Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenBao's Namespace Deletion May Not Delete Data Properly BIT-openbao-2026-42186, CVE-2026-42186, GHSA-vv66-6rp4-wr4f, GO-2026-5674 | Low | 0.2% | 05 May, 2026 | Go github.com/openbao/openbao |
Prometheus: Remote read endpoint allows denial of service via crafted snappy payload BIT-prometheus-2026-42154, CVE-2026-42154, GHSA-8rm2-7qqf-34qm, GO-2026-5264 | High | 0.8% | 05 May, 2026 | Go github.com/prometheus/prometheus Go github.com/prometheus/prometheus/v2 |
Prometheus Azure AD remote write OAuth client secret exposed via config API BIT-prometheus-2026-42151, CVE-2026-42151, GHSA-wg65-39gg-5wfj, GO-2026-5710 | High | 0.4% | 05 May, 2026 | Go github.com/prometheus/prometheus |
S3-Proxy has Security Issues in its Resource Path Matching Implementation CVE-2026-42882, GHSA-rfgq-wgg8-662p, GO-2026-5616 | Critical | 0.6% | 05 May, 2026 | Go github.com/oxyno-zeta/s3-proxy |
External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore CVE-2026-42875, GHSA-wv26-88m5-6h59, GO-2026-5723 | Medium | 0.2% | 05 May, 2026 | Go github.com/external-secrets/external-secrets |
ots has a negative expire override that can bypass its secret retention policy GHSA-h5fq-653g-gxrm, GO-2026-5413 | Medium | Not scored | 05 May, 2026 | Go github.com/Luzifer/ots |
nuts-node has JWT type confusion in v1 access token introspection that allows VP replay as access token CVE-2026-41164, GHSA-9hmg-827w-9rhj, GO-2026-5291 | Medium | 0.1% | 05 May, 2026 | Go github.com/nuts-foundation/nuts-node |
Hashicorp Boundary workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes CVE-2026-7776, GHSA-7x9r-wcgg-w86f, GO-2026-5237 | High | 0.2% | 05 May, 2026 | Go github.com/hashicorp/boundary |
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) CVE-2026-42575, GHSA-hcwr-pq9g-rq3m, GO-2026-5422 | High | 0.2% | 04 May, 2026 | Go chainguard.dev/apko |
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root CVE-2026-42574, GHSA-qq3r-w4hj-gjp6, GO-2026-5589 | High | 0.4% | 04 May, 2026 | Go chainguard.dev/apko |
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery CVE-2026-42576, GHSA-m7hm-vm4x-28jf, GO-2026-5497 | Medium | 0.3% | 04 May, 2026 | Go chainguard.dev/apko |
Pelican Web UI Affected by a Privilege Escalation Attack CVE-2026-42571, GHSA-rpfr-x88x-xwcw, GO-2026-5632 | Critical | 0.3% | 04 May, 2026 | Go github.com/pelicanplatform/pelican |
Distribution's tag deletion bypasses `storage.delete.enabled` configuration BIT-distribution-2026-41888, CVE-2026-41888, GHSA-6pjf-3r9x-m592, GO-2026-5185 | Medium | 0.3% | 04 May, 2026 | Go github.com/distribution/distribution Go github.com/distribution/distribution/v3 |
Argo vulnerable to exposure of artifact repository credentials BIT-argo-workflows-2026-42295, CVE-2026-42295, GHSA-7vf8-2cr6-54mf, GO-2026-5235 | High | 0.4% | 04 May, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 Go github.com/argoproj/argo-workflows/v4 |
Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure BIT-argo-workflows-2026-42296, CVE-2026-42296, GHSA-3775-99mw-8rp4, GO-2026-5072 | High | 0.4% | 04 May, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 Go github.com/argoproj/argo-workflows/v4 |
Argo Vulnerable to Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor BIT-argo-workflows-2026-42294, CVE-2026-42294, GHSA-jcc8-g2q4-9fxq, GO-2026-5462 | High | 0.6% | 04 May, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 Go github.com/argoproj/argo-workflows/v4 |
Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) BIT-argo-workflows-2026-42183, CVE-2026-42183, GHSA-p4gq-3vxj-f4jq, GO-2026-5527 | Low | 0.4% | 04 May, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 Go github.com/argoproj/argo-workflows/v4 |
Argo has Missing Authorization in its Sync ConfigMap Provider BIT-argo-workflows-2026-42297, CVE-2026-42297, GHSA-xchc-cqwg-g76q, GO-2026-5751 | High | 0.5% | 04 May, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 Go github.com/argoproj/argo-workflows/v4 |
Incus is affected by unbounded binary import disk exhaustion CVE-2026-41685, GHSA-98vh-x9cx-9cfp, GO-2026-5280 | Medium | 0.3% | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd |
Incus has Nil Dereferences on Restore via Malformed YAML CVE-2026-41684, GHSA-x5r6-jr56-89pv, GO-2026-5742 | Medium | 0.4% | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd |
Incus has Unbounded YAML Metadata Decode via Parsing CVE-2026-41648, GHSA-67wx-r9xr-x75x, GO-2026-5168 | Medium | 0.3% | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd |
Incus has Nil-Pointer Dereference via S3 Bucket Import CVE-2026-41647, GHSA-fwj8-62r8-8p8m, GO-2026-5384 | Medium | 0.4% | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd |
Kata Container has CopyFile Policy Subversion via Symlinks CVE-2026-41326, GHSA-q49m-57vm-c8cc, GO-2026-5563 | High | 0.3% | 04 May, 2026 | Go github.com/kata-containers/kata-containers |
Traefik's errors middleware forwards Authorization and Cookie headers to separate error page service CVE-2026-41181, GHSA-p6hg-qh38-555r, GO-2026-5532 | Medium | 0.4% | 04 May, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Gotenberg has an ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names that Allows Arbitrary File Rename and Move CVE-2026-40893, GHSA-62p3-hvxx-fxg4, GO-2026-5162 | High | 0.3% | 04 May, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
Incus Vulnerable to Panic via Snapshot Bounds Check CVE-2026-40251, GHSA-4m88-wxj4-9qj6, GO-2026-5127 | High | 0.4% | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd Go github.com/lxc/incus/v7 |
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots CVE-2026-40243, GHSA-c839-4qxr-j4x3, GO-2026-5319 | Low | 0.2% | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd Go github.com/lxc/incus/v7 |
GoBGP has an out-of-bounds read in the ParseIP6Extended function CVE-2026-37461, GHSA-wmvj-f67g-qg4g, GO-2026-5713 | High | 0.3% | 04 May, 2026 | Go github.com/osrg/gobgp/v4 |
Incus has a Nil-Pointer Dereference via Custom Volume Import CVE-2026-40197, GHSA-r7w7-mmxr-47r9, GO-2026-5612 | High | 0.4% | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd Go github.com/lxc/incus/v7 |
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata CVE-2026-40195, GHSA-gc7j-g665-rxr9, GO-2026-5397 | High | 0.4% | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd Go github.com/lxc/incus/v7 |
Incus has Blind SSRF via Image Import Preflight HEAD CVE-2026-35527, GHSA-8gw4-p4wq-4hcv, GO-2026-5254 | Medium | 0.3% | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd Go github.com/lxc/incus/v7 |
Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader CVE-2026-7482, GHSA-x8qc-fggm-mpqg, GO-2026-5748 | High | 2.2% | 04 May, 2026 | Go github.com/ollama/ollama |
GoBGP has an Integer Underflow Issue CVE-2026-7736, GHSA-hj4w-qr9j-c4cf, GO-2026-5427 | Medium | 0.5% | 04 May, 2026 | Go github.com/osrg/gobgp/v4 |
GoBGP has Improper Restriction of Operations within the Bounds of a Memory Buffer CVE-2026-7737, GHSA-w88c-9vg8-cmq8, GO-2026-5699 | Medium | 0.6% | 04 May, 2026 | Go github.com/osrg/gobgp Go github.com/osrg/gobgp/v4 |
GoBGP has an Improper Resource Shutdown or Release CVE-2026-7734, GHSA-vm3g-8xwv-mxfp, GO-2026-5665 | Medium | 0.5% | 04 May, 2026 | Go github.com/osrg/gobgp/v4 |
Contras Affected by CopyFile Policy Subversion via Symlinks CVE-2026-100838, GHSA-rh99-wc69-c255, GO-2026-5624 | High | 0.2% | 30 Apr, 2026 | Go github.com/edgelesssys/contrast |
Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets) CVE-2026-42461, GHSA-cxx3-hr75-4q96, GO-2026-5340 | High | 1.3% | 30 Apr, 2026 | Go github.com/getarcaneapp/arcane/backend |
auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation CVE-2026-42560, GHSA-f6qq-3m3h-4g42, GO-2026-5348 | Critical | 0.4% | 30 Apr, 2026 | Go github.com/go-pkgz/auth Go github.com/go-pkgz/auth/v2 |
ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction GHSA-28xx-pppm-vqff, GO-2026-4983 | Low | Not scored | 30 Apr, 2026 | Go github.com/ydb-platform/ydb-go-sdk/v3 |
Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix) CVE-2026-40281, GHSA-q7r4-hc83-hf2q, GO-2026-5572 | Critical | 2.3% | 30 Apr, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL CVE-2026-39383, GHSA-5vh4-rgv7-p9g4, GO-2026-5155 | Medium | 0.2% | 30 Apr, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection CVE-2026-40280, GHSA-5q7p-7jgv-ww56, GO-2026-5151 | High | 1.9% | 30 Apr, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
netfoil's optional seccomp sandboxing was not applied GHSA-vjgj-42f6-7997, GO-2026-5664 | Medium | Not scored | 29 Apr, 2026 | Go github.com/tinfoil-factory/netfoil |
Netfoil has incorrect allowlist enforcement GHSA-84g5-x8j3-7235, GO-2026-5240 | Medium | Not scored | 29 Apr, 2026 | Go github.com/tinfoil-factory/netfoil |
Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services CVE-2026-44015, GHSA-wr32-99hh-6f35, GO-2026-5719 | High | 0.3% | 29 Apr, 2026 | Go github.com/0xJacky/Nginx-UI |
GoBGP has Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE CVE-2026-41643, GHSA-8rxh-r2p6-7f2q, GO-2026-5266 | High | 0.5% | 29 Apr, 2026 | Go github.com/osrg/gobgp/v4 |
GoBGP has Remote Denial of Service (Panic) via Malformed Well-known Path Attribute CVE-2026-41642, GHSA-7235-89m6-f4px, GO-2026-5198 | High | 0.5% | 29 Apr, 2026 | Go github.com/osrg/gobgp/v4 |
Elastic Package Registry has Improper Verification of Cryptographic Signature CVE-2026-33467, GHSA-r727-5pf6-47r2, GO-2026-5611 | Medium | 0.1% | 29 Apr, 2026 | Go github.com/elastic/package-registry |
CoreDNS has TSIG authentication bypass on gRPC and QUIC transports CVE-2026-35579, GHSA-vp29-5652-4fw9, GO-2026-5667 | High | 0.6% | 28 Apr, 2026 | Go github.com/coredns/coredns |
CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC CVE-2026-33190, GHSA-qhmp-q7xh-99rh, GO-2026-5583 | High | 0.4% | 28 Apr, 2026 | Go github.com/coredns/coredns |