Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API CVE-2026-41422, GHSA-rw2c-8rfq-gwfv, GO-2026-5640 | High | 0.3% | 22 Apr, 2026 | Go github.com/daptin/daptin |
RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution BIT-rclone-2026-41179, CVE-2026-41179, GHSA-jfwf-28xr-xw6q, GO-2026-5466 | Critical | 8.6% | 22 Apr, 2026 | Go github.com/ncw/rclone Go github.com/rclone/rclone |
Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution BIT-rclone-2026-41176, CVE-2026-41176, GHSA-25qr-6mpr-f7qx, GO-2026-4964 | Critical | 32.7% | 22 Apr, 2026 | Go github.com/rclone/rclone |
openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access CVE-2026-41070, GHSA-246w-jgmq-88fg, GO-2026-4963 | Critical | 0.4% | 22 Apr, 2026 | Go github.com/jkroepke/openvpn-auth-oauth2 |
Tekton Pipeline: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE CVE-2026-40938, GHSA-94jr-7pqp-xhcq, GO-2026-5272 | High | 0.8% | 21 Apr, 2026 | Go github.com/tektoncd/pipeline |
Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion CVE-2026-40924, GHSA-m2cx-gpqf-qf74, GO-2026-5486 | Medium | 0.3% | 21 Apr, 2026 | Go github.com/tektoncd/pipeline |
Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check CVE-2026-40923, GHSA-rx35-6rhx-7858, GO-2026-5643 | Medium | 0.2% | 21 Apr, 2026 | Go github.com/tektoncd/pipeline |
free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation CVE-2026-40343, GHSA-jwch-w7wh-gqjm, GO-2026-5482 | Medium | 8.6% | 21 Apr, 2026 | Go github.com/free5gc/udr |
Excessive memory allocation when decoding malicious SFNT in golang.org/x/image CVE-2026-33812, GO-2026-4962 | 0.1% | 21 Apr, 2026 | Go golang.org/x/image | |
Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image CVE-2026-33813, GO-2026-4961 | 0.3% | 21 Apr, 2026 | Go golang.org/x/image | |
Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL CVE-2026-40161, GHSA-wjxp-xrpv-xpff, GO-2026-5711 | High | 0.3% | 21 Apr, 2026 | Go github.com/tektoncd/pipeline |
OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation BIT-openbao-2026-40264, CVE-2026-40264, GHSA-p49j-v9wc-wg57, GO-2026-5526 | Low | 0.3% | 21 Apr, 2026 | Go github.com/openbao/openbao |
OpenBao's SQL Injection in PostgreSQL database secrets engine BIT-openbao-2026-39946, CVE-2026-39946, GHSA-6vgr-cp5c-ffx3, GO-2026-5192 | Medium | 0.2% | 21 Apr, 2026 | Go github.com/openbao/openbao |
OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS) BIT-openbao-2026-39396, CVE-2026-39396, GHSA-r65v-xgwc-g56j, GO-2026-5609 | Low | 0.2% | 21 Apr, 2026 | Go github.com/openbao/openbao |
OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate BIT-openbao-2026-39388, CVE-2026-39388, GHSA-7ccv-rp6m-rffr, GO-2026-5213 | Low | 0.1% | 21 Apr, 2026 | Go github.com/openbao/openbao |
Neko has a Self-service Privilege Escalation for Authenticated Users CVE-2026-39386, GHSA-2gw9-c2r2-f5qf, GO-2026-4960 | High | 0.4% | 21 Apr, 2026 | Go github.com/m1k1o/neko/server |
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching CVE-2026-25542, GHSA-rmx9-2pp3-xhcr, GO-2026-5630 | Medium | 0.3% | 21 Apr, 2026 | Go github.com/tektoncd/pipeline |
Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints CVE-2026-34403, GHSA-78mf-482w-62qj, GO-2026-5210 | High | 0.2% | 21 Apr, 2026 | Go github.com/0xJacky/Nginx-UI |
Nginx-UI: Disabled users retain full API access through previously issued bearer tokens CVE-2026-33031, GHSA-x234-x5vq-cc2v, GO-2026-5733 | High | 0.3% | 21 Apr, 2026 | Go github.com/0xJacky/Nginx-UI |
Memos has an Incorrect Privilege Assignment issue CVE-2026-6634, GHSA-gqp3-hfc3-8q54, GO-2026-5403 | Low | 0.3% | 20 Apr, 2026 | Go github.com/usememos/memos |
Wish has SCP Path Traversal that allows arbitrary file read/write CVE-2026-41589, GHSA-xjvp-7243-rg9h, GO-2026-5762 | Critical | 0.4% | 18 Apr, 2026 | Go charm.land/wish/v2 Go github.com/charmbracelet/wish |
Amazon EFS CSI Driver has mount option injection via unsanitized volumeHandle and mounttargetip fields CVE-2026-6437, GHSA-mph4-q2vm-w2pw | Medium | 0.6% | 18 Apr, 2026 | Go github.com/kubernetes-sigs/aws-efs-csi-driver |
Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass CVE-2026-41574, GHSA-6g38-8j4p-j3pr, GO-2026-5176 | Critical | 0.8% | 18 Apr, 2026 | Go github.com/nhost/nhost |
go-git: Credential leak via cross-host redirect in smart HTTP transport CVE-2026-41506, GHSA-3xc5-wrhm-f963, GO-2026-5105 | Medium | 0.3% | 17 Apr, 2026 | Go github.com/go-git/go-git/v5 Go github.com/go-git/go-git/v6 |
OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR CVE-2026-41433, GHSA-8gmg-3w2q-65f4, GO-2026-5253 | High | 0.2% | 17 Apr, 2026 | Go go.opentelemetry.io/obi |
Dapr: Service Invocation path traversal ACL bypass CVE-2026-41491, GHSA-85gx-3qv6-4463, GO-2026-5242 | High | 0.3% | 17 Apr, 2026 | Go github.com/dapr/dapr |
Mattermost doesn't validate whether users were correctly owned by the correct Connected Workspace CVE-2026-27769, GHSA-mxxh-fmjq-j6x4, GO-2026-5522 | Low | 0.2% | 17 Apr, 2026 | Go github.com/mattermost/mattermost-server |
Mattermost doesn't validate CSRF tokens on an authentication endpoint CVE-2026-28741, GHSA-m7cf-4gh2-v4qg, GO-2026-5495 | Medium | 0.1% | 17 Apr, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement CVE-2026-3590, GHSA-mh4x-rmrx-3hp4, GO-2026-5507 | Medium | 0.2% | 17 Apr, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
goldmark vulnerable to Cross-site Scripting (XSS) CVE-2026-5160, GHSA-c97m-vxhj-p7j6, GO-2026-5320 | Medium | 0.3% | 17 Apr, 2026 | Go github.com/yuin/goldmark Go github.com/yuin/goldmark/renderer/html |
HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations BIT-vault-2026-5807, CVE-2026-5807, GHSA-88v5-9hxc-f85r, GO-2026-5247 | High | 0.7% | 17 Apr, 2026 | Go github.com/hashicorp/vault |
HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service BIT-vault-2026-3605, CVE-2026-3605, GHSA-m2w4-8ggf-rj47, GO-2026-5487 | High | 0.4% | 17 Apr, 2026 | Go github.com/hashicorp/vault |
HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization BIT-vault-2026-4525, CVE-2026-4525, GHSA-72gw-fmmr-c4r4, GO-2026-5199 | High | 0.4% | 17 Apr, 2026 | Go github.com/hashicorp/vault |
HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS BIT-vault-2026-5052, CVE-2026-5052, GHSA-8r5m-3f66-qpr3, GO-2026-5262 | Medium | 0.3% | 17 Apr, 2026 | Go github.com/hashicorp/vault |
