Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo CVE-2026-26231, GHSA-mm7c-rhg6-qr4r, GO-2026-5510 | High | Not scored | 16 Jun, 2026 | Go code.gitea.io/gitea |
Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication CVE-2026-28699, GHSA-9r5x-wg6m-x2rc, GO-2026-5299 | High | Not scored | 16 Jun, 2026 | Go code.gitea.io/gitea |
Gogs: Overwriting critical files results in a denial of service CVE-2026-52797, GHSA-pm6v-2h4w-4rp2, GO-2026-5545 | High | Not scored | 16 Jun, 2026 | Go gogs.io/gogs |
Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix BIT-rclone-2026-49980, CVE-2026-49980, GHSA-qw24-gh76-8rvv, GO-2026-5596 | Critical | Not scored | 16 Jun, 2026 | Go github.com/ncw/rclone Go github.com/rclone/rclone |
Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens CVE-2026-28744, GHSA-cc8w-r4qh-3v65, GO-2026-5321 | High | Not scored | 16 Jun, 2026 | Go code.gitea.io/gitea |
Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles CVE-2026-54322, GHSA-qxvm-pcfm-qc39, GO-2026-5600 | High | Not scored | 16 Jun, 2026 | Go github.com/daytonaio/daytona |
Caddy: stripHTML template function bypass CVE-2026-52846, GHSA-vcc4-2c75-vc9v, GO-2026-5660 | Medium | Not scored | 16 Jun, 2026 | Go github.com/caddyserver/caddy Go github.com/caddyserver/caddy/v2 |
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers` CVE-2026-52845, GHSA-f59h-q822-g45g, GO-2026-5346 | High | Not scored | 16 Jun, 2026 | Go github.com/caddyserver/caddy Go github.com/caddyserver/caddy/v2 |
Caddy: Windows `file_server` path authorization bypass via encoded backslash CVE-2026-52844, GHSA-qrp7-cvwr-j2c6, GO-2026-5595 | High | Not scored | 16 Jun, 2026 | Go github.com/caddyserver/caddy Go github.com/caddyserver/caddy/v2 |
Daytona: Public sandbox previews remain accessible for up to one hour after being made private CVE-2026-54321, GHSA-ww63-pv5x-vfc8, GO-2026-5729 | High | Not scored | 16 Jun, 2026 | Go github.com/daytonaio/daytona |
Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts CVE-2026-53622, GHSA-9cr8-q42q-g8m7, GO-2026-5287 | High | Not scored | 16 Jun, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Hugo: Symlink confinement bypass in resources.Get CVE-2026-50135, GHSA-fw87-fv5r-9fpw, GO-2026-5380 | Medium | Not scored | 16 Jun, 2026 | Go github.com/gohugoio/hugo |
Hugo: security.http.urls allow-list bypass via HTTP redirects CVE-2026-50134, GHSA-vxgm-5rmg-5w8g, GO-2026-5681 | Medium | Not scored | 16 Jun, 2026 | Go github.com/gohugoio/hugo |
Hugo: XSS via text/html content files CVE-2026-50133, GHSA-c54g-xjwj-8g82, GO-2026-5313 | Medium | Not scored | 16 Jun, 2026 | Go github.com/gohugoio/hugo |
Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass CVE-2026-48491, GHSA-5r4w-85f3-pw66, GO-2026-5152 | High | Not scored | 16 Jun, 2026 | Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Filestash allows attackers to escalate privileges via sending a crafted request CVE-2026-50891, GHSA-rcqf-cpv9-g5jf, GO-2026-6300 | High | Not scored | 15 Jun, 2026 | Go github.com/mickael-kerjean/filestash |
linx-server has an issue in the uploadPostHandler component that allows attackers to cause a Denial of Service (DoS) via a crafted POST request CVE-2026-50879, GHSA-g743-m6x3-v6wm, GO-2026-6297 | High | Not scored | 15 Jun, 2026 | Go github.com/andreimarcu/linx-server |
statping-ng allows attackers to escalate privileges to Administrator and access sensitive components CVE-2026-50884, GHSA-5442-mh7f-72px, GO-2026-6299 | High | Not scored | 15 Jun, 2026 | Go github.com/statping-ng/statping-ng |
MCP Toolbox for Databases has an Origin Validation Error CVE-2026-11624, GHSA-76g7-m3xw-x9gr, GO-2026-6288 | Critical | Not scored | 13 Jun, 2026 | Go github.com/googleapis/genai-toolbox Go github.com/googleapis/mcp-toolbox |
File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection CVE-2026-54090, GHSA-8c9q-7855-wfxq, GO-2026-5250 | High | Not scored | 12 Jun, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser has incorrect access control for public directory shares via rule path rebasing CVE-2026-54091, GHSA-j9jx-hp4c-ghhh, GO-2026-5458 | High | Not scored | 12 Jun, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames CVE-2026-54093, GHSA-gxjx-7m74-hcq8, GO-2026-5411 | Medium | Not scored | 12 Jun, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope CVE-2026-54094, GHSA-239w-m3h6-ch8v, GO-2026-5055 | Medium | Not scored | 12 Jun, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser has a DoS Vulnerability via Public Login API CVE-2026-54092, GHSA-w5fm-68j4-fpc4, GO-2026-5691 | High | Not scored | 12 Jun, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path CVE-2026-54096, GHSA-3q2p-72cj-682c, GO-2026-5096 | High | Not scored | 12 Jun, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix CVE-2026-54097, GHSA-5ww9-jg6q-38r7, GO-2026-5159 | High | Not scored | 12 Jun, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint CVE-2026-46371, GHSA-x4qr-qw6h-wvxq, GO-2026-5739 | Medium | Not scored | 12 Jun, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint CVE-2026-46370, GHSA-vxm7-9x8v-8gm4, GO-2026-5682 | Medium | Not scored | 12 Jun, 2026 | Go github.com/fleetdm/fleet/v4 |
Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs) CVE-2026-53999, GHSA-fp5j-4fj2-4jvq, GO-2026-5373 | High | Not scored | 12 Jun, 2026 | Go github.com/radius-project/radius |
Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel CVE-2026-3433, GHSA-rp4v-qc77-phm4, GO-2026-6286 | Medium | Not scored | 12 Jun, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't validate that a username returned during bot registration belongs to a bot account CVE-2026-6046, GHSA-3vmp-whvv-5v9v, GO-2026-6279 | Medium | Not scored | 12 Jun, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation CVE-2026-6689, GHSA-c28q-m4gf-vg4q, GO-2026-6283 | Medium | Not scored | 12 Jun, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't require system-level permission when patching protected default system roles CVE-2026-6739, GHSA-m2w9-h2mm-79qr, GO-2026-6285 | Medium | Not scored | 12 Jun, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync CVE-2026-6961, GHSA-8qq9-cqj8-82w4, GO-2026-6281 | High | Not scored | 12 Jun, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations CVE-2026-7184, GHSA-9p44-r552-4wp9, GO-2026-6282 | Medium | Not scored | 12 Jun, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints CVE-2026-7387, GHSA-6hxm-w4hv-vgvw, GO-2026-6280 | High | Not scored | 12 Jun, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store GHSA-6vgg-xhvh-38ff, GO-2026-5191 | Low | Not scored | 12 Jun, 2026 | Go github.com/juev/nebula-mesh |
gorest InMemorySecret2FA race condition allows process crash via concurrent map access (CWE-362) CVE-2026-48154, GHSA-cpwg-x64r-rgwg, GO-2026-5330 | Medium | Not scored | 12 Jun, 2026 | Go github.com/pilinux/gorest |
Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList() CVE-2026-12681, GHSA-9r4w-jg96-92mv, GO-2026-5298 | High | Not scored | 12 Jun, 2026 | Go github.com/google/go-attestation |
Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection CVE-2026-48113, GHSA-24fp-5v3p-rvpw, GO-2026-5054 | High | Not scored | 12 Jun, 2026 | Go github.com/jpillora/chisel |
AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance CVE-2026-11401, GHSA-r236-5pc3-3qcp, GO-2026-5601 | High | Not scored | 11 Jun, 2026 | Go github.com/aws/aws-advanced-go-wrapper/auth-helpers Go github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager Go github.com/aws/aws-advanced-go-wrapper/awssql Go github.com/aws/aws-advanced-go-wrapper/awssql/v2 +8 more |
OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning CVE-2026-48096, GHSA-8396-jffm-qx4w, GO-2026-5239 | Medium | Not scored | 11 Jun, 2026 | Go github.com/openfga/openfga |
DevGuard has improper authorization on public assets CVE-2026-48089, GHSA-6p54-fw2f-q7gf, GO-2026-5183 | High | Not scored | 11 Jun, 2026 | Go github.com/l3montree-dev/devguard |
Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS CVE-2026-48050, GHSA-j93g-rp6m-j32m, GO-2026-5457 | High | Not scored | 11 Jun, 2026 | Go github.com/basekick-labs/arc |
Traefik has a StripPrefix Route-Level Auth Bypass via Path Normalization CVE-2026-48020, GHSA-xf64-8mw2-4gr2, GO-2026-5752 | High | Not scored | 11 Jun, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
free5GC UDR has improper `ueId` validation in EE subscription handlers that allows arbitrary identifier persistence CVE-2026-47780, GHSA-6gxq-gpr8-xgjp, GO-2026-5178 | Medium | Not scored | 11 Jun, 2026 | Go github.com/free5gc/udr |
nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs) CVE-2026-47768, GHSA-9pg3-25fq-p6cc, GO-2026-5294 | Medium | Not scored | 10 Jun, 2026 | Go github.com/juev/nebula-mesh |
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) CVE-2026-47753, GHSA-8g7m-96c8-8wwc, GO-2026-5252 | Medium | Not scored | 10 Jun, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v7 |
nebula-mesh: Session and OIDC state cookies lack the Secure attribute CVE-2026-48058, GHSA-rqfj-vv8r-xhqc, GO-2026-5635 | Medium | Not scored | 10 Jun, 2026 | Go github.com/juev/nebula-mesh |
nebula-mesh: Decrypted CA private key persists in heap after signing CVE-2026-48025, GHSA-8h84-fhqq-q58v, GO-2026-5255 | Medium | Not scored | 10 Jun, 2026 | Go github.com/forgekeep/nebula-mesh Go github.com/juev/nebula-mesh |