Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Free5GC is vulnerable to DoS via the Nudm_SubscriberDataManagement API CVE-2025-60633, GHSA-3j9f-7w24-pcqg, GO-2025-4162 | Medium | Not scored | 24 Nov, 2025 | Go github.com/free5gc/openapi Go github.com/free5gc/udm |
OpenFGA Improper Policy Enforcement CVE-2025-64751, GHSA-2c64-vmv2-hgfc, GO-2025-4150 | Medium | Not scored | 20 Nov, 2025 | Go github.com/openfga/openfga |
esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript CVE-2025-65026, GHSA-hcpf-qv9m-vfgp, GO-2025-4139 | Medium | Not scored | 19 Nov, 2025 | Go github.com/esm-dev/esm.sh |
golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read CVE-2025-47914, GHSA-f6x5-jh6r-wrfv, GO-2025-4135 | Medium | Not scored | 19 Nov, 2025 | Go golang.org/x/crypto |
golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption CVE-2025-58181, GHSA-j5w8-q4qc-rx2x, GO-2025-4134 | Medium | Not scored | 19 Nov, 2025 | Go golang.org/x/crypto |
authentik's invitation expiry is delayed by at least 5 minutes BIT-authentik-2025-64708, CVE-2025-64708, GHSA-ch7q-53v8-73pc, GO-2025-4136 | Medium | Not scored | 19 Nov, 2025 | Go goauthentik.io |
authentik allows a deactivated Service account to authenticate to OAuth BIT-authentik-2025-64521, CVE-2025-64521, GHSA-xr73-jq5p-ch8r, GO-2025-4137, PYSEC-2025-237 | Medium | 0.2% | 19 Nov, 2025 | Go goauthentik.io PyPI authentik-client |
Mattermost allows system administrators to access password hashes and MFA secrets CVE-2025-11794, GHSA-mqp8-pgg5-7x7m, GO-2025-4130 | Medium | Not scored | 14 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly restrict access to archived channel search API CVE-2025-11776, GHSA-j6gg-r5jc-47cm, GO-2025-4126 | Medium | Not scored | 14 Nov, 2025 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +2 more |
Mattermost does not enforce MFA on WebSocket connections CVE-2025-55070, GHSA-xpg8-8xpv-948p, GO-2025-4128 | Medium | Not scored | 14 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL CVE-2025-55073, GHSA-ff85-qw3h-g9vp, GO-2025-4129 | Medium | Not scored | 14 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Soft Serve does not sanitize ANSI escape sequences in user input CVE-2025-64494, GHSA-fv2r-r8mp-pg48, GO-2025-4106 | Medium | Not scored | 06 Nov, 2025 | Go github.com/charmbracelet/soft-serve |
KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes CVE-2025-64437, GHSA-2r4r-5x78-mvqf, GO-2025-4102 | Medium | Not scored | 06 Nov, 2025 | Go kubevirt.io/kubevirt |
KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes CVE-2025-64436, GHSA-7xgm-5prm-v5gc, GO-2025-4104 | Medium | Not scored | 06 Nov, 2025 | Go github.com/kubevirt/kubevirt Go kubevirt.io/kubevirt |
KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation CVE-2025-64435, GHSA-9m94-w2vq-hcf9, GO-2025-4105 | Medium | Not scored | 06 Nov, 2025 | Go kubevirt.io/kubevirt |
KubeVirt's Improper TLS Certificate Management Handling Allows API Identity Spoofing CVE-2025-64434, GHSA-ggp9-c99x-54gp, GO-2025-4107 | Medium | Not scored | 06 Nov, 2025 | Go kubevirt.io/kubevirt |
KubeVirt Arbitrary Container File Read CVE-2025-64433, GHSA-qw6q-3pgr-5cwq, GO-2025-4109 | Medium | Not scored | 06 Nov, 2025 | Go kubevirt.io/kubevirt |
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer CVE-2025-64432, GHSA-38jw-g2qx-4286, GO-2025-4103 | Medium | Not scored | 06 Nov, 2025 | Go kubevirt.io/kubevirt |
containerd CRI server: Host memory exhaustion through Attach goroutine leak CVE-2025-64329, GHSA-m6hq-p25p-ffr2, GO-2025-4108 | Medium | Not scored | 06 Nov, 2025 | Go github.com/containerd/containerd Go github.com/containerd/containerd/v2 |
Kgateway transformation policy template can emit files from the container GHSA-5pmx-7r6r-wfqq, GO-2025-4095 | Medium | Not scored | 04 Nov, 2025 | Go github.com/kgateway-dev/kgateway Go github.com/kgateway-dev/kgateway/v2 |
kgateway is missing xDS authorization CVE-2025-64323, GHSA-4766-x535-jw3r, GO-2025-4094 | Medium | Not scored | 04 Nov, 2025 | Go github.com/kgateway-dev/kgateway Go github.com/kgateway-dev/kgateway/v2 |
lakeFS affected by unauthenticated access to API usage metrics CVE-2025-64179, GHSA-h238-5mwf-8xw8, GO-2025-4090 | Medium | Not scored | 03 Nov, 2025 | Go github.com/treeverse/lakefs |
Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode CVE-2025-64716, GHSA-cf57-c578-7jvv, GO-2025-4086 | Medium | Not scored | 30 Oct, 2025 | Go github.com/TecharoHQ/anubis |
Consul key/value endpoint is vulnerable to denial of service BIT-consul-2025-11374, CVE-2025-11374, GHSA-7g3r-8c6v-hfmr, GO-2025-4081 | Medium | Not scored | 28 Oct, 2025 | Go github.com/hashicorp/consul |
Consul event endpoint is vulnerable to denial of service BIT-consul-2025-11375, CVE-2025-11375, GHSA-qh7p-pfq3-677h, GO-2025-4082 | Medium | Not scored | 28 Oct, 2025 | Go github.com/hashicorp/consul |
Contrast has insecure LUKS2 persistent storage partitions may be opened and used CVE-2025-71422, GHSA-f5p4-p5q5-jv3h, GO-2025-4078 | Medium | Not scored | 28 Oct, 2025 | Go github.com/edgelesssys/contrast |
Silver has unrestricted traffic between Wireguard clients CVE-2025-27093, GHSA-q8j9-34qf-7vq7, GO-2025-4079 | Medium | Not scored | 28 Oct, 2025 | Go github.com/BishopFox/sliver Go github.com/bishopfox/sliver |
Rancher exposes sensitive information through audit logs CVE-2024-58269, GHSA-mw39-9qc2-f7mg, GO-2025-4074 | Medium | Not scored | 24 Oct, 2025 | Go github.com/rancher/rancher |
Rancher user retains access to clusters despite Global Role removal CVE-2023-32199, GHSA-j4vr-pcmw-hx59, GO-2025-4073 | Medium | Not scored | 24 Oct, 2025 | Go github.com/rancher/rancher |
Slack Nebula may accept arbitrary source IP addresses CVE-2025-62820, GHSA-x6fh-7qmf-69xh, GO-2025-4068 | Medium | Not scored | 23 Oct, 2025 | Go github.com/slackhq/nebula |
OpenBao and Vault Leak []byte Fields in Audit Logs BIT-openbao-2025-62705, CVE-2025-62705, GHSA-rc54-2g2c-g36g, GO-2025-4052 | Medium | Not scored | 22 Oct, 2025 | Go github.com/openbao/openbao |
OpenBao leaks HTTPRawBody in Audit Logs BIT-openbao-2025-62513, CVE-2025-62513, GHSA-ghfh-fmx4-26h8, GO-2025-4049 | Medium | Not scored | 22 Oct, 2025 | Go github.com/openbao/openbao |
NeuVector is shipping cryptographic material into its binary CVE-2025-54471, GHSA-h773-7gf7-9m2x, GO-2025-4043 | Medium | Not scored | 21 Oct, 2025 | Go github.com/neuvector/neuvector |
Mattermost has a Missing Authorization vulnerability CVE-2025-41410, GHSA-3q4q-wqm6-hvf3, GO-2025-4029 | Medium | Not scored | 16 Oct, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost has a Missing Authorization vulnerability CVE-2025-41443, GHSA-7cr3-38jm-6p45, GO-2025-4031 | Medium | Not scored | 16 Oct, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost/server/v8 |
go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents CVE-2025-62375, GHSA-72c7-4g63-hpw5, GO-2025-4028 | Medium | Not scored | 15 Oct, 2025 | Go github.com/in-toto/go-witness |
Omni is Vulnerable to DoS via Empty Create/Update Resource Requests CVE-2025-59836, GHSA-4p3p-cr38-v5xp, GO-2025-4021 | Medium | Not scored | 13 Oct, 2025 | Go github.com/siderolabs/omni |
Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret CVE-2025-61926, GHSA-33f4-mjch-7fpr, GO-2025-4018 | Medium | Not scored | 10 Oct, 2025 | Go github.com/ossf/allstar |
rardecode: DoS risk due to unrestricted RAR dictionary sizes CVE-2025-11579, GHSA-rwvp-r38j-9rgg, GO-2025-4020 | Medium | Not scored | 10 Oct, 2025 | Go github.com/nwaples/rardecode Go github.com/nwaples/rardecode/v2 |
Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server CVE-2025-54288, GHSA-7232-97c6-j525, GO-2025-4001 | Medium | Not scored | 02 Oct, 2025 | Go github.com/canonical/lxd |
Canonical LXD Project Existence Determination Through Error Handling in Image Export Function CVE-2025-54290, GHSA-p3x5-mvmp-5f35, GO-2025-4002 | Medium | Not scored | 02 Oct, 2025 | Go github.com/canonical/lxd |
Canonical LXD Project Existence Determination Through Error Handling in Image Get Function CVE-2025-54291, GHSA-xch9-h8qw-85c7, GO-2025-4005 | Medium | Not scored | 02 Oct, 2025 | Go github.com/canonical/lxd |
Repository Credentials Race Condition Crashes Argo CD Server BIT-argo-cd-2025-55191, CVE-2025-55191, GHSA-g88p-r42r-ppp9, GO-2025-3994 | Medium | Not scored | 30 Sep, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 Go github.com/argoproj/argo-cd/v3 |
Coder AgentAPI exposed user chat history via a DNS rebinding attack CVE-2025-59956, GHSA-w64r-2g3w-w8w4, GO-2025-3991 | Medium | Not scored | 29 Sep, 2025 | Go github.com/coder/agentapi |
go-f3 Vulnerable to Cached Justification Verification Bypass CVE-2025-59941, GHSA-7pq9-rf9p-wcrf, GO-2025-3989 | Medium | Not scored | 29 Sep, 2025 | Go github.com/filecoin-project/go-f3 |
github.com/nyaruka/phonenumbers Vulnerable to Improper Validation of Syntactic Correctness of Input CVE-2025-10954, GHSA-fmjh-f678-cv3x, GO-2025-3987 | Medium | Not scored | 27 Sep, 2025 | Go github.com/nyaruka/phonenumbers |
Rancher sends sensitive information to external services through the `/meta/proxy` endpoint CVE-2025-54468, GHSA-mjcp-rj3c-36fr, GO-2025-3982 | Medium | Not scored | 26 Sep, 2025 | Go github.com/rancher/rancher |
Grafana-Zabbix ReDoS vulnerability CVE-2025-10630, GHSA-g4rr-88fc-26fj, GO-2025-3976 | Medium | Not scored | 19 Sep, 2025 | Go github.com/alexanderzobnin/grafana-zabbix |
DragonFly's tiny file download uses hard coded HTTP protocol CVE-2025-59410, GHSA-mcvp-rpgg-9273, GO-2025-3974 | Medium | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
DragonFly has weak integrity checks for downloaded files CVE-2025-59354, GHSA-hx2h-vjw2-8r54, GO-2025-3973 | Medium | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |