Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Soft Serve vulnerable to arbitrary file writing through SSH API CVE-2025-58355, GHSA-33pr-m977-5w97, GO-2025-3930 | High | Not scored | 02 Sep, 2025 | Go github.com/charmbracelet/soft-serve |
Rancher Fleet Helm Values are stored inside BundleDeployment in plain text CVE-2024-52284, GHSA-6h9x-9j5v-7w9h, GO-2025-3927 | High | Not scored | 29 Aug, 2025 | Go github.com/rancher/fleet |
gnark affected by denial of service when computing scalar multiplication using fake-GLV algorithm CVE-2025-58157, GHSA-9fvj-xqr2-xwg8, GO-2025-3929 | High | Not scored | 29 Aug, 2025 | Go github.com/consensys/gnark |
Harness Allows Arbitrary File Write in Gitness LFS server CVE-2025-58158, GHSA-w469-hj2f-jpr5, GO-2025-3926 | High | Not scored | 29 Aug, 2025 | Go github.com/harness/gitness |
Versity panic induced by AWS chunked data sent to port GHSA-v2ch-c8v8-fgr7, GO-2025-3925 | High | Not scored | 29 Aug, 2025 | Go github.com/versity/versitygw |
Rancher affected by unauthenticated Denial of Service CVE-2024-58259, GHSA-4h45-jpvh-6p5j, GO-2025-3923 | High | Not scored | 29 Aug, 2025 | Go github.com/rancher/rancher |
HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads BIT-vault-2025-6203, CVE-2025-6203, GHSA-8f82-53h8-2p34, GO-2025-3924 | High | Not scored | 28 Aug, 2025 | Go github.com/hashicorp/vault |
Contrast leaks workload secrets to logs on INFO level CVE-2025-71423, GHSA-vxg3-w9rv-rhr2, GO-2025-3920 | High | Not scored | 28 Aug, 2025 | Go github.com/edgelesssys/contrast |
simple-admin-core SQL Injection vulnerability CVE-2025-51667, GHSA-f2m2-4q6r-cwc4, GO-2025-3916 | High | Not scored | 27 Aug, 2025 | Go github.com/suyuan32/simple-admin-core |
gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks CVE-2025-57801, GHSA-95v9-hv42-pwrj, GO-2025-3912 | High | Not scored | 22 Aug, 2025 | Go github.com/consensys/gnark |
HashiCorp go-getter Vulnerable to Symlink Attacks CVE-2025-8959, GHSA-wjrx-6529-hcj3, GO-2025-3892 | High | Not scored | 15 Aug, 2025 | Go github.com/hashicorp/go-getter |
External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access CVE-2025-55196, GHSA-fcxq-v2r3-cc8h, GO-2025-3885 | High | Not scored | 13 Aug, 2025 | Go github.com/external-secrets/external-secrets |
OliveTin OS Command Injection vulnerability CVE-2025-50946, GHSA-p3qf-84rg-jxfc, GO-2025-3886 | High | Not scored | 13 Aug, 2025 | Go github.com/OliveTin/OliveTin |
Komari vulnerable to 2FA Authentication Bypass GHSA-jhmr-57cj-q6g9, GO-2025-3873 | High | Not scored | 12 Aug, 2025 | Go github.com/komari-monitor/komari |
Komari vulnerable to Cross-site WebSocket Hijacking CVE-2025-55300, GHSA-q355-h244-969h, GO-2025-3874 | High | Not scored | 12 Aug, 2025 | Go github.com/komari-monitor/komari |
Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions CVE-2025-52931, GHSA-vc77-c2hx-h5x2, GO-2025-3870 | High | Not scored | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Improper Validation of Specified Type of Input CVE-2025-54525, GHSA-3cg3-3mmr-w8hj, GO-2025-3872 | High | Not scored | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin is Missing Authentication for Critical Function CVE-2025-44004, GHSA-6ff3-jgxh-vffj, GO-2025-3865 | High | Not scored | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
