Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
fzf vulnerable to denial of service through quadratic HTTP request-body accumulation CVE-2026-53433, GHSA-mvmf-94v6-879g, GO-2026-6620 | Medium | Not scored | 30 Jun, 2026 | Go github.com/junegunn/fzf |
Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query CVE-2026-44840, GHSA-q2m9-6jp9-c6mc, GO-2026-5837 | High | Not scored | 29 Jun, 2026 | Go github.com/dgraph-io/dgraph Go github.com/dgraph-io/dgraph/v25 Go github.com/hypermodeinc/dgraph/v24 |
MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints CVE-2026-11720, GHSA-vwxw-jrg6-9jxv, GO-2026-6411 | Critical | Not scored | 29 Jun, 2026 | Go github.com/googleapis/mcp-toolbox |
Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API CVE-2026-59155, GHSA-ww5p-j6cj-6mqq, GO-2026-5832 | Medium | Not scored | 26 Jun, 2026 | Go github.com/nezhahq/nezha |
Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR) CVE-2026-49338, GHSA-hmgp-w9jm-vp95, GO-2026-5830 | High | Not scored | 26 Jun, 2026 | Go go.senan.xyz/gonic |
gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists CVE-2026-49339, GHSA-2fp4-5v5c-4448, GO-2026-5825 | High | Not scored | 26 Jun, 2026 | Go go.senan.xyz/gonic |
gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host CVE-2026-49340, GHSA-4gxv-p5g5-j7w7, GO-2026-5827 | High | Not scored | 26 Jun, 2026 | Go go.senan.xyz/gonic |
Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection CVE-2026-53523, GHSA-9rc6-8cjv-rcvx, GO-2026-5829 | Medium | Not scored | 26 Jun, 2026 | Go github.com/nezhahq/nezha |
Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS CVE-2026-53522, GHSA-jg62-j5h6-8mpq, GO-2026-5831 | Medium | Not scored | 26 Jun, 2026 | Go github.com/nezhahq/nezha |
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key CVE-2026-53519, GHSA-5c25-7vpj-9mqh, GO-2026-5828 | Critical | Not scored | 26 Jun, 2026 | Go github.com/nezhahq/nezha |
Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context CVE-2026-53521, GHSA-39g2-8x68-pmx8, GO-2026-5826 | Medium | Not scored | 26 Jun, 2026 | Go github.com/nezhahq/nezha |
Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing CVE-2026-53520, GHSA-x6fg-52vr-hj4w, GO-2026-5824 | Medium | Not scored | 26 Jun, 2026 | Go github.com/nezhahq/nezha |
regclient may leak authentication credentials to external blob stores CVE-2026-49349, GHSA-qvqc-4c52-x6qp, GO-2026-5822 | Medium | Not scored | 26 Jun, 2026 | Go github.com/regclient/regclient |
Authelia has an Edge Case Access Control Rule Mismatch CVE-2026-48794, GHSA-j748-h363-wqj8, GO-2026-5819 | Low | Not scored | 26 Jun, 2026 | Go github.com/authelia/authelia Go github.com/authelia/authelia/v4 |
Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check CVE-2026-62283, GHSA-q6xx-5vr8-p898, GO-2026-5821 | Critical | Not scored | 26 Jun, 2026 | Go github.com/nezhahq/nezha |
Blnk has an API key authorization bypass in owner and scope enforcement GHSA-wcr3-9x4c-f5gj, GO-2026-5823 | High | Not scored | 26 Jun, 2026 | Go github.com/blnkfinance/blnk |
Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete) CVE-2026-49258, GHSA-c6v2-3ffm-vcmc, GO-2026-5816 | High | Not scored | 26 Jun, 2026 | Go github.com/juev/nebula-mesh |
nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction GHSA-v2jf-442r-6mjh, GO-2026-5815 | Low | Not scored | 26 Jun, 2026 | Go github.com/juev/nebula-mesh |
Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container GHSA-rhq6-9rgh-v45c, GO-2026-5814 | Medium | Not scored | 26 Jun, 2026 | Go github.com/pterodactyl/wings |
turso-cli persists Turso platform JWT with world-readable (0o644) file permissions CVE-2026-48790, GHSA-57f6-pvx8-hwj6, GO-2026-5811 | Medium | Not scored | 26 Jun, 2026 | Go github.com/tursodatabase/turso-cli |
Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint CVE-2026-41262, GHSA-gm7f-v959-fr2g, GO-2026-5812 | Medium | Not scored | 26 Jun, 2026 | Go github.com/fleetdm/fleet/v4 |
Hysteria: http large header with sniff cause server DoS GHSA-jqc5-2p7q-fqfc, GO-2026-5813 | High | Not scored | 26 Jun, 2026 | Go github.com/apernet/hysteria |
Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image CVE-2026-46604, GO-2026-5066 | Not scored | 26 Jun, 2026 | Go golang.org/x/image | |
Hysteria vulnerable to server crash when max_datagram_frame_size very small GHSA-qh5x-rfwf-rvfv, GO-2026-5807 | High | Not scored | 26 Jun, 2026 | Go github.com/apernet/hysteria |
Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF GHSA-vgrc-hq28-p3xp, GO-2026-5809 | High | Not scored | 26 Jun, 2026 | Go github.com/apernet/hysteria/core Go github.com/apernet/hysteria/core/v2 |
Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing CVE-2026-48788, GHSA-4c8j-mgm4-qqvp, GO-2026-5804 | High | Not scored | 26 Jun, 2026 | Go github.com/umputun/remark42 |
Apptainer has incorrect path matching for 'limit container paths' directive CVE-2026-48785, GHSA-cr2j-534f-mf3g, GO-2026-5805 | Medium | Not scored | 26 Jun, 2026 | Go github.com/apptainer/apptainer |
Incus has an arbitrary file write on its client due to trusted image hash CVE-2026-48769, GHSA-f6m5-xw2g-xc4x, GO-2026-5806 | Critical | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) CVE-2026-48756, GHSA-xhqx-mgh3-3h7q, GO-2026-5810 | Low | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has an argument injection in backup compression algorithm leading to AFW and ACE CVE-2026-48755, GHSA-v6mj-8pf4-hhw4, GO-2026-5808 | Critical | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} CVE-2026-48754, GHSA-4xg6-52mh-fpw8, GO-2026-5800 | Low | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has an arbitrary file write via path traversal in S3 multipart upload CVE-2026-48753, GHSA-ccjc-4qc3-jxqc, GO-2026-5802 | Critical | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has arbitrary file read+write on host via templates/ symlink in malicious image CVE-2026-48752, GHSA-vxp5-584q-c479, GO-2026-5803 | Critical | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has a restricted project bypass leading to arbitrary command execution CVE-2026-48751, GHSA-48q5-w887-33wv, GO-2026-5799 | Critical | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image CVE-2026-48750, GHSA-73hr-m85f-64v9, GO-2026-5801 | Critical | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image CVE-2026-48749, GHSA-2q3f-q5pq-g8wv, GO-2026-5798 | Critical | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction CVE-2026-13426, GHSA-72v2-v53v-4qmm | Medium | Not scored | 26 Jun, 2026 | Go github.com/mattermost/mattermost/server/public |
KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite CVE-2026-13218, GHSA-q3jc-42cq-33fj | Medium | Not scored | 26 Jun, 2026 | Go kubevirt.io/kubevirt |
KubeVirt virt-api port-forward handler vulnerable to SSRF via guest-controlled VMI IP address CVE-2026-13318, GHSA-cgm6-wvp9-4g5h | Medium | Not scored | 26 Jun, 2026 | Go kubevirt.io/kubevirt |
KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumption CVE-2026-13322, GHSA-6f2p-2qg2-qqch | Low | Not scored | 26 Jun, 2026 | Go github.com/kubevirt/kubevirt |
Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic CVE-2026-48702, GHSA-47q9-m4ww-924m, GO-2026-5778 | High | Not scored | 25 Jun, 2026 | Go github.com/sigstore/rekor |
GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion CVE-2026-48529, GHSA-pjp5-fpmr-3349, GO-2026-5779 | Medium | Not scored | 25 Jun, 2026 | Go github.com/github/github-mcp-server |
chi Has an IP Spoofing Vulnerability in `middleware.RealIP` CVE-2026-72815, GHSA-3fxj-6jh8-hvhx, GO-2026-5774 | Medium | Not scored | 25 Jun, 2026 | Go github.com/go-chi/chi/v5 Go github.com/go-chi/chi/v5/middleware |
chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header CVE-2026-72816, GHSA-rjr7-jggh-pgcp, GO-2026-5777 | High | Not scored | 25 Jun, 2026 | Go github.com/go-chi/chi/middleware Go github.com/go-chi/chi/v2/middleware Go github.com/go-chi/chi/v3/middleware Go github.com/go-chi/chi/v4/middleware +2 more |
chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution CVE-2026-72817, GHSA-9g5q-2w5x-hmxf, GO-2026-5775 | High | Not scored | 25 Jun, 2026 | Go github.com/go-chi/chi/middleware Go github.com/go-chi/chi/v2/middleware Go github.com/go-chi/chi/v3/middleware Go github.com/go-chi/chi/v4/middleware +2 more |
FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks GHSA-r4v7-6wcg-ghj5, GO-2026-5776 | Medium | Not scored | 25 Jun, 2026 | Go github.com/gtsteffaniak/filebrowser |
OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering CVE-2026-53541, GHSA-prj9-97mp-mwh2, GO-2026-5552 | Medium | Not scored | 24 Jun, 2026 | Go github.com/OliveTin/OliveTin |
OliveTin: ValidateArgumentType API Endpoint's Missing Authentication Allows Action and Argument Enumeration CVE-2026-48709, GHSA-f637-w7p2-m7fx, GO-2026-5347 | Low | Not scored | 24 Jun, 2026 | Go github.com/OliveTin/OliveTin |
OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination CVE-2026-48708, GHSA-7fq5-7wr8-rjwj, GO-2026-5216 | High | Not scored | 24 Jun, 2026 | Go github.com/OliveTin/OliveTin |
OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree CVE-2026-74796, GHSA-wcmj-x466-56mm, GO-2026-5705 | Medium | Not scored | 23 Jun, 2026 | Go github.com/opentofu/opentofu |