Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
act: Unrestricted set-env and add-path command processing enables environment injection CVE-2026-34041, GHSA-xmgr-9pqc-h5vw, GO-2026-4891 | High | Not scored | 27 Mar, 2026 | Go github.com/nektos/act |
Fleet's unbounded request body read allows remote Denial of Service CVE-2026-26061, GHSA-99hj-44vg-hfcp, GO-2026-4889 | High | Not scored | 27 Mar, 2026 | Go github.com/fleetdm/fleet/v4 |
Moby has AuthZ plugin bypass when provided oversized request bodies CVE-2026-34040, GHSA-x744-4wpc-v9h2, GO-2026-4887 | High | Not scored | 27 Mar, 2026 | Go github.com/docker/docker Go github.com/moby/moby Go github.com/moby/moby/v2 |
Local Incus UI web server vulnerable to nuthentication bypass CVE-2026-33898, GHSA-453r-g2pg-cxxq, GO-2026-4879 | High | Not scored | 27 Mar, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incus |
Incus does not verify combined fingerprint when downloading images from simplestreams servers CVE-2026-33542, GHSA-p8mm-23gg-jc9r, GO-2026-4882 | High | Not scored | 27 Mar, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/client |
Grafana Tempo has Inadequate Encryption Strength CVE-2026-28377, GHSA-ffqx-q65f-36jf, GO-2026-5359 | High | Not scored | 27 Mar, 2026 | Go github.com/grafana/tempo |
Ella Core has Privilege Escalation via Database Restore by NetworkManager role CVE-2026-33906, GHSA-87j9-m7x6-hvw2, GO-2026-4873 | High | Not scored | 26 Mar, 2026 | Go github.com/ellanetworks/core |
Contrast BadAML injection allows arbitrary code execution CVE-2026-100839, GHSA-g9ww-x58f-9g6m, GO-2026-4863 | High | Not scored | 26 Mar, 2026 | Go github.com/edgelesssys/contrast |
Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences CVE-2026-3108, GHSA-3439-vqgj-2gcf, GO-2026-5067 | High | Not scored | 26 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
BuildKit Git URL subdir component can cause access to restricted files CVE-2026-33748, GHSA-4vrq-3vrq-g6gg, GO-2026-4859 | High | Not scored | 26 Mar, 2026 | Go github.com/moby/buildkit |
BuildKit's Malicious frontend can cause file escape outside of storage root CVE-2026-33747, GHSA-4c29-8rgm-jvjj, GO-2026-4858 | High | Not scored | 26 Mar, 2026 | Go github.com/moby/buildkit |
Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation CVE-2026-33680, GHSA-8hp8-9fhr-pfm9, GO-2026-4848 | High | Not scored | 25 Mar, 2026 | Go code.vikunja.io/api |
Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion CVE-2026-33678, GHSA-jfmm-mjcp-8wq2, GO-2026-4853 | High | Not scored | 25 Mar, 2026 | Go code.vikunja.io/api |
Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect CVE-2026-33668, GHSA-94xm-jj8x-3cr4, GO-2026-4849 | High | Not scored | 25 Mar, 2026 | Go code.vikunja.io/api |
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead BIT-nats-2026-27889, CVE-2026-27889, GHSA-pq2q-rcw4-3hr6, GO-2026-4841 | High | Not scored | 25 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS has pre-auth server panic via leafnode handling BIT-nats-2026-33218, CVE-2026-33218, GHSA-vprv-35vv-q339, GO-2026-4837 | High | Not scored | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS allows MQTT clients to bypass ACL checks BIT-nats-2026-33217, CVE-2026-33217, GHSA-jxxm-27vp-c3m5, GO-2026-4834 | High | Not scored | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS has MQTT plaintext password disclosure BIT-nats-2026-33216, CVE-2026-33216, GHSA-v722-jcv5-w7mc, GO-2026-4836 | High | Not scored | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS Server panic via malicious compression on leafnode port BIT-nats-2026-29785, CVE-2026-29785, GHSA-52jh-2xxh-pwh6, GO-2026-4829 | High | Not scored | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS credentials are exposed in monitoring port via command-line argv BIT-nats-2026-33247, CVE-2026-33247, GHSA-x6g4-f6q3-fqvv, GO-2026-4827 | High | Not scored | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
DigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint CVE-2026-24516, GHSA-fh3m-562m-w4f6, GO-2026-4854 | High | Not scored | 23 Mar, 2026 | Go github.com/digitalocean/droplet-agent |
Ory Keto has a SQL injection via forged pagination tokens CVE-2026-33505, GHSA-c38g-mx2c-9wf2, GO-2026-4800 | High | Not scored | 20 Mar, 2026 | Go github.com/ory/keto |
Ory Hydra has a SQL injection via forged pagination tokens CVE-2026-33504, GHSA-r9w3-57w2-gch2, GO-2026-4807 | High | Not scored | 20 Mar, 2026 | Go github.com/ory/hydra Go github.com/ory/hydra/v2 |
Ory Kratos has a SQL injection via forged pagination tokens CVE-2026-33503, GHSA-hgx2-28f8-6g2r, GO-2026-4801 | High | Not scored | 20 Mar, 2026 | Go github.com/ory/kratos |