OpenBao Root Namespace Operator May Elevate Token Privileges BIT-openbao-2025-54996, CVE-2025-54996, GHSA-vf84-mxrq-crqc, GO-2025-3857 | High | Not scored | 08 Aug, 2025 | Go github.com/openbao/openbao |
Fiber Crashes in BodyParser Due to Unvalidated Large Slice Index in Decoder CVE-2025-54801, GHSA-qx2q-88mx-vhg7, GO-2025-3845 | High | Not scored | 05 Aug, 2025 | Go github.com/gofiber/fiber/v2 |
RatPanel can perform remote command execution without authorization CVE-2025-53534, GHSA-fm3m-jrgm-5ppg, GO-2025-3844 | High | Not scored | 04 Aug, 2025 | Go github.com/TheTNB/panel Go github.com/TheTNB/panel/v2 Go github.com/tnb-labs/panel Go github.com/tnborg/panel |
Hashicorp Vault has Privilege Escalation Vulnerability BIT-vault-2025-5999, CVE-2025-5999, GHSA-6h4p-m86h-hhgh, GO-2025-3837 | High | Not scored | 01 Aug, 2025 | Go github.com/hashicorp/vault |
1Panel agent certificate verification bypass leading to arbitrary command execution CVE-2025-54424, GHSA-8j63-96wh-wh3j, GO-2025-3834 | High | Not scored | 01 Aug, 2025 | Go github.com/1Panel-dev/1Panel/core |
Traefik Client Plugin's Path Traversal Vulnerability Allows Arbitrary File Overwrite and Remote Code Execution CVE-2025-54386, GHSA-q6gg-9f92-r9wg, GO-2025-3835 | High | Not scored | 01 Aug, 2025 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Couchbase Sync Gateway shows cleartext passwords in redacted and unredacted output CVE-2025-52490, GHSA-pqhp-4xfc-hjgq, GO-2026-5550, PYSEC-2025-101 | High | 0.2% | 29 Jul, 2025 | Go github.com/couchbase/sync_gateway PyPI couchbase |
eKuiper API endpoints handling SQL queries with user-controlled table names. CVE-2025-54379, GHSA-526j-mv3p-f4vv, GO-2025-3827, PYSEC-2025-241 | High | 0.9% | 24 Jul, 2025 | Go github.com/lf-edge/ekuiper Go github.com/lf-edge/ekuiper/v2 PyPI ekuiper |
Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources BIT-authentik-2025-53942, CVE-2025-53942, GHSA-9g4j-v8w5-7x42, GO-2025-3822 | High | Not scored | 22 Jul, 2025 | Go goauthentik.io |
Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service BIT-kyverno-2025-47281, CVE-2025-47281, GHSA-r5p3-955p-5ggq, GO-2025-3823 | High | Not scored | 22 Jul, 2025 | Go github.com/kyverno/kyverno |
apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files CVE-2025-53945, GHSA-x6ph-r535-3vjw, GO-2025-3816 | High | Not scored | 18 Jul, 2025 | Go chainguard.dev/apko |
Grafana is vulnerable to XSS attacks through open redirects and path traversal BIT-grafana-2025-6023, CVE-2025-6023, GHSA-vqph-p5vc-g644, GO-2025-3817 | High | Not scored | 18 Jul, 2025 | Go github.com/grafana/grafana |
NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook CVE-2025-23267, GHSA-67jc-hmvg-q4c7, GO-2025-3998 | High | Not scored | 17 Jul, 2025 | Go github.com/NVIDIA/gpu-operator Go github.com/NVIDIA/k8s-device-plugin Go github.com/NVIDIA/mig-parted Go github.com/NVIDIA/nvidia-container-toolkit |
File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing CVE-2025-53893, GHSA-7xqm-7738-642x, GO-2025-3811 | High | Not scored | 16 Jul, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser’s insecure JWT handling can lead to session replay attacks after logout CVE-2025-53826, GHSA-7xwp-2cpp-p8r7, GO-2025-3812 | High | Not scored | 16 Jul, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Chall-Manager's HTTP Gateway is vulnerable to DoS due to missing header timeout CVE-2025-53634, GHSA-ggmv-j932-q89q, GO-2025-3809 | High | Not scored | 10 Jul, 2025 | Go github.com/ctfer-io/chall-manager |
