Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
goshs is Missing Write Protection for Parametric Data Values CVE-2026-40188, GHSA-2943-crp8-38xx, GO-2026-4953 | High | 0.3% | 10 Apr, 2026 | Go github.com/patrickhener/goshs |
Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload CVE-2026-79670, GHSA-69hx-63pv-f8f4, GO-2026-5172 | Medium | 0.3% | 10 Apr, 2026 | Go github.com/lin-snow/ech0 |
Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation CVE-2026-79671, GHSA-r2x7-427f-rq69, GO-2026-5603 | Medium | 0.3% | 10 Apr, 2026 | Go github.com/lin-snow/ech0 |
Ech0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure CVE-2026-79669, GHSA-w8jj-cwmc-wgq2, GO-2026-5701 | Medium | 0.3% | 10 Apr, 2026 | Go github.com/lin-snow/ech0 |
Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass CVE-2026-79672, GHSA-fwg7-53p4-g33c, GO-2026-5382 | Medium | 0.3% | 10 Apr, 2026 | Go github.com/lin-snow/ech0 |
Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session CVE-2026-79673, GHSA-hm2h-wwwh-g49x, GO-2026-5431 | Medium | 0.4% | 10 Apr, 2026 | Go github.com/lin-snow/ech0 |
Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs CVE-2026-79666, GHSA-cp79-9mwr-wr49, GO-2026-5328 | Medium | 0.4% | 10 Apr, 2026 | Go github.com/lin-snow/ech0 |
Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export CVE-2026-79667, GHSA-4h9q-p5j4-xvvh, GO-2026-5123 | High | 0.3% | 10 Apr, 2026 | Go github.com/lin-snow/ech0 |
SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView` CVE-2026-40318, GHSA-vw86-c94w-v3x4, GO-2026-5679 | High | 0.3% | 10 Apr, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via `/api/av/removeUnusedAttributeView` CVE-2026-40259, GHSA-7m5h-w69j-qggg, GO-2026-5229 | High | 0.4% | 10 Apr, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering CVE-2026-40107, GHSA-w95v-4h65-j455, GO-2026-5702 | High | 0.3% | 10 Apr, 2026 | Go github.com/siyuan-note/siyuan/kernel |
LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf CVE-2026-34177, GHSA-fm2x-c5qw-4h6f, GO-2026-5368 | Critical | 0.4% | 10 Apr, 2026 | Go github.com/canonical/lxd |
LXD: Importing a crafted backup leads to project restriction bypass CVE-2026-34178, GHSA-q96j-3fmm-7fv4, GO-2026-5576 | Critical | 0.4% | 10 Apr, 2026 | Go github.com/canonical/lxd |
LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin CVE-2026-34179, GHSA-c3h3-89qf-jqm5, GO-2026-5306 | Critical | 0.3% | 10 Apr, 2026 | Go github.com/canonical/lxd |
Beszel has an IDOR in hub API endpoints that read system ID from URL parameter CVE-2026-40077, GHSA-5f5r-95pg-xrpm, GO-2026-5141 | Low | 0.2% | 10 Apr, 2026 | Go github.com/henrygd/beszel |
Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource CVE-2026-39961, GHSA-99j8-wv67-4c72, GO-2026-5283 | Medium | 0.4% | 10 Apr, 2026 | Go github.com/aiven/aiven-operator |
Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds CVE-2026-40103, GHSA-v479-vf79-mg83, GO-2026-5650 | Medium | 0.2% | 10 Apr, 2026 | Go code.vikunja.io/api |
Vikunja has File Size Limit Bypass via Vikunja Import CVE-2026-35602, GHSA-qh78-rvg3-cv54, GO-2026-5582 | Medium | 0.3% | 10 Apr, 2026 | Go code.vikunja.io/api |
Vikunja has iCalendar Property Injection via CRLF in CalDAV Task Output CVE-2026-35601, GHSA-2g7h-7rqr-9p4r, GO-2026-4951 | Medium | 0.2% | 10 Apr, 2026 | Go code.vikunja.io/api |
Vikunja has HTML Injection via Task Titles in Overdue Email Notifications CVE-2026-35600, GHSA-45q4-x4r9-8fqj, GO-2026-5111 | Medium | 0.2% | 10 Apr, 2026 | Go code.vikunja.io/api |
Vikunja has Algorithmic Complexity DoS in Repeating Task Handler CVE-2026-35599, GHSA-r4fg-73rc-hhh7, GO-2026-5608 | Medium | 0.3% | 10 Apr, 2026 | Go code.vikunja.io/api |
Vikunja Missing Authorization on CalDAV Task Read CVE-2026-35598, GHSA-48ch-p4gq-x46x, GO-2026-5114 | Medium | 0.2% | 10 Apr, 2026 | Go code.vikunja.io/api |
Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account Lockout CVE-2026-35597, GHSA-fgfv-pv97-6cmj, GO-2026-5362 | Medium | 0.3% | 10 Apr, 2026 | Go code.vikunja.io/api |
Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug CVE-2026-35596, GHSA-hj5c-mhh2-g7jq, GO-2026-5428 | Medium | 0.3% | 10 Apr, 2026 | Go code.vikunja.io/api |
Vikunja vulnerable to Privilege Escalation via Project Reparenting CVE-2026-35595, GHSA-2vq4-854f-5c72, GO-2026-4952 | High | 0.3% | 10 Apr, 2026 | Go code.vikunja.io/api |
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment BIT-helm-2026-35206, CVE-2026-35206, GHSA-hr2v-4r36-88hr, GO-2026-5435 | Medium | 0.2% | 10 Apr, 2026 | Go helm.sh/helm/v3 Go helm.sh/helm/v4 |
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install BIT-helm-2026-35205, CVE-2026-35205, GHSA-q5jf-9vfq-h4h7, GO-2026-5566 | High | 0.2% | 10 Apr, 2026 | Go helm.sh/helm/v4 |
Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory BIT-helm-2026-35204, CVE-2026-35204, GHSA-vmx8-mqv2-9gmg, GO-2026-5666 | High | 0.2% | 10 Apr, 2026 | Go helm.sh/helm/v4 |
Vikunja: Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade CVE-2026-35594, GHSA-96q5-xm3p-7m84, GO-2026-5276 | Medium | 0.3% | 10 Apr, 2026 | Go code.vikunja.io/api |
Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path CVE-2026-34727, GHSA-8jvc-mcx6-r4cg, GO-2026-5258 | High | 0.3% | 10 Apr, 2026 | Go code.vikunja.io/api |
MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing CVE-2026-39414, GHSA-h749-fxx7-pwpg, GO-2026-5415 | High | 0.5% | 09 Apr, 2026 | Go github.com/minio/minio |
HashiCorp's go-getter library may allow arbitrary file reads CVE-2026-4660, GHSA-92mm-2pjq-r785, GO-2026-5058 | High | 0.6% | 09 Apr, 2026 | Go github.com/hashicorp/go-getter |
Mattermost MS Teams plugin doesn't limit the request body size on the /lifecycle webhook endpoint CVE-2026-21388, GHSA-x274-8qfc-hrgf, GO-2026-5734 | Low | 0.3% | 09 Apr, 2026 | Go github.com/mattermost/mattermost-plugin-msteams |
Mattermost MS Teams plugin doesn't limit the request body size on the /changes webhook endpoint CVE-2026-24661, GHSA-5rfv-h47g-xj42, GO-2026-5153 | Medium | 0.3% | 09 Apr, 2026 | Go github.com/mattermost/mattermost-plugin-msteams |
OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response CVE-2026-40293, GHSA-68m9-983m-f3v5, GO-2026-5170 | Medium | 0.3% | 08 Apr, 2026 | Go github.com/openfga/openfga |
mercure has Topic Selector Cache Key Collision CVE-2026-39972, GHSA-hwr4-mq23-wcv5, GO-2026-5444 | High | 0.3% | 08 Apr, 2026 | Go github.com/dunglas/mercure |
monetr: Protected Transactions Deletable via PUT CVE-2026-39901, GHSA-hqxq-hwqf-wg83, GO-2026-5434 | Medium | 0.3% | 08 Apr, 2026 | Go github.com/monetr/monetr |
opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking CVE-2026-39883, GHSA-hfvc-g4fc-pqhx, GO-2026-5426 | High | 0.3% | 08 Apr, 2026 | Go go.opentelemetry.io/otel/sdk |
opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies CVE-2026-39882, GHSA-w8rr-5gcm-pp58, GO-2026-4985 | Medium | 0.2% | 08 Apr, 2026 | Go go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp Go go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp Go go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp |
Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit CVE-2026-27806, GHSA-rphv-h674-5hp2, GO-2026-5634 | High | 0.1% | 08 Apr, 2026 | Go github.com/fleetdm/fleet/v4 |
kubernetes-graphql-gateway: GraphQL Endpoint Vulnerable to Authenticated Denial-of-Service via Unrestricted Query Execution GHSA-h9mw-h4qc-f5jf, GO-2026-5420 | Medium | Not scored | 08 Apr, 2026 | Go github.com/platform-mesh/kubernetes-graphql-gateway |
kcp's cache server is accessible without authentication or authorization checks CVE-2026-39429, GHSA-3j3q-wp9x-585p, GO-2026-5088 | High | 0.4% | 08 Apr, 2026 | Go github.com/kcp-dev/kcp |
SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions CVE-2026-39846, GHSA-phhp-9rm9-6gr2, GO-2026-5540 | Critical | 0.6% | 08 Apr, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder CVE-2026-89090, GHSA-xmrv-pmrh-hhx2, GO-2026-5764 | Medium | 0.3% | 08 Apr, 2026 | Go github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream Go github.com/aws/aws-sdk-go-v2/service/bedrockagentcore Go github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime Go github.com/aws/aws-sdk-go-v2/service/bedrockruntime +8 more |
Cosign's verify-blob-attestation reports false positive when payload parsing fails BIT-cosign-2026-39395, CVE-2026-39395, GHSA-w6c6-c85g-mmv6, GO-2026-5694 | Medium | 0.3% | 08 Apr, 2026 | Go github.com/sigstore/cosign Go github.com/sigstore/cosign/v2 Go github.com/sigstore/cosign/v3 |
kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level GHSA-fcmh-qfxc-w685, GO-2026-5354 | Medium | Not scored | 08 Apr, 2026 | Go github.com/cloudnativelabs/kube-router Go github.com/cloudnativelabs/kube-router/v2 |
File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands CVE-2026-35607, GHSA-7526-j432-6ppp, GO-2026-5205 | High | 0.4% | 08 Apr, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check CVE-2026-35606, GHSA-67cg-cpj7-qgc9, GO-2026-5167 | Medium | 0.4% | 08 Apr, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser share links remain accessible after Share/Download permissions are revoked CVE-2026-35604, GHSA-v9w4-gm2x-6rvf, GO-2026-5659 | High | 0.3% | 08 Apr, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser has an access rule bypass via HasPrefix without trailing separator in path matching CVE-2026-35605, GHSA-5q48-q4fm-g3m6, GO-2026-5150 | Medium | 0.4% | 08 Apr, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |