Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims BIT-oauth2-proxy-2026-40574, CVE-2026-40574, GHSA-c5c4-8r6x-56w3, GO-2026-5314 | Medium | 0.2% | 15 Apr, 2026 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing BIT-oauth2-proxy-2026-40575, BIT-oauth2-proxy-2026-76835, CVE-2026-40575, CVE-2026-76835, GHSA-7x63-xv5r-3p2x, GO-2026-5236 | Critical | 0.5% | 15 Apr, 2026 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token CVE-2026-6290, GHSA-hv5g-26jg-pc45, GO-2026-5438 | Critical | 0.2% | 15 Apr, 2026 | Go www.velocidex.com/golang/velociraptor |
NietThijmen ShoppingCart: Command injection in the connect function CVE-2024-53412, GHSA-ggmw-mjhv-75rm, GO-2026-5398 | High | 0.6% | 15 Apr, 2026 | Go github.com/NietThijmen/ShoppingCart |
MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads CVE-2026-41145, GHSA-hv4r-mvr4-25vw, GO-2026-5437 | High | 0.3% | 14 Apr, 2026 | Go github.com/minio/minio |
OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses GHSA-hw5x-4r37-72w7, GO-2026-5441 | Low | Not scored | 14 Apr, 2026 | Go github.com/opentofu/opentofu |
frp has an authentication bypass in HTTP vhost routing when routeByHTTPUser is used for access control CVE-2026-40910, GHSA-pq96-pwvg-vrr9, GO-2026-5549 | Medium | 0.3% | 14 Apr, 2026 | Go github.com/fatedier/frp |
Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles CVE-2026-40944, GHSA-7jrq-q4pq-rhm6, GO-2026-5226 | High | 0.2% | 14 Apr, 2026 | Go github.com/oxia-db/oxia |
Oxia affected by server crash via race condition in session heartbeat handling CVE-2026-40943, GHSA-5gqc-qhrj-9xw8, GO-2026-5145 | High | 0.2% | 14 Apr, 2026 | Go github.com/oxia-db/oxia |
Oxia has an OIDC token audience validation bypass via SkipClientIDCheck CVE-2026-40946, GHSA-fhvp-9hcj-6m33, GO-2026-5364 | Critical | 0.3% | 14 Apr, 2026 | Go github.com/oxia-db/oxia |
Oxia exposes bearer token in debug log messages on authentication failure CVE-2026-40945, GHSA-pm7q-rjjx-979p, GO-2026-5546 | High | 0.3% | 14 Apr, 2026 | Go github.com/oxia-db/oxia |
SiYuan has incomplete fix for CVE-2026-33066: XSS CVE-2026-40922, GHSA-8q5w-mmxf-48jg, GO-2026-5260 | Medium | 0.3% | 14 Apr, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint GHSA-7qx6-f23w-3w7f, GO-2026-5232 | Low | Not scored | 14 Apr, 2026 | Go github.com/patrickhener/goshs Go github.com/patrickhener/goshs/v2 |
Go Markdown has an Out-of-bounds Read in SmartypantsRenderer CVE-2026-40890, GHSA-77fj-vx54-gvh7, GO-2026-5208 | High | 0.3% | 14 Apr, 2026 | Go github.com/gomarkdown/markdown |
Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access BIT-kyverno-2026-4789, CVE-2026-4789, GHSA-rggm-jjmc-3394, GO-2026-5621 | High | 0.7% | 14 Apr, 2026 | Go github.com/kyverno/kyverno |
SpiceDB's SPICEDB_DATASTORE_CONN_URI is leaked on startup logs CVE-2026-40091, GHSA-jf4f-rr2c-9m58, GO-2026-5465 | Medium | 0.2% | 14 Apr, 2026 | Go github.com/authzed/spicedb |
Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write CVE-2026-40090, GHSA-pj97-4p9w-gx3q, GO-2026-5542 | High | 0.3% | 14 Apr, 2026 | Go github.com/defenseunicorns/zarf Go github.com/zarf-dev/zarf |
OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in auth_request Mode BIT-oauth2-proxy-2026-34457, CVE-2026-34457, GHSA-5hvv-m4w4-gf6v, GO-2026-5147 | Critical | 0.5% | 14 Apr, 2026 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
OAuth2 Proxy's session cookies are not cleared when rendering sign-in page BIT-oauth2-proxy-2026-34454, CVE-2026-34454, GHSA-f24x-5g9q-753f, GO-2026-5341 | Low | 0.2% | 14 Apr, 2026 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
PowerShell Command Injection in Podman HyperV Machine CVE-2026-33414, GHSA-hc8w-h2mf-hp59, GO-2026-5421 | Medium | 0.6% | 14 Apr, 2026 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 +1 more |
goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access CVE-2026-40885, GHSA-7h3j-592v-jcrp, GO-2026-5221 | High | 0.3% | 14 Apr, 2026 | Go github.com/patrickhener/goshs Go github.com/patrickhener/goshs/v2 |
goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation CVE-2026-40883, GHSA-jrq5-hg6x-j6g3, GO-2026-5479 | Medium | 0.1% | 14 Apr, 2026 | Go github.com/patrickhener/goshs Go github.com/patrickhener/goshs/v2 |
goshs has an empty-username SFTP password authentication bypass CVE-2026-40884, GHSA-c29w-qq4m-2gcv, GO-2026-5303 | Critical | 0.5% | 14 Apr, 2026 | Go github.com/patrickhener/goshs Go github.com/patrickhener/goshs/v2 |
SFTP root escape via prefix-based path validation in goshs CVE-2026-40876, GHSA-5h6h-7rc9-3824, GO-2026-5146 | High | 0.4% | 14 Apr, 2026 | Go github.com/patrickhener/goshs Go github.com/patrickhener/goshs/v2 |
kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token BIT-kyverno-2026-40868, CVE-2026-40868, GHSA-q93q-v844-jrqp, GO-2026-5575 | High | 0.3% | 14 Apr, 2026 | Go github.com/kyverno/kyverno |
Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach BIT-kyverno-2026-84199, CVE-2026-84199, GHSA-fmqp-4wfc-w3v7, GO-2026-5371 | High | 0.4% | 14 Apr, 2026 | Go github.com/kyverno/kyverno |
Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF BIT-kyverno-2026-84196, CVE-2026-84196, GHSA-qr4g-8hrp-c4rw, GO-2026-5594 | High | 0.4% | 14 Apr, 2026 | Go github.com/kyverno/kyverno |
free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors CVE-2026-40249, GHSA-gx38-8h33-pmxr, GO-2026-5407 | Medium | 0.3% | 14 Apr, 2026 | Go github.com/free5gc/udr |
free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions CVE-2026-40248, GHSA-jgq2-qv8v-5cmj, GO-2026-5470 | High | 0.4% | 14 Apr, 2026 | Go github.com/free5gc/udr |
free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions CVE-2026-40247, GHSA-x5r2-r74c-3w28, GO-2026-5741 | High | 0.5% | 14 Apr, 2026 | Go github.com/free5gc/udr |
free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions CVE-2026-40246, GHSA-g9cw-qwhf-24jp, GO-2026-5396 | High | 0.4% | 14 Apr, 2026 | Go github.com/free5gc/udr |
free5gc UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication CVE-2026-40245, GHSA-wrwh-rpq4-87hf, GO-2026-5722 | High | 0.5% | 14 Apr, 2026 | Go github.com/free5gc/udr |
Sigstore Timestamp Authority has Improper Certificate Validation in verifier CVE-2026-39984, GHSA-xm5m-wgh2-rrg3, GO-2026-5763 | Medium | 0.1% | 14 Apr, 2026 | Go github.com/sigstore/timestamp-authority Go github.com/sigstore/timestamp-authority/v2 |
MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads CVE-2026-40344, GHSA-9c4q-hq6p-c237, GO-2026-5284 | High | 0.4% | 14 Apr, 2026 | Go github.com/minio/minio |
In monetr, unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation CVE-2026-40481, GHSA-v7xq-3wx6-fqc2, GO-2026-5654 | High | 0.4% | 14 Apr, 2026 | Go github.com/monetr/monetr |
Note Mark has Broken Access Control on Asset Download CVE-2026-40265, GHSA-p5w6-75f9-cc2p, GO-2026-5530 | Medium | 0.4% | 13 Apr, 2026 | Go github.com/enchant97/note-mark/backend |
Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel CVE-2026-40263, GHSA-w6m9-39cv-2fwp, GO-2026-5696 | Low | 0.3% | 13 Apr, 2026 | Go github.com/enchant97/note-mark/backend |
Note Mark has Stored XSS via Unrestricted Asset Upload CVE-2026-40262, GHSA-9pr4-rf97-79qh, GO-2026-5295 | High | 0.3% | 13 Apr, 2026 | Go github.com/enchant97/note-mark/backend |
Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username CVE-2026-40193, GHSA-5835-4gvc-32pc, GO-2026-5137 | High | 0.4% | 13 Apr, 2026 | Go github.com/foxcpp/maddy |
Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer BIT-prometheus-2026-40179, CVE-2026-40179, GHSA-vffh-x6r8-xx99, GO-2026-5662 | Medium | 0.3% | 13 Apr, 2026 | Go github.com/prometheus/prometheus |
External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine CVE-2026-34984, GHSA-r2pg-r6h7-crf3, GO-2026-5602 | High | 0.3% | 13 Apr, 2026 | Go github.com/external-secrets/external-secrets |
Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server CVE-2026-34476, GHSA-c4hg-6933-x62x, GO-2026-5310 | High | 0.5% | 13 Apr, 2026 | Go github.com/apache/skywalking-mcp |
Daptin has Unauthenticated Path Traversal and Zip Slip GHSA-9cp7-j3f8-p5jx, GO-2026-5285 | Critical | Not scored | 10 Apr, 2026 | Go github.com/daptin/daptin |
Temporal does not enforce authentication and authorization for the streaming AdminService/StreamWorkflowReplicationMessages endpoint CVE-2026-5724, GHSA-q98v-9f9w-f49q, GO-2026-5578 | Medium | 0.5% | 10 Apr, 2026 | Go go.temporal.io/server |
Juju: In-Memory Token Store for Discharge Tokens Lacks Concurrency Safety and Persistence CVE-2026-5774, GHSA-7m55-2hr4-pw78, GO-2026-5228 | Medium | 0.2% | 10 Apr, 2026 | Go github.com/juju/juju |
Juju: CloudSpec method leaking cloud credentials CVE-2026-5412, GHSA-w5fq-8965-c969, GO-2026-5692 | Critical | 0.4% | 10 Apr, 2026 | Go github.com/juju/juju |
Arcane has Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint CVE-2026-40242, GHSA-ff24-4prj-gpmj, GO-2026-5356 | High | 0.6% | 10 Apr, 2026 | Go github.com/getarcaneapp/arcane/backend |
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering CVE-2026-40109, GHSA-h9cx-xjg6-5v2w, GO-2026-5419 | Low | 0.1% | 10 Apr, 2026 | Go github.com/fluxcd/notification-controller |
Step CA affected by an index out of bounds panic in TPM attestation EKU validation CVE-2026-40097, GHSA-9qq8-cgcv-qmc9, GO-2026-5297 | Low | 0.2% | 10 Apr, 2026 | Go github.com/smallstep/certificates |
goshs has a file-based ACL authorization bypass in goshs state-changing routes CVE-2026-40189, GHSA-wvhv-qcqf-f3cx, GO-2026-5728 | Critical | 0.6% | 10 Apr, 2026 | Go github.com/patrickhener/goshs |