Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent CVE-2026-48496, GHSA-f2r5-5m7w-p5cx, GO-2026-5343 | Medium | Not scored | 23 Jun, 2026 | Go go.opentelemetry.io/ebpf-profiler |
Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir CVE-2026-48126, GHSA-jc3j-x6pg-4hmv, GO-2026-5460 | High | Not scored | 23 Jun, 2026 | Go github.com/xyproto/algernon |
Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS CVE-2026-52816, GHSA-3w28-36p9-w929, GO-2026-5103 | Medium | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API CVE-2026-52815, GHSA-744x-3838-5r56, GO-2026-5202 | Medium | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) CVE-2026-52814, GHSA-xp79-5mx3-jx52, GO-2026-5765 | Medium | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs has Path Traversal in organization name that results in RCE through Git hooks CVE-2026-52813, GHSA-c39w-43gm-34h5, GO-2026-5305 | Critical | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs: LFS dedupe path leaks private repo content across tenants CVE-2026-52812, GHSA-6p9m-q3jp-47h4, GO-2026-5184 | High | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym CVE-2026-52811, GHSA-89mr-xqfv-758m, GO-2026-5249 | Critical | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion CVE-2026-52810, GHSA-wmfg-5p4h-5fw3, GO-2026-5712 | High | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES CVE-2026-52809, GHSA-5c3f-6486-3g7g, GO-2026-5140 | Medium | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs's write-level collaborators can mutate admin-only repository settings via API CVE-2026-52808, GHSA-268j-37xf-pp52, GO-2026-5065 | High | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs has DOM-based XSS via Milestone Name on New Issue Page CVE-2026-52807, GHSA-vcm5-gvmp-78mp, GO-2026-5661 | Medium | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge CVE-2026-52806, GHSA-qf6p-p7ww-cwr9, GO-2026-5580 | Critical | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft CVE-2026-52805, GHSA-g2f5-gjr4-qjvm, GO-2026-5387 | High | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation CVE-2026-52804, GHSA-4565-r4x7-hg8j, GO-2026-5110 | Medium | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs has an Open Redirect via redirect_to CVE-2026-52802, GHSA-xxhq-69mf-w8cr, GO-2026-5773 | Medium | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
OpenShift Cluster Logging Operator missing authorization flaw CVE-2026-10609, GHSA-9xm2-gw56-wj7m, GO-2026-6590 | Medium | Not scored | 23 Jun, 2026 | Go github.com/openshift/cluster-logging-operator |
Gogs has the ability to import local repositories via Mirror Settings CVE-2026-52801, GHSA-wv27-2vqp-j7g5, GO-2026-5724 | High | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs Vulnerable to CSRF Leading to Organization Owner Takeover CVE-2026-52800, GHSA-pwx3-qcgw-vh7h, GO-2026-5556 | High | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs Missing Authorization in Attachment Download CVE-2026-52799, GHSA-p9f5-h3rx-j5qw, GO-2026-5536 | High | Not scored | 22 Jun, 2026 | Go gogs.io/gogs |
Gogs has Stored XSS in `.ipynb` Preview CVE-2026-52798, GHSA-jq8v-rmf6-65jw, GO-2026-5477 | High | Not scored | 22 Jun, 2026 | Go gogs.io/gogs |
Gogs has DoS in rendering issue index pattern CVE-2026-52796, GHSA-4j89-2c4f-44c6, GO-2026-5124 | Low | Not scored | 22 Jun, 2026 | Go gogs.io/gogs |
nebula-mesh's stores enrollment tokens unhashed in SQLite GHSA-ghmh-jhmj-wcmf, GO-2026-5399 | Medium | Not scored | 22 Jun, 2026 | Go github.com/juev/nebula-mesh |
Gogs has SSRF in webhook deliveries CVE-2026-47267, GHSA-c4v7-xg93-qf8g, GO-2026-5312 | High | Not scored | 22 Jun, 2026 | Go gogs.io/gogs |
Gophish contains a denial of service vulnerability CVE-2026-39904, GHSA-42jc-v69j-g38f, GO-2026-6212 | High | Not scored | 22 Jun, 2026 | Go github.com/gophish/gophish |
package pkcs12: Authentication bypass in Decode functions GHSA-mpwr-8vm7-h73f, GO-2026-5052 | Medium | Not scored | 22 Jun, 2026 | Go software.sslmate.com/src/go-pkcs12 |
Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF (no shipped gadget affected) CVE-2026-44778, GHSA-7cfq-5mhv-jrp9, GO-2026-5214 | Low | Not scored | 22 Jun, 2026 | Go github.com/inspektor-gadget/inspektor-gadget |
Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive CVE-2026-44517, GHSA-49p4-px3h-rq49, GO-2026-5116 | Medium | Not scored | 22 Jun, 2026 | Go github.com/containers/buildah |
runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations CVE-2026-41579, GHSA-xjvp-4fhw-gc47, GO-2026-5761 | Medium | Not scored | 22 Jun, 2026 | Go github.com/opencontainers/runc |
Canonical ADSys Uses a Less Trusted Source CVE-2026-12249, GHSA-crm4-q7v4-c2r2, GO-2026-6543 | Critical | Not scored | 22 Jun, 2026 | Go github.com/ubuntu/adsys |
Grafana: Pre-authentication denial of service in the public dashboard query handler BIT-grafana-2026-42127, CVE-2026-42127, GHSA-3w66-95m3-8jxg, GO-2026-6541 | High | Not scored | 22 Jun, 2026 | Go github.com/grafana/grafana |
Mattermost has an Incorrect Authorization issue CVE-2026-8823, GHSA-xmfh-3ccg-c9fx, GO-2026-6547 | Low | Not scored | 22 Jun, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers CVE-2026-25119, GHSA-w6j9-vw59-27wv, GO-2026-5695 | High | Not scored | 22 Jun, 2026 | Go gogs.io/gogs |
Gogs has a Denial of Service in repository/wiki file listing web pages CVE-2025-64719, GHSA-3qq3-668m-v9mj, GO-2026-5098 | Medium | Not scored | 22 Jun, 2026 | Go gogs.io/gogs |
Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint CVE-2026-8074, GHSA-g5vr-6pgg-74qv, GO-2026-6481 | Low | Not scored | 22 Jun, 2026 | Go github.com/mattermost/mattermost-server |
Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug BIT-grafana-2026-9029, CVE-2026-9029, GHSA-9g84-39mm-q4p3, GO-2026-6542 | High | Not scored | 22 Jun, 2026 | Go github.com/grafana/grafana |
Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation CVE-2026-9162, GHSA-h998-hxxj-8q83, GO-2026-6482 | Medium | Not scored | 22 Jun, 2026 | Go github.com/mattermost/mattermost-server |
Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler CVE-2026-5139, GHSA-2g8v-grq3-hq2g, GO-2026-6480 | Medium | Not scored | 22 Jun, 2026 | Go github.com/mattermost/mattermost-server |
Mattermost doesn't validate channel ownership of an existing subscription before applying edits CVE-2026-6062, GHSA-mxq2-5jpg-7474, GO-2026-6484 | Medium | Not scored | 22 Jun, 2026 | Go github.com/mattermost/mattermost-server |
Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret CVE-2026-6673, GHSA-jqgv-39mg-7c2r, GO-2026-6483 | Medium | Not scored | 22 Jun, 2026 | Go github.com/mattermost/mattermost-server |
Grafana: Path traversal in the Tempo and Loki data source plugins BIT-grafana-2026-10601, CVE-2026-10601, GHSA-9493-h4f5-633x, GO-2026-6545 | Medium | Not scored | 22 Jun, 2026 | Go github.com/grafana/grafana |
Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. CVE-2026-42129, GHSA-f74p-cwhp-x2wx, GO-2026-6544 | High | Not scored | 22 Jun, 2026 | Go github.com/grafana/grafana |
Gogs: XSS in .ipynb files renderer due to outdated notebookjs GHSA-6vxv-wg6j-5qwp, GO-2026-5193 | High | Not scored | 19 Jun, 2026 | Go gogs.io/gogs |
SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected CVE-2026-55866, GHSA-4vrg-r928-h5vv, GO-2026-5133 | Low | Not scored | 19 Jun, 2026 | Go github.com/authzed/spicedb |
OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types BIT-openbao-2026-55776, CVE-2026-55776, GHSA-8w8f-r2xv-4q4j, GO-2026-5267 | Medium | Not scored | 19 Jun, 2026 | Go github.com/openbao/openbao |
OpenBao's System Backend allows Unauthorized Management of the containing Namespace BIT-openbao-2026-55775, CVE-2026-55775, GHSA-mwr2-wmgp-crj6, GO-2026-5517 | Low | Not scored | 19 Jun, 2026 | Go github.com/openbao/openbao |
OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 BIT-openbao-2026-55774, CVE-2026-55774, GHSA-c36x-h252-g9x2, GO-2026-5304 | Low | Not scored | 19 Jun, 2026 | Go github.com/openbao/openbao |
OpenBao: LDAPi ldaputil (wrong escape func) BIT-openbao-2026-55770, CVE-2026-55770, GHSA-6mwx-4547-5vc9, GO-2026-5182 | Medium | Not scored | 19 Jun, 2026 | Go github.com/openbao/openbao |
Grafana Tempo vulnerable to an out-of-memory crash CVE-2026-27878, GHSA-6xff-cpcq-vpw2, GO-2026-6325 | Medium | Not scored | 19 Jun, 2026 | Go github.com/grafana/tempo |
Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms CVE-2026-55187, GHSA-w4mc-hhc6-xp28, GO-2026-5688 | Medium | Not scored | 19 Jun, 2026 | Go github.com/axllent/mailpit |