Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mattermost Boards Plugin fails to implement authorisation checks on comment block modifications CVE-2026-2461, GHSA-hf8w-x9h5-5gf9, GO-2026-4782 | Medium | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-plugin-boards |
Mattermost fails to filter invite IDs based on user permissions CVE-2026-2463, GHSA-fx49-m253-27jj, GO-2026-4735 | Medium | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to preserve the redacted state of burn-on-read posts during deletion CVE-2026-2578, GHSA-3rhr-jr63-hwq5, GO-2026-4734 | Medium | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows attackers to spoof permalink embeds CVE-2026-2457, GHSA-ph22-fw5m-w2q9, GO-2026-4732 | Medium | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to bound memory allocation when processing DOC files CVE-2026-25780, GHSA-xv2p-wchj-qjhp, GO-2026-4733 | Medium | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly validate User-Agent header tokens CVE-2026-25783, GHSA-2v3w-6g35-5f9v, GO-2026-4725 | Medium | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to bound memory allocation when processing PSD image files CVE-2026-26246, GHSA-44mv-jq72-gj49, GO-2026-4727 | Medium | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB CVE-2026-32704, GHSA-4j3x-hhg2-fm2x, GO-2026-4700 | Medium | Not scored | 13 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload CVE-2026-30961, GHSA-45vh-rpc8-hxpp, GO-2026-4695 | Medium | Not scored | 13 Mar, 2026 | Go github.com/forceu/gokapi |
Gokapi vulnerable to DoS in E2E Metadata Parser CVE-2026-30955, GHSA-qwc6-vc2v-2ggj, GO-2026-4698 | Medium | Not scored | 13 Mar, 2026 | Go github.com/forceu/gokapi |
Gokapi vulnerable to Privilege Escalation in File Replace CVE-2026-30943, GHSA-j6jp-78w8-34x6, GO-2026-4696 | Medium | Not scored | 13 Mar, 2026 | Go github.com/forceu/gokapi |
SFTPGo improperly sanitizes placeholders in group home directories/key prefixes CVE-2026-30915, GHSA-m83q-5wr4-4gfp, GO-2026-4697 | Medium | Not scored | 13 Mar, 2026 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |
SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy CVE-2026-30914, GHSA-x8qh-7475-c5mp, GO-2026-4699 | Medium | Not scored | 13 Mar, 2026 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |
Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstrings CVE-2026-32320, GHSA-j478-p7vq-3347, GO-2026-4691 | Medium | Not scored | 12 Mar, 2026 | Go github.com/ellanetworks/core |
Tinyauth's OIDC authorization codes are not bound to client on token exchange CVE-2026-32245, GHSA-xg2q-62g2-cvcm, GO-2026-4689 | Medium | Not scored | 12 Mar, 2026 | Go github.com/steveiliop56/tinyauth |
OliveTin's email argument makes compliance harder, enables log injection GHSA-xx6g-43w2-9g6g, GO-2026-4687 | Medium | Not scored | 12 Mar, 2026 | Go github.com/OliveTin/OliveTin |
Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication BIT-consul-2026-2808, CVE-2026-2808, GHSA-cpfq-66p2-336j, GO-2026-4690 | Medium | Not scored | 12 Mar, 2026 | Go github.com/hashicorp/consul |
Traefik: kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values CVE-2026-29777, GHSA-8q2w-wr49-whqj, GO-2026-4679 | Medium | Not scored | 11 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Quill has DoS via unbounded read of HTTP response body during notarization CVE-2026-31960, GHSA-g32c-4pvp-769g, GO-2026-4672 | Medium | Not scored | 11 Mar, 2026 | Go github.com/anchore/quill |
Quill has unbounded memory allocation via unvalidated size fields in Mach-O binary parsing CVE-2026-31961, GHSA-xj69-m9qq-8m94, GO-2026-4675 | Medium | Not scored | 11 Mar, 2026 | Go github.com/anchore/quill |
Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval CVE-2026-31959, GHSA-7q3q-5px6-4c5p, GO-2026-4671 | Medium | Not scored | 11 Mar, 2026 | Go github.com/anchore/quill |
SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS CVE-2026-31809, GHSA-pmc9-f5qr-2pcr, GO-2026-4669 | Medium | Not scored | 10 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS CVE-2026-31807, GHSA-5hc8-qmg8-pw27, GO-2026-4667 | Medium | Not scored | 10 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Envoy's global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly BIT-envoy-2026-26330, CVE-2026-26330, GHSA-c23c-rp3m-vpg3 | Medium | Not scored | 10 Mar, 2026 | Go github.com/envoyproxy/envoy |
Envoy: HTTP - filter chain execution on reset streams causing UAF crash BIT-envoy-2026-26311, CVE-2026-26311, GHSA-84xm-r438-86px | Medium | Not scored | 10 Mar, 2026 | Go github.com/envoyproxy/envoy |
Envoy affected by off-by-one write in JsonEscaper::escapeString() BIT-envoy-2026-26309, CVE-2026-26309, GHSA-56cj-wgg3-x943 | Medium | Not scored | 10 Mar, 2026 | Go github.com/envoyproxy/envoy |
Envoy vulnerable to crash for scoped ip address during DNS BIT-envoy-2026-26310, CVE-2026-26310, GHSA-3cw6-2j68-868p | Medium | Not scored | 10 Mar, 2026 | Go github.com/envoyproxy/envoy |
Kubewarden: Cross-namespace data exfiltration via deprecated host callback binding CVE-2026-29773, GHSA-6r7f-3fwq-hq74, GO-2026-4652 | Medium | Not scored | 09 Mar, 2026 | Go github.com/kubewarden/kubewarden-controller |
Netmaker has Privilege Escalation from Admin to Super-Admin via User Update CVE-2026-29195, GHSA-ch3w-9456-38v3, GO-2026-4654 | Medium | Not scored | 09 Mar, 2026 | Go github.com/gravitl/netmaker |
WeKnora has Unauthorized Cross‑Tenant Knowledge Base Cloning CVE-2026-30857, GHSA-8rf9-c59g-f82f, GO-2026-4640 | Medium | Not scored | 06 Mar, 2026 | Go github.com/Tencent/WeKnora |
WeKnora Vulnerable to Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection CVE-2026-30856, GHSA-67q9-58vj-32qx, GO-2026-4638 | Medium | Not scored | 06 Mar, 2026 | Go github.com/Tencent/WeKnora |
Caddy's vars_regexp double-expands user input, leaking env vars and files CVE-2026-30852, GHSA-m2w3-8f23-hxxf, GO-2026-4644 | Medium | Not scored | 06 Mar, 2026 | Go github.com/caddyserver/caddy/v2 Go github.com/caddyserver/caddy/v2/modules/caddyhttp |
WeKnora is Vulnerable to SSRF via Redirection CVE-2026-30247, GHSA-595m-wc8g-6qgc, GO-2026-4628 | Medium | Not scored | 05 Mar, 2026 | Go github.com/Tencent/WeKnora |
OliveTin doesn't check view permission when returning dashboards CVE-2026-30233, GHSA-jf73-858c-54pg, GO-2026-4629 | Medium | Not scored | 05 Mar, 2026 | Go github.com/OliveTin/OliveTin |
OliveTin has crash on NPE by calling APIs with invalid bindings or log references GHSA-fwhj-785h-43hh, GO-2026-4621 | Medium | Not scored | 05 Mar, 2026 | Go github.com/OliveTin/OliveTin |
OliveTin's RestartAction always runs actions as guest CVE-2026-30225, GHSA-p443-p7w5-2f7f, GO-2026-4625 | Medium | Not scored | 05 Mar, 2026 | Go github.com/OliveTin/OliveTin |
OliveTin Session Fixation: Logout Fails to Invalidate Server-Side Session CVE-2026-30224, GHSA-gq2m-77hf-vwgh, GO-2026-4623 | Medium | Not scored | 05 Mar, 2026 | Go github.com/OliveTin/OliveTin |
Gokapi has CSRF in Login Endpoint CVE-2026-29084, GHSA-hcff-qv74-7hr4, GO-2026-4624 | Medium | Not scored | 05 Mar, 2026 | Go github.com/forceu/gokapi |
Gokapi has privilege escalation via incomplete API-key permission revocation on user rank demotion CVE-2026-29061, GHSA-q658-hfpg-35qc, GO-2026-4626 | Medium | Not scored | 05 Mar, 2026 | Go github.com/forceu/gokapi |
Gogs: Access tokens get exposed through URL params in API requests CVE-2026-26196, GHSA-x9p5-w45c-7ffc, GO-2026-4619 | Medium | Not scored | 05 Mar, 2026 | Go gogs.io/gogs |
Gogs: Stored XSS in branch and wiki views through author and committer names CVE-2026-26195, GHSA-vgvf-m4fw-938j, GO-2026-4618 | Medium | Not scored | 05 Mar, 2026 | Go gogs.io/gogs |
Gokapi has privilege escalation with auth token CVE-2026-29060, GHSA-m2hx-wjxc-9fp4, GO-2026-4615 | Medium | Not scored | 05 Mar, 2026 | Go github.com/forceu/gokapi |
Gokapi has Data Leak in Upload Status Stream CVE-2026-28682, GHSA-c36c-7pc2-f2ph, GO-2026-4613 | Medium | Not scored | 05 Mar, 2026 | Go github.com/forceu/gokapi |
Agentgateway is missing parameter sanitization in MCP to OpenAPI conversion CVE-2026-29791, GHSA-v2x6-wwfw-r2rq | Medium | Not scored | 05 Mar, 2026 | Go github.com/agentgateway/agentgateway |
lxd's non-recursive certificate listing bypasses per-object authorization and leaks all fingerprints CVE-2026-3351, GHSA-crmg-9m86-636r, GO-2026-4595 | Medium | Not scored | 04 Mar, 2026 | Go github.com/canonical/lxd |
Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS CVE-2026-26998, GHSA-fw45-f5q2-2p4x, GO-2026-4593 | Medium | Not scored | 04 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access CVE-2026-29073, GHSA-jqwg-75qf-vmf9, GO-2026-4592 | Medium | Not scored | 03 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Rancher Backup Operator pod's logs leak S3 tokens CVE-2025-62879, GHSA-wj3p-5h3x-c74q, GO-2026-4591 | Medium | Not scored | 03 Mar, 2026 | Go github.com/rancher/backup-restore-operator |
Rancher's weave CNI password is not configured when a cluster is created from an RKE template CVE-2022-21951, GHSA-vrph-m5jj-c46c | Medium | Not scored | 03 Mar, 2026 | Go github.com/rancher/rancher |
`melange update-cache` has unbounded HTTP download that can exhaust disk in CI CVE-2026-29049, GHSA-7rp8-r62p-q6wc, GO-2026-4588 | Medium | Not scored | 02 Mar, 2026 | Go chainguard.dev/melange |