Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass) CVE-2026-33489, GHSA-h8mm-c463-wjq3, GO-2026-5417 | High | 0.4% | 28 Apr, 2026 | Go github.com/coredns/coredns |
CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification CVE-2026-32936, GHSA-63cw-r7xf-jmwr, GO-2026-5164 | High | 0.7% | 28 Apr, 2026 | Go github.com/coredns/coredns |
CoreDNS' DoQ worker pool does not bound stream backlog CVE-2026-32934, GHSA-2wpx-qpw2-g5h5, GO-2026-4969 | High | 0.5% | 28 Apr, 2026 | Go github.com/coredns/coredns |
Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters CVE-2026-30246, GHSA-35hp-hqmv-8qg8, GO-2026-5069 | Medium | 0.3% | 28 Apr, 2026 | Go github.com/gofiber/fiber/v3 |
Netmaker does not verify JWT signatures for host tokens CVE-2026-38651, GHSA-qpv2-rwc8-c993, GO-2026-5588 | Critical | 0.4% | 28 Apr, 2026 | Go github.com/gravitl/netmaker |
Apache Thrift TFramedTransport Go language implementation has an Integer Overflow or Wraparound vulnerability BIT-thrift-2026-41602, CVE-2026-41602, GHSA-wf45-q9ch-q8gh | High | 1.2% | 28 Apr, 2026 | Go github.com/apache/thrift |
Ollama is Vulnerable to Path Traversal CVE-2026-7020, GHSA-x99g-8v8j-25j2, GO-2026-5750 | Low | 0.9% | 26 Apr, 2026 | Go github.com/ollama/ollama |
Note Mark: Unauthenticated read of notes and assets in soft-deleted public books CVE-2026-41572, GHSA-3gr9-485j-v4xf, GO-2026-5085 | Medium | 0.2% | 25 Apr, 2026 | Go github.com/enchant97/note-mark/backend |
Note Mark: OIDC-registered users authenticated by submitting password "null" CVE-2026-41571, GHSA-pxf8-6wqm-r6hh, GO-2026-5557 | Critical | 0.4% | 25 Apr, 2026 | Go github.com/enchant97/note-mark/backend |
Cillium exposes sensitive information included in the cilium-bugtool debug archive BIT-cilium-2026-41520, BIT-cilium-operator-2026-41520, BIT-hubble-relay-2026-41520, CVE-2026-41520, GHSA-gj49-89wh-h4gj, GO-2026-5400 | High | 0.1% | 25 Apr, 2026 | Go github.com/cilium/cilium |
zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write CVE-2026-42275, GHSA-74m3-9qvm-rp9h, GO-2026-5203 | High | 0.3% | 25 Apr, 2026 | Go github.com/openziti/zrok Go github.com/openziti/zrok/v2 |
Heimdall has an authorization bypass via path normalization mismatch CVE-2026-42274, GHSA-3q34-rx83-r6mq, GO-2026-5097 | High | 0.4% | 25 Apr, 2026 | Go github.com/dadrus/heimdall |
Heimdall: Case-sensitive host matching may lead to policy bypass CVE-2026-42273, GHSA-72h4-mxfc-jx37, GO-2026-5200 | High | 0.3% | 25 Apr, 2026 | Go github.com/dadrus/heimdall |
Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation CVE-2026-42272, GHSA-43jv-5j4x-qv67, GO-2026-5108 | High | 0.4% | 25 Apr, 2026 | Go github.com/dadrus/heimdall |
Kratos has a Confused Deputy issue CVE-2026-6993, GHSA-jj45-xvq5-rhh9, GO-2026-5471 | Medium | 0.3% | 25 Apr, 2026 | Go github.com/go-kratos/kratos/v2 |
PicoClaw has an Injection issue in its Web Launcher Management Plane component CVE-2026-6987, GHSA-6r3x-h84w-fhxx, GO-2026-5187 | Medium | 3.4% | 25 Apr, 2026 | Go github.com/sipeed/picoclaw |
gitverify has improper tag signature verification GHSA-h829-5cg7-6hff, GO-2026-5416 | Medium | Not scored | 24 Apr, 2026 | Go github.com/supply-chain-tools/gitverify |
