Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mattermost Confluence plugin doesn't properly escape user-controlled display names in HTML template rendering CVE-2025-13523, GHSA-ffx7-34p2-vm3w, GO-2026-4456 | High | Not scored | 06 Feb, 2026 | Go github.com/mattermost/mattermost-plugin-confluence |
Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update CVE-2026-24135, GHSA-jp7c-wj6q-3qf2, GO-2026-4452 | High | Not scored | 06 Feb, 2026 | Go gogs.io/gogs |
Gogs Vulnerable to 2FA Bypass via Recovery Code CVE-2025-64175, GHSA-p6x6-9mx6-26wj, GO-2026-4449 | High | Not scored | 06 Feb, 2026 | Go gogs.io/gogs |
OpenCloud Affected by Public Link Exploit GHSA-vf5j-r2hw-2hrw, GO-2026-4447 | High | Not scored | 05 Feb, 2026 | Go github.com/opencloud-eu/opencloud |
OpenCloud Reva has a Public Link Exploit CVE-2026-23989, GHSA-9j2f-3rj3-wgpg, GO-2026-4444 | High | Not scored | 05 Feb, 2026 | Go github.com/opencloud-eu/reva Go github.com/opencloud-eu/reva/v2 |
Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage CVE-2026-25538, GHSA-8wpc-j9q9-j5m2, GO-2026-4416 | High | Not scored | 04 Feb, 2026 | Go github.com/devtron-labs/devtron |
Alist vulnerable to Path Traversal in multiple file operation handlers CVE-2026-25161, GHSA-x4q4-7phh-42j9, GO-2026-4415 | High | Not scored | 04 Feb, 2026 | Go github.com/alist-org/alist Go github.com/alist-org/alist/v3 |
ingress-nginx's `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx CVE-2026-1580, GHSA-9h3p-52vh-959w, GO-2026-4423 | High | Not scored | 04 Feb, 2026 | Go k8s.io/ingress-nginx |
ingress-nginx's `rules.http.paths.path` Ingress field can be used to inject configuration into nginx CVE-2026-24512, GHSA-jx8c-56mg-h6vp, GO-2026-4426 | High | Not scored | 04 Feb, 2026 | Go k8s.io/ingress-nginx |
melange affected by potential host command execution via license-check YAML mode patch pipeline CVE-2026-25143, GHSA-rf4g-89h5-crcr, GO-2026-4412 | High | Not scored | 04 Feb, 2026 | Go chainguard.dev/melange |
apko has a path traversal in apko dirFS which allows filesystem writes outside base CVE-2026-25121, GHSA-5g94-c2wx-8pxw, GO-2026-4405 | High | Not scored | 03 Feb, 2026 | Go chainguard.dev/apko |
melange pipeline working-directory could allow command injection CVE-2026-24844, GHSA-vqqr-rmpc-hhg2, GO-2026-4408 | High | Not scored | 03 Feb, 2026 | Go chainguard.dev/melange |
melange QEMU runner could write files outside workspace directory CVE-2026-24843, GHSA-qxx2-7h4c-83f4, GO-2026-4407 | High | Not scored | 03 Feb, 2026 | Go chainguard.dev/melange |
terraform-provider-proxmox has insecure sudo recommendation in the documentation CVE-2026-25499, GHSA-gwch-7m8v-7544, GO-2026-4395 | High | Not scored | 02 Feb, 2026 | Go github.com/bpg/terraform-provider-proxmox |
OpenList has Insecure TLS Default Configuration CVE-2026-25060, GHSA-wf93-3ghh-h389, GO-2026-4397 | High | Not scored | 02 Feb, 2026 | Go github.com/OpenListTeam/OpenList Go github.com/OpenListTeam/OpenList/v3 Go github.com/OpenListTeam/OpenList/v4 |
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking CVE-2026-24051, GHSA-9h8m-3fm2-qjrq, GO-2026-4394 | High | Not scored | 02 Feb, 2026 | Go go.opentelemetry.io/otel/sdk |
