Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Podman Improper Certificate Validation; machine missing TLS verification CVE-2025-6032, GHSA-65gg-3w2w-hr4h, GO-2025-3777 | High | Not scored | 25 Jun, 2025 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 +1 more |
Hashicorp Nomad Incorrect Privilege Assignment vulnerability CVE-2025-4922, GHSA-rx97-6c62-55mf, GO-2025-3758 | High | Not scored | 11 Jun, 2025 | Go github.com/hashicorp/nomad |
CWA-2025-006: wasmd's improper error handling may lead to IBC channel opening despite error GHSA-79xg-q4qm-7v9w, GO-2025-3755 | High | Not scored | 11 Jun, 2025 | Go github.com/CosmWasm/wasmd |
Pion Interceptor's improper RTP padding handling allows remote crash for SFU users (DoS) CVE-2025-49140, GHSA-f26w-gh5m-qq77, GO-2025-3748 | High | Not scored | 09 Jun, 2025 | Go github.com/pion/interceptor |
CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification CVE-2025-47950, GHSA-cvx7-x8pj-x2gw, GO-2025-3743 | High | Not scored | 06 Jun, 2025 | Go github.com/coredns/coredns |
quic-go Has Panic in Path Probe Loss Recovery Handling CVE-2025-29785, GHSA-j972-j939-p2v3, GO-2025-3735 | High | Not scored | 03 Jun, 2025 | Go github.com/quic-go/quic-go |
Grafana vulnerable to authenticated users bypassing dashboard, folder permissions BIT-grafana-2025-3260, CVE-2025-3260, GHSA-3px7-c4j3-576r, GO-2025-3740 | High | Not scored | 02 Jun, 2025 | Go github.com/grafana/grafana |
Navidrome Transcoding Permission Bypass Vulnerability Report CVE-2025-48948, GHSA-f238-rggp-82m3, GO-2025-3733 | High | Not scored | 29 May, 2025 | Go github.com/navidrome/navidrome |
Navidrome allows SQL Injection via role parameter CVE-2025-48949, GHSA-5wgp-vjxm-3x2r, GO-2025-3734 | High | Not scored | 29 May, 2025 | Go github.com/navidrome/navidrome |
ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection CVE-2025-48936, GHSA-93m4-mfpg-c3xf, GO-2025-3721 | High | Not scored | 28 May, 2025 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
Contrast workload secrets leak to logs on INFO level CVE-2025-71425, GHSA-h5f8-crrq-4pw8, GO-2025-3718 | High | Not scored | 28 May, 2025 | Go github.com/edgelesssys/contrast |
Fiber panics when fiber.Ctx.BodyParser parses invalid range index CVE-2025-48075, GHSA-hg3g-gphw-5hhm, GO-2025-3706 | High | Not scored | 22 May, 2025 | Go github.com/gofiber/fiber Go github.com/gofiber/fiber/v2 |
Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin BIT-grafana-2025-4123, CVE-2025-4123, GHSA-q53q-gxq9-mgrj, GO-2025-3704 | High | Not scored | 22 May, 2025 | Go github.com/grafana/grafana |
containerd allows host filesystem access on pull CVE-2025-47290, GHSA-cm76-qm8v-3j95, GO-2025-3699 | High | Not scored | 21 May, 2025 | Go github.com/containerd/containerd/v2 |
Ollama Server Vulnerable to Denial of Service (DoS) Attack CVE-2025-1975, GHSA-wrh5-cmwx-q2qr, GO-2025-3695, PYSEC-2025-145 | High | 0.5% | 16 May, 2025 | Go github.com/ollama/ollama PyPI ollama |
Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt GHSA-869w-47c6-fq8q, GO-2025-3687 | High | Not scored | 15 May, 2025 | Go github.com/babylonlabs-io/babylon |
Babylon Finality Provider `MsgCommitPubRandList` replay attack GHSA-7mm3-vfg8-7rg6, GO-2025-3686 | High | Not scored | 15 May, 2025 | Go github.com/babylonlabs-io/babylon |
Cosmos EVM Allows Partial Precompile State Writes GHSA-mjfq-3qr2-6g84, GO-2025-3684 | High | Not scored | 14 May, 2025 | Go github.com/cosmos/evm |
Yggdrasil Vulnerable to Local Privilege Escalation CVE-2025-3931, GHSA-rpg2-jvhp-h354, GO-2025-3688 | High | Not scored | 14 May, 2025 | Go github.com/redhatinsights/yggdrasil |
ZITADEL Allows IdP Intent Token Reuse CVE-2025-46815, GHSA-g4r8-mp7g-85fq, GO-2025-3671 | High | Not scored | 06 May, 2025 | Go github.com/zitadel/zitadel |
OPA server Data API HTTP path injection of Rego CVE-2025-46569, GHSA-6m8w-jc87-6cr7, GO-2025-3660 | High | Not scored | 01 May, 2025 | Go github.com/open-policy-agent/opa Go github.com/open-policy-agent/opa/server Go github.com/open-policy-agent/opa/v1/server |
Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin CVE-2025-32777, GHSA-hg79-fw4p-25p8, GO-2025-3656 | High | Not scored | 30 Apr, 2025 | Go volcano.sh/volcano |
Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements BIT-kyverno-2025-46342, CVE-2025-46342, GHSA-jrr2-x33p-6hvc, GO-2025-3652 | High | Not scored | 29 Apr, 2025 | Go github.com/kyverno/kyverno |
Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks CVE-2023-32198, GHSA-95fc-g4gj-mqmx, GO-2025-3648 | High | Not scored | 25 Apr, 2025 | Go github.com/rancher/steve |
Rancher users who can create Projects can gain access to arbitrary projects CVE-2024-22031, GHSA-8h6m-wv39-239m, GO-2025-3647 | High | Not scored | 25 Apr, 2025 | Go github.com/rancher/rancher |
Traefik has a possible vulnerability with its path matchers CVE-2025-32431, GHSA-6p68-w45g-48j7, GO-2025-3634 | High | Not scored | 21 Apr, 2025 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
GoBGP panics due to a zero value for softwareVersionLen CVE-2025-43971, GHSA-7m35-vw2c-696v, GO-2025-3631 | High | Not scored | 21 Apr, 2025 | Go github.com/osrg/gobgp Go github.com/osrg/gobgp/v3 |
Traefik affected by Go oauth2/jws Improper Validation of Syntactic Correctness of Input vulnerability GHSA-3wqc-mwfx-672p | High | Not scored | 18 Apr, 2025 | Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Kyverno vulnerable to SSRF via Service Calls BIT-kyverno-2025-15613, CVE-2025-15613, GHSA-459x-q9hg-4gpq, GO-2025-3615 | High | Not scored | 15 Apr, 2025 | Go github.com/kyverno/kyverno |
mholt/archiver Vulnerable to Path Traversal via Crafted ZIP File CVE-2025-3445, GHSA-7vpp-9cxj-q8gv, GO-2025-3605 | High | Not scored | 14 Apr, 2025 | Go github.com/mholt/archiver Go github.com/mholt/archiver/v3 |
MinIO performs incomplete signature validation for unsigned-trailer uploads CVE-2025-31489, GHSA-wg47-6jq2-q2hh, GO-2025-3594 | High | Not scored | 04 Apr, 2025 | Go github.com/minio/minio |
Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics CVE-2023-27591, GHSA-3qjf-qh38-x73v | High | Not scored | 02 Apr, 2025 | Go miniflux.app Go miniflux.app/v2 |
Nethermind Juno Potential Denial of Service (DoS) via Integer Overflow CVE-2025-29072, GHSA-wq32-8rp4-w2mc, GO-2025-3583 | High | Not scored | 27 Mar, 2025 | Go github.com/NethermindEth/juno |
ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation CVE-2025-1097, GHSA-823x-fv5p-h7hw, GO-2025-3565 | High | Not scored | 25 Mar, 2025 | Go k8s.io/ingress-nginx |
ingress-nginx controller - configuration injection via unsanitized mirror annotations CVE-2025-1098, GHSA-vg63-w3p9-jc9m, GO-2025-3568 | High | Not scored | 25 Mar, 2025 | Go k8s.io/ingress-nginx |
ingress-nginx controller - configuration injection via unsanitized auth-url annotation CVE-2025-24514, GHSA-fwwp-xcxw-39vq, GO-2025-3566 | High | Not scored | 25 Mar, 2025 | Go k8s.io/ingress-nginx |
jwt-go allows excessive memory allocation during header parsing CVE-2025-30204, GHSA-mh63-6h87-95cp, GO-2025-3553 | High | Not scored | 21 Mar, 2025 | Go github.com/golang-jwt/jwt Go github.com/golang-jwt/jwt/v4 Go github.com/golang-jwt/jwt/v5 |
PipeCD Vulnerable to Privilege Escalation CVE-2024-53351, GHSA-4jhw-c53w-w5r7, GO-2025-3546 | High | Not scored | 21 Mar, 2025 | Go github.com/pipe-cd/pipecd |
Mattermost Fails to Enforce MFA on Plugin Endpoints BIT-mattermost-2025-25068, CVE-2025-25068, GHSA-72qv-j8vr-xvfv, GO-2025-3551 | High | Not scored | 21 Mar, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Ollama Denial of Service (DoS) via Null Pointer Dereference CVE-2025-0312, GHSA-p2wh-w96x-w232, GO-2025-3582 | High | Not scored | 20 Mar, 2025 | Go github.com/ollama/ollama |
Ollama Allocation of Resources Without Limits or Throttling vulnerability CVE-2025-0315, GHSA-fccc-8m69-8r78, GO-2025-3557 | High | Not scored | 20 Mar, 2025 | Go github.com/ollama/ollama |
Ollama Divide By Zero vulnerability CVE-2025-0317, GHSA-9gcr-28rp-cc24, GO-2025-3559 | High | Not scored | 20 Mar, 2025 | Go github.com/ollama/ollama |
Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIP CVE-2024-12886, GHSA-v464-r2r9-www7, GO-2025-3548 | High | Not scored | 20 Mar, 2025 | Go github.com/ollama/ollama |
Ollama Allows Out-of-Bounds Read CVE-2024-12055, GHSA-89qx-m49c-8crf, GO-2025-3558 | High | Not scored | 20 Mar, 2025 | Go github.com/ollama/ollama |
Ollama Divide by Zero Vulnerability CVE-2024-8063, GHSA-2xf2-gjm6-g2c6, GO-2025-3689, PYSEC-2025-144 | High | 0.6% | 20 Mar, 2025 | Go github.com/ollama/ollama PyPI ollama |
Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter CVE-2025-30153, GHSA-wq9g-9vfc-cfq9, GO-2025-3533 | High | Not scored | 19 Mar, 2025 | Go github.com/getkin/kin-openapi |
Memory Exhaustion in Expr Parser with Unrestricted Input CVE-2025-29786, GHSA-93mq-9ffx-83m2, GO-2025-3525 | High | Not scored | 17 Mar, 2025 | Go github.com/expr-lang/expr |
Openshift Hive Exposes VCenter Credentials via ClusterProvision CVE-2025-2241, GHSA-c339-mwfc-fmr2, GO-2025-3529 | High | Not scored | 17 Mar, 2025 | Go github.com/openshift/hive |
Cosmos SDK: x/group can halt when erroring in EndBlocker GHSA-47ww-ff84-4jrg, GO-2025-3516 | High | Not scored | 12 Mar, 2025 | Go github.com/cosmos/cosmos-sdk |
Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries CVE-2025-27403, GHSA-44f7-5fj5-h4px, GO-2025-3511 | High | Not scored | 11 Mar, 2025 | Go github.com/deislabs/ratify Go github.com/ratify-project/ratify |