Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
GoDoxy has a Path Traversal Vulnerability in its File API CVE-2026-33528, GHSA-4753-cmc8-8j9v, GO-2026-4817 | Medium | Not scored | 24 Mar, 2026 | Go github.com/yusing/godoxy |
New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check CVE-2026-30886, GHSA-f35r-v9x5-r8mc, GO-2026-4814 | Medium | Not scored | 23 Mar, 2026 | Go github.com/QuantumNous/new-api |
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure CVE-2026-32879, GHSA-5353-f8fq-65vc, GO-2026-4813 | Medium | Not scored | 23 Mar, 2026 | Go github.com/QuantumNous/new-api |
Free5GC AMF is vulnerable to DoS through its HandleRegistrationComplete function CVE-2026-4531, GHSA-xq44-64rg-8g3h, GO-2026-5767 | Medium | Not scored | 22 Mar, 2026 | Go github.com/free5gc/amf |
NFS CSI driver for Kubernetes is Vulnerable to Path Traversal through Volume Identifier Parameter CVE-2026-3864, GHSA-2mjq-54qg-7w6j, GO-2026-4816 | Medium | Not scored | 21 Mar, 2026 | Go github.com/kubernetes-csi/csi-driver-nfs |
Ory Oathkeeper has an authentication bypass by usage of untrusted header CVE-2026-33495, GHSA-vhr5-ggp3-qq85, GO-2026-4810 | Medium | Not scored | 20 Mar, 2026 | Go github.com/ory/oathkeeper |
Syft improper temporary file cleanup CVE-2026-33481, GHSA-rjcw-vg7j-m9rc, GO-2026-4809 | Medium | Not scored | 20 Mar, 2026 | Go github.com/anchore/syft |
Vikunja Affected by DoS via Image Preview Generation CVE-2026-33474, GHSA-wc83-79hj-hpmq, GO-2026-4811 | Medium | Not scored | 20 Mar, 2026 | Go code.vikunja.io/api |
Vikunja has TOTP Reuse During Validity Window CVE-2026-33473, GHSA-p747-qc5p-773r, GO-2026-4805 | Medium | Not scored | 20 Mar, 2026 | Go code.vikunja.io/api |
Vikunja has a 2FA Bypass via Caldav Basic Auth CVE-2026-33315, GHSA-47cr-f226-r4pq, GO-2026-4794 | Medium | Not scored | 20 Mar, 2026 | Go code.vikunja.io/api |
Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments CVE-2026-33313, GHSA-mr3j-p26x-72x4, GO-2026-4797 | Medium | Not scored | 20 Mar, 2026 | Go code.vikunja.io/api |
Vikunja read-only users can delete project background images via broken object-level authorization CVE-2026-33312, GHSA-564f-wx8x-878h, GO-2026-4795 | Medium | Not scored | 20 Mar, 2026 | Go code.vikunja.io/api |
Traefik Affected by BasicAuth Middleware Timing Attack Allows Username Enumeration CVE-2026-32595, GHSA-g3hg-j4jv-cwfr, GO-2026-4792 | Medium | Not scored | 20 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers CVE-2026-29794, GHSA-m547-hp4w-j6jx, GO-2026-4791 | Medium | Not scored | 20 Mar, 2026 | Go code.vikunja.io/api |
Packetbeat does not properly validate an array index in multiple protocol parser components CVE-2026-26933, GHSA-27qj-9gvp-8rh9, GO-2026-4789 | Medium | Not scored | 19 Mar, 2026 | Go github.com/elastic/beats Go github.com/elastic/beats/v7 |
Metricbeat Allocates Memory with Excessive Size Value Leading to Denial of Service CVE-2026-26931, GHSA-5vrw-qjxw-89r5, GO-2026-4790 | Medium | Not scored | 19 Mar, 2026 | Go github.com/elastic/beats Go github.com/elastic/beats/v7 |
Ella Core panics on malformed ULNASTransport Message without a Request Type CVE-2026-33283, GHSA-3366-gw57-fcm5, GO-2026-4776 | Medium | Not scored | 19 Mar, 2026 | Go github.com/ellanetworks/core |
Ella Core panics on invalid PDU Session IDs in NGAP messages CVE-2026-33281, GHSA-q669-4gmv-g8mf, GO-2026-4783 | Medium | Not scored | 19 Mar, 2026 | Go github.com/ellanetworks/core |
Juju affected by Confused Deputy IDOR attack via Predictable user specified ID in Juju Secrets CVE-2026-32694, GHSA-5cj2-rqqf-hx9p, GO-2026-4778 | Medium | Not scored | 19 Mar, 2026 | Go github.com/juju/juju |
Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service CVE-2026-33320, GHSA-4fcp-jxh7-23x8, GO-2026-4768 | Medium | Not scored | 19 Mar, 2026 | Go github.com/tomwright/dasel Go github.com/tomwright/dasel/v2 Go github.com/tomwright/dasel/v3 |
Juju affected by timing ownership claim attack on new external back-end secrets CVE-2026-32691, GHSA-gfgr-6hrj-85ww, GO-2026-4769 | Medium | Not scored | 19 Mar, 2026 | Go github.com/juju/juju |
SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass) CVE-2026-33194, GHSA-vm69-h85x-8p85, GO-2026-4766 | Medium | Not scored | 18 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request CVE-2026-33065, GHSA-958m-gxmc-mccm, GO-2026-4758 | Medium | Not scored | 18 Mar, 2026 | Go github.com/free5gc/udm |
Zitadel is missing enforcement of organization scopes CVE-2026-33132, GHSA-g2pf-ww5m-2r9m, GO-2026-4751 | Medium | Not scored | 18 Mar, 2026 | Go github.com/zitadel/zitadel |
