Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) CVE-2026-50553, GHSA-rqrh-8wpv-x7hh, GO-2026-5949 | High | Not scored | 09 Jul, 2026 | Go github.com/enchant97/note-mark/backend |
Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books CVE-2026-50554, GHSA-588f-fvcv-xhvf, GO-2026-5948 | Medium | Not scored | 09 Jul, 2026 | Go github.com/enchant97/note-mark/backend |
Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE CVE-2026-53649, GHSA-xqhv-chqm-fhcc, GO-2026-5947 | Critical | Not scored | 08 Jul, 2026 | Go github.com/BishopFox/joro |
Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE CVE-2026-52831, GHSA-v5px-423j-pf7p, GO-2026-5946 | Critical | Not scored | 08 Jul, 2026 | Go github.com/nuclio/nuclio |
Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests CVE-2026-50197, GHSA-659f-rgp5-w4wf, GO-2026-5944 | High | Not scored | 08 Jul, 2026 | Go github.com/zalando/skipper |
oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read) CVE-2026-53508, GHSA-2jcc-mxv7-p3f9, GO-2026-5937 | Medium | Not scored | 07 Jul, 2026 | Go github.com/oasdiff/oasdiff |
KEDA has PostgreSQL connection string parameter injection via incomplete whitespace escaping CVE-2026-53572, GHSA-6w3m-4hhp-775q, GO-2026-5940 | Medium | Not scored | 07 Jul, 2026 | Go github.com/kedacore/keda Go github.com/kedacore/keda/v2 |
Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise CVE-2026-114665, CVE-2026-53553, GHSA-4g5x-hcwm-82jw, GO-2026-5938 | High | Not scored | 07 Jul, 2026 | Go github.com/zhenorzz/goploy |
Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers CVE-2026-53552, GHSA-26rh-24rg-j3vv, GO-2026-5936 | Critical | Not scored | 07 Jul, 2026 | Go github.com/zhenorzz/goploy |
Kite has an authenticated cluster RBAC bypass in /api/v1/overview CVE-2026-53487, GHSA-gvhc-wv3v-7pf8, GO-2026-5941 | Medium | Not scored | 07 Jul, 2026 | Go github.com/zxh326/kite |
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues GO-2026-5932 | Not scored | 07 Jul, 2026 | Go golang.org/x/crypto Go golang.org/x/crypto/openpgp | |
Root escape via symlink plus trailing slash in os BIT-golang-2026-39822, CVE-2026-39822, GO-2026-4970 | Not scored | 07 Jul, 2026 | Go stdlib | |
Invoking Encrypted Client Hello privacy leak in crypto/tls BIT-golang-2026-42505, CVE-2026-42505, GO-2026-5856 | Not scored | 07 Jul, 2026 | Go stdlib | |
LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs CVE-2026-59707, GHSA-8c5q-hx4g-qq23, GO-2026-6645 | Critical | Not scored | 07 Jul, 2026 | Go github.com/mudler/LocalAI |
netfoil: Attacker controlled data written to logs GHSA-7856-g3gv-9wq8, GO-2026-5935 | Low | Not scored | 07 Jul, 2026 | Go github.com/tinfoil-factory/netfoil |
netfoil has a resource leak in LRU cache GHSA-3g4q-2f67-2gvh, GO-2026-5933 | Low | Not scored | 07 Jul, 2026 | Go github.com/tinfoil-factory/netfoil |
netfoil has a domain name filter bypass via multiple questions GHSA-59qp-cfj3-rp64, GO-2026-5934 | Medium | Not scored | 07 Jul, 2026 | Go github.com/tinfoil-factory/netfoil |
New API is vulnerable to CSRF through user email binding CVE-2026-44342, GHSA-26v7-h57m-gh9m, GO-2026-5929 | Medium | Not scored | 07 Jul, 2026 | Go github.com/QuantumNous/new-api |
New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs CVE-2026-33655, GHSA-6qcr-qxgr-m7fv, GO-2026-5930 | High | Not scored | 07 Jul, 2026 | Go github.com/QuantumNous/new-api |
Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write CVE-2026-63443, GHSA-qrwj-vh9x-gw5v, GO-2026-5923 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing CVE-2026-55438, GHSA-5wg6-jmq2-53pw, GO-2026-5918 | Medium | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component CVE-2026-55437, GHSA-7qw2-f75v-62f7, GO-2026-5919 | Medium | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder's AI Bridge Proxy skips TLS certificate verification in default configuration CVE-2026-55436, GHSA-84rm-42xw-mx52, GO-2026-5920 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Suspended Coder users retain access to AI Bridge LLM proxy endpoints CVE-2026-55435, GHSA-wqxv-w64v-5wh6, GO-2026-5925 | Medium | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints CVE-2026-55434, GHSA-f5vp-w269-392g, GO-2026-5921 | Medium | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers CVE-2026-55433, GHSA-jqj2-x4c5-jfxm, GO-2026-5922 | Medium | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder's sub-agent app registration bypasses template port-sharing policy enforcement CVE-2026-55432, GHSA-x9qq-2qh5-8rxf, GO-2026-5926 | Medium | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps CVE-2026-55431, GHSA-v54h-cp2w-9x4g, GO-2026-5924 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service CVE-2026-55078, GHSA-2mg2-p7r7-g27f, GO-2026-5916 | Medium | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access CVE-2026-55430, GHSA-5g4w-3vw9-478w, GO-2026-5917 | Medium | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator CVE-2026-55428, GHSA-wrq8-fcv5-8hvp, GO-2026-5915 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID CVE-2026-55429, GHSA-9rjw-3gwp-f59v, GO-2026-5909 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service CVE-2026-55079, GHSA-f962-qm93-mj4c, GO-2026-5911 | Medium | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` CVE-2026-55427, GHSA-mcqq-fqgf-rxwm, GO-2026-5913 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder: User-admin role can reset owner account password CVE-2026-55077, GHSA-29xf-69gq-m9jx, GO-2026-5906 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass CVE-2026-55075, GHSA-9r87-mvcw-x35f, GO-2026-5908 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking CVE-2026-55076, GHSA-75vm-6w67-gwvp, GO-2026-5907 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation BIT-cilium-2026-53935, BIT-cilium-operator-2026-53935, BIT-hubble-relay-2026-53935, CVE-2026-53935, GHSA-q6h5-q3q6-f87x, GO-2026-5914 | Medium | Not scored | 06 Jul, 2026 | Go github.com/cilium/cilium |
GoFiber never set HSTS header in helmet middleware due to incorrect protocol check CVE-2026-53624, GHSA-gv83-gqw6-9j2c, GO-2026-5912 | Medium | Not scored | 06 Jul, 2026 | Go github.com/gofiber/fiber Go github.com/gofiber/fiber/v3 |
Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile CVE-2026-54637, GHSA-chwm-m7g7-685g, GO-2026-5910 | Medium | Not scored | 06 Jul, 2026 | Go d7y.io/dragonfly/v2 |
Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access BIT-cilium-2026-49445, BIT-cilium-operator-2026-49445, BIT-hubble-relay-2026-49445, CVE-2026-49445, GHSA-3fcv-jvfp-m4q9, GO-2026-5905 | Critical | Not scored | 06 Jul, 2026 | Go github.com/cilium/cilium |
Gitea forwarded-proto validation allows canonical URL spoofing CVE-2026-27779, GHSA-v8f2-2ghq-9whv, GO-2026-6345 | High | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea pre-receive hook scanner errors allow branch-protection bypass CVE-2026-27780, GHSA-vhq7-fwwh-7hjf, GO-2026-6346 | Critical | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea release asset dumps permit path traversal through crafted names CVE-2026-28705, GHSA-7jvx-g65v-r899, GO-2026-6337 | Medium | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea exposes tracked time entries without repository authorization CVE-2026-20909, GHSA-fhq3-p242-2qpf, GO-2026-6339 | Medium | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea repository creation accepts insufficiently validated fields CVE-2026-22547, GHSA-922f-hfwp-p56f, GO-2026-6338 | Critical | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea pull request branch permission checks allow unauthorized updates and rebases CVE-2026-24690, GHSA-47rq-xp99-92mx, GO-2026-6334 | High | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea organization permission APIs expose hidden membership and private organization data CVE-2026-25712, GHSA-37w2-86g3-h4qh, GO-2026-6333 | High | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea template repository generation follows unsafe filesystem paths CVE-2026-25718, GHSA-h697-89cp-24q8, GO-2026-6340 | Critical | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea tracked-time deletion is not scoped to the requested issue CVE-2026-25782, GHSA-qm72-8prh-g92x, GO-2026-6343 | Medium | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |