Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
golang.org/x/net/html has a Quadratic Parsing Complexity issue CVE-2025-47911, GHSA-w4gw-w5jq-g9jh, GO-2026-4440 | Medium | Not scored | 05 Feb, 2026 | Go golang.org/x/net Go golang.org/x/net/html |
EVE Has Partially Predetermined Vault Key CVE-2023-43637, GHSA-g7vp-j25f-h34p, GO-2026-4436 | Medium | Not scored | 04 Feb, 2026 | Go github.com/lf-edge/eve |
EVE Doesn't Protect Rootfs CVE-2023-43636, GHSA-5h7v-g49c-h887, GO-2026-4435 | Medium | Not scored | 04 Feb, 2026 | Go github.com/lf-edge/eve Go github.com/lf-edge/eve/pkg/grub |
EVE Seals Vault Key With SHA1 PCRs CVE-2023-43635, GHSA-4jvr-vj2c-8q37, GO-2026-4434 | Medium | Not scored | 04 Feb, 2026 | Go github.com/lf-edge/eve |
EVE Doesn't Protect Config Partition with Measured Boot CVE-2023-43634, GHSA-wc42-fcjp-v8vq, GO-2026-4432 | Medium | Not scored | 04 Feb, 2026 | Go github.com/lf-edge/eve |
EVE's Debug Functions Unlockable Without Triggering Measured Boot CVE-2023-43633, GHSA-4c4v-42hc-72p6, GO-2026-4428 | Medium | Not scored | 04 Feb, 2026 | Go github.com/lf-edge/eve |
EVE Freely Allocates Buffer on The Stack With Data From Socket CVE-2023-43632, GHSA-6jp5-grgh-jw42, GO-2026-4422 | Medium | Not scored | 04 Feb, 2026 | Go github.com/lf-edge/eve |
EVE: SSH as Root Unlockable Without Triggering Measured Boot CVE-2023-43631, GHSA-3mq9-xhgq-r7gj, GO-2026-4418 | Medium | Not scored | 04 Feb, 2026 | Go github.com/lf-edge/eve |
EVE Doesn't Measure Config Partition From 2 Fronts CVE-2023-43630, GHSA-phcg-h58r-gmcq, GO-2026-4430 | Medium | Not scored | 04 Feb, 2026 | Go github.com/lf-edge/eve |
Apache Answer Exposure of Private Personal Information to an Unauthorized Actor vulnerability CVE-2026-24735, GHSA-5w5r-8xc6-2xhw, GO-2026-4421 | Medium | Not scored | 04 Feb, 2026 | Go github.com/apache/answer |
ingress-nginx vulnerable to Allocation of Resources Without Limits or Throttling CVE-2026-24514, GHSA-2pf9-vr92-6h3v, GO-2026-4417 | Medium | Not scored | 04 Feb, 2026 | Go k8s.io/ingress-nginx |
Navidrome has XSS via comment from song metadata CVE-2026-25578, GHSA-rh3r-8pxm-hg4w, GO-2026-4413 | Medium | Not scored | 04 Feb, 2026 | Go github.com/navidrome/navidrome |
melange has a path traversal in license-path which allows reading files outside workspace CVE-2026-25145, GHSA-2w4f-9fgg-q2v9, GO-2026-4409 | Medium | Not scored | 04 Feb, 2026 | Go chainguard.dev/melange |
apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams CVE-2026-25122, GHSA-6p9p-q6wh-9j89, GO-2026-4406 | Medium | Not scored | 03 Feb, 2026 | Go chainguard.dev/apko |
cert-manager-controller DoS via Specially Crafted DNS Response BIT-cert-manager-2026-25518, CVE-2026-25518, GHSA-gx3x-vq4p-mhhv, GO-2026-4399 | Medium | Not scored | 02 Feb, 2026 | Go github.com/cert-manager/cert-manager |
WireGuard Portal v2 has Open Redirect Vulnerability in OAuth Authentication Flow GHSA-grh9-37g7-53mj, GO-2026-4398 | Medium | Not scored | 02 Feb, 2026 | Go github.com/h44z/wg-portal |
malcontent vulnerable to symlink Path Traversal via handleSymlink argument confusion in archive extraction CVE-2026-24846, GHSA-923j-vrcg-hxwh, GO-2026-4391 | Medium | Not scored | 29 Jan, 2026 | Go github.com/chainguard-dev/malcontent |
malcontent OCI image pull credential exfiltration via malicious registry token realm CVE-2026-24845, GHSA-9m43-p3cx-w8j5, GO-2026-4392 | Medium | Not scored | 29 Jan, 2026 | Go github.com/chainguard-dev/bincapz Go github.com/chainguard-dev/malcontent |
Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access CVE-2026-24748, GHSA-w5wv-wvrp-v5m5, GO-2026-4385 | Medium | Not scored | 27 Jan, 2026 | Go github.com/akuity/kargo |
gmrtd ReadFile Vulnerable to Denial of Service via Excessive TLV Length Values CVE-2026-24738, GHSA-j49h-6577-5xwq, GO-2026-4379 | Medium | Not scored | 27 Jan, 2026 | Go github.com/gmrtd/gmrtd |
go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names CVE-2026-24686, GHSA-jqc5-w2xx-5vq4, GO-2026-4377 | Medium | Not scored | 26 Jan, 2026 | Go github.com/theupdateframework/go-tuf/v2 |
KubeVirt Guest Agent DoS via Excessive Network Interface Reports CVE-2025-14525, GHSA-25mh-hp8x-cgrv, GO-2026-4384 | Medium | Not scored | 26 Jan, 2026 | Go kubevirt.io/kubevirt |
Gitea does not properly validate ownership when toggling OpenID URI visibility BIT-gitea-2026-20904, CVE-2026-20904, GHSA-jrpc-w85r-hgqx, GHSA-qqgv-v353-cv8p, GO-2026-4369 | Medium | Not scored | 23 Jan, 2026 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Gitea does not properly validate repository ownership when linking attachments to releases BIT-gitea-2026-20912, CVE-2026-20912, GHSA-4xx9-vc8v-87hv, GHSA-vfmv-f93v-37mw, GO-2026-4364 | Medium | Not scored | 23 Jan, 2026 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Gitea does not properly validate project ownership in organization project operations BIT-gitea-2026-20750, CVE-2026-20750, GHSA-h4fh-pc4w-8w27, GHSA-rw22-5hhq-pfpf, GO-2026-4370 | Medium | Not scored | 23 Jan, 2026 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface BIT-gitea-2026-20888, CVE-2026-20888, GHSA-9cgq-wp42-4rpq, GHSA-ccq9-c5hv-cf64, GO-2026-4366 | Medium | Not scored | 23 Jan, 2026 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Gitea does not properly validate repository ownership when deleting Git LFS locks BIT-gitea-2026-20897, CVE-2026-20897, GHSA-393c-qgvj-3xph, GHSA-rrq5-r9h5-pc7c, GO-2026-4363 | Medium | Not scored | 23 Jan, 2026 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal CVE-2026-24137, GHSA-fcv2-xgw5-pqxf, GO-2026-4358 | Medium | Not scored | 22 Jan, 2026 | Go github.com/sigstore/sigstore |
Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL CVE-2026-24117, GHSA-4c4x-jm2x-pf9j, GO-2026-4355 | Medium | Not scored | 22 Jan, 2026 | Go github.com/sigstore/rekor |
Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message CVE-2026-23831, GHSA-273p-m2cw-6833, GO-2026-4354 | Medium | Not scored | 22 Jan, 2026 | Go github.com/sigstore/rekor |
Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims CVE-2026-23990, GHSA-4xh5-jcj2-ch8q, GO-2026-4351 | Medium | Not scored | 21 Jan, 2026 | Go github.com/controlplaneio-fluxcd/flux-operator |
go-tuf improperly validates the configured threshold for delegations CVE-2026-23992, GHSA-fphv-w9fq-2525, GO-2026-4349 | Medium | Not scored | 21 Jan, 2026 | Go github.com/theupdateframework/go-tuf/v2 |
go-tuf affected by client DoS via malformed server response CVE-2026-23991, GHSA-846p-jg2w-w324, GO-2026-4348 | Medium | Not scored | 21 Jan, 2026 | Go github.com/theupdateframework/go-tuf/v2 |
File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login CVE-2026-23849, GHSA-43mm-m3h2-3prc, GO-2026-4344 | Medium | Not scored | 21 Jan, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Mailpit has a Server-Side Request Forgery (SSRF) via HTML Check API CVE-2026-23845, GHSA-6jxm-fv7w-rw5j, GO-2026-4345 | Medium | Not scored | 21 Jan, 2026 | Go github.com/axllent/mailpit |
Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability CVE-2026-22808, GHSA-gfpw-jgvr-cw4j, GO-2026-4336 | Medium | Not scored | 20 Jan, 2026 | Go github.com/fleetdm/fleet Go github.com/fleetdm/fleet/v4 |
Mailpit has an SMTP Header Injection via Regex Bypass CVE-2026-23829, GHSA-54wq-72mp-cq7c, GO-2026-4333 | Medium | Not scored | 20 Jan, 2026 | Go github.com/axllent/mailpit |
SiYuan Has a Stored Cross-Site Scripting (XSS) Vulnerability via Unrestricted SVG File Upload CVE-2026-23645, GHSA-pcjq-j3mq-jv5j, GO-2026-4324 | Medium | Not scored | 16 Jan, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Mattermost is vulnerable to DoS due to infinite re-renders on API errors CVE-2025-14435, GHSA-mx8m-v8qm-xwr8, GO-2026-4326 | Medium | Not scored | 16 Jan, 2026 | Go github.com/mattermost/mattermost-server |
Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall CVE-2026-22045, GHSA-cwjm-3f7h-9hwq, GO-2026-4322 | Medium | Not scored | 15 Jan, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
lakeFS is Missing Timestamp Validation in S3 Gateway Authentication CVE-2025-68671, GHSA-f2ph-gc9m-q55f, GO-2026-4321 | Medium | Not scored | 15 Jan, 2026 | Go github.com/treeverse/lakefs |
Zitadel has a user enumeration vulnerability in Login UIs CVE-2026-23511, GHSA-pvm5-9frx-264r, GO-2026-4319 | Medium | Not scored | 15 Jan, 2026 | Go github.com/zitadel/zitadel |
chi has an open redirect vulnerability in the RedirectSlashes middleware CVE-2025-69725, GHSA-mqqf-5wvp-8fh8, GO-2026-4316 | Medium | Not scored | 14 Jan, 2026 | Go github.com/go-chi/chi Go github.com/go-chi/chi/v2 Go github.com/go-chi/chi/v3 Go github.com/go-chi/chi/v4 +1 more |
Metricbeat affected by multiple denial of service vulnerabilities CVE-2026-0528, GHSA-w2gr-585j-r428, GO-2026-4360 | Medium | Not scored | 13 Jan, 2026 | Go github.com/elastic/beats Go github.com/elastic/beats/v7 |
Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass CVE-2026-22772, GHSA-59jp-pj84-45mr, GO-2026-4311 | Medium | Not scored | 13 Jan, 2026 | Go github.com/sigstore/fulcio |
Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails CVE-2026-22689, GHSA-524m-q5m7-79mm, GO-2026-4310 | Medium | Not scored | 13 Jan, 2026 | Go github.com/axllent/mailpit |
Cosign verification accepts any valid Rekor entry under certain conditions BIT-cosign-2026-22703, CVE-2026-22703, GHSA-whqx-f9j3-ch6m, GO-2026-4309 | Medium | Not scored | 13 Jan, 2026 | Go github.com/sigstore/cosign Go github.com/sigstore/cosign/v2 Go github.com/sigstore/cosign/v3 |
Shiori is vulnerable to authentication bypass via a brute force attack CVE-2025-60538, GHSA-mw8h-g64c-rxv4, GO-2026-4308 | Medium | Not scored | 09 Jan, 2026 | Go github.com/go-shiori/shiori |
WeKnora vulnerable to SQL Injection CVE-2026-22687, GHSA-pcwc-3fw3-8cqv, GO-2026-4293 | Medium | Not scored | 09 Jan, 2026 | Go github.com/Tencent/WeKnora |
Soft Serve is missing an authorization check in LFS lock deletion CVE-2026-22253, GHSA-6jm8-x3g6-r33j, GO-2026-4290 | Medium | Not scored | 08 Jan, 2026 | Go github.com/charmbracelet/soft-serve |