/helm/v3 Go helm.sh/helm/v4 |
Vikunja: Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade CVE-2026-35594, GHSA-96q5-xm3p-7m84, GO-2026-5276 | Medium | Not scored | 10 Apr, 2026 | Go code.vikunja.io/api |
Mattermost MS Teams plugin doesn't limit the request body size on the /changes webhook endpoint CVE-2026-24661, GHSA-5rfv-h47g-xj42, GO-2026-5153 | Medium | Not scored | 09 Apr, 2026 | Go github.com/mattermost/mattermost-plugin-msteams |
OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response CVE-2026-40293, GHSA-68m9-983m-f3v5, GO-2026-5170 | Medium | Not scored | 08 Apr, 2026 | Go github.com/openfga/openfga |
monetr: Protected Transactions Deletable via PUT CVE-2026-39901, GHSA-hqxq-hwqf-wg83, GO-2026-5434 | Medium | Not scored | 08 Apr, 2026 | Go github.com/monetr/monetr |
opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies CVE-2026-39882, GHSA-w8rr-5gcm-pp58, GO-2026-4985 | Medium | Not scored | 08 Apr, 2026 | Go go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp Go go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp Go go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp |
kubernetes-graphql-gateway: GraphQL Endpoint Vulnerable to Authenticated Denial-of-Service via Unrestricted Query Execution GHSA-h9mw-h4qc-f5jf, GO-2026-5420 | Medium | Not scored | 08 Apr, 2026 | Go github.com/platform-mesh/kubernetes-graphql-gateway |
Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder CVE-2026-89090, GHSA-xmrv-pmrh-hhx2, GO-2026-5764 | Medium | Not scored | 08 Apr, 2026 | Go github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream Go github.com/aws/aws-sdk-go-v2/service/bedrockagentcore Go github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime Go github.com/aws/aws-sdk-go-v2/service/bedrockruntime +8 more |
Cosign's verify-blob-attestation reports false positive when payload parsing fails BIT-cosign-2026-39395, CVE-2026-39395, GHSA-w6c6-c85g-mmv6, GO-2026-5694 | Medium | Not scored | 08 Apr, 2026 | Go github.com/sigstore/cosign Go github.com/sigstore/cosign/v2 Go github.com/sigstore/cosign/v3 |
kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level GHSA-fcmh-qfxc-w685, GO-2026-5354 | Medium | Not scored | 08 Apr, 2026 | Go github.com/cloudnativelabs/kube-router Go github.com/cloudnativelabs/kube-router/v2 |
File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check CVE-2026-35606, GHSA-67cg-cpj7-qgc9, GO-2026-5167 | Medium | Not scored | 08 Apr, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser has an access rule bypass via HasPrefix without trailing separator in path matching CVE-2026-35605, GHSA-5q48-q4fm-g3m6, GO-2026-5150 | Medium | Not scored | 08 Apr, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision CVE-2026-34972, GHSA-jwvj-g8pc-cx45, GO-2026-5483 | Medium | Not scored | 07 Apr, 2026 | Go github.com/openfga/openfga |
go-ipld-prime: DAG-CBOR decoder unbounded memory allocation from CBOR headers CVE-2026-35480, GHSA-378j-3jfj-8r9f, GO-2026-5073 | Medium | Not scored | 06 Apr, 2026 | Go github.com/ipld/go-ipld-prime |
Hugo: Certain markdown links are not properly escaped CVE-2026-35166, GHSA-mcv8-8m8x-48pg, GO-2026-5504 | Medium | Not scored | 03 Apr, 2026 | Go github.com/gohugoio/hugo |
Juju: Read All Controller Logs From Compromised Workload CVE-2025-68152, GHSA-j6f6-jp3p-53mw, GO-2026-5451 | Medium | Not scored | 03 Apr, 2026 | Go github.com/juju/juju |
Focalboard doesn't validate file ownership when serving uploaded files CVE-2026-28736, GHSA-vph7-r229-qxpf, GO-2026-5670 | Medium | Not scored | 03 Apr, 2026 | Go github.com/mattermost/focalboard |
Casdoor vulnerable to SSRF via crafted Webhook URL CVE-2026-5469, GHSA-p8c7-hjc4-gwf8, GO-2026-5535 | Medium | Not scored | 03 Apr, 2026 | Go github.com/casdoor/casdoor |
Tesla Fleet Telemetry allows spoofing telemetry for arbitrary vehicles via compromised vehicle credentials GHSA-prxj-3gcv-cqrh, GO-2026-5553 | Medium | Not scored | 01 Apr, 2026 | Go github.com/teslamotors/fleet-telemetry |
Ella Core Panics Upon NGAP handover failure CVE-2026-34761, GHSA-6gm8-3g4h-w82m, GO-2026-5177 | Medium | Not scored | 01 Apr, 2026 | Go github.com/ellanetworks/core |
NetBird has Race Condition on UpdateUser Function, Resulting in Privilege Escalation From Admin to Owner GHSA-rxmp-8h9v-56cx, GO-2026-5646 | Medium | Not scored | 01 Apr, 2026 | Go github.com/netbirdio/netbird |
File Browser vulnerable to Stored Cross-site Scripting via text/template branding injection CVE-2026-34530, GHSA-xfqj-3vmx-63wv, GO-2026-5754 | Medium | Not scored | 31 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface CVE-2026-34227, GHSA-6fpf-248c-m7wm, GO-2026-5175 | Medium | Not scored | 31 Mar, 2026 | Go github.com/bishopfox/sliver |
Fleet's user account creation via invite does not enforce invited email address CVE-2026-34389, GHSA-4f9r-x588-pp2h, GO-2026-4912 | Medium | Not scored | 30 Mar, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint CVE-2026-34388, GHSA-w254-4hp5-7cvv, GO-2026-4915 | Medium | Not scored | 30 Mar, 2026 | Go github.com/fleetdm/fleet/v4 |