Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization BIT-envoy-gateway-2026-53719, CVE-2026-53719, GHSA-m2v6-2jmh-4c68, GO-2026-6009 | Medium | Not scored | 16 Jul, 2026 | Go github.com/envoyproxy/gateway |
Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit BIT-envoy-gateway-2026-53716, CVE-2026-53716, GHSA-cxpq-8v7q-cg56, GO-2026-6006 | Medium | Not scored | 16 Jul, 2026 | Go github.com/envoyproxy/gateway |
Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass BIT-envoy-gateway-2026-53718, CVE-2026-53718, GHSA-fcrp-7gc2-93g7, GO-2026-6007 | Medium | Not scored | 16 Jul, 2026 | Go github.com/envoyproxy/gateway |
kumactl connects to control plane without verifying TLS certificate when no CA is configured CVE-2026-18678, CVE-2026-50166, GHSA-v95x-xhq5-4929, GO-2026-6010 | Medium | Not scored | 16 Jul, 2026 | Go github.com/kumahq/kuma Go github.com/kumahq/kuma/v2 |
ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) CVE-2026-58196, GHSA-pr64-jmmf-jp54, GO-2026-6002 | Low | Not scored | 15 Jul, 2026 | Go github.com/stacklok/toolhive |
Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback CVE-2026-50285, GHSA-ggw3-5987-rx77 | High | Not scored | 15 Jul, 2026 | Go github.com/pomerium/pomerium |
dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS CVE-2026-50274, GHSA-74j5-xf3v-crq8, GO-2026-6000 | High | Not scored | 15 Jul, 2026 | Go github.com/DataDog/dd-trace-go Go github.com/DataDog/dd-trace-go/v2 |
open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters CVE-2026-54495, GHSA-398h-7f66-3h4p, GO-2026-5998 | Medium | Not scored | 15 Jul, 2026 | Go github.com/open-feature/open-feature-operator |
safeurl is Missing IPv6 CIDR Ranges in Blocklist CVE-2026-54452, GHSA-xgch-x3mx-cm3c, GO-2026-5997 | Medium | Not scored | 15 Jul, 2026 | Go github.com/doyensec/safeurl |
ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway CVE-2026-54450, GHSA-pph6-vfjv-vpjw, GO-2026-5996 | Low | Not scored | 15 Jul, 2026 | Go github.com/stacklok/toolhive |
Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend CVE-2026-61549, GHSA-qf34-295c-26v8, GO-2026-5992 | High | Not scored | 14 Jul, 2026 | Go github.com/woodpecker-ci/woodpecker Go go.woodpecker-ci.org/woodpecker Go go.woodpecker-ci.org/woodpecker/v2 Go go.woodpecker-ci.org/woodpecker/v3 |
Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` CVE-2026-63464, GHSA-7rx3-5wx3-5v76, GO-2026-5985 | High | Not scored | 14 Jul, 2026 | Go github.com/forgekeep/nebula-mesh |
nebula-mesh: Certificate revocation is never enforced at the mesh CVE-2026-61699, GHSA-cm26-5974-52h8, GO-2026-5986 | High | Not scored | 14 Jul, 2026 | Go github.com/forgekeep/nebula-mesh |
nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens CVE-2026-55513, GHSA-g4x6-jcvr-9m3g, GO-2026-5987 | Medium | Not scored | 14 Jul, 2026 | Go github.com/forgekeep/nebula-mesh Go github.com/juev/nebula-mesh |
nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting CVE-2026-55512, GHSA-m3cx-mwpg-32jg, GO-2026-5989 | Medium | Not scored | 14 Jul, 2026 | Go github.com/forgekeep/nebula-mesh Go github.com/juev/nebula-mesh |
Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode CVE-2026-54629, GHSA-mf78-3rpf-r784, GO-2026-5990 | High | Not scored | 14 Jul, 2026 | Go github.com/julien040/anyquery |
nebula-mesh: Operator session tokens stored in plaintext in the database CVE-2026-53603, GHSA-q4vm-pq3q-8wgq, GO-2026-5991 | High | Not scored | 14 Jul, 2026 | Go github.com/forgekeep/nebula-mesh |
nebula-mesh: CA private key not zeroized on web mobile-bundle error paths CVE-2026-53604, GHSA-2p2f-px33-4vv5, GO-2026-5984 | High | Not scored | 14 Jul, 2026 | Go github.com/forgekeep/nebula-mesh |
Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode CVE-2026-54628, GHSA-hwrq-8wxh-q4xv, GO-2026-5988 | High | Not scored | 14 Jul, 2026 | Go github.com/julien040/anyquery |
Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware GHSA-mqxv-9rm6-w8qc, GO-2026-5981 | High | Not scored | 14 Jul, 2026 | Go github.com/lin-snow/ech0 |
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser CVE-2026-54448, GHSA-q3fv-x8vg-qqm4, GO-2026-5983 | High | Not scored | 14 Jul, 2026 | Go github.com/aquasecurity/trivy |
TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services GHSA-pqg7-v6wh-3pfp, GO-2026-5982 | High | Not scored | 14 Jul, 2026 | Go github.com/almeidapaulopt/tsdproxy |
yutu: Arbitrary File Write via MCP `caption-download` Tool CVE-2026-50158, GHSA-2c7f-fxww-6w6c, GO-2026-5980 | High | Not scored | 14 Jul, 2026 | Go github.com/eat-pray-ai/yutu |
Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation CVE-2026-50141, GHSA-g7mm-9vx7-jm7h, GO-2026-5976 | High | Not scored | 14 Jul, 2026 | Go go.woodpecker-ci.org/woodpecker Go go.woodpecker-ci.org/woodpecker/v2 Go go.woodpecker-ci.org/woodpecker/v3 |
Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode CVE-2026-50006, GHSA-xrcf-6jh3-ggvx, GO-2026-5979 | Critical | Not scored | 14 Jul, 2026 | Go github.com/julien040/anyquery |
MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion CVE-2026-50125, GHSA-qw5r-ppcg-f8rj, GO-2026-5978 | High | Not scored | 14 Jul, 2026 | Go github.com/StacklokLabs/mkp |
Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions CVE-2026-50018, GHSA-42j2-w334-qxw7, GO-2026-5975 | Medium | Not scored | 14 Jul, 2026 | Go github.com/SpectoLabs/hoverfly |
Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode CVE-2026-50013, GHSA-qrh4-p6v4-mrfg, GO-2026-5977 | High | Not scored | 14 Jul, 2026 | Go github.com/SpectoLabs/hoverfly |
K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression CVE-2026-54250, GHSA-jxr7-mqhw-9p98, GO-2026-5973 | Medium | Not scored | 14 Jul, 2026 | Go github.com/k3s-io/k3s |
Infinite loop on invalid input in golang.org/x/text CVE-2026-56852, GO-2026-5970 | Not scored | 14 Jul, 2026 | Go golang.org/x/text | |
Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage BIT-golang-2026-46600, CVE-2026-46600, GO-2026-5942 | Not scored | 14 Jul, 2026 | Go golang.org/x/net Go stdlib | |
OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection CVE-2026-44300, GHSA-wmj8-9953-vff5, GO-2026-5974 | High | Not scored | 14 Jul, 2026 | Go github.com/opencost/opencost |
TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation GHSA-g936-7jqj-mwv8, GO-2026-5969 | Critical | Not scored | 10 Jul, 2026 | Go github.com/almeidapaulopt/tsdproxy |
melange: Incomplete package integrity verification allows data section substitution CVE-2026-54174, GHSA-fpg8-7664-jc5q, GO-2026-5968 | High | Not scored | 10 Jul, 2026 | Go chainguard.dev/apko Go chainguard.dev/melange |
SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content CVE-2026-50551, GHSA-56mp-4f3v-fgj2, GO-2026-5967 | Critical | Not scored | 10 Jul, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML() CVE-2026-54158, GHSA-5xfx-xj4h-5p7r, GO-2026-5957 | Critical | Not scored | 10 Jul, 2026 | Go github.com/siyuan-note/siyuan/kernel |
File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) CVE-2026-54088, GHSA-m93h-4hw7-5qcm, GO-2026-5962 | Critical | Not scored | 10 Jul, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
SiYuan: Stored XSS in Bazaar marketplace via package README event handlers CVE-2026-54070, GHSA-w7cg-whh7-xp28, GO-2026-5965 | High | Not scored | 10 Jul, 2026 | Go github.com/siyuan-note/siyuan/kernel |
File Browser: Authentication Bypass via Proxy Auth Header Forgery CVE-2026-54089, GHSA-xqp3-jq6g-x3qm, GO-2026-5966 | Critical | Not scored | 10 Jul, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist CVE-2026-54069, GHSA-hvr9-72v2-fff3, GO-2026-5961 | Critical | Not scored | 10 Jul, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon CVE-2026-54068, GHSA-gcm7-57gf-953c, GO-2026-5958 | Medium | Not scored | 10 Jul, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) CVE-2026-54063, GHSA-h69g-9hx6-f3v4, GO-2026-5960 | High | Not scored | 10 Jul, 2026 | Go github.com/xuri/excelize/v2 |
Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL CVE-2026-54072, GHSA-h29v-hj44-q8cv, GO-2026-5959 | Critical | Not scored | 10 Jul, 2026 | Go github.com/authorizerdev/authorizer |
SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() CVE-2026-54067, GHSA-mvjr-vv3c-w4qv, GO-2026-5963 | Critical | Not scored | 10 Jul, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894 CVE-2026-54066, GHSA-p4m3-mgmm-c664, GO-2026-5964 | High | Not scored | 10 Jul, 2026 | Go github.com/siyuan-note/siyuan/kernel |
GoBGP confederation validation panics on empty AS_PATH attribute CVE-2026-49838, GHSA-frrj-87jh-2772, GO-2026-5954 | Medium | Not scored | 09 Jul, 2026 | Go github.com/osrg/gobgp/v4 |
GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries CVE-2026-49837, GHSA-gjrg-jjr3-56cm, GO-2026-5955 | Medium | Not scored | 09 Jul, 2026 | Go github.com/osrg/gobgp/v4 |
sigstore-go has a multi-log threshold bypass via single compromised log CVE-2026-49834, GHSA-9vcr-p3rj-q5q6, GO-2026-5952 | Medium | Not scored | 09 Jul, 2026 | Go github.com/sigstore/sigstore-go |
OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect CVE-2026-55252, GHSA-h5g6-xmh4-hc37, GO-2026-5956 | Medium | Not scored | 09 Jul, 2026 | Go github.com/openrundev/openrun |
nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate CVE-2026-53602, GHSA-339v-266x-79xr, GO-2026-5950 | Medium | Not scored | 09 Jul, 2026 | Go github.com/forgekeep/nebula-mesh |