Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference CVE-2026-44322, GHSA-j59f-x285-69jx, GO-2026-5447 | High | Not scored | 08 May, 2026 | Go github.com/free5gc/nef |
free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf) CVE-2026-44321, GHSA-44qj-cghf-9p97, GO-2026-5109 | High | Not scored | 08 May, 2026 | Go github.com/free5gc/smf |
free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path CVE-2026-44320, GHSA-wqfh-gq79-j8mf, GO-2026-5717 | High | Not scored | 08 May, 2026 | Go github.com/free5gc/nef |
free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri) CVE-2026-44319, GHSA-rxrq-fv76-26pr, GO-2026-5647 | High | Not scored | 08 May, 2026 | Go github.com/free5gc/nef |
free5GC's BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions CVE-2026-44318, GHSA-27ph-8q4f-h7m7, GO-2026-4994 | Medium | Not scored | 08 May, 2026 | Go github.com/free5gc/bsf |
free5GC's PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference CVE-2026-44317, GHSA-wwqh-7jm5-gj7w, GO-2026-5731 | Medium | Not scored | 08 May, 2026 | Go github.com/free5gc/pcf |
free5GC's PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference CVE-2026-44316, GHSA-wr8j-6chw-gm6p, GO-2026-5720 | High | Not scored | 08 May, 2026 | Go github.com/free5gc/pcf |
free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions CVE-2026-44315, GHSA-5f62-53r8-qrqf, GO-2026-5142 | Critical | Not scored | 08 May, 2026 | Go github.com/free5gc/nef |
gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits CVE-2026-44309, GHSA-7rmh-48mx-2vwc, GO-2026-5233 | Medium | Not scored | 08 May, 2026 | Go github.com/sigstore/gitsign |
in-toto-golang and in-toto-python have inconsistent negation behavior GHSA-pmwq-pjrm-6p5r, GO-2026-5547 | Medium | Not scored | 08 May, 2026 | Go github.com/in-toto/in-toto-golang |
Volcano's webhook server vulnerable to OOM due to unbounded HTTP request body size CVE-2026-44247, GHSA-8wxp-xxp2-rcgx, GO-2026-5269 | Medium | Not scored | 08 May, 2026 | Go volcano.sh/volcano |
SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585) CVE-2026-44588, GHSA-25rp-h46x-2hjm, GO-2026-4993 | Critical | Not scored | 08 May, 2026 | Go github.com/siyuan-note/siyuan/kernel |
nhost has Session Persistence After Password Change GHSA-7hgr-xvrr-xpw3, GO-2026-5222 | Low | Not scored | 08 May, 2026 | Go github.com/nhost/nhost |
gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers CVE-2026-44310, GHSA-7c37-gx6w-8vc5, GO-2026-5212 | Medium | Not scored | 08 May, 2026 | Go github.com/sigstore/gitsign |
ExternalSecrets vulnerable to privilege escalation with secret overwriting CVE-2026-42876, GHSA-fq7h-9x26-6j22, GO-2026-5377 | Medium | Not scored | 08 May, 2026 | Go github.com/external-secrets/external-secrets/apis |
MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist CVE-2026-44430, GHSA-r48c-v28r-pf6v, GO-2026-5607 | Medium | Not scored | 08 May, 2026 | Go github.com/modelcontextprotocol/registry |
MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` CVE-2026-44429, GHSA-rqv2-m695-f8j4, GO-2026-5637 | Medium | Not scored | 08 May, 2026 | Go github.com/modelcontextprotocol/registry |
ZITADEL has LDAP Filter Injection in Login Flow CVE-2026-44671, GHSA-rxvx-hhpj-q6px, GO-2026-5648 | High | Not scored | 08 May, 2026 | Go github.com/zitadel/zitadel |
MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience CVE-2026-44428, GHSA-95c3-6vvw-4mrq, GO-2026-5273 | Low | Not scored | 08 May, 2026 | Go github.com/modelcontextprotocol/registry |
MCP Registry has open redirect via protocol-relative path in trailing-slash middleware CVE-2026-44427, GHSA-v8vw-gw5j-w7m6, GO-2026-5658 | Medium | Not scored | 08 May, 2026 | Go github.com/modelcontextprotocol/registry |
SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE CVE-2026-44670, GHSA-2h64-c999-c9r6, GO-2026-4992 | Critical | Not scored | 08 May, 2026 | Go github.com/siyuan-note/siyuan/kernel |
ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI CVE-2026-79664, GHSA-fpw6-hrg5-q5x5, GO-2026-5375 | High | Not scored | 07 May, 2026 | Go github.com/lin-snow/ech0 |
Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft CVE-2026-79662, GHSA-p64j-f4x9-wq66, GO-2026-5531 | High | Not scored | 07 May, 2026 | Go github.com/lin-snow/Ech0 Go github.com/lin-snow/ech0 |
Ech0 has Server-Side Request Forgery (SSRF) via Connect Handler fetchPeerConnectInfo CVE-2026-79659, GHSA-8mc6-xjpr-h98x, GO-2026-5259 | High | Not scored | 07 May, 2026 | Go github.com/lin-snow/ech0 |
Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count CVE-2026-79661, GHSA-pj6q-4vq4-r8cg, GO-2026-5541 | Medium | Not scored | 07 May, 2026 | Go github.com/lin-snow/Ech0 Go github.com/lin-snow/ech0 |
Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation CVE-2026-79668, GHSA-rgj7-vg8v-j4wr, GO-2026-5623 | Medium | Not scored | 07 May, 2026 | Go github.com/lin-snow/ech0 |
Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers CVE-2026-79663, GHSA-3v85-fqvh-7rxf, GO-2026-5100 | Medium | Not scored | 07 May, 2026 | Go github.com/lin-snow/Ech0 Go github.com/lin-snow/ech0 |
Ech0 comment model's Email field returned on public /api/comments endpoints CVE-2026-79660, GHSA-rj4g-rqgh-rx9h, GO-2026-5626 | Medium | Not scored | 07 May, 2026 | Go github.com/lin-snow/Ech0 Go github.com/lin-snow/ech0 |
Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery CVE-2026-44523, GHSA-q6mh-rqwh-g786, GO-2026-5567 | Critical | Not scored | 07 May, 2026 | Go github.com/enchant97/note-mark/backend |
Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution CVE-2026-44522, GHSA-g49p-4qxj-88v3, GO-2026-5389 | High | Not scored | 07 May, 2026 | Go github.com/enchant97/note-mark/backend |
Crash when handling long CNAME response in net BIT-golang-2026-33811, CVE-2026-33811, GO-2026-4981 | Not scored | 07 May, 2026 | Go stdlib | |
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net BIT-golang-2026-33814, CVE-2026-33814, GO-2026-4918 | Not scored | 07 May, 2026 | Go golang.org/x/net Go stdlib | |
Invoking "go tool pack" does not sanitize output paths in cmd/go BIT-golang-2026-39817, CVE-2026-39817, GO-2026-4979 | Not scored | 07 May, 2026 | Go toolchain | |
Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go BIT-golang-2026-39819, CVE-2026-39819, GO-2026-4978 | Not scored | 07 May, 2026 | Go toolchain | |
Quadratic string concatentation in consumeComment in net/mail BIT-golang-2026-39820, CVE-2026-39820, GO-2026-4986 | Not scored | 07 May, 2026 | Go stdlib | |
Bypass of meta content URL escaping causes XSS in html/template BIT-golang-2026-39823, CVE-2026-39823, GO-2026-4982 | Not scored | 07 May, 2026 | Go stdlib | |
ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil BIT-golang-2026-39825, CVE-2026-39825, GO-2026-4976 | Not scored | 07 May, 2026 | Go stdlib | |
Escaper bypass leads to XSS in html/template BIT-golang-2026-39826, CVE-2026-39826, GO-2026-4980 | Not scored | 07 May, 2026 | Go stdlib | |
Panic in Dial and LookupPort when handling NUL byte on Windows in net BIT-golang-2026-39836, CVE-2026-39836, GO-2026-4971 | Not scored | 07 May, 2026 | Go stdlib | |
Quadratic string concatenation in consumePhrase in net/mail BIT-golang-2026-42499, CVE-2026-42499, GO-2026-4977 | Not scored | 07 May, 2026 | Go stdlib | |
Malicious module proxy can bypass checksum database in cmd/go BIT-golang-2026-42501, CVE-2026-42501, GO-2026-4984 | Not scored | 07 May, 2026 | Go toolchain | |
gittuf's policy can be rolled back to prior valid versions CVE-2026-44544, GHSA-vxvc-cg7j-rwqj, GO-2026-5683 | Medium | Not scored | 07 May, 2026 | Go github.com/gittuf/gittuf |
FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header) GHSA-mmpx-jh39-wrv6, GO-2026-5511 | Medium | Not scored | 07 May, 2026 | Go github.com/gtsteffaniak/filebrowser |
FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion CVE-2026-44542, GHSA-fwj3-42wh-8673, GO-2026-5383 | Critical | Not scored | 07 May, 2026 | Go github.com/gtsteffaniak/filebrowser |
etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests BIT-etcd-2026-44283, CVE-2026-44283, GHSA-x35m-3gp4-4fh5, GO-2026-5736 | Low | Not scored | 07 May, 2026 | Go go.etcd.io/etcd Go go.etcd.io/etcd/server/v3 Go go.etcd.io/etcd/v3 |
ShellHub has cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check CVE-2026-44426, GHSA-vwx9-7qcf-gg7f, GO-2026-5680 | Medium | Not scored | 07 May, 2026 | Go github.com/shellhub-io/shellhub |
Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change GHSA-258c-965c-p3hc, GO-2026-4991 | Medium | Not scored | 07 May, 2026 | Go github.com/daptin/daptin |
Talos Linux has a local privilege escalation from untrusted workloads GHSA-m38g-vww2-mvgx | High | Not scored | 07 May, 2026 | Go github.com/siderolabs/talos |
Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users CVE-2026-44514, GHSA-v8j7-hp7c-738f, GO-2026-5656 | Medium | Not scored | 07 May, 2026 | Go github.com/kubetail-org/kubetail/modules/cli Go github.com/kubetail-org/kubetail/modules/dashboard |
Free5GC UDM has Improper Input Validation and Generation of Error Messages Containing Sensitive Information CVE-2026-42459, GHSA-585v-hcgf-jhfr, GO-2026-5138 | High | Not scored | 07 May, 2026 | Go github.com/free5gc/udm |