Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mattermost Fails to Validate Team Invite Permissions CVE-2025-3446, GHSA-r7r2-m3vr-c8qc, GO-2025-3693 | Medium | Not scored | 15 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Fails to Lockout LDAP Users After Repeated Login Failures CVE-2025-31947, GHSA-qgwx-rffp-6cx9, GO-2025-3692 | Medium | Not scored | 15 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
LF Edge eKuiper Vulnerable to Stored XSS in Configuration Key Functionality CVE-2024-52290, GHSA-9cwv-pxcr-hfjc, GO-2025-3682 | Medium | Not scored | 14 May, 2025 | Go github.com/lf-edge/ekuiper Go github.com/lf-edge/ekuiper/v2 |
nosurf vulnerable to CSRF due to non-functional same-origin request checks CVE-2025-46721, GHSA-w9hf-35q4-vcjw, GO-2025-3683 | Medium | Not scored | 14 May, 2025 | Go github.com/justinas/nosurf |
Inspektor Gadget Security Policies Can be Bypassed GHSA-pv22-fqcj-7xwh, GO-2025-3665 | Medium | Not scored | 06 May, 2025 | Go github.com/inspektor-gadget/inspektor-gadget |
Linkerd resource exhaustion vulnerability CVE-2025-43915, GHSA-42mr-jpwh-m9rv, GO-2025-3664 | Medium | Not scored | 05 May, 2025 | Go github.com/linkerd/linkerd2 |
Hashicorp Vault Community vulnerable to Incorrect Authorization BIT-vault-2025-3879, CVE-2025-3879, GHSA-f9ch-h8j7-8jwg, GO-2025-3662 | Medium | Not scored | 02 May, 2025 | Go github.com/hashicorp/vault |
Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization in github.com/casdoor/casdoor CVE-2025-4210, GHSA-8w8f-h4cm-c4pg, GO-2025-3661 | Medium | Not scored | 02 May, 2025 | Go github.com/casdoor/casdoor |
Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information BIT-openbao-2025-4166, BIT-vault-2025-4166, CVE-2025-4166, GHSA-gcqf-f89c-68hv, GO-2025-3663 | Medium | Not scored | 02 May, 2025 | Go github.com/hashicorp/vault |
OpenFGA Authorization Bypass CVE-2025-46331, GHSA-w222-m46c-mgh6, GO-2025-3657 | Medium | Not scored | 30 Apr, 2025 | Go github.com/openfga/openfga |
Fleet doesn’t validate a server’s certificate when connecting through SSH CVE-2025-23390, GHSA-xgpc-q899-67p8, GO-2025-3649 | Medium | Not scored | 25 Apr, 2025 | Go github.com/rancher/fleet |
CNCF K3s Kubernetes kubelet configuration exposes credentials CVE-2025-46599, GHSA-864f-7xjm-2jp2, GO-2025-3646 | Medium | Not scored | 25 Apr, 2025 | Go github.com/k3s-io/k3s |
Mattermost Playbooks fails to validate the uniqueness and quantity of task actions CVE-2025-35965, GHSA-689c-xq7x-xjwf, GO-2025-3643 | Medium | Not scored | 24 Apr, 2025 | Go github.com/mattermost/mattermost-plugin-playbooks Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type CVE-2025-41395, GHSA-3g36-gf7c-75qw, GO-2025-3642 | Medium | Not scored | 24 Apr, 2025 | Go github.com/mattermost/mattermost-plugin-playbooks Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canaries CVE-2026-26994, GHSA-pmc3-p9hx-jq96, GO-2025-3638 | Medium | Not scored | 23 Apr, 2025 | Go github.com/refraction-networking/utls |
Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS CVE-2025-32963, GHSA-7m6v-q233-q9j9, GO-2025-3637 | Medium | Not scored | 21 Apr, 2025 | Go github.com/minio/operator |
In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters BIT-cilium-2025-32793, BIT-cilium-operator-2025-32793, BIT-hubble-relay-2025-32793, CVE-2025-32793, GHSA-5vxx-c285-pcq4, GO-2025-3635 | Medium | Not scored | 21 Apr, 2025 | Go github.com/cilium/cilium |
GoBGP crashes in the flowspec parser CVE-2025-43972, GHSA-mfvv-mgf6-q25r, GO-2025-3632 | Medium | Not scored | 21 Apr, 2025 | Go github.com/osrg/gobgp Go github.com/osrg/gobgp/v3 |
GoBGP does not verify that the input length CVE-2025-43973, GHSA-c5jg-wr5v-2wp2, GO-2025-3633 | Medium | Not scored | 21 Apr, 2025 | Go github.com/osrg/gobgp Go github.com/osrg/gobgp/v3 |
GoBGP does not properly check the input length CVE-2025-43970, GHSA-hqhq-hp5x-xp3w, GO-2025-3630 | Medium | Not scored | 21 Apr, 2025 | Go github.com/osrg/gobgp Go github.com/osrg/gobgp/v3 |
one-api Cross-site Scripting vulnerability CVE-2025-3801, GHSA-wvcx-j62q-45qw, GO-2025-3636 | Medium | Not scored | 19 Apr, 2025 | Go github.com/songquanpeng/one-api |
Mattermost Incorrect Authorization vulnerability CVE-2025-2564, GHSA-mj2p-v2c2-vh4v, GO-2025-3623 | Medium | Not scored | 16 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
golang.org/x/net vulnerable to Cross-site Scripting CVE-2025-22872, GHSA-vvgc-356p-c3xw, GO-2025-3595 | Medium | Not scored | 16 Apr, 2025 | Go golang.org/x/net |
Mattermost vulnerable to Observable Timing Discrepancy CVE-2025-27936, GHSA-2j87-p623-8cc2, GO-2025-3618 | Medium | Not scored | 16 Apr, 2025 | Go github.com/mattermost/mattermost-plugin-msteams Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Mattermost Incorrect Authorization vulnerability CVE-2025-27571, GHSA-h4rr-f37j-4hh7, GO-2025-3619 | Medium | Not scored | 16 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm CVE-2025-2475, GHSA-6rqh-8465-2xcw, GO-2025-3610 | Medium | Not scored | 14 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
gorilla/csrf CSRF vulnerability due to broken Referer validation CVE-2025-24358, GHSA-rq77-p4h8-4crw, GO-2025-3607 | Medium | Not scored | 14 Apr, 2025 | Go github.com/gorilla/csrf |
Mattermost Fails to Restrict Certain Operations on System Admins CVE-2025-32093, GHSA-322v-vh2g-qvpv, GO-2025-3609 | Medium | Not scored | 14 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
CVE-2025-1386- Query smuggling in ch-go library CVE-2025-1386, GHSA-m454-3xv7-qj85, GO-2025-3603 | Medium | Not scored | 12 Apr, 2025 | Go github.com/ClickHouse/ch-go |
Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow BIT-helm-2025-32387, CVE-2025-32387, GHSA-5xqw-8hwv-wg92, GO-2025-3602 | Medium | Not scored | 10 Apr, 2025 | Go helm.sh/helm/v3 |
Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination BIT-helm-2025-32386, CVE-2025-32386, GHSA-4hfp-h4cw-hj8p, GO-2025-3601 | Medium | Not scored | 10 Apr, 2025 | Go helm.sh/helm/v3 |
bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing CVE-2025-32025, GHSA-fmhh-rw3h-785m, GO-2025-3599 | Medium | Not scored | 09 Apr, 2025 | Go github.com/bep/imagemeta |
bep/imagemeta allows excessively large EXIF data structures CVE-2025-32024, GHSA-q7rw-w4cq-2j6w, GO-2025-3598 | Medium | Not scored | 09 Apr, 2025 | Go github.com/bep/imagemeta |
Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration CVE-2025-31483, GHSA-cq88-842x-2jhp, GO-2025-3591 | Medium | Not scored | 04 Apr, 2025 | Go miniflux.app Go miniflux.app/v2 |
Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler CVE-2023-27592, GHSA-mqqg-xjhj-wfgw | Medium | Not scored | 02 Apr, 2025 | Go miniflux.app/v2 |
Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2025-2786, GHSA-28gr-56hr-prp6, GO-2026-4996 | Medium | Not scored | 02 Apr, 2025 | Go github.com/grafana/tempo-operator |
Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2025-2842, GHSA-5xf3-gmx4-529v, GO-2026-5161 | Medium | Not scored | 02 Apr, 2025 | Go github.com/grafana/tempo-operator |
Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times CVE-2025-31135, GHSA-c2c3-pqw5-5p7c, GO-2025-3588 | Medium | Not scored | 01 Apr, 2025 | Go github.com/phires/go-guerrilla |
go.rgst.io/stencil/v2 vulnerable to Path Traversal GHSA-p799-q2pr-6mxj, GO-2025-3584 | Medium | Not scored | 29 Mar, 2025 | Go go.rgst.io/stencil Go go.rgst.io/stencil/v2 |
github.com/jaredallard/archives Has Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2025-64346, GHSA-j95m-rcjp-q69h, GO-2025-3581 | Medium | Not scored | 28 Mar, 2025 | Go github.com/jaredallard/archives |
ingress-nginx controller - auth secret file path traversal vulnerability CVE-2025-24513, GHSA-242m-6h72-7hgp, GO-2025-3564 | Medium | Not scored | 25 Mar, 2025 | Go k8s.io/ingress-nginx |
Kyverno ignores subjectRegExp and IssuerRegExp BIT-kyverno-2025-29778, CVE-2025-29778, GHSA-46mp-8w32-6g94, GO-2025-3562 | Medium | Not scored | 24 Mar, 2025 | Go github.com/kyverno/kyverno |
Envoy crashes when HTTP ext_proc processes local replies BIT-envoy-2025-30157, CVE-2025-30157, GHSA-cf3q-gqg7-3fm9 | Medium | Not scored | 21 Mar, 2025 | Go github.com/envoyproxy/envoy |
Mattermost allows members with permission to convert public channels to private and convert private to public BIT-mattermost-2025-27933, CVE-2025-27933, GHSA-h5v9-xw2g-7hrq, GO-2025-3556 | Medium | Not scored | 21 Mar, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Fails to Enforce Certain Search APIs BIT-mattermost-2025-30179, CVE-2025-30179, GHSA-3gpx-p63p-pr5r, GO-2025-3549 | Medium | Not scored | 21 Mar, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels BIT-mattermost-2025-24920, CVE-2025-24920, GHSA-rp74-x43m-cpw3, GO-2025-3552 | Medium | Not scored | 21 Mar, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Fails to Restrict Command Execution in Archived Channels BIT-mattermost-2025-25274, CVE-2025-25274, GHSA-4v65-xqcj-wpgg, GO-2025-3550 | Medium | Not scored | 21 Mar, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` CVE-2025-29914, GHSA-q9f5-625g-xm39, GO-2025-3537 | Medium | Not scored | 20 Mar, 2025 | Go github.com/corazawaf/coraza Go github.com/corazawaf/coraza/v2 Go github.com/corazawaf/coraza/v3 Go github.com/jptosso/coraza-waf |
LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality CVE-2024-9900, GHSA-w6hh-w36c-vxmw, GO-2025-3542 | Medium | Not scored | 20 Mar, 2025 | Go github.com/mudler/LocalAI |
OpenShift Console Has a Path Traversal Vulnerability CVE-2024-7631, GHSA-69x5-hjg4-m267, GO-2025-3539 | Medium | Not scored | 19 Mar, 2025 | Go github.com/openshift/console |