Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability BIT-vault-2025-6015, CVE-2025-6015, GHSA-v6r4-35f9-9rpw, GO-2025-3842 | Medium | Not scored | 01 Aug, 2025 | Go github.com/hashicorp/vault |
Hashicorp Vault has Incorrect Validation for Non-CA Certificates BIT-vault-2025-6037, CVE-2025-6037, GHSA-6c5r-4wfc-3mcx, GO-2025-3836 | Medium | Not scored | 01 Aug, 2025 | Go github.com/hashicorp/vault |
OAuth2-Proxy's `--gitlab-group` GitLab Group Authorization config flag stopped working in v7.0.0 BIT-oauth2-proxy-2021-21411, CVE-2021-21411, GHSA-652x-m2gr-hppm, GO-2025-3832 | Medium | Not scored | 30 Jul, 2025 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
Moby firewalld reload makes published container ports accessible from remote hosts CVE-2025-54388, GHSA-x4rx-4gw3-53p4, GO-2025-3830 | Medium | Not scored | 29 Jul, 2025 | Go github.com/docker/docker |
Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs CVE-2025-50738, GHSA-hfcf-79gh-f3jc, GO-2025-3831 | Medium | Not scored | 29 Jul, 2025 | Go github.com/usememos/memos |
Possible ORM Leak Vulnerability in the Harbor CVE-2025-30086, GHSA-h27m-3qw8-3pw8, GO-2025-3826 | Medium | Not scored | 23 Jul, 2025 | Go github.com/goharbor/harbor |
Harbor repository description page has Cross-site Scripting vulnerability BIT-harbor-2025-32019, CVE-2025-32019, GHSA-f9vc-vf3r-pqqq, GO-2025-3825 | Medium | Not scored | 23 Jul, 2025 | Go github.com/goharbor/harbor |
Ollama vulnerable to Cross-Domain Token Exposure CVE-2025-51471, GHSA-x9hg-5q6g-q3jr, GO-2025-3824, PYSEC-2025-147 | Medium | 18.5% | 22 Jul, 2025 | Go github.com/ollama/ollama PyPI ollama |
melange's world-writable permissions expose SBOM files to potential image tampering CVE-2025-54059, GHSA-5662-cv6m-63wh, GO-2025-3815 | Medium | Not scored | 18 Jul, 2025 | Go chainguard.dev/melange |
Mattermost Path Traversal vulnerability CVE-2025-6233, GHSA-wvw2-3jh4-4c39, GO-2025-3820 | Medium | Not scored | 18 Jul, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Missing Authentication for Critical Function CVE-2025-6226, GHSA-7h34-9chr-58qh, GO-2025-3819 | Medium | Not scored | 18 Jul, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Grafana's insecure DingDing Alert integration exposes sensitive information BIT-grafana-2025-3415, CVE-2025-3415, GHSA-46m5-8hpj-p5p5, GO-2025-3814 | Medium | Not scored | 17 Jul, 2025 | Go github.com/grafana/grafana |
Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization CVE-2025-53512, GHSA-r64v-82fh-xc63, GO-2025-3806 | Medium | Not scored | 09 Jul, 2025 | Go github.com/juju/juju |
juju/utils leaks private key in certs CVE-2025-6224, GHSA-h34r-jxqm-qgpr, GO-2025-3798 | Medium | Not scored | 01 Jul, 2025 | Go github.com/juju/utils Go github.com/juju/utils/v2 Go github.com/juju/utils/v3 Go github.com/juju/utils/v4 +1 more |
Mattermost Incorrect Authorization vulnerability CVE-2025-46702, GHSA-v8fr-vxmw-6mf6, GO-2025-3796 | Medium | Not scored | 30 Jun, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Incorrect Authorization vulnerability CVE-2025-47871, GHSA-wgvp-jj4w-88hf, GO-2025-3797 | Medium | Not scored | 30 Jun, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
File Browser vulnerable to insecure password handling CVE-2025-52997, GHSA-cm2r-rg7r-p7gg, GO-2025-3792 | Medium | Not scored | 30 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser allows sensitive data to be transferred in URL CVE-2025-52901, GHSA-rmwh-g367-mj4x, GO-2025-3794 | Medium | Not scored | 30 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data GHSA-fv92-fjc5-jj9h, GO-2025-3787 | Medium | Not scored | 27 Jun, 2025 | Go github.com/go-viper/mapstructure Go github.com/go-viper/mapstructure/v2 |
filebrowser Sets Insecure File Permissions CVE-2025-52900, GHSA-jj2r-455p-5gvf, GO-2025-3785 | Medium | Not scored | 27 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
OpenBao allows cancellation of root rekey and recovery rekey operations without authentication BIT-openbao-2025-52894, CVE-2025-52894, GHSA-prpj-rchp-9j5h, GO-2025-3783 | Medium | Not scored | 26 Jun, 2025 | Go github.com/openbao/openbao |
OpenBao Inserts Sensitive Information into Log File when processing malformed data BIT-openbao-2025-52893, CVE-2025-52893, GHSA-8f5r-8cmq-7fmq, GO-2025-3780 | Medium | Not scored | 26 Jun, 2025 | Go github.com/openbao/openbao/sdk Go github.com/openbao/openbao/sdk/v2 |
Gogs XSS allowed by stored call in PDF renderer CVE-2025-47943, GHSA-xh32-cx6c-cp4v, GO-2025-3778 | Medium | Not scored | 26 Jun, 2025 | Go github.com/gogs/gogs Go gogs.io/gogs |
chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes CVE-2025-71405, GHSA-vrw8-fxc6-2r93, GO-2025-3770 | Medium | Not scored | 20 Jun, 2025 | Go github.com/go-chi/chi/v5 |
Mattermost allows unauthorized channel member management through playbook runs CVE-2025-3227, GHSA-qwwm-c582-82rx, GO-2025-3772 | Medium | Not scored | 20 Jun, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows an unauthorized Guest user access to Playbook CVE-2025-3228, GHSA-4578-6gjh-f2jm, GO-2025-3771 | Medium | Not scored | 20 Jun, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Velociraptor vulnerable to privilege escalation via UpdateConfig artifact CVE-2025-6264, GHSA-gpfc-mph4-qm24, GO-2025-3768 | Medium | Not scored | 20 Jun, 2025 | Go www.velocidex.com/golang/velociraptor |
OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal CVE-2025-5981, GHSA-2hcm-q3f4-fjgw, GO-2025-3767 | Medium | Not scored | 18 Jun, 2025 | Go github.com/google/osv-scalibr |
New authd users logging in via SSH are members of the root group CVE-2025-5689, GHSA-g8qw-mgjx-rwjr, GO-2025-3762 | Medium | Not scored | 16 Jun, 2025 | Go github.com/ubuntu/authd |
uptrace pgdriver SQL injection vulnerability CVE-2024-44906, GHSA-h4h6-vccr-44h2, GO-2025-3765 | Medium | Not scored | 12 Jun, 2025 | Go github.com/uptrace/bun/driver/pgdriver |
go-pg SQL injection vulnerability via the component /types/append_value.go CVE-2024-44905, GHSA-6xp3-p59p-q4fj, GO-2025-3764 | Medium | Not scored | 12 Jun, 2025 | Go github.com/go-pg/pg Go github.com/go-pg/pg/v10 Go github.com/go-pg/pg/v9 |
Mattermost allows authenticated administrator to execute LDAP search filter injection CVE-2025-4573, GHSA-4r67-4x4p-fprg, GO-2025-3756 | Medium | Not scored | 11 Jun, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Authorino Uncontrolled Resource Consumption vulnerability CVE-2025-25208, GHSA-vqvv-2wj5-q34w, GO-2025-3747 | Medium | Not scored | 09 Jun, 2025 | Go github.com/kuadrant/authorino |
Authorino Uncontrolled Resource Consumption vulnerability CVE-2025-25207, GHSA-r8xr-pgv5-gxw3, GO-2025-3746 | Medium | Not scored | 09 Jun, 2025 | Go github.com/kuadrant/authorino |
kro Confused Deputy vulnerability CVE-2025-48710, GHSA-7633-x85h-5mqh, GO-2025-3741 | Medium | Not scored | 04 Jun, 2025 | Go github.com/kro-run/kro |
Gokapi vulnerable to stored XSS via uploading file with malicious file name CVE-2025-48494, GHSA-95rc-wc32-gm53, GO-2025-3737 | Medium | Not scored | 03 Jun, 2025 | Go github.com/forceu/gokapi |
Gokapi has stored XSS vulnerability in friendly name for API keys CVE-2025-48495, GHSA-4xg4-54hm-9j77, GO-2025-3736 | Medium | Not scored | 03 Jun, 2025 | Go github.com/forceu/gokapi |
Grafana's datasource proxy API allows authorization checks to be bypassed BIT-grafana-2025-3454, CVE-2025-3454, GHSA-9j65-rv5x-4vrf, GO-2025-3742 | Medium | Not scored | 02 Jun, 2025 | Go github.com/grafana/grafana |
Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server CVE-2025-48938, GHSA-g9f5-x53j-h563, GO-2025-3732 | Medium | Not scored | 30 May, 2025 | Go github.com/cli/go-gh/v2 |
Mattermost fails to clear Google OAuth credentials CVE-2025-2571, GHSA-8cgx-9ccj-3gwr, GO-2025-3729 | Medium | Not scored | 30 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly invalidate personal access tokens upon user deactivation CVE-2025-3230, GHSA-mc2f-jgj6-6cp3, GO-2025-3731 | Medium | Not scored | 30 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost improperly allows team administrators to modify team invites CVE-2025-3913, GHSA-4mmr-2w8p-whcr, GO-2025-3724 | Medium | Not scored | 29 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
ActiveMQ Artemis AMQ Broker Operator Starting Credentials Reuse CVE-2025-4057, GHSA-q5q7-8x6x-hcg2, GO-2025-3717 | Medium | Not scored | 26 May, 2025 | Go github.com/arkmq-org/activemq-artemis-operator |
OpenFGA Authorization Bypass CVE-2025-48371, GHSA-c72g-53hw-82q7, GO-2025-3707 | Medium | Not scored | 23 May, 2025 | Go github.com/openfga/openfga |
zot logs secrets CVE-2025-48374, GHSA-c37v-3c8w-crq8, GO-2025-3705 | Medium | Not scored | 22 May, 2025 | Go zotregistry.dev/zot |
Insufficient input sanitization in ejson2env CVE-2025-48069, GHSA-2c47-m757-32g6, GO-2025-3702 | Medium | Not scored | 21 May, 2025 | Go github.com/Shopify/ejson2env Go github.com/Shopify/ejson2env/v2 RubyGems ejson2env |
containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. CVE-2025-47291, GHSA-cxfp-7pvr-95ff, GO-2025-3701 | Medium | Not scored | 21 May, 2025 | Go github.com/containerd/containerd/v2 |
Character injection in Hubble CLI CVE-2025-48056, GHSA-274q-79q9-52j7, GO-2025-3700 | Medium | Not scored | 21 May, 2025 | Go github.com/cilium/hubble |
SeaweedFS Vulnerable to SQL Injection BIT-seaweedfs-2024-40120, CVE-2024-40120, GHSA-q97m-8853-pq76, GO-2025-3690 | Medium | Not scored | 16 May, 2025 | Go github.com/seaweedfs/seaweedfs |
Mattermost Fails to Verify User's Permissions When Accessing Groups CVE-2025-2527, GHSA-h356-3mfw-x368, GO-2025-3691 | Medium | Not scored | 15 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |