Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin CVE-2026-34386, GHSA-9p23-p2m4-2r4m, GO-2026-4913 | Medium | Not scored | 30 Mar, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database CVE-2026-34385, GHSA-v895-833r-8c45, GO-2026-4914 | Medium | Not scored | 30 Mar, 2026 | Go github.com/fleetdm/fleet/v4 |
go-git: Maliciously crafted idx file can cause asymmetric memory consumption CVE-2026-34165, GHSA-jhf3-xxhw-2wpp, GO-2026-4910 | Medium | Not scored | 30 Mar, 2026 | Go github.com/go-git/go-git Go github.com/go-git/go-git/v4 Go github.com/go-git/go-git/v5 |
Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF) CVE-2026-33990, GHSA-x2f5-332j-9xwq, GO-2026-4911 | Medium | Not scored | 30 Mar, 2026 | Go github.com/docker/model-runner |
nginx-ui Vulnerable to DoS via Negative Integer Input in Logrotate Interval CVE-2026-33029, GHSA-cp8r-8jvw-v3qg, GO-2026-4902 | Medium | Not scored | 30 Mar, 2026 | Go github.com/0xJacky/Nginx-UI |
Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation CVE-2026-33027, GHSA-m8p8-53vf-8357, GO-2026-4907 | Medium | Not scored | 30 Mar, 2026 | Go github.com/0xJacky/Nginx-UI |
Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField CVE-2026-33433, GHSA-qr99-7898-vr7c, GO-2026-4893 | Medium | Not scored | 27 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
A Fleet team maintainer can transfer hosts from any team via missing source team authorization CVE-2026-29180, GHSA-m2h6-4xpq-qw3m, GO-2026-4892 | Medium | Not scored | 27 Mar, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet: Password reset tokens remain valid after password change for 24 hours CVE-2026-26060, GHSA-3458-r943-hmx4, GO-2026-4888 | Medium | Not scored | 27 Mar, 2026 | Go github.com/fleetdm/fleet/v4 |
Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass CVE-2026-32695, GHSA-67jx-r9pv-98rj, GO-2026-4880 | Medium | Not scored | 27 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Moby has an Off-by-one error in its plugin privilege validation CVE-2026-33997, GHSA-pxq6-2prw-chj9, GO-2026-4883 | Medium | Not scored | 27 Mar, 2026 | Go github.com/docker/docker Go github.com/moby/moby Go github.com/moby/moby/v2 |
Incus vulnerable to denial of source through crafted bucket backup file CVE-2026-33743, GHSA-vg76-xmhg-j5x3, GO-2026-4886 | Medium | Not scored | 27 Mar, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |
Incus vulnerable to local privilege escalation through VM screenshot path CVE-2026-33711, GHSA-q9vp-3wcg-8p4x, GO-2026-4885 | Medium | Not scored | 27 Mar, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |
Grafana public dashboards disclose all direct mode datasources BIT-grafana-2026-27877, CVE-2026-27877, GHSA-3q27-7qjq-p9c5, GO-2026-5095 | Medium | Not scored | 27 Mar, 2026 | Go github.com/grafana/grafana |
Harbor: LDAP password and OIDC secret are not redacted in the audit log GHSA-prh4-vhfh-24mj, GO-2026-4876 | Medium | Not scored | 26 Mar, 2026 | Go github.com/goharbor/harbor |
Ella Core Panics during NAS Authentication Response/Failure with missing IEs CVE-2026-33907, GHSA-55q8-2gwx-29pc, GO-2026-4872 | Medium | Not scored | 26 Mar, 2026 | Go github.com/ellanetworks/core |
Ella Core has a Denial of Service via SCTP connection cleanup deadlock CVE-2026-33904, GHSA-9h59-p45g-445h, GO-2026-4874 | Medium | Not scored | 26 Mar, 2026 | Go github.com/ellanetworks/core |
Ella Core panics when processing a crafted NGAP LocationReport message CVE-2026-33903, GHSA-f2f3-9cx3-wcmf, GO-2026-4875 | Medium | Not scored | 26 Mar, 2026 | Go github.com/ellanetworks/core |
Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions BIT-grafana-2026-21724, CVE-2026-21724, GHSA-7g92-g4vh-hp84, GO-2026-5219 | Medium | Not scored | 26 Mar, 2026 | Go github.com/grafana/grafana |
Mattermost allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration CVE-2026-3112, GHSA-3mw5-466q-295q, GO-2026-5092 | Medium | Not scored | 26 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't set permissions on downloaded bulk export CVE-2026-3113, GHSA-4765-v66x-rqx7, GO-2026-5112 | Medium | Not scored | 26 Mar, 2026 | Go github.com/mattermost/mattermost-server |
Mattermost doesn't validate decompressed archive entry sizes during file extraction CVE-2026-3114, GHSA-vhgh-g7x8-4rx8, GO-2026-5663 | Medium | Not scored | 26 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows authenticated guest users to enumerate user IDs outside their allowed visibility scope CVE-2026-3115, GHSA-mpc7-mm28-f6wq, GO-2026-5512 | Medium | Not scored | 26 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
OpenFGA has an Authorization Bypass through cached keys CVE-2026-33729, GHSA-h6c8-cww8-35hf, GO-2026-4857 | Medium | Not scored | 26 Mar, 2026 | Go github.com/openfga/openfga |
Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic BIT-cilium-2026-33726, BIT-cilium-operator-2026-33726, BIT-hubble-relay-2026-33726, CVE-2026-33726, GHSA-hxv8-4j4r-cqgv, GO-2026-4856 | Medium | Not scored | 26 Mar, 2026 | Go github.com/cilium/cilium |
Mattermost has an Incorrect Authorization issue CVE-2026-4274, GHSA-g7fp-cqj5-x8hf, GO-2026-5393 | Medium | Not scored | 26 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion CVE-2026-33700, GHSA-f95f-77jx-fcjc, GO-2026-4850 | Medium | Not scored | 25 Mar, 2026 | Go code.vikunja.io/api |
Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download CVE-2026-33679, GHSA-g9xj-752q-xh63, GO-2026-4852 | Medium | Not scored | 25 Mar, 2026 | Go code.vikunja.io/api |
Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API CVE-2026-33677, GHSA-7c2g-p23p-4jg3, GO-2026-4846 | Medium | Not scored | 25 Mar, 2026 | Go code.vikunja.io/api |
Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read CVE-2026-33676, GHSA-8cmm-j6c4-rr8v, GO-2026-4847 | Medium | Not scored | 25 Mar, 2026 | Go code.vikunja.io/api |
Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources CVE-2026-33675, GHSA-g66v-54v9-52pr, GO-2026-4851 | Medium | Not scored | 25 Mar, 2026 | Go code.vikunja.io/api |
Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw CVE-2026-27656, GHSA-fg35-5rf6-qg3g, GO-2026-5360 | Medium | Not scored | 25 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't properly validate CSRF tokens CVE-2026-27659, GHSA-rmhw-c3xr-m3xx, GO-2026-5629 | Medium | Not scored | 25 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't rate limit login requests, allowing DoS CVE-2026-26233, GHSA-247x-7qw8-fp98, GO-2026-4916 | Medium | Not scored | 25 Mar, 2026 | Go github.com/mattermost/mattermost-server |
Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds CVE-2026-20719, GHSA-86vc-mg26-fj6x, GO-2026-5245 | Medium | Not scored | 25 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Go Images vulnerable to an out-of-memory error via a crafted TIFF file CVE-2026-33809, GHSA-44p7-9xx4-hf2g, GO-2026-4815 | Medium | Not scored | 25 Mar, 2026 | Go golang.org/x/image |
Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint CVE-2026-33638, GHSA-m983-7426-5hrj, GO-2026-4838 | Medium | Not scored | 24 Mar, 2026 | Go github.com/lin-snow/ech0 |
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching BIT-nats-2026-33248, CVE-2026-33248, GHSA-3f24-pcvm-5jqc, GO-2026-4828 | Medium | Not scored | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers BIT-nats-2026-33246, CVE-2026-33246, GHSA-55h8-8g96-x4hj, GO-2026-4830 | Medium | Not scored | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing BIT-nats-2026-33223, CVE-2026-33223, GHSA-pwx7-fx9r-hr4h, GO-2026-4835 | Medium | Not scored | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS JetStream has an authorization bypass through its Management API BIT-nats-2026-33222, CVE-2026-33222, GHSA-9983-vrx2-fg9c, GO-2026-4832 | Medium | Not scored | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS is vulnerable to pre-auth DoS through WebSockets client service BIT-nats-2026-33219, CVE-2026-33219, GHSA-8r68-gvr4-jh7j, GO-2026-4831 | Medium | Not scored | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS is vulnerable to MQTT hijacking via Client ID BIT-nats-2026-33215, CVE-2026-33215, GHSA-fcjp-h8cc-6879, GO-2026-4833 | Medium | Not scored | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS: Message tracing can be redirected to arbitrary subject BIT-nats-2026-33249, CVE-2026-33249, GHSA-8m2x-3m6q-6w8j, GO-2026-4826 | Medium | Not scored | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token CVE-2026-33621, GHSA-j65m-hv65-r264, GO-2026-4821 | Medium | Not scored | 24 Mar, 2026 | Go github.com/pinchtab/pinchtab |
PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution CVE-2026-33623, GHSA-p8mm-644p-phmh, GO-2026-4823 | Medium | Not scored | 24 Mar, 2026 | Go github.com/pinchtab/pinchtab Go github.com/pinchtab/pinchtab/cmd/pinchtab |
A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution CVE-2026-33622, GHSA-w5pc-m664-r62v, GO-2026-4824 | Medium | Not scored | 24 Mar, 2026 | Go github.com/pinchtab/pinchtab Go github.com/pinchtab/pinchtab/cmd/pinchtab |
PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems CVE-2026-33620, GHSA-mrqc-3276-74f8, GO-2026-4822 | Medium | Not scored | 24 Mar, 2026 | Go github.com/pinchtab/pinchtab |
PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl CVE-2026-33619, GHSA-xqq2-4j46-vwp7, GO-2026-4825 | Medium | Not scored | 24 Mar, 2026 | Go github.com/pinchtab/pinchtab |
FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel CVE-2026-54685, GHSA-7789-65hx-f26w, GO-2026-4820 | Medium | Not scored | 24 Mar, 2026 | Go github.com/gtsteffaniak/filebrowser/backend |