Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace CVE-2026-32769, GHSA-hxm7-9q36-c77f, GO-2026-4715 | High | Not scored | 16 Mar, 2026 | Go github.com/ctfer-io/fullchain |
Romeo is vulnerable to Archive Slip due to missing checks in sanitization CVE-2026-32805, GHSA-p799-g7vv-f279, GO-2026-4719 | High | Not scored | 16 Mar, 2026 | Go github.com/ctfer-io/romeo/webserver |
Monitoring is vulnerable to Archive Slip due to missing checks in sanitization CVE-2026-32771, GHSA-f7cq-gvh6-qr25, GO-2026-4712 | High | Not scored | 16 Mar, 2026 | Go github.com/ctfer-io/monitoring |
Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace CVE-2026-32737, GHSA-fgm3-q9r5-43v9, GO-2026-4714 | High | Not scored | 16 Mar, 2026 | Go github.com/ctfer-io/romeo/environment/deploy |
Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace CVE-2026-32768, GHSA-mw24-f3xh-j3qv, GO-2026-4718 | High | Not scored | 16 Mar, 2026 | Go github.com/ctfer-io/chall-manager/deploy Go github.com/ctfer-io/chall-manager/sdk |
Denial of service in github.com/shamaton/msgpack CVE-2026-32284, GHSA-h9q6-hc68-35rp, GO-2026-4513, GO-2026-4740 | High | Not scored | 16 Mar, 2026 | Go github.com/shamaton/msgpack Go github.com/shamaton/msgpack/v2 Go github.com/shamaton/msgpack/v3 |
github.com/buger/jsonparser has a denial of service vulnerability CVE-2026-32285, GHSA-6g7g-w4f8-9c9x, GO-2026-4514 | High | Not scored | 16 Mar, 2026 | Go github.com/buger/jsonparser |
Denial of service in github.com/jackc/pgproto3/v2 CVE-2026-32286, GHSA-jqcq-xjh3-6g23, GO-2026-4518 | High | Not scored | 16 Mar, 2026 | Go github.com/jackc/pgproto3/v2 |
SiYuan importSY/importZipMd: path traversal via multipart filename enables arbitrary file write CVE-2026-32749, GHSA-qvvf-q994-x79v, GO-2026-4707 | High | Not scored | 16 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute CVE-2026-30405, GHSA-4p9m-8gc4-rw2h, GO-2026-4736 | High | Not scored | 16 Mar, 2026 | Go github.com/osrg/gobgp Go github.com/osrg/gobgp/v3 Go github.com/osrg/gobgp/v4 |
IncusOS has a LUKS encryption bypass due to insufficient TPM policy CVE-2026-32606, GHSA-wj2j-qwcf-cfcc, GO-2026-4704 | High | Not scored | 16 Mar, 2026 | Go github.com/lxc/incus-os/incus-osd |
Mattermost Microsoft Teams Plugin fails to properly mask sensitive configuration values CVE-2026-2476, GHSA-4ppj-6chv-5pgc, GO-2026-4784 | High | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-plugin-msteams |
Mattermost fails to properly handle very long passwords CVE-2026-24458, GHSA-m5rv-56xx-hfc6, GO-2026-4731 | High | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
github.com/ctfer-io/monitoring Vulnerable to Improper Access Control CVE-2026-32720, GHSA-7x23-j8gv-v54x, GO-2026-4701 | High | Not scored | 13 Mar, 2026 | Go github.com/ctfer-io/monitoring |
Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload CVE-2026-32319, GHSA-m9pm-w3gv-c68f, GO-2026-4692 | High | Not scored | 12 Mar, 2026 | Go github.com/ellanetworks/core |
Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint CVE-2026-32246, GHSA-3q28-qjrv-qr39, GO-2026-4688 | High | Not scored | 12 Mar, 2026 | Go github.com/steveiliop56/tinyauth |
Traefik: HTTP/2 frames can cause a running server to panic GHSA-4hjq-9h5c-252j, GO-2026-4684 | High | Not scored | 12 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
