Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability GHSA-54p8-x2m9-c593, GO-2026-4583 | Medium | Not scored | 02 Mar, 2026 | Go github.com/chainguard-dev/malcontent |
Bytebase vulnerable to Improper Authentication CVE-2022-51026, GHSA-5r3p-6rj5-7937 | Medium | Not scored | 02 Mar, 2026 | Go github.com/bytebase/bytebase |
malcontent: Nested archive extraction failure can drop content from scan inputs CVE-2026-28407, GHSA-945p-3jhm-6rcp, GO-2026-4577 | Medium | Not scored | 28 Feb, 2026 | Go github.com/chainguard-dev/malcontent |
osctrl has Stored Cross-Site Scripting (XSS) in On-Demand Query List CVE-2026-28280, GHSA-4rv8-5cmm-2r22, GO-2026-4576 | Medium | Not scored | 28 Feb, 2026 | Go github.com/jmpsec/osctrl |
ZITADEL's truncated opaque tokens are still valid CVE-2026-27840, GHSA-6mq3-xmgp-pjm5, GO-2026-4573 | Medium | Not scored | 27 Feb, 2026 | Go github.com/zitadel/zitadel |
Beszel: Docker API has a Path Traversal Vulnerability via Unsanitized Container ID CVE-2026-27734, GHSA-phwh-4f42-gwf3, GO-2026-4571 | Medium | Not scored | 27 Feb, 2026 | Go github.com/henrygd/beszel |
Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations BIT-sealed-secrets-2026-22728, CVE-2026-22728, GHSA-465p-v42x-3fmj, GO-2026-4565 | Medium | Not scored | 26 Feb, 2026 | Go github.com/bitnami-labs/sealed-secrets |
Terraform Provider for Linode Debug Logs Vulnerable to Sensitive Information Exposure CVE-2026-27900, GHSA-5rc7-2jj6-mp64, GO-2026-4562 | Medium | Not scored | 26 Feb, 2026 | Go github.com/linode/terraform-provider-linode Go github.com/linode/terraform-provider-linode/v2 Go github.com/linode/terraform-provider-linode/v3 |
Fleet: Authorization Bypass in certificate template batch deletion for team administrators CVE-2026-25963, GHSA-5jvp-m9h4-253h, GO-2026-4561 | Medium | Not scored | 26 Feb, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint CVE-2026-24004, GHSA-9pm7-6g36-6j78, GO-2026-4563 | Medium | Not scored | 26 Feb, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet: Device lock PIN can be predicted if lock time is known CVE-2026-23999, GHSA-ppwx-5jq7-px2w, GO-2026-4564 | Medium | Not scored | 26 Feb, 2026 | Go github.com/fleetdm/fleet/v4 |
Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API CVE-2026-27808, GHSA-mpf7-p9x7-96r3, GO-2026-4558 | Medium | Not scored | 26 Feb, 2026 | Go github.com/axllent/mailpit |
Fleet has an SQL Injection vulnerability via backtick escape in ORDER BY parameter CVE-2026-26186, GHSA-49xw-vfc4-7p43, GO-2026-4557 | Medium | Not scored | 26 Feb, 2026 | Go github.com/fleetdm/fleet/v4 |
Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module CVE-2026-27116, GHSA-4qgr-4h56-8895, GO-2026-4552 | Medium | Not scored | 25 Feb, 2026 | Go code.vikunja.io/api |
Fiber has a Denial of Service Vulnerability via Route Parameter Overflow CVE-2026-25882, GHSA-mrq8-rjmw-wpq3, GO-2026-4543 | Medium | Not scored | 24 Feb, 2026 | Go github.com/gofiber/fiber/v2 Go github.com/gofiber/fiber/v3 |
Caddy is vulnerable to cross-origin config application via local admin API /load CVE-2026-27589, GHSA-879p-475x-rqh2, GO-2026-4537 | Medium | Not scored | 24 Feb, 2026 | Go github.com/caddyserver/caddy/v2 |
Caddy: Improper sanitization of glob characters in file matcher may lead to bypassing security protections CVE-2026-27585, GHSA-4xrr-hq4w-6vf4, GO-2026-4535 | Medium | Not scored | 24 Feb, 2026 | Go github.com/caddyserver/caddy/v2 |
