Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Jellysweep uses uncontrolled data in image cache API endpoint CVE-2025-64178, GHSA-xc93-q32j-cpcg, GO-2025-4091 | High | Not scored | 04 Nov, 2025 | Go github.com/jon4hz/jellysweep |
sqls-server/sqls is vulnerable to command injection in the config command CVE-2025-61141, GHSA-f9f4-5859-29mf, GO-2025-4088 | High | Not scored | 30 Oct, 2025 | Go github.com/sqls-server/sqls |
gnark-crypto allows unchecked memory allocation during vector deserialization GHSA-fj2x-735w-74vq, GO-2025-4087 | High | Not scored | 30 Oct, 2025 | Go github.com/consensys/gnark-crypto |
Zitadel May Bypass Second Authentication Factor CVE-2025-64103, GHSA-cfjq-28r2-4jv5, GO-2025-4083 | High | Not scored | 29 Oct, 2025 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
Zitadel allows brute-forcing authentication factors CVE-2025-64102, GHSA-xrw9-r35x-x878, GO-2025-4085 | High | Not scored | 29 Oct, 2025 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection CVE-2025-64101, GHSA-mwmh-7px9-4c23, GO-2025-4084 | High | Not scored | 29 Oct, 2025 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotations CVE-2025-62725, GHSA-gv8h-7v7w-r22q, GO-2025-4077 | High | Not scored | 27 Oct, 2025 | Go github.com/docker/compose Go github.com/docker/compose/v2 |
Constellation has insecure LUKS2 persistent storage partitions which may be opened and used CVE-2025-58356, GHSA-hq76-6gh2-5g4q, GO-2025-4076 | High | Not scored | 27 Oct, 2025 | Go github.com/edgelesssys/constellation Go github.com/edgelesssys/constellation/v2 |
Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON BIT-vault-2025-12044, CVE-2025-12044, GHSA-vp5w-xcfc-73wf, GO-2025-4071 | High | Not scored | 23 Oct, 2025 | Go github.com/hashicorp/vault |
HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass BIT-vault-2025-11621, CVE-2025-11621, GHSA-9g4h-h484-3578, GO-2025-4070 | High | Not scored | 23 Oct, 2025 | Go github.com/hashicorp/vault |
OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method CVE-2025-59048, GHSA-jp7h-4f3c-9rc7, GO-2025-4067 | High | Not scored | 23 Oct, 2025 | Go github.com/openbao/openbao-plugins |
NeuVector telemetry sender is vulnerable to MITM and DoS CVE-2025-54470, GHSA-qqj3-g7mx-5p4w, GO-2025-4044 | High | Not scored | 21 Oct, 2025 | Go github.com/neuvector/neuvector |
OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requests BIT-openbao-2025-59043, CVE-2025-59043, GHSA-g46h-2rq9-gw5m, GO-2025-4039 | High | Not scored | 17 Oct, 2025 | Go github.com/openbao/openbao |
Git LFS may write to arbitrary files via crafted symlinks BIT-git-lfs-2025-26625, CVE-2025-26625, GHSA-6pvw-g552-53c5, GO-2025-4038 | High | Not scored | 17 Oct, 2025 | Go github.com/git-lfs/git-lfs Go github.com/git-lfs/git-lfs/v3 |
MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS CVE-2025-62506, GHSA-jjjj-jwhf-8rgr, GO-2025-4034 | High | Not scored | 16 Oct, 2025 | Go github.com/minio/minio |
Mattermost has a Missing Authorization vulnerability CVE-2025-58073, GHSA-6q7m-p8cc-998r, GO-2025-4032 | High | Not scored | 16 Oct, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost has a Missing Authorization vulnerability CVE-2025-58075, GHSA-r6qj-894f-5hr2, GO-2025-4035 | High | Not scored | 16 Oct, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
CometBFT's invalid BitArray handling can lead to network halt GHSA-hrhf-2vcr-ghch, GO-2025-4025 | High | Not scored | 14 Oct, 2025 | Go github.com/cometbft/cometbft |
Argo Workflow may expose artifact repository credentials BIT-argo-workflows-2025-62157, CVE-2025-62157, GHSA-c2hv-4pfj-mm2r, GO-2025-4024 | High | Not scored | 14 Oct, 2025 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
Argo Workflow has a Zipslip Vulnerability BIT-argo-workflows-2025-62156, CVE-2025-62156, GHSA-p84v-gxvw-73pf, GO-2025-4023 | High | Not scored | 14 Oct, 2025 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
Omni vulnerable to information leak via API CVE-2025-61688, GHSA-77r9-w39m-9xh5, GO-2025-4022 | High | Not scored | 13 Oct, 2025 | Go github.com/siderolabs/omni |
Parallax is vulnerable to DoS via malicious p2p message GHSA-xc79-566c-j4qx, GO-2025-4019 | High | Not scored | 10 Oct, 2025 | Go github.com/microstack-tech/parallax |
quic-go: Panic occurs when queuing undecryptable packets after handshake completion CVE-2025-59530, GHSA-47m2-4cr7-mhcw, GO-2025-4017 | High | Not scored | 10 Oct, 2025 | Go github.com/quic-go/quic-go |
Casdoor is vulnerable to Improper Authorization CVE-2025-61524, GHSA-5m9m-j5p7-m7f9, GO-2025-4026 | High | Not scored | 08 Oct, 2025 | Go github.com/casdoor/casdoor |
Canonical LXD CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI CVE-2025-54286, GHSA-p8hw-rfjg-689h, GO-2025-4003 | High | Not scored | 02 Oct, 2025 | Go github.com/canonical/lxd |
Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns CVE-2025-54287, GHSA-w2hg-2v4p-vmh6, GO-2025-4004 | High | Not scored | 02 Oct, 2025 | Go github.com/lxc/lxd Go github.com/lxc/lxd/v6 |
Canonical LXD Vulnerable to Privilege Escalation via WebSocket Connection Hijacking in Operations API CVE-2025-54289, GHSA-3g72-chj4-2228, GO-2025-3999 | High | Not scored | 02 Oct, 2025 | Go github.com/canonical/lxd |
Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function CVE-2025-54293, GHSA-472f-vmf2-pr3h, GO-2025-4000 | High | Not scored | 02 Oct, 2025 | Go github.com/canonical/lxd |
github.com/MANTRA-Chain/mantrachain/x/tokenfactory tx gas limit is not enforced in send hooks CVE-2025-61595, GHSA-qwvm-wqq8-8j69, GO-2025-3997 | High | Not scored | 30 Sep, 2025 | Go github.com/MANTRA-Chain/mantrachain Go github.com/MANTRA-Chain/mantrachain/v2 Go github.com/MANTRA-Chain/mantrachain/v3 Go github.com/MANTRA-Chain/mantrachain/v4 |
Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook BIT-argo-cd-2025-59538, CVE-2025-59538, GHSA-gpx4-37g2-c8pv, GO-2025-3995 | High | Not scored | 30 Sep, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 Go github.com/argoproj/argo-cd/v3 |
argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload BIT-argo-cd-2025-59537, CVE-2025-59537, GHSA-wp4p-9pxh-cgx2, GO-2025-3996 | High | Not scored | 30 Sep, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 Go github.com/argoproj/argo-cd/v3 |
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload BIT-argo-cd-2025-59531, CVE-2025-59531, GHSA-f9gq-prrc-hrhc, GO-2025-3993 | High | Not scored | 30 Sep, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 Go github.com/argoproj/argo-cd/v3 |
go-f3 module vulnerable to integer overflow leading to panic CVE-2025-59942, GHSA-g99p-47x7-mq88, GO-2025-3990 | High | Not scored | 29 Sep, 2025 | Go github.com/filecoin-project/go-f3 |
go-mail has insufficient address encoding when passing mail addresses to the SMTP client CVE-2025-59937, GHSA-wpwj-69cm-q9c5, GO-2025-3988 | High | Not scored | 29 Sep, 2025 | Go github.com/wneessen/go-mail |
Rancher update on users can deny the service to the admin CVE-2024-58260, GHSA-q82v-h4rq-5c86, GO-2025-3983 | High | Not scored | 26 Sep, 2025 | Go github.com/rancher/rancher |
Rancher CLI SAML authentication is vulnerable to phishing attacks CVE-2024-58267, GHSA-v3vj-5868-2ch2, GO-2025-3984 | High | Not scored | 26 Sep, 2025 | Go github.com/rancher/rancher |
Mattermost Path Traversal vulnerability CVE-2025-9079, GHSA-qx3f-6vq3-8j8m, GO-2025-3977 | High | Not scored | 19 Sep, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
DragonFly's manager generates mTLS certificates for arbitrary IP addresses CVE-2025-59353, GHSA-255v-qv84-29p5, GO-2025-3969 | High | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
Dragonfly vulnerable to server-side request forgery CVE-2025-59346, GHSA-g2rq-jv54-wcpr, GO-2025-3968 | High | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
Dragonfly doesn't have authentication enabled for some Manager’s endpoints CVE-2025-59345, GHSA-89vc-vf32-ch59, GO-2025-3965 | High | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
esm.sh has File Inclusion issue CVE-2025-59341, GHSA-49pv-gwxp-532r, GO-2025-3962 | High | Not scored | 17 Sep, 2025 | Go github.com/esm-dev/esm.sh |
Podman Creates Temporary File with Insecure Permissions CVE-2025-4953, GHSA-m68q-4hqr-mc6f, GO-2025-3961 | High | Not scored | 16 Sep, 2025 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 +1 more |
Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults BIT-envoy-2025-54588, CVE-2025-54588, GHSA-g9vw-6pvx-7gmw | High | Not scored | 15 Sep, 2025 | Go github.com/envoyproxy/envoy |
Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function CVE-2025-59358, GHSA-2gg8-85m5-8r2p, GO-2025-3951 | High | Not scored | 15 Sep, 2025 | Go github.com/chaos-mesh/chaos-mesh |
Mattermost Open Redirect vulnerability CVE-2025-9072, GHSA-69j8-prx2-vx98, GO-2025-3958 | High | Not scored | 15 Sep, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled CVE-2025-54376, GHSA-jxmr-2h4q-rhxp, GO-2025-3945 | High | Not scored | 10 Sep, 2025 | Go github.com/SpectoLabs/hoverfly |
listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover CVE-2025-58430, GHSA-rf24-wg77-gq7w, GO-2025-3943 | High | Not scored | 09 Sep, 2025 | Go github.com/knadh/listmonk |
CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion CVE-2025-58063, GHSA-93mf-426m-g6x9, GO-2025-3942 | High | Not scored | 09 Sep, 2025 | Go github.com/coredns/coredns |
Coder vulnerable to privilege escalation could lead to a cross workspace compromise CVE-2025-58437, GHSA-j6xf-jwrj-v5qp, GO-2025-3938 | High | Not scored | 05 Sep, 2025 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
podman kube play symlink traversal vulnerability CVE-2025-9566, GHSA-wp3j-xq48-xpjw, GO-2025-3935 | High | Not scored | 04 Sep, 2025 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 +1 more |