OpenList vulnerable to Path Traversal in file copy and remove handlers CVE-2026-25059, GHSA-qmj2-8r24-xxcq, GO-2026-4396 | High | Not scored | 02 Feb, 2026 | Go github.com/OpenListTeam/OpenList Go github.com/OpenListTeam/OpenList/v3 Go github.com/OpenListTeam/OpenList/v4 |
Rancher CLI skips TLS verification on Rancher CLI login command CVE-2025-67601, GHSA-mc24-7m59-4q5p, GO-2026-4393 | High | Not scored | 01 Feb, 2026 | Go github.com/rancher/rancher |
SiYuan File Read API Case Sensitivity Bypass can Lead to Path Traversal CVE-2026-25992, GHSA-f72r-2h5j-7639, GO-2026-4386 | High | Not scored | 28 Jan, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Kyverno Denial of Service via Context Variable Amplification in Policy Engine BIT-kyverno-2026-23881, CVE-2026-23881, GHSA-r2rj-wwm5-x6mq, GO-2026-4382 | High | Not scored | 27 Jan, 2026 | Go github.com/kyverno/kyverno |
Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access CVE-2026-24740, GHSA-m855-r557-5rc5, GO-2026-4380 | High | Not scored | 27 Jan, 2026 | Go github.com/amir20/dozzle |
Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName CVE-2026-24470, GHSA-mxxc-p822-2hx9, GO-2026-4378 | High | Not scored | 26 Jan, 2026 | Go github.com/zalando/skipper |
CometBFT has inconsistencies between how commit signatures are verified and how block time is derived GHSA-c32p-wcqj-j677, GO-2026-4361 | High | Not scored | 23 Jan, 2026 | Go github.com/cometbft/cometbft |
Incus container image templating arbitrary host file read and write CVE-2026-23954, GHSA-7f67-crqm-jgh7, GO-2026-4357 | High | Not scored | 22 Jan, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd |
Incus container environment configuration newline injection CVE-2026-23953, GHSA-x6jc-phwx-hp32, GO-2026-4359 | High | Not scored | 22 Jan, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |
Dragonfly Manager Job API Unauthenticated Access CVE-2026-24124, GHSA-j8hf-cp34-g4j7, GO-2026-4356 | High | Not scored | 22 Jan, 2026 | Go d7y.io/dragonfly/v2 |
Soft Serve Affected by an Authentication Bypass CVE-2026-24058, GHSA-pchf-49fh-w34r, GO-2026-4353 | High | Not scored | 21 Jan, 2026 | Go github.com/charmbracelet/soft-serve |
Argo Workflows affected by stored XSS in the artifact directory listing BIT-argo-workflows-2026-23960, CVE-2026-23960, GHSA-cv78-6m8q-ph82, GO-2026-4350 | High | Not scored | 21 Jan, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
SiYuan vulnerable to Arbitrary file Read / SSRF CVE-2026-23850, GHSA-cv54-7wv7-qxcw, GO-2026-4347 | High | Not scored | 21 Jan, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality CVE-2026-23851, GHSA-94c7-g2fj-7682, GO-2026-4346 | High | Not scored | 21 Jan, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Fleet has an Access Control vulnerability in debug/pprof endpoints CVE-2026-23517, GHSA-4r5r-ccr6-q6f6, GO-2026-4334 | High | Not scored | 20 Jan, 2026 | Go github.com/fleetdm/fleet Go github.com/fleetdm/fleet/v4 |
esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages CVE-2026-23644, GHSA-2657-3c98-63jq, GO-2026-4332 | High | Not scored | 20 Jan, 2026 | Go github.com/esm-dev/esm.sh |
Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered CVE-2026-21696, GHSA-2497-gp99-2m74, GO-2026-4329 | High | Not scored | 20 Jan, 2026 | Go github.com/pterodactyl/wings |
Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks CVE-2025-69199, GHSA-8w7m-w749-rx98, GO-2026-4331 | High | Not scored | 20 Jan, 2026 | Go github.com/pterodactyl/wings |