PinchTab has a Blind SSRF via browser-side redirect bypass in /download URL validation CVE-2026-33081, GHSA-qwxp-6qf9-wr4m, GO-2026-4748 | Medium | Not scored | 18 Mar, 2026 | Go github.com/pinchtab/pinchtab |
SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata CVE-2026-33067, GHSA-mvpm-v6q4-m2pf, GO-2026-4747 | Medium | Not scored | 18 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering CVE-2026-33066, GHSA-4663-4mpg-879v, GO-2026-4743 | Medium | Not scored | 18 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
File Browser has an Authorization Policy Bypass in Public Share Download Flow CVE-2026-32761, GHSA-68j5-4m99-w9w9, GO-2026-4738 | Medium | Not scored | 18 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 Go https://github.com/filebrowser/filebrowser |
Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121 GHSA-594f-3595-c47v, GO-2026-4737 | Medium | Not scored | 18 Mar, 2026 | Go github.com/argoproj-labs/terraform-provider-argocd |
Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun CVE-2026-33022, GHSA-cv4x-93xx-wgfj, GO-2026-4730 | Medium | Not scored | 17 Mar, 2026 | Go github.com/tektoncd/pipeline |
Tillitis TKey Client has an Error in Protocol Implementation CVE-2026-32953, GHSA-4w7r-3222-8h6v, GO-2026-4728 | Medium | Not scored | 17 Mar, 2026 | Go github.com/tillitis/tkeyclient |
Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports CVE-2026-32941, GHSA-97vp-pwqj-46qc, GO-2026-4723 | Medium | Not scored | 17 Mar, 2026 | Go github.com/bishopfox/sliver |
Mattermost fails to verify run_create permission for empty playbookId CVE-2026-26304, GHSA-4pmx-622h-x359, GO-2026-4812 | Medium | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-plugin-playbooks |
Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration CVE-2026-32828, GHSA-j94x-8wcp-x7hm, GO-2026-4717 | Medium | Not scored | 16 Mar, 2026 | Go github.com/akuity/kargo |
File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter CVE-2026-32758, GHSA-9f3r-2vgw-m8xp, GO-2026-4711 | Medium | Not scored | 16 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS CVE-2026-56395, CVE-2026-56397, GHSA-v3mg-9v85-fcm7, GO-2026-4720 | Medium | Not scored | 16 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely CVE-2026-32759, GHSA-ffx7-75gc-jg7c, GO-2026-4713 | Medium | Not scored | 16 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface CVE-2026-32751, GHSA-qr46-rcv3-4hq3, GO-2026-4706 | Medium | Not scored | 16 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes CVE-2026-32750, GHSA-rjhh-m223-9qqv, GO-2026-4708 | Medium | Not scored | 16 Mar, 2026 | Go github.com/siyuan-note/siyuan |
SiYuan Vulnerable to Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure CVE-2026-32815, GHSA-xp2m-98x8-rpj6, GO-2026-4709 | Medium | Not scored | 16 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan globalCopyFiles: incomplete sensitive path blocklist allows reading /proc and Docker secrets CVE-2026-32747, GHSA-h5vh-m7fg-w5h6, GO-2026-4705 | Medium | Not scored | 16 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation CVE-2026-2455, GHSA-gqv7-j2j8-qmwq, GO-2026-4746 | Medium | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly enforce read permissions in search API endpoints CVE-2026-24692, GHSA-cwfj-642j-gfh4, GO-2026-4745 | Medium | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to use consistent error responses when handling the /mute command CVE-2026-21386, GHSA-5mr9-crcg-8wh2, GO-2026-4744 | Medium | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to validate team-specific upload_file permissions CVE-2026-4265, GHSA-xpvf-6qcc-9jqc, GO-2026-4749 | Medium | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to limit the size of responses from integration action endpoints CVE-2026-2456, GHSA-34g8-9fpp-46ch, GO-2026-4726 | Medium | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows a removed team member to enumerate all public channels within a private team CVE-2026-2458, GHSA-679f-wmrg-qf57, GO-2026-4729 | Medium | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Boards Plugin fails to implement authorisation checks on comment block modifications CVE-2026-2461, GHSA-hf8w-x9h5-5gf9, GO-2026-4782 | Medium | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-plugin-boards |
Mattermost fails to filter invite IDs based on user permissions CVE-2026-2463, GHSA-fx49-m253-27jj, GO-2026-4735 | Medium | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to preserve the redacted state of burn-on-read posts during deletion CVE-2026-2578, GHSA-3rhr-jr63-hwq5, GO-2026-4734 | Medium | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |