Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs CVE-2026-45371, GHSA-gmmv-4cc5-wr9r, GO-2026-5402 | High | Not scored | 13 May, 2026 | Go github.com/siyuan-note/siyuan/kernel |
uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution CVE-2026-45152, GHSA-qqq4-5773-pmw5, GO-2026-5590 | High | Not scored | 13 May, 2026 | Go gitlab.com/uniget-org/cli |
SiYuan has broken access control in `/api/search/{searchAsset,searchTag,searchWidget,searchTemplate}` publish-mode CVE-2026-45148, GHSA-fmh9-gpqh-g53g, GO-2026-5370 | Medium | Not scored | 13 May, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan: Broken access control in `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk CVE-2026-45147, GHSA-6r88-8v7q-q4p2, GO-2026-5188 | Medium | Not scored | 13 May, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server CVE-2026-101084, GHSA-vw82-7fv8-r6gp, GO-2026-5678 | Critical | Not scored | 13 May, 2026 | Go github.com/obot-platform/obot |
Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false CVE-2026-44774, GHSA-96qj-4jj5-wcjc, GO-2026-5277 | Medium | Not scored | 13 May, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion CVE-2026-44740, GHSA-m3xc-h892-ggx6, GO-2026-5490 | Medium | Not scored | 13 May, 2026 | Go github.com/go-git/go-billy/v5 Go github.com/go-git/go-billy/v6 |
Malicious release: Malicious code in github.com/BufferZoneCorp/config-loader (Go) MAL-2026-3620 | Malicious | Not scored | 13 May, 2026 | Go github.com/BufferZoneCorp/config-loader |
Malicious release: Malicious code in github.com/BufferZoneCorp/go-envconfig (Go) MAL-2026-3621 | Malicious | Not scored | 13 May, 2026 | Go github.com/BufferZoneCorp/go-envconfig |
Malicious release: Malicious code in github.com/BufferZoneCorp/go-metrics-sdk (Go) MAL-2026-3622 | Malicious | Not scored | 13 May, 2026 | Go github.com/BufferZoneCorp/go-metrics-sdk |
Malicious release: Malicious code in github.com/BufferZoneCorp/go-retryablehttp (Go) MAL-2026-3623 | Malicious | Not scored | 13 May, 2026 | Go github.com/BufferZoneCorp/go-retryablehttp |
Malicious release: Malicious code in github.com/BufferZoneCorp/go-stdlib-ext (Go) MAL-2026-3624 | Malicious | Not scored | 13 May, 2026 | Go github.com/BufferZoneCorp/go-stdlib-ext |
Malicious release: Malicious code in github.com/BufferZoneCorp/go-stdlog (Go) MAL-2026-3625 | Malicious | Not scored | 13 May, 2026 | Go github.com/BufferZoneCorp/go-stdlog |
Malicious release: Malicious code in github.com/BufferZoneCorp/go-weather-sdk (Go) MAL-2026-3626 | Malicious | Not scored | 13 May, 2026 | Go github.com/BufferZoneCorp/go-weather-sdk |
Malicious release: Malicious code in github.com/BufferZoneCorp/grpc-client (Go) MAL-2026-3627 | Malicious | Not scored | 13 May, 2026 | Go github.com/BufferZoneCorp/grpc-client |
Malicious release: Malicious code in github.com/BufferZoneCorp/log-core (Go) MAL-2026-3628 | Malicious | Not scored | 13 May, 2026 | Go github.com/BufferZoneCorp/log-core |
Malicious release: Malicious code in github.com/BufferZoneCorp/net-helper (Go) MAL-2026-3629 | Malicious | Not scored | 13 May, 2026 | Go github.com/BufferZoneCorp/net-helper |
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload CVE-2026-44697, GHSA-87m7-qffr-542v, GO-2026-5246 | High | Not scored | 13 May, 2026 | Go github.com/klever-io/klever-go |
esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files CVE-2026-44594, GHSA-rg65-45m7-hq57, GO-2026-5620 | High | Not scored | 12 May, 2026 | Go github.com/esm-dev/esm.sh |
esm.sh: Legacy Route Path Traversal Can Lead to RCE CVE-2026-44593, GHSA-3636-h3vx-6465, GO-2026-5071 | High | Not scored | 12 May, 2026 | Go github.com/esm-dev/esm.sh |
HashiCorp Nomad vulnerable to symlink attack CVE-2026-6959, GHSA-3934-423w-4jq3, GO-2026-5076 | Medium | Not scored | 12 May, 2026 | Go github.com/hashicorp/nomad |
HashiCorp Nomad vulnerable to a path traversal CVE-2026-7474, GHSA-hx53-77qj-8663, GO-2026-5445 | High | Not scored | 12 May, 2026 | Go github.com/hashicorp/nomad |
HashiCorp Nomad’s exec2 task driver vulnerable to a symlink attack CVE-2026-8052, GHSA-wqwc-x3rc-2xw6, GO-2026-5718 | Medium | Not scored | 12 May, 2026 | Go github.com/hashicorp/nomad-driver-exec2 |
Dalfox has an Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode) CVE-2026-45090, GHSA-2g4x-fq3j-cgq4, GO-2026-4999 | High | Not scored | 12 May, 2026 | Go github.com/hahwul/dalfox Go github.com/hahwul/dalfox/v2 |
Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option CVE-2026-45089, GHSA-8hf9-3q64-q2qf, GO-2026-5257 | High | Not scored | 12 May, 2026 | Go github.com/hahwul/dalfox Go github.com/hahwul/dalfox/v2 |
Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` CVE-2026-45088, GHSA-35wr-x7v6-9fv2, GO-2026-5070 | High | Not scored | 12 May, 2026 | Go github.com/hahwul/dalfox Go github.com/hahwul/dalfox/v2 |
Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action` CVE-2026-45087, GHSA-v25v-m36w-jp4h, GO-2026-5649 | Critical | Not scored | 12 May, 2026 | Go github.com/hahwul/dalfox Go github.com/hahwul/dalfox/v2 |
omec-project amf crashes when processing malformed LocationReports CVE-2026-8349, GHSA-3h63-fx68-x5fm, GO-2026-5087 | Low | Not scored | 12 May, 2026 | Go github.com/omec-project/amf |
Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution CVE-2026-45224, GHSA-3cjv-h753-qf7h, GO-2026-5079 | Medium | Not scored | 11 May, 2026 | Go github.com/openclaw/crabbox |
Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content CVE-2026-45046, GHSA-f3jg-756w-gm35, GO-2026-5345 | Medium | Not scored | 11 May, 2026 | Go github.com/safedep/gryph |
Casdoor: Arbitrary file write possible through Local File System storage provider CVE-2026-6815, GHSA-rmxx-v9rj-vpvg, GO-2026-5945 | Medium | Not scored | 11 May, 2026 | Go github.com/casdoor/casdoor |
Bird-lg-go has a Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding CVE-2026-45047, GHSA-39qr-rc93-vhqm, GO-2026-5077 | High | Not scored | 11 May, 2026 | Go github.com/xddxdd/bird-lg-go |
Local Path Provisioner Vulnerable to HelperPod Template Injection CVE-2026-44543, GHSA-7fxv-8wr2-mfc4, GO-2026-5218 | High | Not scored | 11 May, 2026 | Go github.com/rancher/local-path-provisioner |
CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE CVE-2026-44477, GHSA-423p-g724-fr39, GO-2026-5106 | Critical | Not scored | 11 May, 2026 | Go github.com/cloudnative-pg/cloudnative-pg |
Ella Core has handover failures during concurrent Security Mode Command CVE-2026-44474, GHSA-mc29-hmx6-856q, GO-2026-5502 | Low | Not scored | 11 May, 2026 | Go github.com/ellanetworks/core |
Ella Core has a UE Security Capability bypass on NGAP PathSwitchRequest CVE-2026-44475, GHSA-pwfh-mqp3-pqwj, GO-2026-5554 | Medium | Not scored | 11 May, 2026 | Go github.com/ellanetworks/core |
Ella Core Vulnerable to UE Downlink Redirection via Forged PDUSessionResourceSetupResponse CVE-2026-44473, GHSA-qfxw-v8qx-vj3v, GO-2026-5581 | High | Not scored | 11 May, 2026 | Go github.com/ellanetworks/core |
go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git CVE-2026-45022, GHSA-389r-gv7p-r3rp, GO-2026-5074 | High | Not scored | 11 May, 2026 | Go github.com/go-git/go-git/v5 Go github.com/go-git/go-git/v6 |
Dozzle's Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpointsbypasses authentication CVE-2026-44985, GHSA-j643-x8pv-8m67, GO-2026-5449 | High | Not scored | 11 May, 2026 | Go github.com/amir20/dozzle |
Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass CVE-2026-42595, GHSA-chwh-f6gm-r836, GO-2026-5324 | High | Not scored | 11 May, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
bettercap Has an Integer Coercion Error in the ippReadChunkedBody Function CVE-2026-8275, GHSA-322p-rrj6-j44g, GO-2026-5003 | Low | Not scored | 11 May, 2026 | Go github.com/bettercap/bettercap Go github.com/bettercap/bettercap/v2 |
bettercap Has an Integer Coercion Error in modules/mysql_server/mysql_server.go CVE-2026-8276, GHSA-jcqv-2g3v-gm88, GO-2026-5463 | Low | Not scored | 11 May, 2026 | Go github.com/bettercap/bettercap/v2 |
free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions CVE-2026-44330, GHSA-rwww-x45w-p52w, GO-2026-5642 | Critical | Not scored | 08 May, 2026 | Go github.com/free5gc/nef |
free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers CVE-2026-44329, GHSA-3258-qmv8-frp3, GO-2026-4995 | Critical | Not scored | 08 May, 2026 | Go github.com/free5gc/smf |
free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating CVE-2026-44328, GHSA-p9mg-74mg-cwwr, GO-2026-5537 | High | Not scored | 08 May, 2026 | Go github.com/free5gc/smf |
free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler CVE-2026-44327, GHSA-cmpj-2x3g-m7g3, GO-2026-5326 | Critical | Not scored | 08 May, 2026 | Go github.com/free5gc/nef |
free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions CVE-2026-44326, GHSA-3p28-73q7-45xp, GO-2026-5093 | Critical | Not scored | 08 May, 2026 | Go github.com/free5gc/nef |
free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types CVE-2026-44325, GHSA-f8qv-7x5w-qr48, GO-2026-5349 | High | Not scored | 08 May, 2026 | Go github.com/free5gc/nrf |
free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request) CVE-2026-44324, GHSA-jqfc-gwj5-3w63, GO-2026-5478 | Medium | Not scored | 08 May, 2026 | Go github.com/free5gc/udr |
free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference) CVE-2026-44323, GHSA-4rqf-grm6-vf75, GO-2026-5131 | Medium | Not scored | 08 May, 2026 | Go github.com/free5gc/udr |