nats-server websockets are vulnerable to pre-auth memory DoS BIT-nats-2026-27571, CVE-2026-27571, GHSA-qrvq-68c2-7grw, GO-2026-4533 | Medium | Not scored | 24 Feb, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
Centrifugo v6.6.0 dependency vulnerabilities GHSA-j9wf-6r2x-hqmx, GO-2026-4528 | Medium | Not scored | 19 Feb, 2026 | Go github.com/centrifugal/centrifugo Go github.com/centrifugal/centrifugo/v3 Go github.com/centrifugal/centrifugo/v4 Go github.com/centrifugal/centrifugo/v5 +1 more |
Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled BIT-cilium-2026-26963, BIT-cilium-operator-2026-26963, BIT-hubble-relay-2026-26963, CVE-2026-26963, GHSA-5r23-prx4-mqg3, GO-2026-4522 | Medium | Not scored | 19 Feb, 2026 | Go github.com/cilium/cilium |
Kata Container to Guest micro VM privilege escalation CVE-2026-24834, GHSA-wwj6-vghv-5p64, GO-2026-4517 | Medium | Not scored | 19 Feb, 2026 | Go github.com/kata-containers/kata-containers/src/runtime |
Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints CVE-2026-27111, GHSA-5vvm-67pj-72g4, GO-2026-4515 | Medium | Not scored | 19 Feb, 2026 | Go github.com/akuity/kargo |
Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake CVE-2026-26315, GHSA-m6j8-rg6r-7mv8, GO-2026-4511 | Medium | Not scored | 18 Feb, 2026 | Go github.com/ethereum/go-ethereum |
Go Ethereum affected by DoS via malicious p2p message CVE-2026-26313, GHSA-689v-6xwf-5jf3, GO-2026-4508 | Medium | Not scored | 18 Feb, 2026 | Go github.com/ethereum/go-ethereum |
Withdrawn Advisory: Libredesk has a SSRF Vulnerability in Webhooks CVE-2026-26957, GHSA-wgm6-9rvv-3438, GO-2026-4505 | Medium | Not scored | 18 Feb, 2026 | Go github.com/abhinavxd/libredesk |
Echo has a Windows path traversal via backslash in middleware.Static default filesystem CVE-2026-25766, GHSA-pgvm-wxw2-hrv9, GO-2026-4502 | Medium | Not scored | 17 Feb, 2026 | Go github.com/labstack/echo/v5 |
Unauthenticated File Upload in Gogs CVE-2026-25242, GHSA-fc3h-92p8-h36f, GO-2026-4500 | Medium | Not scored | 17 Feb, 2026 | Go gogs.io/gogs |
Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs CVE-2026-25229, GHSA-cv22-72px-f4gh, GO-2026-4499 | Medium | Not scored | 17 Feb, 2026 | Go gogs.io/gogs |
Gogs Allows Cross-Repository Comment Deletion via DeleteComment CVE-2026-25120, GHSA-jj5m-h57j-5gv7, GO-2026-4501 | Medium | Not scored | 17 Feb, 2026 | Go gogs.io/gogs |
Mattermost fails to properly validate team membership when processing channel mentions CVE-2025-14350, GHSA-57cc-2pf4-mhmx, GO-2026-4521 | Medium | Not scored | 16 Feb, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to sanitize sensitive data in WebSocket messages CVE-2025-13821, GHSA-pp9j-pf5c-659x, GO-2026-4524 | Medium | Not scored | 16 Feb, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Plugin Zoom allows any logged-in user to change Zoom meeting restrictions for arbitrary channels CVE-2026-0997, GHSA-2phx-frhf-xr55, GO-2026-4519 | Medium | Not scored | 16 Feb, 2026 | Go github.com/mattermost/mattermost-plugin-zoom |
Mattermost Plugin Zoom fail to validate user identity and post ownership in the {{/api/v1/askPMI}} endpoint CVE-2026-0998, GHSA-w65c-fvp5-fvc5, GO-2026-4525 | Medium | Not scored | 16 Feb, 2026 | Go github.com/mattermost/mattermost-plugin-zoom |
Mattermost fails to properly validate login method restrictions CVE-2026-0999, GHSA-3c9r-7f29-qp32, GO-2026-4520 | Medium | Not scored | 16 Feb, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't validate user permissions when creating Jira issues from Mattermost posts CVE-2026-22892, GHSA-9pj7-jh2r-87g8, GO-2026-4496 | Medium | Not scored | 13 Feb, 2026 | Go github.com/mattermost/mattermost-server |
webtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map CVE-2026-21438, GHSA-2f2x-8mwp-p2gc, GO-2026-4483 | Medium | Not scored | 12 Feb, 2026 | Go github.com/quic-go/webtransport-go |
webtransport-go: CloseWithError can block indefinitely CVE-2026-21435, GHSA-px4r-g4p3-hhqv, GO-2026-4488 | Medium | Not scored | 12 Feb, 2026 | Go github.com/quic-go/webtransport-go |
webtransport-go: Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule CVE-2026-21434, GHSA-g6x7-jq8p-6q9q, GO-2026-4485 | Medium | Not scored | 12 Feb, 2026 | Go github.com/marten-seemann/webtransport-go Go github.com/quic-go/webtransport-go |
Grafana has a Cross-site Scripting issue BIT-grafana-2025-41117, CVE-2025-41117, GHSA-cqp7-wf4c-3xgc, GO-2026-5332 | Medium | Not scored | 12 Feb, 2026 | Go github.com/grafana/grafana |
Pion DTLS's usage of random nonce generation with AES GCM ciphers risks leaking the authentication key CVE-2026-26014, GHSA-9f3f-wv7r-qc8r, GO-2026-4479 | Medium | Not scored | 11 Feb, 2026 | Go github.com/pion/dtls Go github.com/pion/dtls/v2 Go github.com/pion/dtls/v3 |
mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling CVE-2026-2303, GHSA-cp6g-7hqx-qxhp, GO-2026-5327 | Medium | Not scored | 10 Feb, 2026 | Go go.mongodb.org/mongo-driver Go go.mongodb.org/mongo-driver/v2 |
go-git improperly verifies data integrity values for .idx and .pack files CVE-2026-25934, GHSA-37cx-329c-33x3, GO-2026-4473 | Medium | Not scored | 10 Feb, 2026 | Go github.com/go-git/go-git Go github.com/go-git/go-git/v4 Go github.com/go-git/go-git/v5 |
File Browser has an Authentication Bypass in User Password Update CVE-2026-25889, GHSA-hxw8-4h9j-hq2r, GO-2026-4475 | Medium | Not scored | 10 Feb, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Gogs has authorization bypass in repository deletion API CVE-2025-65852, GHSA-rjv5-9px2-fqw6, GO-2026-4457 | Medium | Not scored | 06 Feb, 2026 | Go gogs.io/gogs |
Gophish is vulnerable to Incorrect Access Control CVE-2025-70963, GHSA-9f8m-9547-2gqm, GO-2026-4455 | Medium | Not scored | 06 Feb, 2026 | Go github.com/gophish/gophish |
Gogs has arbitrary file read/write via Path Traversal in Git hook editing CVE-2026-23633, GHSA-mrph-w4hh-gx3g, GO-2026-4453 | Medium | Not scored | 06 Feb, 2026 | Go gogs.io/gogs |
Gogs user can update repository content with read-only permission CVE-2026-23632, GHSA-5qhx-gwfj-6jqr, GO-2026-4450 | Medium | Not scored | 06 Feb, 2026 | Go gogs.io/gogs |
Gogs has a Denial of Service issue CVE-2026-22592, GHSA-cr88-6mqm-4g57, GO-2026-4451 | Medium | Not scored | 06 Feb, 2026 | Go gogs.io/gogs |
Sliver Vulnerable to Website Path Traversal / Arbitrary File Read (Authenticated) CVE-2026-25760, GHSA-2286-hxv5-cmp2, GO-2026-4445 | Medium | Not scored | 05 Feb, 2026 | Go github.com/bishopfox/sliver |
OpenFGA Improper Policy Enforcement CVE-2026-24851, GHSA-jq9f-gm9w-rwm9, GO-2026-4446 | Medium | Not scored | 05 Feb, 2026 | Go github.com/openfga/openfga |