Skipper is vulnerable to arbitrary code execution through lua filters CVE-2026-23742, GHSA-cc8m-98fm-rc9g, GO-2026-4327 | High | Not scored | 16 Jan, 2026 | Go github.com/zalando/skipper |
DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface CVE-2025-66292, GHSA-vh2x-fw87-4fxq, GO-2026-4318 | High | Not scored | 15 Jan, 2026 | Go github.com/donknap/dpanel |
go-ethereum is vulnerable to high CPU usage leading to DoS via malicious p2p message CVE-2026-22868, GHSA-mq3p-rrmp-79jg, GO-2026-4314 | High | Not scored | 13 Jan, 2026 | Go github.com/ethereum/go-ethereum |
go-ethereum is vulnerable to DoS via malicious p2p message affecting a vulnerable node CVE-2026-22862, GHSA-mr7q-c9w9-wh4h, GO-2026-4315 | High | Not scored | 13 Jan, 2026 | Go github.com/ethereum/go-ethereum |
Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal CVE-2026-22786, GHSA-3558-j79f-vvm6, GO-2026-4313 | High | Not scored | 13 Jan, 2026 | Go github.com/flipped-aurora/gin-vue-admin |
Envoy Extension Policy lua scripts injection causes arbitrary command execution BIT-envoy-gateway-2026-22771, CVE-2026-22771, GHSA-xrwg-mqj6-6m22, GO-2026-4312 | High | Not scored | 13 Jan, 2026 | Go github.com/envoyproxy/gateway |
Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced CVE-2025-68954, GHSA-8c39-xppg-479c, GO-2026-4283 | High | 0.2% | 06 Jan, 2026 | Go github.com/pterodactyl/wings Packagist pterodactyl/panel |
flagd: Multiple Go Runtime CVEs Impact Security and Availability GHSA-4c5f-9mj4-m247, GO-2026-4279 | High | Not scored | 05 Jan, 2026 | Go github.com/open-feature/flagd/core Go github.com/open-feature/flagd/flagd Go github.com/open-feature/flagd/flagd-proxy |
Gitea allows attackers to add attachments with forbidden file extensions BIT-gitea-2025-68939, CVE-2025-68939, GHSA-263q-5cv3-xq9g, GO-2025-4261 | High | Not scored | 26 Dec, 2025 | Go code.gitea.io/gitea |
KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential CVE-2025-68476, GHSA-c4p6-qg4m-9jmr, GO-2025-4257 | High | Not scored | 22 Dec, 2025 | Go github.com/kedacore/keda Go github.com/kedacore/keda/v2 |
Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm CVE-2025-14273, GHSA-qvmc-92vg-6r35, GO-2026-4275 | High | Not scored | 22 Dec, 2025 | Go github.com/mattermost/mattermost-plugin-jira Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments CVE-2025-68388, GHSA-fj69-23m4-ccvv, GO-2025-4253 | High | Not scored | 19 Dec, 2025 | Go github.com/elastic/beats Go github.com/elastic/beats/v7 |
Expr has Denial of Service via Unbounded Recursion in Builtin Functions CVE-2025-68156, GHSA-cfpf-hrx2-8rv6, GO-2025-4245 | High | Not scored | 16 Dec, 2025 | Go github.com/expr-lang/expr |
SIPGO is Vulnerable to Response DoS via Nil Pointer Dereference CVE-2025-68274, GHSA-c623-f998-8hhv, GO-2025-4244 | High | Not scored | 16 Dec, 2025 | Go github.com/emiago/sipgo |
Libredesk has Improper Neutralization of HTML Tags in a Web Page CVE-2025-68927, GHSA-wh6m-h6f4-rjf4, GO-2025-4243 | High | Not scored | 16 Dec, 2025 | Go github.com/abhinavxd/libredesk |
openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References CVE-2025-14443, GHSA-gxvv-45f6-3ch8, GO-2026-4578 | High | Not scored | 16 Dec, 2025 | Go github.com/openshift/openshift-apiserver |