Ory Oathkeeper has an authentication bypass by cache key confusion CVE-2026-33496, GHSA-4mq7-pvjg-xp2r, GO-2026-4799 | High | Not scored | 20 Mar, 2026 | Go github.com/ory/oathkeeper |
etcd: Authorization bypasses in multiple APIs BIT-etcd-2026-33413, CVE-2026-33413, GHSA-q8m4-xhhv-38mg, GO-2026-4806 | High | Not scored | 20 Mar, 2026 | Go go.etcd.io/etcd Go go.etcd.io/etcd/v3 |
Siyuan has an Unauthenticated Arbitrary File Read via Path Traversal CVE-2026-33476, GHSA-hhgj-gg9h-rjp7, GO-2026-4802 | High | Not scored | 20 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement CVE-2026-33316, GHSA-vq4q-79hh-q767, GO-2026-4798 | High | Not scored | 20 Mar, 2026 | Go code.vikunja.io/api |
Traefik has a Potential mTLS Bypass via Fragmented TLS ClientHello Causing Pre-SNI Sniff Fallback to Default Non-mTLS TLS Config CVE-2026-32305, GHSA-wvvq-wgcr-9q48, GO-2026-4793 | High | Not scored | 20 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
ingress-nginx comment-based nginx configuration injection CVE-2026-4342, GHSA-f53h-mxv9-cp98, GO-2026-4796 | High | Not scored | 20 Mar, 2026 | Go k8s.io/ingress-nginx |
In Soft Serve, an authenticated repo import can clone server-local private repositories CVE-2026-33353, GHSA-xgxp-f695-6vrp, GO-2026-4788 | High | Not scored | 19 Mar, 2026 | Go github.com/charmbracelet/soft-serve |
Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG CVE-2026-33344, GHSA-ph8x-4jfv-v9v8, GO-2026-4785 | High | Not scored | 19 Mar, 2026 | Go github.com/dagu-org/dagu |
Ella Core panics on malformed NGAP Location Report CVE-2026-33282, GHSA-826q-wrq4-p23x, GO-2026-4780 | High | Not scored | 19 Mar, 2026 | Go github.com/ellanetworks/core |
Juju has unauthorized access to out-of-scope Kubernetes secrets CVE-2026-32693, GHSA-439w-v2p7-pggc, GO-2026-4777 | High | Not scored | 19 Mar, 2026 | Go github.com/juju/juju |
Juju has unauthorized update of out-of-scope Vault secrets CVE-2026-32692, GHSA-89x7-5m5m-mcmm, GO-2026-4781 | High | Not scored | 19 Mar, 2026 | Go github.com/juju/juju |
Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk CVE-2026-33252, GHSA-89xv-2j6f-qhc8, GO-2026-4773 | High | Not scored | 19 Mar, 2026 | Go github.com/modelcontextprotocol/go-sdk |
Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk GHSA-q382-vc8q-7jhj, GO-2026-4770 | High | Not scored | 19 Mar, 2026 | Go github.com/modelcontextprotocol/go-sdk |
Unsigned SAML LogoutRequest Acceptance in gosaml2 GHSA-pcgw-qcv5-h8ch, GO-2026-4764 | High | Not scored | 18 Mar, 2026 | Go github.com/russellhaering/gosaml2 |
gosaml2 CBC Padding Panic — Unauthenticated Process Crash GHSA-hwqm-qvj9-4jr2, GO-2026-4760 | High | Not scored | 18 Mar, 2026 | Go github.com/russellhaering/gosaml2 |
validateSignature Loop Variable Capture Signature Bypass in goxmldsig CVE-2026-33487, GHSA-479m-364c-43vc, GO-2026-4753 | High | Not scored | 18 Mar, 2026 | Go github.com/russellhaering/goxmldsig |
free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques CVE-2026-33192, GHSA-5rvc-5cwx-g5x8, GO-2026-4755 | High | Not scored | 18 Mar, 2026 | Go github.com/free5gc/udm |
free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error CVE-2026-33191, GHSA-p9hg-pq3q-v9gv, GO-2026-4763 | High | Not scored | 18 Mar, 2026 | Go github.com/free5gc/udm |
SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass CVE-2026-33203, GHSA-3g9h-9hp4-654v, GO-2026-4752 | High | Not scored | 18 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference CVE-2026-33064, GHSA-7g27-v5wj-jr75, GO-2026-4757 | High | Not scored | 18 Mar, 2026 | Go github.com/free5gc/udm |
free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion CVE-2026-33063, GHSA-4jrw-92fg-4jwx, GO-2026-4754 | High | Not scored | 18 Mar, 2026 | Go github.com/free5gc/ausf |
free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter CVE-2026-33062, GHSA-7c47-xr7q-p6hg, GO-2026-4756 | High | Not scored | 18 Mar, 2026 | Go github.com/free5gc/nrf |
Out-of-Bounds Slice Access in free5GC CHF Leading to DoS CVE-2026-32937, GHSA-6g43-577r-wf4x, GO-2026-4750 | High | Not scored | 18 Mar, 2026 | Go github.com/free5gc/chf |
Heimdall: Path received via Envoy gRPC corrupted when containing query string CVE-2026-32811, GHSA-r8x2-fhmf-6mxp, GO-2026-4742 | High | Not scored | 18 Mar, 2026 | Go github.com/dadrus/heimdall |
XPath: Boolean expression infinite loop leads to denial of service via CPU exhaustion CVE-2026-32287, GHSA-65xw-vw82-r86x, GO-2026-4526 | High | Not scored | 17 Mar, 2026 | Go github.com/antchfx/xpath |
Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS CVE-2026-32254, GHSA-phqm-jgc3-qf8g, GO-2026-4724 | High | Not scored | 17 Mar, 2026 | Go github.com/cloudnativelabs/kube-router Go github.com/cloudnativelabs/kube-router/v2 |