Chall-Manager's scenario decoding process does not check for zip bombs CVE-2025-53633, GHSA-r7fm-3pqm-ww5w, GO-2025-3810 | High | Not scored | 10 Jul, 2025 | Go github.com/ctfer-io/chall-manager |
Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive CVE-2025-53632, GHSA-3gv2-v3jx-r9fh, GO-2025-3808 | High | Not scored | 10 Jul, 2025 | Go github.com/ctfer-io/chall-manager |
Juju allows arbitrary executable uploads via authenticated endpoint without authorization CVE-2025-0928, GHSA-4vc8-wvhw-m5gv, GO-2025-3805 | High | Not scored | 09 Jul, 2025 | Go github.com/juju/juju |
Juju zip slip vulnerability via authenticated endpoint CVE-2025-53513, GHSA-24ch-w38v-xmh8, GO-2025-3804 | High | Not scored | 09 Jul, 2025 | Go github.com/juju/juju |
Cosmos SDK's Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt GHSA-p22h-3m2v-cmgh, GO-2025-3803 | High | Not scored | 08 Jul, 2025 | Go github.com/cosmos/cosmos-sdk |
Helm vulnerable to Code Injection through malicious chart.yaml content BIT-helm-2025-53547, CVE-2025-53547, GHSA-557j-xg8c-q2mm, GO-2025-3802 | High | Not scored | 08 Jul, 2025 | Go helm.sh/helm/v3 |
Babylon vulnerable to chain halt when a message modifies the validator set at the epoch boundary GHSA-rj53-j6jw-7f7g, GO-2025-3801 | High | Not scored | 08 Jul, 2025 | Go github.com/babylonlabs-io/babylon Go github.com/babylonlabs-io/babylon/v2 |
eKuiper /config/uploads API arbitrary file writing may lead to RCE GHSA-gj54-gwj9-x2c6, GO-2025-3800 | High | Not scored | 03 Jul, 2025 | Go github.com/lf-edge/ekuiper Go github.com/lf-edge/ekuiper/v2 |
LF Edge eKuiper vulnerable to File Path Traversal leading to file replacement GHSA-fv2p-qj5p-wqq4, GO-2025-3799 | High | Not scored | 03 Jul, 2025 | Go github.com/lf-edge/ekuiper Go github.com/lf-edge/ekuiper/v2 |
Babylon vulnerable to chain half when transaction has fees different than `ubbn` GHSA-56j4-446m-qrf6, GO-2025-3791 | High | Not scored | 30 Jun, 2025 | Go github.com/babylonlabs-io/babylon Go github.com/babylonlabs-io/babylon/v2 |
File Browser vulnerable to command execution allowlist bypass CVE-2025-52995, GHSA-w7qc-6grj-w7r8, GO-2025-3795 | High | Not scored | 30 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser: Command Execution not Limited to Scope CVE-2025-52904, GHSA-hc8f-m8g5-8362, GO-2025-3793 | High | Not scored | 30 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
filebrowser Allows Shell Commands to Spawn Other Commands CVE-2025-52903, GHSA-3q2w-42mv-cph4, GO-2025-3786 | High | Not scored | 27 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
filebrowser allows Stored Cross-Site Scripting through the Markdown preview function CVE-2025-52902, GHSA-4wx8-5gm2-2j97, GO-2025-3784 | High | Not scored | 27 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Incus creates nftables rules that partially bypass security options CVE-2025-52890, GHSA-p7fw-vjjm-2rwp, GO-2025-3782 | High | Not scored | 26 Jun, 2025 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |
Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens CVE-2025-52477, GHSA-h3qp-hwvr-9xcq, GO-2025-3779 | High | Not scored | 26 Jun, 2025 | Go github.com/octo-sts/app |