Istio: SSRF via RequestAuthentication jwksUri CVE-2026-41413, GHSA-fgw5-hp8f-xfhc, GO-2026-5363 | Medium | 0.3% | 16 Apr, 2026 | Go istio.io/istio |
Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak) BIT-kyverno-2026-84195, CVE-2026-84195, GHSA-8wfp-579w-6r25, GO-2026-5268 | High | 0.4% | 16 Apr, 2026 | Go github.com/kyverno/kyverno |
Kyverno: ServiceAccount token leaked to external servers via apiCall service URL BIT-kyverno-2026-41323, CVE-2026-41323, GHSA-f9g8-6ppc-pqq4, GO-2026-5351 | High | 0.6% | 16 Apr, 2026 | Go github.com/kyverno/kyverno |
Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) BIT-kyverno-2026-41068, CVE-2026-41068, GHSA-cvq5-hhx3-f99p, GO-2026-5337 | High | 0.3% | 16 Apr, 2026 | Go github.com/kyverno/kyverno |
ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider CVE-2026-40611, GHSA-qqx8-2xmm-jrv8, GO-2026-5593 | High | 0.4% | 16 Apr, 2026 | Go github.com/go-acme/lego Go github.com/go-acme/lego/v3 Go github.com/go-acme/lego/v4 |
zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records CVE-2026-40304, GHSA-3jpj-v3xr-5h6g, GO-2026-5090 | Medium | 0.3% | 16 Apr, 2026 | Go github.com/openziti/zrok Go github.com/openziti/zrok/v2 |
zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing CVE-2026-40303, GHSA-cpf9-ph2j-ccr9, GO-2026-5329 | High | 0.5% | 16 Apr, 2026 | Go github.com/openziti/zrok Go github.com/openziti/zrok/v2 |
zrok: Reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering CVE-2026-40302, GHSA-4fxq-2x3x-6xqx, GO-2026-5118 | Medium | 0.2% | 16 Apr, 2026 | Go github.com/openziti/zrok Go github.com/openziti/zrok/v2 |
Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints CVE-2026-40173, GHSA-95mq-xwj4-r47p, GO-2026-5274 | Critical | 0.5% | 16 Apr, 2026 | Go github.com/dgraph-io/dgraph Go github.com/dgraph-io/dgraph/v24 Go github.com/dgraph-io/dgraph/v25 Go github.com/hypermodeinc/dgraph/v24 |
Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots CVE-2026-39350, GHSA-9gcg-w975-3rjh, GO-2026-5289 | Medium | 0.2% | 16 Apr, 2026 | Go istio.io/istio |
SpdyStream: DOS on CRI CVE-2026-35469, GHSA-pc3f-x583-g7j2, GO-2026-4958 | High | 0.7% | 16 Apr, 2026 | Go github.com/moby/spdystream |
Pyroscope Exposes Storage Secret BIT-grafana-pyroscope-2025-41118, CVE-2025-41118, GHSA-m9hq-h476-h2g8, GO-2026-5501 | Critical | 0.4% | 15 Apr, 2026 | Go github.com/grafana/pyroscope |
Grafana Loki Path Traversal - CVE-2021-36156 Bypass CVE-2026-21726, GHSA-497x-rrr9-68jp, GO-2026-5115 | Medium | 0.4% | 15 Apr, 2026 | Go github.com/grafana/loki Go github.com/grafana/loki/v3 |
Grafana legacy correlations allow cross-tenant disclosure and deletion BIT-grafana-2026-21727, CVE-2026-21727, GHSA-p5x9-j974-rpfp, GO-2026-6664 | Low | 0.2% | 15 Apr, 2026 | Go github.com/grafana/grafana |
KubeVirt's authorization mechanism improperly truncates subresource names CVE-2026-6383, GHSA-j6cv-3w8p-vrg8, GO-2026-5450 | Medium | 0.1% | 15 Apr, 2026 | Go kubevirt.io/kubevirt |
OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex BIT-oauth2-proxy-2026-41059, CVE-2026-41059, GHSA-pxq7-h93f-9jrg, GO-2026-5559 | High | 0.3% | 15 Apr, 2026 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |