Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
iskorotkov/avro: Denial-of-Service Vulnerability in Decoder GHSA-mx64-mj3q-7prj, GO-2026-5048 | High | Not scored | 18 May, 2026 | Go github.com/hamba/avro/v2 Go github.com/iskorotkov/avro/v2 |
Mattermost doesn't enforce slash command trigger-word uniqueness during command updates CVE-2026-28732, GHSA-wvcv-9xpm-7mqc, GO-2026-5726 | Medium | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't check if {{team_id}} was being changed when updating playbooks CVE-2026-4286, GHSA-gvg4-jhmr-6j23, GO-2026-5404 | Low | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-plugin-playbooks Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Mattermost doesn't verify channel membership when processing AI-assisted message rewrites CVE-2026-5163, GHSA-8r89-8w26-cq32, GO-2026-5263 | Medium | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't validate the Host header when constructing response URLs for custom slash command CVE-2026-6333, GHSA-vqp5-2mrp-qqxg, GO-2026-5671 | Low | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpoint CVE-2026-6339, GHSA-xvcx-mgpc-5xh3, GO-2026-5769 | Medium | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't check public/private permissions CVE-2026-6343, GHSA-m79q-8qf5-v622, GO-2026-5494 | Medium | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-plugin-playbooks Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Mattermost doesn't prevent disclosure of created user password CVE-2026-6345, GHSA-wvgv-4fc3-2rcp, GO-2026-5727 | Medium | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generation CVE-2026-6346, GHSA-9p64-jpc7-m2rp, GO-2026-5293 | High | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin CVE-2026-6347, GHSA-82j6-4fq7-fx62, GO-2026-5238 | High | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-plugin-calls Go github.com/mattermost/mattermost-server |
Mattermost doesn't limit the size of the request body on the start meeting API endpoint CVE-2026-2325, GHSA-m3p3-8frq-q7qh, GO-2026-5489 | Medium | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-plugin-msteams-meetings Go github.com/mattermost/mattermost-server |
Mattermost does not verify remote cluster channel access when processing shared channel membership removals CVE-2026-28759, GHSA-8h9w-w78c-vvr3, GO-2026-5256 | Medium | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't escape some variables that could contain malicious content during error page composition CVE-2026-3495, GHSA-jx93-pf6x-874r, GO-2026-5484 | Low | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't check the create_post channel permission during post edit operations CVE-2026-3637, GHSA-v549-xx3c-6pc8, GO-2026-5651 | Medium | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation CVE-2026-4273, GHSA-hqpj-f3jh-29vx, GO-2026-5432 | Low | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow CVE-2026-6334, GHSA-jp3f-x449-4q75, GO-2026-5474 | Low | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't validate 7zip archive structure before processing CVE-2026-6340, GHSA-cjm8-jxpw-g43m, GO-2026-5325 | Medium | Not scored | 18 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
AMF Vulnerable to Improper Resource Shutdown or Release CVE-2026-8783, GHSA-6v92-ph9p-hrpc, GO-2026-5190 | Low | Not scored | 18 May, 2026 | Go github.com/omec-project/amf |
AMF Improperly Restricts Operations within the Bounds of a Memory Buffer CVE-2026-8779, GHSA-fxvj-wqv2-xgcq, GO-2026-5386 | Low | Not scored | 18 May, 2026 | Go github.com/omec-project/amf |
AMF Improperly Restricts Operations within the Bounds of a Memory Buffer CVE-2026-8780, GHSA-3x4g-259h-5p7c, GO-2026-5104 | Low | Not scored | 18 May, 2026 | Go github.com/omec-project/amf |
AMF Vulnerable to Improper Resource Shutdown or Release CVE-2026-8781, GHSA-4qf2-p32m-7hmf, GO-2026-5130 | Low | Not scored | 18 May, 2026 | Go github.com/omec-project/amf |
AMF Vulnerable to Improper Resource Shutdown or Release CVE-2026-8782, GHSA-6h8r-h22r-jj64, GO-2026-5179 | Low | Not scored | 18 May, 2026 | Go github.com/omec-project/amf |
Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields CVE-2026-4053, GHSA-hw87-6jcq-9f8q, GO-2026-5442 | Low | Not scored | 15 May, 2026 | Go github.com/mattermost/mattermost-server |
Mattermost doesn't validate the response body of proxied images CVE-2026-4054, GHSA-j76w-p754-g2w7, GO-2026-5454 | Medium | Not scored | 15 May, 2026 | Go github.com/mattermost/mattermost-server |
arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS GHSA-rc6v-5rmx-w5mv, GO-2026-5614 | Medium | Not scored | 15 May, 2026 | Go github.com/arnika-project/arnika |
goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request GHSA-mxg3-432p-mr72, GO-2026-5519 | High | Not scored | 15 May, 2026 | Go goshs.de/goshs Go goshs.de/goshs/v2 |
FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files CVE-2026-45062, GHSA-3g8v-8r37-cgjm, GO-2026-5084 | High | Not scored | 15 May, 2026 | Go github.com/dunglas/frankenphp |
Crabbox: environment variable exposure vulnerability CVE-2026-8634, GHSA-fm77-94qm-4894, GO-2026-5369 | Critical | Not scored | 14 May, 2026 | Go github.com/openclaw/crabbox |
Crabbox: authentication bypass vulnerability that allows impersonation of others by spoofing identity headers CVE-2026-8621, GHSA-4g9m-rffv-h6wq, GO-2026-5120 | High | Not scored | 14 May, 2026 | Go github.com/openclaw/crabbox |
slack-go `SecretsVerifier` accepts empty signing secret without precondition GHSA-gxhx-2686-5h9g, GO-2026-5410 | Medium | Not scored | 14 May, 2026 | Go github.com/slack-go/slack |
Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin CVE-2026-18676, CVE-2026-45021, GHSA-3vcp-chfh-f6r2, GO-2026-5102 | Medium | Not scored | 14 May, 2026 | Go github.com/kumahq/kuma Go github.com/kumahq/kuma/v2 |
go-billy has path traversal vulnerabilities CVE-2026-44973, GHSA-qw64-3x98-g7q2, GO-2026-5597 | High | Not scored | 14 May, 2026 | Go github.com/go-git/go-billy/v5 Go github.com/go-git/go-billy/v6 |
Portainer missing authorization on custom template file endpoint, which exposes template content CVE-2026-44884, GHSA-cqpq-2fgr-8mvc, GO-2026-5333 | Medium | Not scored | 14 May, 2026 | Go github.com/portainer/portainer |
Portainer: JWT accepted in URL query leaks tokens to logs and referers CVE-2026-44883, GHSA-jvp4-q659-95mj, GO-2026-5480 | High | Not scored | 14 May, 2026 | Go github.com/portainer/portainer |
Portainer has an endpoint security bypass via Swarm service create/update CVE-2026-44849, GHSA-5fxq-qcf3-244w, GO-2026-5143 | Critical | Not scored | 14 May, 2026 | Go github.com/portainer/portainer |
Portainer's Kubernetes middleware continues after token validation failure, bypassing endpoint authorization CVE-2026-44882, GHSA-mgq6-4x29-88r3, GO-2026-5505 | High | Not scored | 14 May, 2026 | Go github.com/portainer/portainer |
Portainer Has an Arbitrary File Read via Git Symlink Injection in Stack Auto-Update CVE-2026-44881, GHSA-rpgq-m5fp-32wr, GO-2026-5633 | High | Not scored | 14 May, 2026 | Go github.com/portainer/portainer |
Portainer has a bind-mount restriction bypass via HostConfig.Mounts CVE-2026-44850, GHSA-7fw3-x4r2-g7wc, GO-2026-5217 | High | Not scored | 14 May, 2026 | Go github.com/portainer/portainer |
Portainer has a path traversal in backup archive extraction that allows arbitrary file write CVE-2026-44885, GHSA-m8fg-67j7-cx4v, GO-2026-5498 | Medium | Not scored | 14 May, 2026 | Go github.com/portainer/portainer |
Portainer missing authorization on Docker plugin endpoints, which allows host RCE CVE-2026-44848, GHSA-rrmm-9v76-h3p4, GO-2026-5639 | Critical | Not scored | 14 May, 2026 | Go github.com/portainer/portainer |
podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints CVE-2026-43644, GHSA-q23m-vm9r-5745, GO-2026-5560 | Medium | Not scored | 14 May, 2026 | Go github.com/stefanprodan/podinfo |
Fleet: IP spoofing allows bypassing API rate limiting CVE-2026-46356, GHSA-mxmp-wr3w-rvqx, GO-2026-5520 | Medium | Not scored | 14 May, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet vulnerable to OS command injection in software packages CVE-2026-26191, GHSA-9vcr-g537-3w5v, GO-2026-5301 | Medium | Not scored | 14 May, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet server may terminate unexpectedly when handling certain gRPC requests CVE-2026-26062, GHSA-x67p-9m2r-fxqv, GO-2026-5744 | High | Not scored | 14 May, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet Windows MDM Azure AD JWT Authentication Bypass CVE-2026-24899, GHSA-ffg9-j72f-j6xm, GO-2026-5358 | High | Not scored | 14 May, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet has a rate limiting bypass via untrusted client IP headers CVE-2026-24000, GHSA-j8h8-75h3-jg53, GO-2026-5455 | Medium | Not scored | 14 May, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet has a Windows MDM management endpoint authentication bypass CVE-2026-23998, GHSA-2rc4-7jc6-qffh, GO-2026-5002 | High | Not scored | 14 May, 2026 | Go github.com/fleetdm/fleet/v4 |
Grafana: SQL Expressions Read File From Disk BIT-grafana-2026-33380, CVE-2026-33380, GHSA-gxcp-jjxh-rwp4, GO-2026-5409 | Medium | Not scored | 13 May, 2026 | Go github.com/grafana/grafana |
Grafana: Users can generate Service Account tokens after permissions removal BIT-grafana-2026-33381, CVE-2026-33381, GHSA-wfhv-mj62-f5xh, GO-2026-5708 | Medium | Not scored | 13 May, 2026 | Go github.com/grafana/grafana |
SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution CVE-2026-45375, GHSA-27qc-m5gf-jv5r, GO-2026-5001 | Critical | Not scored | 13 May, 2026 | Go github.com/siyuan-note/siyuan/kernel |