Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
DragonFly vulnerable to arbitrary file read and write on a peer machine CVE-2025-59352, GHSA-79hx-3fp8-hj66, GO-2025-3971 | Medium | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error CVE-2025-59351, GHSA-4mhv-8rh3-4ghw, GO-2025-3970 | Medium | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
Dragonfly vulnerable to timing attacks against Proxy’s basic authentication CVE-2025-59350, GHSA-c2fc-9q9c-5486, GO-2025-3972 | Medium | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
Dragonfly incorrectly handles a task structure’s usedTrac field CVE-2025-59348, GHSA-2qgr-gfvj-qpcr, GO-2025-3963 | Medium | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
Dragonfly's manager makes requests to external endpoints with disabled TLS authentication CVE-2025-59347, GHSA-98x5-jw98-6c97, GO-2025-3966 | Medium | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header CVE-2025-59342, GHSA-g2h5-cvvr-7gmw, GO-2025-3967 | Medium | Not scored | 17 Sep, 2025 | Go github.com/esm-dev/esm.sh |
Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling CVE-2025-8396, GHSA-p768-c3pr-6459, GO-2025-3953 | Medium | Not scored | 15 Sep, 2025 | Go go.temporal.io/server |
Mattermost makes Use of Weak Hash CVE-2025-9078, GHSA-9p92-x77w-9fw2, GO-2025-3959 | Medium | Not scored | 15 Sep, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Missing Authorization vulnerability CVE-2025-9076, GHSA-3vcm-c42p-3hhf, GO-2025-3950 | Medium | Not scored | 15 Sep, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
secrets-store-sync-controller discloses service account tokens in logs CVE-2025-7445, GHSA-rcw7-pqfp-735x, GO-2025-3939 | Medium | Not scored | 05 Sep, 2025 | Go sigs.k8s.io/secrets-store-sync-controller |
Memos Vulnerable to Path Traversal via the CreateResource Endpoint CVE-2025-56760, GHSA-78j5-8vq7-jxv5, GO-2025-3936 | Medium | Not scored | 04 Sep, 2025 | Go github.com/usememos/memos |
Memos Vulnerable to Stored Cross-Site Scripting CVE-2025-56761, GHSA-cgrg-86m5-xm4w, GO-2025-3937 | Medium | Not scored | 04 Sep, 2025 | Go github.com/usememos/memos |
github.com/gorilla/csrf improperly validates TrustedOrigins allowing CSRF attacks CVE-2025-47909, GHSA-82ff-hg59-8x73, GO-2025-3884 | Medium | Not scored | 29 Aug, 2025 | Go github.com/gorilla/csrf |
github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives CVE-2025-58058, GHSA-jc7w-c686-c4v9, GO-2025-3922 | Medium | Not scored | 28 Aug, 2025 | Go github.com/ulikunitz/xz |
NeuVector process with sensitive arguments lead to leakage CVE-2025-54467, GHSA-w54x-xfxg-4gxq, GO-2025-3919 | Medium | Not scored | 28 Aug, 2025 | Go github.com/neuvector/neuvector |
NeuVector has an insecure password storage and is vulnerable to rainbow attack CVE-2025-53884, GHSA-8ff6-pc43-jwv3, GO-2025-3917 | Medium | Not scored | 28 Aug, 2025 | Go github.com/neuvector/neuvector |
Kubernetes Nodes can delete themselves by adding an OwnerReference CVE-2025-5187, GHSA-4x4m-3c2p-qppc, GO-2025-3915 | Medium | Not scored | 27 Aug, 2025 | Go k8s.io/kubernetes |
traQ Allows Insertion of Sensitive Information into Log File CVE-2025-57813, GHSA-27r7-3m9x-r533, GO-2025-3913 | Medium | Not scored | 26 Aug, 2025 | Go github.com/traPtitech/traQ |
Dpanel has an arbitrary file read vulnerability CVE-2025-53363, GHSA-gcqf-pxgg-gw8q, GO-2025-3909 | Medium | Not scored | 22 Aug, 2025 | Go github.com/donknap/dpanel |
Mattermost Fails to Sanitize File Names CVE-2025-6465, GHSA-pj6f-rc94-gw53, GO-2025-3910 | Medium | Not scored | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost has Potential Server Crash due to Unvalidated Import Data CVE-2025-8402, GHSA-h469-4fcf-p23h, GO-2025-3911 | Medium | Not scored | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data CVE-2025-11065, GHSA-2464-8j7c-4cjm, GO-2025-3900 | Medium | Not scored | 21 Aug, 2025 | Go github.com/go-viper/mapstructure Go github.com/go-viper/mapstructure/v2 |
Mattermost Fails to Sanitize Path Traversal Sequences CVE-2025-8023, GHSA-x67c-v8jr-p29r, GO-2025-3907 | Medium | Not scored | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Fails to Validate File Paths CVE-2025-36530, GHSA-gq3r-5833-5532, GO-2025-3901 | Medium | Not scored | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Does Not Sanitize the Team Invite ID CVE-2025-47870, GHSA-qj47-w9f2-qg44, GO-2025-3905 | Medium | Not scored | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Fails to Validate Remote Cluster Upload Sessions CVE-2025-49222, GHSA-q453-638c-h4mr, GO-2025-3904 | Medium | Not scored | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
CRI-O has Potential High Memory Consumption from File Read CVE-2025-4437, GHSA-8f93-j3fx-72f3, GO-2025-3897 | Medium | Not scored | 20 Aug, 2025 | Go github.com/cri-o/cri-o |
Default Credentials in nginx-defender Configuration Files CVE-2025-55740, GHSA-pr72-8fxw-xx22, GO-2025-3896 | Medium | Not scored | 19 Aug, 2025 | Go github.com/Anipaleja/nginx-defender |
OpenFGA Authorization Bypass CVE-2025-55213, GHSA-mgh9-4mwp-fg55, GO-2025-3894 | Medium | Not scored | 18 Aug, 2025 | Go github.com/openfga/openfga |
Information Disclosure in Amazon ECS Container Agent CVE-2025-9039, GHSA-wm7x-ww72-r77q, GO-2025-3891 | Medium | Not scored | 14 Aug, 2025 | Go github.com/aws/amazon-ecs-agent |
Helm May Panic Due To Incorrect YAML Content BIT-helm-2025-55198, CVE-2025-55198, GHSA-f9f8-9pmf-xv68, GO-2025-3888 | Medium | Not scored | 14 Aug, 2025 | Go helm.sh/helm Go helm.sh/helm/v3 |
Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion BIT-helm-2025-55199, CVE-2025-55199, GHSA-9h84-qmv7-982p, GO-2025-3887 | Medium | Not scored | 14 Aug, 2025 | Go helm.sh/helm Go helm.sh/helm/v3 |
Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions CVE-2025-53514, GHSA-w92j-c6gr-hj8r, GO-2025-3871 | Medium | Not scored | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Missing Authorization vulnerability CVE-2025-53910, GHSA-v6c8-g53h-mc2h, GO-2025-3869 | Medium | Not scored | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Missing Authorization vulnerability CVE-2025-54458, GHSA-j66h-xhpr-7q5g, GO-2025-3867 | Medium | Not scored | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions CVE-2025-54463, GHSA-gjpm-6w34-ppvf, GO-2025-3866 | Medium | Not scored | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin is Missing Authentication for Critical Function CVE-2025-54478, GHSA-qpjq-c5hr-7925, GO-2025-3875 | Medium | Not scored | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Missing Authorization vulnerability CVE-2025-8285, GHSA-qjrx-j8wm-xf83, GO-2025-3868 | Medium | Not scored | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Missing Authorization vulnerability CVE-2025-48731, GHSA-cmpr-8prq-w5p5, GO-2025-3861 | Medium | Not scored | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Missing Authorization vulnerability CVE-2025-44001, GHSA-vpcr-fqpc-386h, GO-2025-3863 | Medium | Not scored | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias BIT-openbao-2025-55001, CVE-2025-55001, GHSA-2q8q-8fgw-9p6p, GO-2025-3859 | Medium | Not scored | 08 Aug, 2025 | Go github.com/openbao/openbao |
OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse BIT-openbao-2025-55003, CVE-2025-55003, GHSA-rxp7-9q75-vj3p, GO-2025-3856 | Medium | Not scored | 08 Aug, 2025 | Go github.com/openbao/openbao |
OpenBao TOTP Secrets Engine Code Reuse BIT-openbao-2025-55000, CVE-2025-55000, GHSA-f7c3-mhj2-9pvg, GO-2025-3853 | Medium | Not scored | 08 Aug, 2025 | Go github.com/openbao/openbao |
OpenBao Userpass and LDAP User Lockout Bypass BIT-openbao-2025-54998, CVE-2025-54998, GHSA-j3xv-7fxp-gfhx, GO-2025-3855 | Medium | Not scored | 08 Aug, 2025 | Go github.com/openbao/openbao |
operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd CVE-2025-7195, GHSA-856v-8qm2-9wjv, GO-2025-3852 | Medium | Not scored | 07 Aug, 2025 | Go github.com/operator-framework/operator-sdk |
Ollama allows deletion of arbitrary files CVE-2025-44779, GHSA-93jv-pvg8-hf3v, GO-2025-3851, PYSEC-2025-146 | Medium | 0.2% | 07 Aug, 2025 | Go github.com/ollama/ollama PyPI ollama |
HashiCorp Vault ldap auth method may not have correctly enforced MFA BIT-vault-2025-6013, CVE-2025-6013, GHSA-7rx2-769v-hrwf, GO-2025-3848 | Medium | Not scored | 06 Aug, 2025 | Go github.com/hashicorp/vault |
Grafana Infinity Datasource Plugin SSRF Vulnerability CVE-2025-8341, GHSA-3c93-92r7-j934, GO-2025-3843 | Medium | Not scored | 04 Aug, 2025 | Go github.com/grafana/grafana-infinity-datasource |
Hashicorp Vault has Lockout Feature Authentication Bypass BIT-vault-2025-6004, CVE-2025-6004, GHSA-qgj7-fmq2-6cc4, GO-2025-3840 | Medium | Not scored | 01 Aug, 2025 | Go github.com/hashicorp/vault |
Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse BIT-vault-2025-6014, CVE-2025-6014, GHSA-qv3p-fmv3-9hww, GO-2025-3841 | Medium | Not scored | 01 Aug, 2025 | Go github.com/hashicorp/vault |