Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Nuclio Shell Runtime Command Injection Leading to Privilege Escalation CVE-2026-29042, GHSA-95fj-3w7g-4r27, GO-2026-4598 | High | Not scored | 04 Mar, 2026 | Go github.com/nuclio/nuclio |
Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (Slowloris DOS) CVE-2026-26999, GHSA-xw98-5q62-jx94, GO-2026-4594 | High | Not scored | 04 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged user GHSA-hwm2-4ph6-w6m5, GO-2026-4590 | High | Not scored | 03 Mar, 2026 | Go github.com/rancher/rancher |
Rancher's Azure AD permission changes are not reflected on active sessions CVE-2023-22648, GHSA-vf6j-6739-78m8 | High | Not scored | 03 Mar, 2026 | Go github.com/rancher/rancher |
OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login CVE-2026-28790, GHSA-4fqm-6fmh-82mq, GO-2026-4587 | High | Not scored | 02 Mar, 2026 | Go github.com/OliveTin/OliveTin |
OliveTin has unauthenticated DoS via concurrent map writes in OAuth2 state handling CVE-2026-28789, GHSA-45m3-398w-m2m9, GO-2026-4586 | High | Not scored | 02 Mar, 2026 | Go github.com/OliveTin/OliveTin |
FileBrowser has Path Traversal in Public Share Links that Exposes Files Outside Shared Directory CVE-2026-28492, GHSA-mr74-928f-rw69, GO-2026-4585 | High | Not scored | 02 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint CVE-2026-28342, GHSA-pc8g-78pf-4xrp, GO-2026-4584 | High | Not scored | 02 Mar, 2026 | Go github.com/OliveTin/OliveTin |
kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories CVE-2026-28406, GHSA-6rxq-q92g-4rmf, GO-2026-4580 | High | Not scored | 01 Mar, 2026 | Go github.com/chainguard-dev/kaniko |
INSATutorat has an authorization bypass vulnerability in its /api/admin/* endpoints GHSA-xfx2-prg5-jq3g, GO-2026-4581 | High | Not scored | 01 Mar, 2026 | Go github.com/romitou/insatutorat |
osctrl is Vulnerable to OS Command Injection via Environment Configuration CVE-2026-28279, GHSA-rchw-322g-f7rm, GO-2026-4579 | High | Not scored | 28 Feb, 2026 | Go github.com/jmpsec/osctrl |
ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API CVE-2026-27946, GHSA-282g-fhmx-xf54, GO-2026-4572 | High | Not scored | 27 Feb, 2026 | Go github.com/zitadel/zitadel |
Vitess users with backup storage access can gain unauthorized access to production deployment environments CVE-2026-27965, GHSA-8g8j-r87h-p36x, GO-2026-4567 | High | Not scored | 26 Feb, 2026 | Go vitess.io/vitess |
Curio exposes database credentials to users with network access through verbose HTTP error responses GHSA-gj6x-q8rh-wj6x, GO-2026-4568 | High | Not scored | 26 Feb, 2026 | Go github.com/filecoin-project/curio |
WireGuard Portal is Vulnerable to Privilege Escalation via User Self-Update to Admin Level CVE-2026-27899, GHSA-5rmx-256w-8mj9, GO-2026-4566 | High | Not scored | 26 Feb, 2026 | Go github.com/h44z/wg-portal |
MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity CVE-2026-27896, GHSA-wvj2-96wp-fq3f, GO-2026-4569 | High | Not scored | 26 Feb, 2026 | Go github.com/modelcontextprotocol/go-sdk |
Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users CVE-2026-27465, GHSA-2v6m-6xw3-6467, GO-2026-4560 | High | Not scored | 26 Feb, 2026 | Go github.com/fleetdm/fleet/v4 |
Vikunja has Path Traversal in CLI Restore CVE-2026-27819, GHSA-42wg-38gx-85rh, GO-2026-4556 | High | Not scored | 26 Feb, 2026 | Go code.vikunja.io/api |
esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route CVE-2026-27730, GHSA-p2v6-84h2-5x4r, GO-2026-4554 | High | Not scored | 25 Feb, 2026 | Go github.com/esm-dev/esm.sh |
Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure CVE-2026-27616, GHSA-7jp5-298q-jg98, GO-2026-4553 | High | Not scored | 25 Feb, 2026 | Go code.vikunja.io/api |
Sliver has Potential Zip Bomb Denial of Service in GzipEncoder GHSA-2phg-qgmm-r638, GO-2026-4548 | High | Not scored | 25 Feb, 2026 | Go github.com/bishopfox/sliver |
FileBrowser Quantum: Password Protection Not Enforced on Shared File Links CVE-2026-27611, GHSA-8vrh-3pm2-v4v6, GO-2026-4546 | High | Not scored | 25 Feb, 2026 | Go github.com/gtsteffaniak/filebrowser/backend |
esm.sh is vulnerable to full-response SSRF CVE-2025-50180, GHSA-3c9r-837r-qqm4, GO-2026-4545 | High | Not scored | 25 Feb, 2026 | Go github.com/esm-dev/esm.sh |
Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory CVE-2026-27598, GHSA-6v48-fcq6-ff23, GO-2026-4542 | High | Not scored | 24 Feb, 2026 | Go github.com/dagu-org/dagu |
Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation CVE-2026-25899, GHSA-2mr3-m5q5-wgp6, GO-2026-4534 | High | Not scored | 24 Feb, 2026 | Go github.com/gofiber/fiber/v3 |
Fiber has an Arbitrary File Read in Static Middleware on Windows CVE-2026-25891, GHSA-m3c2-496v-cw3v, GO-2026-4540 | High | Not scored | 24 Feb, 2026 | Go github.com/gofiber/fiber/v3 |
Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport CVE-2026-27590, GHSA-5r3v-vc8m-m96g, GO-2026-4536 | High | Not scored | 24 Feb, 2026 | Go github.com/caddyserver/caddy/v2 |
Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass CVE-2026-27588, GHSA-x76f-jf84-rqj8, GO-2026-4541 | High | Not scored | 24 Feb, 2026 | Go github.com/caddyserver/caddy/v2 |
Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass CVE-2026-27587, GHSA-g7pc-pc7g-h8jh, GO-2026-4538 | High | Not scored | 24 Feb, 2026 | Go github.com/caddyserver/caddy/v2 |
Caddy: mTLS client authentication silently fails open when CA certificate file is missing or malformed CVE-2026-27586, GHSA-hffm-g8v7-wrv7, GO-2026-4539 | High | Not scored | 24 Feb, 2026 | Go github.com/caddyserver/caddy/v2 |
New API has Potential XSS in its MarkdownRenderer component CVE-2026-25802, GHSA-299v-8pq9-5gjq, GO-2026-4532 | High | Not scored | 23 Feb, 2026 | Go github.com/QuantumNous/new-api |
New API has an SQL LIKE Wildcard Injection DoS via Token Search CVE-2026-25591, GHSA-w6x6-9fp7-fqm4, GO-2026-4531 | High | Not scored | 23 Feb, 2026 | Go github.com/QuantumNous/new-api |
Traefik affected by TLS ClientAuth Bypass on HTTP/3 GHSA-gv8r-9rw9-9697, GO-2026-4530 | High | Not scored | 20 Feb, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Go Ethereum affected by DoS via malicious p2p message CVE-2026-26314, GHSA-2gjw-fg97-vg3r, GO-2026-4507 | High | Not scored | 18 Feb, 2026 | Go github.com/ethereum/go-ethereum |
opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path CVE-2026-26205, GHSA-9f29-v6mm-pw6w, GO-2026-4506 | High | Not scored | 18 Feb, 2026 | Go github.com/open-policy-agent/opa-envoy-plugin |
emp3r0r Affected by Concurrent Map Access DoS (panic/crash) CVE-2026-26201, GHSA-f5p9-j34q-pwcc, GO-2026-4504 | High | Not scored | 17 Feb, 2026 | Go github.com/jm33-m0/emp3r0r/core |
Gogs has a Protected Branch Deletion Bypass in Web Interface CVE-2026-25232, GHSA-2c6v-8r3v-gh6p, GO-2026-4498 | High | Not scored | 17 Feb, 2026 | Go gogs.io/gogs |
Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change GHSA-hr7j-63v7-vj7g, GO-2026-4497 | High | Not scored | 17 Feb, 2026 | Go github.com/pterodactyl/wings Packagist pterodactyl/panel |
lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access CVE-2026-26187, GHSA-699m-4v95-rmpm, GO-2026-4494 | High | Not scored | 13 Feb, 2026 | Go github.com/treeverse/lakefs |
Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC CVE-2026-26056, GHSA-wj8p-jj64-h7ff, GO-2026-4493 | High | Not scored | 12 Feb, 2026 | Go github.com/yokecd/yoke |
Unauthenticated Admission Webhook Endpoints in Yoke ATC CVE-2026-26055, GHSA-965m-v4cc-6334, GO-2026-4491 | High | Not scored | 12 Feb, 2026 | Go github.com/yokecd/yoke |
Traefik: TCP readTimeout bypass via STARTTLS on Postgres CVE-2026-25949, GHSA-89p3-4642-cr2w, GO-2026-4484 | High | Not scored | 12 Feb, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP CVE-2026-24895, GHSA-g966-83w7-6w38, GO-2026-4486 | High | Not scored | 12 Feb, 2026 | Go github.com/dunglas/frankenphp |
FrankenPHP leaks session data between requests in worker mode CVE-2026-24894, GHSA-r3xh-3r3w-47gp, GO-2026-4489 | High | Not scored | 12 Feb, 2026 | Go github.com/dunglas/frankenphp |
Vikunja Vulnerable to XSS Via Task Preview CVE-2026-25935, GHSA-m4g2-2q66-vc9v, GO-2026-4480 | High | Not scored | 11 Feb, 2026 | Go code.vikunja.io/api |
File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL CVE-2026-25890, GHSA-4mh3-h929-w968, GO-2026-4474 | High | Not scored | 10 Feb, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Sliver has DNS C2 OTP Bypass that Allows Unauthenticated Session Flooding and Denial of Service CVE-2026-25791, GHSA-wxrw-gvg8-fqjp, GO-2026-4466 | High | Not scored | 06 Feb, 2026 | Go github.com/bishopfox/sliver |
Antrea has invalid enforcement order for network policy rules caused by integer overflow CVE-2026-25804, GHSA-86x4-wp9f-wrr9, GO-2026-4461 | High | Not scored | 06 Feb, 2026 | Go antrea.io/antrea |
Blocklist Bypass possible via ECDSA Signature Malleability CVE-2026-25793, GHSA-69x3-g4r3-p962, GO-2026-4458 | High | Not scored | 06 Feb, 2026 | Go github.com/slackhq/nebula |
Gogs vulnerable to Stored XSS via Mermaid diagrams GHSA-26gq-grmh-6xm6, GO-2026-4454 | High | Not scored | 06 Feb, 2026 | Go gogs.io/gogs |