SiYuan has a Full-Read SSRF via /api/network/forwardProxy CVE-2026-32110, GHSA-56cv-c5p2-j2wg, GO-2026-4685 | High | Not scored | 12 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
OliveTin Vulnerable to Unauthorized Action Output Disclosure via EventStream CVE-2026-32102, GHSA-228v-wc5r-j8m7, GO-2026-4683 | High | Not scored | 12 Mar, 2026 | Go github.com/OliveTin/OliveTin |
Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode BIT-argo-workflows-2026-31892, CVE-2026-31892, GHSA-3wf5-g532-rcrr, GO-2026-4681 | High | Not scored | 11 Mar, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 Go github.com/argoproj/argo-workflows/v4 |
Unauthorized access to Argo Workflows Template BIT-argo-workflows-2026-28229, CVE-2026-28229, GHSA-56px-hm34-xqj5, GO-2026-4678 | High | Not scored | 11 Mar, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 Go github.com/argoproj/argo-workflows/v4 |
flagd Vulnerable to Allocation of Resources Without Limits or Throttling CVE-2026-31866, GHSA-rmrf-g9r3-73pm, GO-2026-4674 | High | Not scored | 11 Mar, 2026 | Go github.com/open-feature/flagd/flagd |
OliveTin's unsafe parsing of UniqueTrackingId can be used to write files CVE-2026-31817, GHSA-364q-w7vh-vhpc, GO-2026-4670 | High | Not scored | 11 Mar, 2026 | Go github.com/OliveTin/OliveTin |
zot’s create-only policy allows overwrite attempts of existing latest tag (update permission not required) CVE-2026-31801, GHSA-85jx-fm8m-x8c6, GO-2026-4668 | High | Not scored | 10 Mar, 2026 | Go zotregistry.dev/zot Go zotregistry.dev/zot/v2 |
Envoy has RBAC Header Validation Bypass via Multi-Value Header Concatenation BIT-envoy-2026-26308, CVE-2026-26308, GHSA-ghc4-35x6-crw5 | High | Not scored | 10 Mar, 2026 | Go github.com/envoyproxy/envoy |
FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse) CVE-2026-30934, GHSA-r633-fcgp-m532, GO-2026-4660 | High | Not scored | 09 Mar, 2026 | Go github.com/gtsteffaniak/filebrowser |
FileBrowser Quantum: Password-Protected Share Bypass via /public/api/share/info CVE-2026-30933, GHSA-525j-95gf-766f, GO-2026-4659 | High | Not scored | 09 Mar, 2026 | Go github.com/gtsteffaniak/filebrowser/backend |
SiYuan: Authorization Bypass Allows Low-Privilege Publish User to Modify Notebook Content via /api/block/appendHeadingChildren CVE-2026-30926, GHSA-f9cq-v43p-v523, GO-2026-4658 | High | Not scored | 09 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys CVE-2026-29196, GHSA-4hgg-c4rr-6h7f, GO-2026-4651 | High | Not scored | 09 Mar, 2026 | Go github.com/gravitl/netmaker |
Netmaker has Insufficient Authorization in Host Token Verification CVE-2026-29194, GHSA-hmqr-wjmj-376c, GO-2026-4655 | High | Not scored | 09 Mar, 2026 | Go github.com/gravitl/netmaker |
Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange CVE-2026-28513, GHSA-qh6q-598w-w6m2, GO-2026-4656 | High | Not scored | 09 Mar, 2026 | Go github.com/pocket-id/pocket-id/backend |
Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion CVE-2026-28512, GHSA-9h33-g3ww-mqff, GO-2026-4653 | High | Not scored | 09 Mar, 2026 | Go github.com/pocket-id/pocket-id/backend |
x402 SDK Security Advisory GHSA-qr2g-p6q7-w82m, GO-2026-4647 | High | Not scored | 07 Mar, 2026 | Go github.com/coinbase/x402/go PyPI x402 npm @x402/svm |
