Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Misconfigured Internal Proxy in runtimes-inventory-rhel8-operator Grants Standard Users Full Cluster Administrator Access CVE-2025-11393, GHSA-cc8c-28gj-px38, GO-2025-4241 | High | Not scored | 15 Dec, 2025 | Go github.com/RedHatInsights/runtimes-inventory-operator |
Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration GHSA-4jmp-x7mh-rgmr, GO-2025-4236 | High | Not scored | 12 Dec, 2025 | Go github.com/babylonlabs-io/finality-provider |
NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM) CVE-2025-66001, GHSA-4jj9-cgqc-x9h5, GO-2025-4235 | High | Not scored | 12 Dec, 2025 | Go github.com/neuvector/neuvector |
Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip CVE-2025-67818, GHSA-7v39-2hx7-7c43, GO-2025-4237 | High | Not scored | 12 Dec, 2025 | Go github.com/weaviate/weaviate |
Weaviate OSS has path traversal vulnerability via the Shard Movement API CVE-2025-67819, GHSA-hmmh-292h-3364, GO-2025-4238 | High | Not scored | 12 Dec, 2025 | Go github.com/weaviate/weaviate |
gardenctl is vulnerable to Command Injection when used with non‑POSIX shells CVE-2025-67508, GHSA-fw33-qpx7-rhx2, GO-2025-4232 | High | Not scored | 11 Dec, 2025 | Go github.com/gardener/gardenctl-v2 |
1Panel contains a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality CVE-2025-34429, GHSA-wrvc-x3wf-j5f5, GO-2025-4231 | High | Not scored | 10 Dec, 2025 | Go github.com/1Panel-dev/1Panel |
1Panel contains a cross-site request forgery (CSRF) vulnerability in the Change Username functionality CVE-2025-34410, GHSA-rpr2-4hqj-hc4q, GO-2025-4229 | High | Not scored | 10 Dec, 2025 | Go github.com/1Panel-dev/1Panel |
Gogs vulnerable to a bypass of CVE-2024-55947 CVE-2025-8110, GHSA-mq8m-42gh-wq7r, GO-2025-4225 | HighExploited | 85.2% | 10 Dec, 2025 | Go gogs.io/gogs |
SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin GHSA-4r66-7rcv-x46x, GO-2025-4219 | High | Not scored | 09 Dec, 2025 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE CVE-2025-67488, GHSA-gqfv-g4v7-m366, GO-2025-4221 | High | Not scored | 09 Dec, 2025 | Go github.com/siyuan-note/siyuan/kernel |
RCE via ZipSlip and symbolic links in argoproj/argo-workflows BIT-argo-workflows-2025-66626, CVE-2025-66626, GHSA-xrqc-7xgx-c9vh, GO-2025-4223 | High | Not scored | 09 Dec, 2025 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers GHSA-m6wq-66p2-c8pc, GO-2025-4211 | High | Not scored | 08 Dec, 2025 | Go github.com/babylonlabs-io/babylon Go github.com/babylonlabs-io/babylon/v2 Go github.com/babylonlabs-io/babylon/v3 Go github.com/babylonlabs-io/babylon/v4 |
ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login CVE-2025-67495, GHSA-v959-qxv6-6f8p, GO-2025-4213 | High | Not scored | 08 Dec, 2025 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 Login CVE-2026-29067, GHSA-pfrf-9r5f-73f5, GO-2025-4212 | High | Not scored | 08 Dec, 2025 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
memos vulnerability allows the creation of arbitrary accounts CVE-2025-65795, GHSA-mg56-wc4q-rw4w, GO-2025-4217 | High | Not scored | 08 Dec, 2025 | Go github.com/usememos/memos |
1Panel – CAPTCHA Bypass via Client-Controlled Flag CVE-2025-66507, GHSA-qmg5-v42x-qqhq, GO-2025-4209 | High | Not scored | 08 Dec, 2025 | Go github.com/1Panel-dev/1Panel Go github.com/1Panel-dev/1Panel/core |
Sigstore Timestamp Authority allocates excessive memory during request parsing CVE-2025-66564, GHSA-4qg8-fj49-pxjh, GO-2025-4192 | High | Not scored | 05 Dec, 2025 | Go github.com/sigstore/timestamp-authority Go github.com/sigstore/timestamp-authority/v2 |
Fulcio allocates excessive memory during token parsing CVE-2025-66506, GHSA-f83f-xpx7-ffpw, GO-2025-4193 | High | Not scored | 05 Dec, 2025 | Go github.com/sigstore/fulcio |
Logrus is vulnerable to DoS when using Entry.Writer() CVE-2025-65637, GHSA-4f99-4q7p-p3gh, GO-2025-4188 | High | Not scored | 04 Dec, 2025 | Go github.com/sirupsen/logrus |
Coder logs sensitive objects unsanitized CVE-2025-66411, GHSA-jf75-p25m-pw74, GO-2025-4182 | High | Not scored | 03 Dec, 2025 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode CVE-2025-64443, GHSA-46gc-mwh4-cc5r, GO-2025-4179 | High | Not scored | 03 Dec, 2025 | Go github.com/docker/mcp-gateway |
gokey allows secret recovery from a seed file without the master password CVE-2025-13353, GHSA-69jw-4jj8-fcxm, GO-2025-4174 | High | Not scored | 02 Dec, 2025 | Go github.com/cloudflare/gokey |
Gin-vue-admin has an arbitrary file deletion vulnerability CVE-2025-66410, GHSA-jrhg-82w2-vvj7, GO-2025-4171 | High | Not scored | 02 Dec, 2025 | Go github.com/flipped-aurora/gin-vue-admin |
Grype has a credential disclosure vulnerability in its JSON output CVE-2025-65965, GHSA-6gxw-85q2-q646, GO-2025-4160 | High | Not scored | 25 Nov, 2025 | Go github.com/anchore/grype |
Babylon's malformed vote extensions are not rejected GHSA-2fcv-qww3-9v6h, GO-2025-4157 | High | Not scored | 24 Nov, 2025 | Go github.com/babylonlabs-io/babylon Go github.com/babylonlabs-io/babylon/v2 Go github.com/babylonlabs-io/babylon/v3 Go github.com/babylonlabs-io/babylon/v4 |
OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation BIT-openbao-2025-64761, CVE-2025-64761, GHSA-7ff4-jw48-3436, GO-2025-4156 | High | Not scored | 24 Nov, 2025 | Go github.com/openbao/openbao |
new-api is vulnerable to SSRF Bypass CVE-2025-62155, GHSA-9f46-w24h-69w4, GO-2025-4154 | High | Not scored | 24 Nov, 2025 | Go github.com/QuantumNous/new-api |
NSSF panic due to nil pointer dereference when expiry field is omitted in NSSAIAvailability POST CVE-2025-60638, GHSA-f2hj-vpp9-6vm2, GO-2025-4163 | High | Not scored | 24 Nov, 2025 | Go github.com/free5gc/nssf |
Vault’s Terraform Provider incorrectly set default deny_null_bind parameter for LDAP auth method to false by default CVE-2025-13357, GHSA-gmm6-j2g5-r52m, GO-2025-4152 | High | Not scored | 21 Nov, 2025 | Go github.com/hashicorp/terraform-provider-vault |
Minder does not sandbox http.send in Rego programs CVE-2025-65109, GHSA-6xvf-4vh9-mw47, GO-2025-4147 | High | Not scored | 20 Nov, 2025 | Go github.com/mindersec/minder |
esm.sh CDN service has arbitrary file write via tarslip CVE-2025-65025, GHSA-h3mw-4f23-gwpw, GO-2025-4138 | High | Not scored | 19 Nov, 2025 | Go github.com/esm-dev/esm.sh |
Memos' Access Tokens Stay Valid after User Password Change CVE-2024-21635, GHSA-mr34-8733-grr2, GO-2025-4127 | High | Not scored | 14 Nov, 2025 | Go github.com/usememos/memos |
ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP CVE-2025-64717, GHSA-j4g7-v4m4-77px, GO-2025-4124 | High | Not scored | 14 Nov, 2025 | Go github.com/zitadel/zitadel |
LXD vulnerable to a local privilege escalation through custom storage volumes GHSA-3g2j-vm47-x4mj, GO-2025-4121 | High | Not scored | 13 Nov, 2025 | Go github.com/canonical/lxd |
File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion Function CVE-2025-64523, GHSA-6cqf-cfhv-659g, GO-2025-4117 | High | Not scored | 13 Nov, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance GHSA-7wq2-32h4-9hc9, GO-2025-4119 | High | Not scored | 13 Nov, 2025 | Go github.com/aws/aws-advanced-go-wrapper/auth-helpers Go github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager Go github.com/aws/aws-advanced-go-wrapper/awssql Go github.com/aws/aws-advanced-go-wrapper/federated-auth +6 more |
golang.org/x/crypto/ssh/agent has a potential denial of service CVE-2025-47913, GHSA-56w8-48fp-6mgv, GO-2025-4116 | High | Not scored | 13 Nov, 2025 | Go golang.org/x/crypto Go golang.org/x/crypto/ssh/agent |
Incus vulnerable to local privilege escalation through custom storage volumes CVE-2025-64507, GHSA-56mx-8g9f-5crf, GO-2025-4115 | High | Not scored | 13 Nov, 2025 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |
Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves CVE-2025-64186, GHSA-88h9-77c7-p6w4, GO-2025-4112 | High | Not scored | 12 Nov, 2025 | Go github.com/evervault/evervault-go |
OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation BIT-oauth2-proxy-2025-64484, CVE-2025-64484, GHSA-vjrc-mh2v-45x6, GO-2025-4113 | High | Not scored | 12 Nov, 2025 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack CVE-2025-2843, GHSA-mj6p-p843-x5wc, GO-2025-4125 | High | Not scored | 12 Nov, 2025 | Go github.com/rhobs/observability-operator |
jose2go is vulnerable to a JWT bomb attack through its decode function CVE-2025-63811, GHSA-9mj6-hxhv-w67j, GO-2025-4123 | High | Not scored | 12 Nov, 2025 | Go github.com/dvsekhvalnov/jose2go |
KubeVirt Vulnerable to Arbitrary Host File Read and Write CVE-2025-64324, GHSA-46xp-26xh-hpqh, GO-2025-4110 | High | Not scored | 07 Nov, 2025 | Go kubevirt.io/kubevirt |
containerd affected by a local privilege escalation via wide permissions on CRI directory CVE-2024-25621, GHSA-pwhc-rpq9-4c8w, GO-2025-4100 | High | Not scored | 06 Nov, 2025 | Go github.com/containerd/containerd Go github.com/containerd/containerd/v2 |
IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering CVE-2025-64431, GHSA-cpf4-pmr4-w6cx, GO-2025-4099 | High | Not scored | 05 Nov, 2025 | Go github.com/zitadel/zitadel |
runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects CVE-2025-52881, GHSA-cgrx-mc8f-2prm, GO-2025-4098 | High | Not scored | 05 Nov, 2025 | Go github.com/opencontainers/runc Go github.com/opencontainers/selinux |
runc container escape with malicious config due to /dev/console mount and related races CVE-2025-52565, GHSA-qw9x-cqr3-wc7r, GO-2025-4097 | High | Not scored | 05 Nov, 2025 | Go github.com/opencontainers/runc |
runc container escape via "masked path" abuse due to mount race conditions CVE-2025-31133, GHSA-9493-h29p-rfm2, GO-2025-4096 | High | Not scored | 05 Nov, 2025 | Go github.com/opencontainers/runc |
MARIN3R: Cross-Namespace Vulnerability in the Operator CVE-2025-64171, GHSA-gf93-xccm-5g6j, GO-2025-4093 | High | Not scored | 04 Nov, 2025 | Go github.com/3scale-sre/marin3r |