Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Authelia has an Edge Case Access Control Rule Mismatch CVE-2026-48794, GHSA-j748-h363-wqj8, GO-2026-5819 | Low | Not scored | 26 Jun, 2026 | Go github.com/authelia/authelia Go github.com/authelia/authelia/v4 |
nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction GHSA-v2jf-442r-6mjh, GO-2026-5815 | Low | Not scored | 26 Jun, 2026 | Go github.com/juev/nebula-mesh |
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) CVE-2026-48756, GHSA-xhqx-mgh3-3h7q, GO-2026-5810 | Low | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} CVE-2026-48754, GHSA-4xg6-52mh-fpw8, GO-2026-5800 | Low | Not scored | 26 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 Go github.com/lxc/incus/v7/cmd/incusd |
OliveTin: ValidateArgumentType API Endpoint's Missing Authentication Allows Action and Argument Enumeration CVE-2026-48709, GHSA-f637-w7p2-m7fx, GO-2026-5347 | Low | Not scored | 24 Jun, 2026 | Go github.com/OliveTin/OliveTin |
Gogs has DoS in rendering issue index pattern CVE-2026-52796, GHSA-4j89-2c4f-44c6, GO-2026-5124 | Low | Not scored | 22 Jun, 2026 | Go gogs.io/gogs |
Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF (no shipped gadget affected) CVE-2026-44778, GHSA-7cfq-5mhv-jrp9, GO-2026-5214 | Low | Not scored | 22 Jun, 2026 | Go github.com/inspektor-gadget/inspektor-gadget |
Mattermost has an Incorrect Authorization issue CVE-2026-8823, GHSA-xmfh-3ccg-c9fx, GO-2026-6547 | Low | Not scored | 22 Jun, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint CVE-2026-8074, GHSA-g5vr-6pgg-74qv, GO-2026-6481 | Low | Not scored | 22 Jun, 2026 | Go github.com/mattermost/mattermost-server |
SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected CVE-2026-55866, GHSA-4vrg-r928-h5vv, GO-2026-5133 | Low | Not scored | 19 Jun, 2026 | Go github.com/authzed/spicedb |
OpenBao's System Backend allows Unauthorized Management of the containing Namespace BIT-openbao-2026-55775, CVE-2026-55775, GHSA-mwr2-wmgp-crj6, GO-2026-5517 | Low | Not scored | 19 Jun, 2026 | Go github.com/openbao/openbao |
OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 BIT-openbao-2026-55774, CVE-2026-55774, GHSA-c36x-h252-g9x2, GO-2026-5304 | Low | Not scored | 19 Jun, 2026 | Go github.com/openbao/openbao |
OpenFGA Improper Policy Enforcement CVE-2026-55170, GHSA-cf98-j28v-49v6, GO-2026-5322 | Low | Not scored | 18 Jun, 2026 | Go github.com/openfga/openfga |
ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers CVE-2026-55670, GHSA-6x8v-2fq5-2229, GO-2026-5197 | Low | Not scored | 18 Jun, 2026 | Go github.com/zitadel/zitadel |
ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components CVE-2026-55671, GHSA-29jh-8cfq-rr8x, GO-2026-5059 | Low | Not scored | 18 Jun, 2026 | Go github.com/zitadel/zitadel |
nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store GHSA-6vgg-xhvh-38ff, GO-2026-5191 | Low | Not scored | 12 Jun, 2026 | Go github.com/juev/nebula-mesh |
Weaviate has an Improper Authorization issue CVE-2026-11500, GHSA-jqpm-wf57-qx5c, GO-2026-6140 | Low | Not scored | 08 Jun, 2026 | Go github.com/weaviate/weaviate |
grepai Uses a Broken or Risky Cryptographic Algorithm CVE-2026-11479, GHSA-6h35-9p2w-3j3r, GO-2026-6125 | Low | Not scored | 08 Jun, 2026 | Go github.com/yoanbernabeu/grepai |
grepai Uses a Broken or Risky Cryptographic Algorithm CVE-2026-11481, GHSA-q76h-p6jh-9rw3, GO-2026-6128 | Low | Not scored | 08 Jun, 2026 | Go github.com/yoanbernabeu/grepai |
songquanpeng one-api has an issue that results in business logic errors CVE-2026-11465, GHSA-7v3v-cp44-vc8m, GO-2026-6126 | Low | Not scored | 08 Jun, 2026 | Go github.com/songquanpeng/one-api |
Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic CVE-2026-45723, GHSA-c66c-vq6w-fvh5, GO-2026-5316 | Low | Not scored | 05 Jun, 2026 | Go github.com/siderolabs/omni |
milvus: RBAC grantee-id uses truncated MD5 (64-bit), enabling privilege-binding collisions and cross-role privilege forgery BIT-milvus-2026-10814, CVE-2026-10814, GHSA-jh6h-v6mp-h22v, GO-2026-5999 | Low | Not scored | 04 Jun, 2026 | Go github.com/milvus-io/milvus |
ebpf-go is vulnerable to integer overflow via LoadCollectionSpecFromReader CVE-2026-10722, GHSA-xhgw-qwwf-pg32, GO-2026-6238 | Low | Not scored | 03 Jun, 2026 | Go github.com/cilium/ebpf |
Authelia Missing Username Canonicalization in Basic Auth (LDAP) CVE-2026-47203, GHSA-hjj4-hfjm-fmrj, GO-2026-5430 | Low | Not scored | 29 May, 2026 | Go github.com/authelia/authelia Go github.com/authelia/authelia/v4 |
opentelemetry-go's Schema ParseFile leaks file descriptors on each parse CVE-2026-45287, GHSA-995v-fvrw-c78m, GO-2026-5281 | Low | Not scored | 28 May, 2026 | Go go.opentelemetry.io/otel/schema Go go.opentelemetry.io/otel/schema/v1.0 Go go.opentelemetry.io/otel/schema/v1.1 |
Capsule Namespace Hijacking via subresource CVE-2026-30963, GHSA-2ww6-hf35-mfjm, GO-2026-5043 | Low | Not scored | 28 May, 2026 | Go github.com/projectcapsule/capsule |
omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer CVE-2026-9299, GHSA-m9r6-r5c3-jw4j, GO-2026-5843 | Low | Not scored | 26 May, 2026 | Go github.com/omec-project/amf |
omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer CVE-2026-9300, GHSA-6p7m-c3mw-4gmw, GO-2026-5842 | Low | Not scored | 26 May, 2026 | Go github.com/omec-project/amf |
omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer CVE-2026-9301, GHSA-qm7q-rcm2-3frc, GO-2026-5844 | Low | Not scored | 26 May, 2026 | Go github.com/omec-project/amf |
SpiceDB: Caveat structures with nested lists can result in improper cache reuse CVE-2026-46668, GHSA-mqcf-gqvg-rmhm, GO-2026-5514 | Low | Not scored | 21 May, 2026 | Go github.com/authzed/spicedb |
androidqf: APK download Path Traversal in device APK paths GHSA-763j-3p5v-jfc6, GO-2026-5206 | Low | Not scored | 21 May, 2026 | Go github.com/mvt-project/androidqf |
androidqf: Zip entry Name Injection in APK bundle (Zip Slip for zip consumers) GHSA-jf2q-463c-6f52, GO-2026-5464 | Low | Not scored | 21 May, 2026 | Go github.com/mvt-project/androidqf |
OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server GHSA-pxh5-6rrc-8rjv, GO-2026-5558 | Low | Not scored | 20 May, 2026 | Go github.com/opentofu/opentofu |
GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection CVE-2026-45803, GHSA-crc3-h8v6-qh57, GO-2026-5335 | Low | Not scored | 19 May, 2026 | Go github.com/cli/cli Go github.com/cli/cli/v2 |
MCP Registry: OCI validator skips ownership check on upstream rate limits CVE-2026-45781, GHSA-2v5f-5r6w-p67r, GO-2026-5008 | Low | Not scored | 19 May, 2026 | Go github.com/modelcontextprotocol/registry |
go-git: Improper single-quote escaping in go-git SSH transport CVE-2026-45570, GHSA-m7cr-m3pv-hgrp, GO-2026-5496 | Low | Not scored | 19 May, 2026 | Go github.com/go-git/go-git Go github.com/go-git/go-git/v5 Go github.com/go-git/go-git/v6 |
OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure CVE-2026-45683, GHSA-fjq3-ffvr-vm46, GO-2026-5366 | Low | Not scored | 18 May, 2026 | Go go.opentelemetry.io/obi |
Mattermost doesn't check if {{team_id}} was being changed when updating playbooks CVE-2026-4286, GHSA-gvg4-jhmr-6j23, GO-2026-5404 | Low | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-plugin-playbooks Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Mattermost doesn't validate the Host header when constructing response URLs for custom slash command CVE-2026-6333, GHSA-vqp5-2mrp-qqxg, GO-2026-5671 | Low | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't escape some variables that could contain malicious content during error page composition CVE-2026-3495, GHSA-jx93-pf6x-874r, GO-2026-5484 | Low | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation CVE-2026-4273, GHSA-hqpj-f3jh-29vx, GO-2026-5432 | Low | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow CVE-2026-6334, GHSA-jp3f-x449-4q75, GO-2026-5474 | Low | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
AMF Vulnerable to Improper Resource Shutdown or Release CVE-2026-8783, GHSA-6v92-ph9p-hrpc, GO-2026-5190 | Low | Not scored | 18 May, 2026 | Go github.com/omec-project/amf |
AMF Improperly Restricts Operations within the Bounds of a Memory Buffer CVE-2026-8779, GHSA-fxvj-wqv2-xgcq, GO-2026-5386 | Low | Not scored | 18 May, 2026 | Go github.com/omec-project/amf |
AMF Improperly Restricts Operations within the Bounds of a Memory Buffer CVE-2026-8780, GHSA-3x4g-259h-5p7c, GO-2026-5104 | Low | Not scored | 18 May, 2026 | Go github.com/omec-project/amf |
AMF Vulnerable to Improper Resource Shutdown or Release CVE-2026-8781, GHSA-4qf2-p32m-7hmf, GO-2026-5130 | Low | Not scored | 18 May, 2026 | Go github.com/omec-project/amf |
AMF Vulnerable to Improper Resource Shutdown or Release CVE-2026-8782, GHSA-6h8r-h22r-jj64, GO-2026-5179 | Low | Not scored | 18 May, 2026 | Go github.com/omec-project/amf |
Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields CVE-2026-4053, GHSA-hw87-6jcq-9f8q, GO-2026-5442 | Low | Not scored | 15 May, 2026 | Go github.com/mattermost/mattermost-server |
omec-project amf crashes when processing malformed LocationReports CVE-2026-8349, GHSA-3h63-fx68-x5fm, GO-2026-5087 | Low | Not scored | 12 May, 2026 | Go github.com/omec-project/amf |
Ella Core has handover failures during concurrent Security Mode Command CVE-2026-44474, GHSA-mc29-hmx6-856q, GO-2026-5502 | Low | Not scored | 11 May, 2026 | Go github.com/ellanetworks/core |