Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
bettercap Has an Integer Coercion Error in the ippReadChunkedBody Function CVE-2026-8275, GHSA-322p-rrj6-j44g, GO-2026-5003 | Low | Not scored | 11 May, 2026 | Go github.com/bettercap/bettercap Go github.com/bettercap/bettercap/v2 |
bettercap Has an Integer Coercion Error in modules/mysql_server/mysql_server.go CVE-2026-8276, GHSA-jcqv-2g3v-gm88, GO-2026-5463 | Low | Not scored | 11 May, 2026 | Go github.com/bettercap/bettercap/v2 |
nhost has Session Persistence After Password Change GHSA-7hgr-xvrr-xpw3, GO-2026-5222 | Low | Not scored | 08 May, 2026 | Go github.com/nhost/nhost |
MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience CVE-2026-44428, GHSA-95c3-6vvw-4mrq, GO-2026-5273 | Low | Not scored | 08 May, 2026 | Go github.com/modelcontextprotocol/registry |
etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests BIT-etcd-2026-44283, CVE-2026-44283, GHSA-x35m-3gp4-4fh5, GO-2026-5736 | Low | Not scored | 07 May, 2026 | Go go.etcd.io/etcd Go go.etcd.io/etcd/server/v3 Go go.etcd.io/etcd/v3 |
Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover CVE-2026-42082, GHSA-vrrx-58h3-prmh, GO-2026-5673 | Low | Not scored | 07 May, 2026 | Go github.com/free5gc/amf |
MediaMTX affected by CVE-2026-27143 due to vulnerable dependency GHSA-2ccx-cjjh-r2j8, GO-2026-4989 | Low | Not scored | 06 May, 2026 | Go github.com/bluenviron/mediamtx |
OpenBao's Namespace Deletion May Not Delete Data Properly BIT-openbao-2026-42186, CVE-2026-42186, GHSA-vv66-6rp4-wr4f, GO-2026-5674 | Low | Not scored | 05 May, 2026 | Go github.com/openbao/openbao |
Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) BIT-argo-workflows-2026-42183, CVE-2026-42183, GHSA-p4gq-3vxj-f4jq, GO-2026-5527 | Low | Not scored | 04 May, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 Go github.com/argoproj/argo-workflows/v4 |
Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots CVE-2026-40243, GHSA-c839-4qxr-j4x3, GO-2026-5319 | Low | Not scored | 04 May, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd Go github.com/lxc/incus/v7 |
ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction GHSA-28xx-pppm-vqff, GO-2026-4983 | Low | Not scored | 30 Apr, 2026 | Go github.com/ydb-platform/ydb-go-sdk/v3 |
Ollama is Vulnerable to Path Traversal CVE-2026-7020, GHSA-x99g-8v8j-25j2, GO-2026-5750 | Low | Not scored | 26 Apr, 2026 | Go github.com/ollama/ollama |
melange has Path Traversal via .PKGINFO in --persist-lint-results CVE-2026-29051, GHSA-q2pw-xx38-p64j, GO-2026-5562 | Low | Not scored | 23 Apr, 2026 | Go chainguard.dev/melange |
pgx: SQL Injection via placeholder confusion with dollar quoted string literals CVE-2026-41889, GHSA-j88v-2chj-qfwx, GO-2026-5004 | Low | Not scored | 22 Apr, 2026 | Go github.com/jackc/pgx Go github.com/jackc/pgx/v4 Go github.com/jackc/pgx/v5 |
OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation BIT-openbao-2026-40264, CVE-2026-40264, GHSA-p49j-v9wc-wg57, GO-2026-5526 | Low | Not scored | 21 Apr, 2026 | Go github.com/openbao/openbao |
OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS) BIT-openbao-2026-39396, CVE-2026-39396, GHSA-r65v-xgwc-g56j, GO-2026-5609 | Low | Not scored | 21 Apr, 2026 | Go github.com/openbao/openbao |
OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate BIT-openbao-2026-39388, CVE-2026-39388, GHSA-7ccv-rp6m-rffr, GO-2026-5213 | Low | Not scored | 21 Apr, 2026 | Go github.com/openbao/openbao |
Memos has an Incorrect Privilege Assignment issue CVE-2026-6634, GHSA-gqp3-hfc3-8q54, GO-2026-5403 | Low | Not scored | 20 Apr, 2026 | Go github.com/usememos/memos |
Mattermost doesn't validate whether users were correctly owned by the correct Connected Workspace CVE-2026-27769, GHSA-mxxh-fmjq-j6x4, GO-2026-5522 | Low | Not scored | 17 Apr, 2026 | Go github.com/mattermost/mattermost-server |
Grafana legacy correlations allow cross-tenant disclosure and deletion BIT-grafana-2026-21727, CVE-2026-21727, GHSA-p5x9-j974-rpfp, GO-2026-6664 | Low | Not scored | 15 Apr, 2026 | Go github.com/grafana/grafana |
OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses GHSA-hw5x-4r37-72w7, GO-2026-5441 | Low | Not scored | 14 Apr, 2026 | Go github.com/opentofu/opentofu |
Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint GHSA-7qx6-f23w-3w7f, GO-2026-5232 | Low | Not scored | 14 Apr, 2026 | Go github.com/patrickhener/goshs Go github.com/patrickhener/goshs/v2 |
OAuth2 Proxy's session cookies are not cleared when rendering sign-in page BIT-oauth2-proxy-2026-34454, CVE-2026-34454, GHSA-f24x-5g9q-753f, GO-2026-5341 | Low | Not scored | 14 Apr, 2026 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel CVE-2026-40263, GHSA-w6m9-39cv-2fwp, GO-2026-5696 | Low | Not scored | 13 Apr, 2026 | Go github.com/enchant97/note-mark/backend |
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering CVE-2026-40109, GHSA-h9cx-xjg6-5v2w, GO-2026-5419 | Low | Not scored | 10 Apr, 2026 | Go github.com/fluxcd/notification-controller |
Step CA affected by an index out of bounds panic in TPM attestation EKU validation CVE-2026-40097, GHSA-9qq8-cgcv-qmc9, GO-2026-5297 | Low | Not scored | 10 Apr, 2026 | Go github.com/smallstep/certificates |
Beszel has an IDOR in hub API endpoints that read system ID from URL parameter CVE-2026-40077, GHSA-5f5r-95pg-xrpm, GO-2026-5141 | Low | Not scored | 10 Apr, 2026 | Go github.com/henrygd/beszel |
Mattermost MS Teams plugin doesn't limit the request body size on the /lifecycle webhook endpoint CVE-2026-21388, GHSA-x274-8qfc-hrgf, GO-2026-5734 | Low | Not scored | 09 Apr, 2026 | Go github.com/mattermost/mattermost-plugin-msteams |
Casdoor vulnerable to Stored XSS via Application formCss / formSideHtml CVE-2026-5468, GHSA-w799-7525-rpr6, GO-2026-5697 | Low | Not scored | 03 Apr, 2026 | Go github.com/casdoor/casdoor |
Casdoor vulnerable to Open Redirect CVE-2026-5467, GHSA-mj24-pqx2-6788, GO-2026-5509 | Low | Not scored | 03 Apr, 2026 | Go github.com/casdoor/casdoor |
Nhost Leaks Refresh Tokens via URL Query Parameter in OAuth Provider Callback CVE-2026-34969, GHSA-g2qj-prgh-4g9r, GO-2026-5388 | Low | Not scored | 01 Apr, 2026 | Go github.com/nhost/nhost |
Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber CVE-2026-34762, GHSA-xw45-cc32-442f, GO-2026-5770 | Low | Not scored | 01 Apr, 2026 | Go github.com/ellanetworks/core |
Temporal Server: attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster CVE-2026-5199, GHSA-xpg8-3hhp-p7w8, GO-2026-5766 | Low | Not scored | 01 Apr, 2026 | Go go.temporal.io/server |
go-git missing validation decoding Index v4 files leads to panic CVE-2026-33762, GHSA-gm2x-2g9h-ccm8, GO-2026-4909 | Low | Not scored | 30 Mar, 2026 | Go github.com/go-git/go-git Go github.com/go-git/go-git/v4 Go github.com/go-git/go-git/v5 |
Zoraxy: Authenticated Path Traversal in Config Import leads to RCE CVE-2026-33529, GHSA-7pq3-326h-f8q9, GO-2026-4844 | Low | Not scored | 25 Mar, 2026 | Go github.com/tobychui/zoraxy |
Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting CVE-2026-33525, GHSA-gmfg-3v4q-9qr4, GO-2026-4818 | Low | Not scored | 24 Mar, 2026 | Go github.com/authelia/authelia Go github.com/authelia/authelia/v4 |
etcd: Nested etcd transactions bypass RBAC authorization checks BIT-etcd-2026-33343, CVE-2026-33343, GHSA-rfx7-8w68-q57q, GO-2026-4808 | Low | Not scored | 20 Mar, 2026 | Go go.etcd.io/etcd Go go.etcd.io/etcd/v3 |
Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload CVE-2026-33221, GHSA-g9f6-9775-hffm, GO-2026-4759 | Low | Not scored | 18 Mar, 2026 | Go github.com/nhost/nhost |
mo has a XSS via inline SVG script tags in Markdown rendering GHSA-vccx-p757-pv6h, GO-2026-4765 | Low | Not scored | 18 Mar, 2026 | Go github.com/k1LoW/mo |
Mattermost fails to validate user's authentication method when processing account auth type switch CVE-2026-22545, GHSA-rv67-7w2g-7976, GO-2026-4786 | Low | Not scored | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning GHSA-q926-c743-49qj, GO-2026-4703 | Low | Not scored | 13 Mar, 2026 | Go github.com/centrifugal/centrifugo Go github.com/centrifugal/centrifugo/v3 Go github.com/centrifugal/centrifugo/v4 Go github.com/centrifugal/centrifugo/v5 +1 more |
Anytype Heart's gRPC API client challenge verification can be bypassed on localhost CVE-2026-31863, GHSA-vv3h-7qwr-722v, GO-2026-4680 | Low | Not scored | 11 Mar, 2026 | Go github.com/anyproto/anytype-cli Go github.com/anyproto/anytype-heart |
Sliver is Vulnerable to Authenticated Nil-Pointer Dereference through its Handlers CVE-2026-29781, GHSA-hx52-cv84-jr5v, GO-2026-4609 | Low | Not scored | 05 Mar, 2026 | Go github.com/bishopfox/sliver |
ZITADEL has potential SSRF via Actions CVE-2026-27945, GHSA-7777-fhq9-592v, GO-2026-4574 | Low | Not scored | 27 Feb, 2026 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
CIRCL has an incorrect calculation in secp384r1 CombinedMult CVE-2026-1229, GHSA-q9hv-hpm4-hj6x, GO-2026-4550 | Low | Not scored | 25 Feb, 2026 | Go github.com/cloudflare/circl |
OpenKruise PodProbeMarker is Vulnerable to SSRF via Unrestricted Host Field CVE-2026-24005, GHSA-9fj4-3849-rv9g, GO-2026-4549 | Low | Not scored | 25 Feb, 2026 | Go github.com/openkruise/kruise |
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped BIT-cosign-2026-24122, CVE-2026-24122, GHSA-wfqv-66vq-46rm, GO-2026-4529 | Low | Not scored | 19 Feb, 2026 | Go github.com/sigstore/cosign Go github.com/sigstore/cosign/v2 Go github.com/sigstore/cosign/v3 |
uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120 CVE-2026-26995, GHSA-rrxv-pmq9-x67r, GO-2026-4512 | Low | Not scored | 18 Feb, 2026 | Go github.com/refraction-networking/utls |
uTLS has a fingerprint vulnerability from GREASE ECH mismatch for Chrome parrots CVE-2026-27017, GHSA-7m29-f4hw-g2vx, GO-2026-4509 | Low | Not scored | 18 Feb, 2026 | Go github.com/refraction-networking/utls |
filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity CVE-2026-26958, GHSA-fw7p-63qq-7hpr, GO-2026-4503 | Low | Not scored | 17 Feb, 2026 | Go filippo.io/edwards25519 |