Kyverno Controller Denial of Service via forEach Mutation Panic BIT-kyverno-2026-41485, CVE-2026-41485, GHSA-fpjq-c37h-cqcv, GO-2026-5374 | High | 0.4% | 24 Apr, 2026 | Go github.com/kyverno/kyverno |
Traefik: A timing side-channel vulnerability allows for valid username enumeration via BasicAuth middleware CVE-2026-41263, GHSA-6x2q-h3cr-8j2h, GO-2026-5195 | Medium | 0.4% | 24 Apr, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding CVE-2026-41174, GHSA-xhjw-95fp-8vgq, GO-2026-5760 | Medium | 0.3% | 24 Apr, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath Desync CVE-2026-40912, GHSA-6jwx-7vp4-9847, GO-2026-5180 | High | 0.8% | 24 Apr, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
k8sGPT has Prompt Injection through its k8sGPT-Operator GHSA-rp7v-4384-hfrp, GO-2026-5631 | High | Not scored | 24 Apr, 2026 | Go github.com/k8sgpt-ai/k8sgpt |
Traefik: Pre-authentication decision bypass due to forwarded alias spoofing CVE-2026-39858, GHSA-5m6w-wvh7-57vm, GO-2026-5149 | High | 0.5% | 24 Apr, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication CVE-2026-35051, GHSA-6384-m2mw-rf54, GO-2026-5163 | High | 0.3% | 24 Apr, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
go-zserio has Unbounded Memory Allocation for All Platforms GHSA-xhj4-g6w8-2xjw, GO-2026-5759 | Critical | Not scored | 24 Apr, 2026 | Go github.com/woven-planet/go-zserio |
Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars CVE-2026-41492, GHSA-vvf7-6rmr-m29q, GO-2026-5675 | Critical | 3.1% | 24 Apr, 2026 | Go github.com/dgraph-io/dgraph Go github.com/dgraph-io/dgraph/v24 Go github.com/dgraph-io/dgraph/v25 Go github.com/hypermodeinc/dgraph/v24 |
New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud CVE-2026-41432, GHSA-xff3-5c9p-2mr4, GO-2026-5753 | High | 0.9% | 24 Apr, 2026 | Go github.com/QuantumNous/new-api |
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field CVE-2026-41328, GHSA-x92x-px7w-4gx4, GO-2026-5749 | Critical | 0.4% | 24 Apr, 2026 | Go github.com/dgraph-io/dgraph Go github.com/dgraph-io/dgraph/v24 Go github.com/dgraph-io/dgraph/v25 Go github.com/hypermodeinc/dgraph/v24 |
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field CVE-2026-41327, GHSA-mrxx-39g5-ph77, GO-2026-5516 | Critical | 0.5% | 24 Apr, 2026 | Go github.com/dgraph-io/dgraph Go github.com/dgraph-io/dgraph/v24 Go github.com/dgraph-io/dgraph/v25 Go github.com/hypermodeinc/dgraph/v24 |
Contour has Lua code injection via Cookie Path Rewrite Policy BIT-contour-2026-41246, CVE-2026-41246, GHSA-x4mj-7f9g-29h4, GO-2026-5738 | High | 0.5% | 24 Apr, 2026 | Go github.com/projectcontour/contour |
Grafana Tempo has an Uncontrolled Resource Consumption issue CVE-2026-21728, GHSA-p4r4-xvrq-gvmc, GO-2026-5528 | High | 0.6% | 24 Apr, 2026 | Go github.com/grafana/tempo |
melange has Path Traversal via .PKGINFO in --persist-lint-results CVE-2026-29051, GHSA-q2pw-xx38-p64j, GO-2026-5562 | Low | 0.2% | 23 Apr, 2026 | Go chainguard.dev/melange |
melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses CVE-2026-29050, GHSA-98f2-w9h9-7fp9, GO-2026-5279 | Medium | 0.1% | 23 Apr, 2026 | Go chainguard.dev/melange |
Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows Controller BIT-argo-workflows-2026-40886, CVE-2026-40886, GHSA-5jv8-h7qh-rf5p, GO-2026-5148 | High | 0.4% | 23 Apr, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 Go github.com/argoproj/argo-workflows/v4 |
go-ntlmssp NTLM challenges can panic on malformed payloads CVE-2026-32952, GHSA-pjcq-xvwq-hhpj, GO-2026-5543 | Medium | 1.0% | 23 Apr, 2026 | Go github.com/Azure/go-ntlmssp |
ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function CVE-2026-39087, GHSA-pqhx-w72w-m393, GO-2026-5551 | Critical | 0.3% | 23 Apr, 2026 | Go heckel.io/ntfy Go heckel.io/ntfy/v2 |
goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS CVE-2026-42091, GHSA-rhf7-wvw3-vjvm, GO-2026-5625 | Medium | 0.2% | 23 Apr, 2026 | Go github.com/patrickhener/goshs Go github.com/patrickhener/goshs/v2 Go goshs.de/goshs Go goshs.de/goshs/v2 |
NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access CVE-2026-42072, GHSA-2hp7-65r3-wv54, GO-2026-4967 | Critical | 0.4% | 22 Apr, 2026 | Go github.com/orneryd/nornicdb |
SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869) CVE-2026-41894, GHSA-hjh7-r5w8-5872, GO-2026-5429 | High | 0.4% | 22 Apr, 2026 | Go github.com/siyuan-note/siyuan/kernel |
pgx: SQL Injection via placeholder confusion with dollar quoted string literals CVE-2026-41889, GHSA-j88v-2chj-qfwx, GO-2026-5004 | Low | 0.4% | 22 Apr, 2026 | Go github.com/jackc/pgx Go github.com/jackc/pgx/v4 Go github.com/jackc/pgx/v5 |
Gitea has insecure default SSH settings GHSA-3m6q-h5gj-7mrw, GO-2026-5091 | Medium | Not scored | 22 Apr, 2026 | Go code.gitea.io/gitea |
Nuclei: Environment variable disclosure via Response-Derived DSL Expressions CVE-2026-41282, CVE-2026-41645, GHSA-jm34-66cf-qpvr, GO-2026-5473 | Medium | 0.4% | 22 Apr, 2026 | Go github.com/projectdiscovery/nuclei Go github.com/projectdiscovery/nuclei/v2 Go github.com/projectdiscovery/nuclei/v3 |
Nuclei: Local File Read via require() Module Loader Bypass CVE-2026-41646, GHSA-29rg-wmcw-hpf4, GO-2026-4965 | Medium | 0.1% | 22 Apr, 2026 | Go github.com/projectdiscovery/nuclei Go github.com/projectdiscovery/nuclei/v2 Go github.com/projectdiscovery/nuclei/v3 |
monetr: Server-side request forgery in Lunch Flow link creation and refresh CVE-2026-41644, GHSA-29v9-frvh-c426, GO-2026-4966 | High | 0.3% | 22 Apr, 2026 | Go github.com/monetr/monetr |
free5GC AMF: Missing default case in Content-Type switch in HTTPUEContextTransfer CVE-2026-41136, GHSA-r99v-75p9-xqm5, GO-2026-5613 | Medium | 0.3% | 22 Apr, 2026 | Go github.com/free5gc/amf |
free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service CVE-2026-41135, GHSA-98cp-84m9-q3qp, GO-2026-5278 | High | 0.5% | 22 Apr, 2026 | Go github.com/free5gc/pcf |
OpenFGA has Improper Policy Enforcement CVE-2026-41131, GHSA-57j5-qwp2-vqp6, GO-2026-5136 | Medium | 0.1% | 22 Apr, 2026 | Go github.com/openfga/openfga |
DDEV has ZipSlip path traversal in tar and zip archive extraction CVE-2026-32885, GHSA-x2xq-qhjf-5mvg, GO-2026-5735 | Medium | 0.4% | 22 Apr, 2026 | Go github.com/ddev/ddev |
Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode CVE-2026-25996, GHSA-34r5-6j7w-235f, GO-2026-5068 | Medium | 0.6% | 22 Apr, 2026 | Go github.com/inspektor-gadget/inspektor-gadget |
Inspektor Gadget: Command Injection via malicious buildOptions manipulation CVE-2026-24905, GHSA-79qw-g77v-2vfh, GO-2026-5211 | Medium | 1.4% | 22 Apr, 2026 | Go github.com/inspektor-gadget/inspektor-gadget |