Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages CVE-2025-68151, GHSA-527x-5wrf-22m2, GO-2026-4289 | Medium | Not scored | 08 Jan, 2026 | Go github.com/coredns/coredns |
Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources CVE-2026-21885, GHSA-xwh2-742g-w3wp, GO-2026-4287 | Medium | Not scored | 07 Jan, 2026 | Go miniflux.app Go miniflux.app/v2 |
Mailpit Proxy Endpoint has Server-Side Request Forgery (SSRF) vulnerability CVE-2026-21859, GHSA-8v65-47jx-7mfr, GO-2026-4284 | Medium | Not scored | 06 Jan, 2026 | Go github.com/axllent/mailpit |
Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass GHSA-hjr9-wj7v-7hv8, GO-2026-4280 | Medium | Not scored | 05 Jan, 2026 | Go github.com/bishopfox/sliver |
listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover CVE-2026-21483, GHSA-jmr4-p576-v565, GO-2026-4277 | Medium | Not scored | 02 Jan, 2026 | Go github.com/knadh/listmonk |
Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists BIT-gitea-2025-69413, CVE-2025-69413, GHSA-pc73-rj2c-wvf9, GO-2026-4274 | Medium | Not scored | 01 Jan, 2026 | Go code.gitea.io/gitea |
Temporal has an Incorrect Authorization vulnerability CVE-2025-14987, GHSA-hmhp-gh8m-c8xp, GO-2026-4273 | Medium | Not scored | 30 Dec, 2025 | Go go.temporal.io/server |
Visual Studio Code Go extension has unexpected untrusted code execution CVE-2025-68120, GHSA-fjmr-7667-8v4p, GO-2025-4249 | Medium | Not scored | 29 Dec, 2025 | Go github.com/golang/vscode-go |
Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order BIT-gitea-2025-68943, CVE-2025-68943, GHSA-jhx5-4vr4-f327, GO-2025-4266 | Medium | Not scored | 26 Dec, 2025 | Go code.gitea.io/gitea |
Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries BIT-gitea-2025-68944, CVE-2025-68944, GHSA-f85h-c7m6-cfpm, GO-2025-4264 | Medium | Not scored | 26 Dec, 2025 | Go code.gitea.io/gitea |
Gitea: anonymous user can visit private user's project BIT-gitea-2025-68945, CVE-2025-68945, GHSA-7xq4-mwcp-q8fx, GO-2025-4262 | Medium | Not scored | 26 Dec, 2025 | Go code.gitea.io/gitea |
Gitea vulnerable to Cross-site Scripting BIT-gitea-2025-68946, CVE-2025-68946, GHSA-hq57-c72x-4774, GO-2025-4265 | Medium | Not scored | 26 Dec, 2025 | Go code.gitea.io/gitea |
Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text BIT-gitea-2025-68942, CVE-2025-68942, GHSA-898p-hh3p-hf9r, GO-2025-4263 | Medium | Not scored | 26 Dec, 2025 | Go code.gitea.io/gitea |
Gitea mishandles authorization for deletion of releases BIT-gitea-2025-68938, CVE-2025-68938, GHSA-cm54-pfmc-xrwx, GO-2025-4258 | Medium | Not scored | 26 Dec, 2025 | Go code.gitea.io/gitea |
Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources BIT-gitea-2025-68941, CVE-2025-68941, GHSA-xfq3-qj7j-4565, GO-2025-4268 | Medium | Not scored | 26 Dec, 2025 | Go code.gitea.io/gitea |
Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues CVE-2025-13767, GHSA-fmqf-pmcm-8cx9, GO-2025-4259 | Medium | Not scored | 24 Dec, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin CVE-2025-64641, GHSA-vww6-79rv-3j4x, GO-2025-4260 | Medium | Not scored | 24 Dec, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Filebeat Beats has Buffer Overflow via Malformed Syslog Message or Malicious Tokenizer Pattern in Dissect Configuration CVE-2025-68383, GHSA-2mj3-6grc-px38, GO-2025-4252 | Medium | Not scored | 19 Dec, 2025 | Go github.com/elastic/beats Go github.com/elastic/beats/v7 |
Amazon S3 Encryption Client has a Key Commitment Issue CVE-2025-14764, GHSA-3g75-q268-r9r6, GO-2025-4250 | Medium | Not scored | 18 Dec, 2025 | Go github.com/aws/amazon-s3-encryption-client-go Go github.com/aws/amazon-s3-encryption-client-go/v3 Go github.com/aws/amazon-s3-encryption-client-go/v4 |
Mattermost fails to check Websocket request for proper UTF-8 format potentially crashing Calls plug-in CVE-2025-12689, GHSA-j5vq-62gr-8v3r, GO-2025-4255 | Medium | Not scored | 17 Dec, 2025 | Go github.com/mattermost/mattermost-plugin-calls |
Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation CVE-2025-13324, GHSA-x3r8-2hmh-89f5, GO-2025-4256 | Medium | Not scored | 17 Dec, 2025 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Mattermost has CSRF vulnerability via Calls Widget page CVE-2025-62190, GHSA-gmx5-frv9-9m9f, GO-2025-4254 | Medium | Not scored | 17 Dec, 2025 | Go github.com/mattermost/mattermost-plugin-calls |
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay CVE-2025-68113, GHSA-6gvq-jcmp-8959, GO-2025-4239, PYSEC-2026-1115 | Medium | 0.5% | 16 Dec, 2025 | Go github.com/altcha-org/altcha-lib-go Hex altcha Maven org.altcha:altcha Packagist altcha-org/altcha +3 more |
kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass CVE-2025-13281, GHSA-r6j8-c6r2-37rr, GO-2025-4240 | Medium | Not scored | 15 Dec, 2025 | Go k8s.io/kubernetes |
quic-go HTTP/3 QPACK Header Expansion DoS CVE-2025-64702, GHSA-g754-hx8w-x2g6, GO-2025-4233 | Medium | Not scored | 11 Dec, 2025 | Go github.com/quic-go/quic-go |
1Panel contains a cross-site request forgery (CSRF) vulnerability in the panel name management functionality CVE-2025-34430, GHSA-5xpq-2vmc-5cqp, GO-2025-4230 | Medium | Not scored | 10 Dec, 2025 | Go github.com/1Panel-dev/1Panel |
Algernon Cross-Site Scripting vulnerability CVE-2025-65754, GHSA-8jqm-8qm3-qgqm, GO-2025-4228 | Medium | Not scored | 10 Dec, 2025 | Go github.com/xyproto/algernon |
Zitadel Discloses the Total Number of Instance Users CVE-2025-67717, GHSA-f4cf-9rvr-2rcx, GO-2025-4227 | Medium | Not scored | 10 Dec, 2025 | Go github.com/zitadel/zitadel |
Miniflux has an Open Redirect via protocol-relative redirect_url CVE-2025-67713, GHSA-wqv2-4wpg-8hc9, GO-2025-4226 | Medium | Not scored | 10 Dec, 2025 | Go miniflux.app Go miniflux.app/v2 |
OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs GHSA-mjcp-gpgx-ggcg, GO-2025-4224 | Medium | Not scored | 09 Dec, 2025 | Go github.com/opentofu/opentofu |
CNA Plugins Portmap nftables backend can intercept non-local traffic CVE-2025-67499, GHSA-jv3w-x3r3-g6rm, GO-2025-4222 | Medium | Not scored | 09 Dec, 2025 | Go github.com/containernetworking/plugins |
Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond GHSA-4rmq-mc2c-r495, GO-2025-4214 | Medium | Not scored | 09 Dec, 2025 | Go github.com/babylonlabs-io/babylon Go github.com/babylonlabs-io/babylon/v2 Go github.com/babylonlabs-io/babylon/v3 Go github.com/babylonlabs-io/babylon/v4 |
memos vulnerability allows arbitrarily modification or deletion registered identity providers CVE-2025-65797, GHSA-99m2-qwx6-2w6f, GO-2025-4220 | Medium | Not scored | 08 Dec, 2025 | Go github.com/usememos/memos |
memos lacks file name validation or verification CVE-2025-65799, GHSA-qgjp-5g5x-vhq2, GO-2025-4218 | Medium | Not scored | 08 Dec, 2025 | Go github.com/usememos/memos |
memos vulnerability allows arbitrarily reactions deletion CVE-2025-65796, GHSA-8jcj-g9f4-qx42, GO-2025-4215 | Medium | Not scored | 08 Dec, 2025 | Go github.com/usememos/memos |
memos vulnerability allows arbitrarily modification or deletion of attachments CVE-2025-65798, GHSA-8p44-g572-557h, GO-2025-4216 | Medium | Not scored | 08 Dec, 2025 | Go github.com/usememos/memos |
1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers CVE-2025-66508, GHSA-7cqv-qcq2-r765, GO-2025-4207 | Medium | Not scored | 08 Dec, 2025 | Go github.com/1Panel-dev/1Panel Go github.com/1Panel-dev/1Panel/agent |
Traefik Inverted TLS Verification Logic in ingress-nginx Provider CVE-2025-66491, GHSA-7vww-mvcr-x6vj, GO-2025-4205 | Medium | Not scored | 08 Dec, 2025 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Path Normalization Bypass in Traefik Router + Middleware Rules CVE-2025-66490, GHSA-gm3x-23wp-hc2c, GO-2025-4206 | Medium | Not scored | 08 Dec, 2025 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Envoy's TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte BIT-envoy-2025-66220, CVE-2025-66220, GHSA-rwjg-c3h2-f57p | Medium | Not scored | 05 Dec, 2025 | Go github.com/envoyproxy/envoy |
Envoy crashes when JWT authentication is configured with the remote JWKS fetching BIT-envoy-2025-64527, CVE-2025-64527, GHSA-mp85-7mrq-r866 | Medium | Not scored | 05 Dec, 2025 | Go github.com/envoyproxy/envoy |
step-ca Has Improper Authorization Check for SSH Certificate Revocation CVE-2025-66406, GHSA-j7c9-79x7-8hpr, GO-2025-4181 | Medium | Not scored | 03 Dec, 2025 | Go github.com/smallstep/certificates |
Apptainer ineffectively applies selinux and apparmor --security options CVE-2025-65105, GHSA-j3rw-fx6g-q46j, GO-2025-4176 | Medium | Not scored | 02 Dec, 2025 | Go github.com/apptainer/apptainer |
Singluarity ineffectively applies selinux / apparmor LSM process labels CVE-2025-64750, GHSA-wwrx-w7c9-rf87, GO-2025-4177 | Medium | Not scored | 02 Dec, 2025 | Go github.com/sylabs/singularity Go github.com/sylabs/singularity/v4 |
Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes CVE-2025-10543, GHSA-32fw-gq77-f2f2, GO-2025-4173 | Medium | Not scored | 02 Dec, 2025 | Go github.com/eclipse/paho.mqtt.golang |
Mattermost fails to validate user permissions when deleting comments in Boards CVE-2025-12756, GHSA-p6gj-jc38-x2m7, GO-2025-4172 | Medium | Not scored | 01 Dec, 2025 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic BIT-cilium-2025-64715, BIT-cilium-operator-2025-64715, BIT-hubble-relay-2025-64715, CVE-2025-64715, GHSA-38pp-6gcp-rqvm, GO-2025-4167 | Medium | Not scored | 01 Dec, 2025 | Go github.com/cilium/cilium |
Mattermost fails to sanitize team email addresses CVE-2025-12559, GHSA-4g87-9x45-cx2h, GO-2025-4169 | Medium | Not scored | 27 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Babylon's BIP322 signature implementation is not fully compliant to the spec GHSA-xq4h-wqm2-668w, GO-2025-4159 | Medium | Not scored | 24 Nov, 2025 | Go github.com/babylonlabs-io/babylon Go github.com/babylonlabs-io/babylon/v2 Go github.com/babylonlabs-io/babylon/v3 Go github.com/babylonlabs-io/babylon/v4 |
Free5GC is vulnerable to DoS through its Npcf_BDTPolicyControl POST API CVE-2025-60632, GHSA-vgq7-9r5r-j9v3, GO-2025-4164 | Medium | Not scored | 24 Nov, 2025 | Go github.com/free5gc/pcf |