WeKnora has Broken Access Control - Cross-Tenant Data Exposure CVE-2026-30859, GHSA-2f4c-vrjq-rcgv, GO-2026-4637 | High | Not scored | 06 Mar, 2026 | Go github.com/Tencent/WeKnora |
WeKnora has DNS Rebinding Vulnerability in web_fetch Tool that Allows SSRF to Internal Resources CVE-2026-30858, GHSA-h6gw-8f77-mmmp, GO-2026-4643 | High | Not scored | 06 Mar, 2026 | Go github.com/Tencent/WeKnora |
Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation CVE-2026-30851, GHSA-7r4p-vjf4-gxv4, GO-2026-4639 | High | Not scored | 06 Mar, 2026 | Go github.com/caddyserver/caddy/v2 Go github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy |
Zarf's symlink targets in archives are not validated against destination directory CVE-2026-29064, GHSA-hcm4-6hpj-vghm, GO-2026-4636 | High | Not scored | 06 Mar, 2026 | Go github.com/zarf-dev/zarf Go github.com/zarf-dev/zarf/src/pkg/archive |
CoreDNS Loop Detection Denial of Service Vulnerability CVE-2026-26018, GHSA-h75p-j8xm-m278, GO-2026-4635 | High | Not scored | 06 Mar, 2026 | Go github.com/coredns/coredns |
PinchTab has SSRF with Full Response Exfiltration via Download Handler CVE-2026-30834, GHSA-rw8p-c6hf-q3pg, GO-2026-4631 | High | Not scored | 06 Mar, 2026 | Go github.com/pinchtab/pinchtab Go github.com/pinchtab/pinchtab/cmd/pinchtab |
CoreDNS ACL Bypass CVE-2026-26017, GHSA-c9v3-4pv7-87pr, GO-2026-4630 | High | Not scored | 06 Mar, 2026 | Go github.com/coredns/coredns |
OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes CVE-2026-30223, GHSA-g962-2j28-3cg9, GO-2026-4622 | High | Not scored | 05 Mar, 2026 | Go github.com/OliveTin/OliveTin |
Gogs: DOM-based XSS via milestone selection CVE-2026-26276, GHSA-vgjm-2cpf-4g7c, GO-2026-4627 | High | Not scored | 05 Mar, 2026 | Go gogs.io/gogs |
Gogs: Release tag option injection in release deletion CVE-2026-26194, GHSA-v9vm-r24h-6rqm, GO-2026-4617 | High | Not scored | 05 Mar, 2026 | Go gogs.io/gogs |
Gogs: Stored XSS via data URI in issue comments CVE-2026-26022, GHSA-xrcr-gmf5-2r8j, GO-2026-4620 | High | Not scored | 05 Mar, 2026 | Go gogs.io/gogs |
Gokapi has Stored XSS in SVG Hotlinks CVE-2026-28683, GHSA-3c22-5j5m-4jq7, GO-2026-4612 | High | Not scored | 05 Mar, 2026 | Go github.com/forceu/gokapi |
Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows BIT-docker-cli-2025-15558, CVE-2025-15558, GHSA-p436-gjf2-799p, GO-2026-4610 | High | Not scored | 05 Mar, 2026 | Go github.com/docker/cli Go github.com/docker/compose Go github.com/docker/compose/v2 Go github.com/docker/compose/v5 |
ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover CVE-2026-29192, GHSA-6rx5-m2rc-hmf7, GO-2026-4605 | High | Not scored | 04 Mar, 2026 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and Authentication CVE-2026-29193, GHSA-25rw-g6ff-fmg8, GO-2026-4604 | High | Not scored | 04 Mar, 2026 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
Netmaker Vulnerable to Denial of Service via Server Shutdown Endpoint CVE-2026-29771, GHSA-rhr9-hgcm-x289, GO-2026-4608 | High | Not scored | 04 Mar, 2026 | Go github.com/gravitl/netmaker |
traefik CVE-2024-45410 fix bypass: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`) CVE-2026-29054, GHSA-92mv-8f8w-wq52, GO-2026-4597 | High | Not scored | 04 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |