Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter CVE-2026-22874, GHSA-2r5c-gw76-rh3w, GO-2026-6030 | Critical | Not scored | 21 Jul, 2026 | Go code.gitea.io/gitea |
Gitea Remember-Me Token Theft Not Invalidating Attacker Session CVE-2026-56750, GHSA-rgv6-xp99-6mgj, GO-2026-6072 | Critical | Not scored | 21 Jul, 2026 | Go code.gitea.io/gitea Go gitea.dev |
Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure BIT-envoy-gateway-2026-53713, CVE-2026-53713, GHSA-wcrf-9vrr-854f, GO-2026-6011 | Critical | Not scored | 16 Jul, 2026 | Go github.com/envoyproxy/gateway |
Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode CVE-2026-50006, GHSA-xrcf-6jh3-ggvx, GO-2026-5979 | Critical | Not scored | 14 Jul, 2026 | Go github.com/julien040/anyquery |
TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation GHSA-g936-7jqj-mwv8, GO-2026-5969 | Critical | Not scored | 10 Jul, 2026 | Go github.com/almeidapaulopt/tsdproxy |
SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content CVE-2026-50551, GHSA-56mp-4f3v-fgj2, GO-2026-5967 | Critical | Not scored | 10 Jul, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML() CVE-2026-54158, GHSA-5xfx-xj4h-5p7r, GO-2026-5957 | Critical | Not scored | 10 Jul, 2026 | Go github.com/siyuan-note/siyuan/kernel |
File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) CVE-2026-54088, GHSA-m93h-4hw7-5qcm, GO-2026-5962 | Critical | Not scored | 10 Jul, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser: Authentication Bypass via Proxy Auth Header Forgery CVE-2026-54089, GHSA-xqp3-jq6g-x3qm, GO-2026-5966 | Critical | Not scored | 10 Jul, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist CVE-2026-54069, GHSA-hvr9-72v2-fff3, GO-2026-5961 | Critical | Not scored | 10 Jul, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL CVE-2026-54072, GHSA-h29v-hj44-q8cv, GO-2026-5959 | Critical | Not scored | 10 Jul, 2026 | Go github.com/authorizerdev/authorizer |
SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() CVE-2026-54067, GHSA-mvjr-vv3c-w4qv, GO-2026-5963 | Critical | Not scored | 10 Jul, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE CVE-2026-53649, GHSA-xqhv-chqm-fhcc, GO-2026-5947 | Critical | Not scored | 08 Jul, 2026 | Go github.com/BishopFox/joro |
Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE CVE-2026-52831, GHSA-v5px-423j-pf7p, GO-2026-5946 | Critical | Not scored | 08 Jul, 2026 | Go github.com/nuclio/nuclio |
Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers CVE-2026-53552, GHSA-26rh-24rg-j3vv, GO-2026-5936 | Critical | Not scored | 07 Jul, 2026 | Go github.com/zhenorzz/goploy |
LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs CVE-2026-59707, GHSA-8c5q-hx4g-qq23, GO-2026-6645 | Critical | Not scored | 07 Jul, 2026 | Go github.com/mudler/LocalAI |
Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access BIT-cilium-2026-49445, BIT-cilium-operator-2026-49445, BIT-hubble-relay-2026-49445, CVE-2026-49445, GHSA-3fcv-jvfp-m4q9, GO-2026-5905 | Critical | Not scored | 06 Jul, 2026 | Go github.com/cilium/cilium |
Gitea pre-receive hook scanner errors allow branch-protection bypass CVE-2026-27780, GHSA-vhq7-fwwh-7hjf, GO-2026-6346 | Critical | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea repository creation accepts insufficiently validated fields CVE-2026-22547, GHSA-922f-hfwp-p56f, GO-2026-6338 | Critical | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea template repository generation follows unsafe filesystem paths CVE-2026-25718, GHSA-h697-89cp-24q8, GO-2026-6340 | Critical | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea OAuth2 authorization codes can be reused after expiry CVE-2026-26232, GHSA-5v69-g2m3-3hq3, GO-2026-6336 | Critical | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea OAuth2 PKCE S256 verifier bypass CVE-2026-26247, GHSA-m5ch-ppfx-xv3v, GO-2026-6342 | Critical | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea LFS mirror operations bypass migration HTTP transport protections CVE-2026-26292, GHSA-rc56-rj3f-xggf, GO-2026-6344 | Critical | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Rancher has Privilege Escalation from Project Owner to Host CVE-2026-41052, GHSA-vx8h-4prv-g744, GO-2026-5876 | Critical | Not scored | 01 Jul, 2026 | Go github.com/rancher/rancher |
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer CVE-2026-44935, GHSA-xr65-5cpm-g36x, GO-2026-5877 | Critical | Not scored | 01 Jul, 2026 | Go github.com/rancher/fleet |
Rancher vulnerable to command injection through unsanitized YAML parameter CVE-2026-44939, GHSA-mhc6-2gfq-xx62, GO-2026-5875 | Critical | Not scored | 01 Jul, 2026 | Go github.com/rancher/rancher |
Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation CVE-2026-50566, GHSA-m63v-2g9w-2w6v, GO-2026-5857 | Critical | Not scored | 30 Jun, 2026 | Go github.com/fission/fission |
Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape CVE-2026-50564, GHSA-gx55-f84r-v3r7, GO-2026-5855 | Critical | Not scored | 30 Jun, 2026 | Go github.com/fission/fission |
Fission Container Executor Function PodSpec Injection Leading to Node Escape CVE-2026-50563, GHSA-v455-mv2v-5g92, GO-2026-5858 | Critical | Not scored | 30 Jun, 2026 | Go github.com/fission/fission |
Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover CVE-2026-50545, GHSA-wmgg-3p4h-48x7, GO-2026-5860 | Critical | Not scored | 30 Jun, 2026 | Go github.com/fission/fission |
MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints CVE-2026-11720, GHSA-vwxw-jrg6-9jxv, GO-2026-6411 | Critical | Not scored | 29 Jun, 2026 | Go github.com/googleapis/mcp-toolbox |
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key CVE-2026-53519, GHSA-5c25-7vpj-9mqh, GO-2026-5828 | Critical | Not scored | 26 Jun, 2026 | Go github.com/nezhahq/nezha |
Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check CVE-2026-62283, GHSA-q6xx-5vr8-p898, GO-2026-5821 | Critical | Not scored | 26 Jun, 2026 | Go github.com/nezhahq/nezha |
Incus has an arbitrary file write on its client due to trusted image hash CVE-2026-48769, GHSA-f6m5-xw2g-xc4x, GO-2026-5806 | Critical | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has an argument injection in backup compression algorithm leading to AFW and ACE CVE-2026-48755, GHSA-v6mj-8pf4-hhw4, GO-2026-5808 | Critical | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has an arbitrary file write via path traversal in S3 multipart upload CVE-2026-48753, GHSA-ccjc-4qc3-jxqc, GO-2026-5802 | Critical | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has arbitrary file read+write on host via templates/ symlink in malicious image CVE-2026-48752, GHSA-vxp5-584q-c479, GO-2026-5803 | Critical | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has a restricted project bypass leading to arbitrary command execution CVE-2026-48751, GHSA-48q5-w887-33wv, GO-2026-5799 | Critical | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image CVE-2026-48750, GHSA-73hr-m85f-64v9, GO-2026-5801 | Critical | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image CVE-2026-48749, GHSA-2q3f-q5pq-g8wv, GO-2026-5798 | Critical | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Gogs has Path Traversal in organization name that results in RCE through Git hooks CVE-2026-52813, GHSA-c39w-43gm-34h5, GO-2026-5305 | Critical | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym CVE-2026-52811, GHSA-89mr-xqfv-758m, GO-2026-5249 | Critical | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge CVE-2026-52806, GHSA-qf6p-p7ww-cwr9, GO-2026-5580 | Critical | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Canonical ADSys Uses a Less Trusted Source CVE-2026-12249, GHSA-crm4-q7v4-c2r2, GO-2026-6543 | Critical | Not scored | 22 Jun, 2026 | Go github.com/ubuntu/adsys |
Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag GHSA-wfqx-gjrf-g28r, GO-2026-5709 | Critical | Not scored | 19 Jun, 2026 | Go github.com/crossplane/crossplane Go github.com/crossplane/crossplane/v2 |
Tilt: Missing authentication on the network-exposed Tilt HUD server CVE-2026-55884, GHSA-c73q-8xxr-rgqm, GO-2026-5317 | Critical | Not scored | 19 Jun, 2026 | Go github.com/tilt-dev/tilt |
googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) CVE-2026-11717, GHSA-8fcc-w5hv-4gxv, GO-2026-5251 | Critical | Not scored | 18 Jun, 2026 | Go github.com/googleapis/mcp-toolbox |
googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) CVE-2026-11718, GHSA-wcpr-6g7x-p44r, GO-2026-5706 | Critical | Not scored | 18 Jun, 2026 | Go github.com/googleapis/mcp-toolbox |
Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix BIT-rclone-2026-49980, CVE-2026-49980, GHSA-qw24-gh76-8rvv, GO-2026-5596 | Critical | Not scored | 16 Jun, 2026 | Go github.com/ncw/rclone Go github.com/rclone/rclone |
MCP Toolbox for Databases has an Origin Validation Error CVE-2026-11624, GHSA-76g7-m3xw-x9gr, GO-2026-6288 | Critical | Not scored | 13 Jun, 2026 | Go github.com/googleapis/genai-toolbox Go github.com/googleapis/mcp-toolbox |