Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
File Browser has a Command Injection via Hook Runner CVE-2026-35585, GHSA-jvpw-637p-h3pw, GO-2026-5481 | High | 2.0% | 08 Apr, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Code execution vulnerability in SWIG code generation in cmd/go BIT-golang-2026-27140, CVE-2026-27140, GO-2026-4871 | 0.7% | 07 Apr, 2026 | Go toolchain | |
Missing bound checks can lead to memory corruption in safe Go in cmd/compile BIT-golang-2026-27143, CVE-2026-27143, GO-2026-4868 | 0.5% | 07 Apr, 2026 | Go toolchain | |
Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile BIT-golang-2026-27144, CVE-2026-27144, GO-2026-4867 | 0.3% | 07 Apr, 2026 | Go toolchain | |
Unexpected work during chain building in crypto/x509 BIT-golang-2026-32280, CVE-2026-32280, GO-2026-4947 | 0.6% | 07 Apr, 2026 | Go stdlib | |
Inefficient policy validation in crypto/x509 BIT-golang-2026-32281, CVE-2026-32281, GO-2026-4946 | 0.4% | 07 Apr, 2026 | Go stdlib | |
TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix BIT-golang-2026-32282, CVE-2026-32282, GO-2026-4864 | 0.3% | 07 Apr, 2026 | Go stdlib | |
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls BIT-golang-2026-32283, CVE-2026-32283, GO-2026-4870 | 0.6% | 07 Apr, 2026 | Go stdlib | |
Unbounded allocation for old GNU sparse in archive/tar BIT-golang-2026-32288, CVE-2026-32288, GO-2026-4869 | 0.3% | 07 Apr, 2026 | Go stdlib | |
JsBraceDepth Context Tracking Bugs (XSS) in html/template BIT-golang-2026-32289, CVE-2026-32289, GO-2026-4865 | 0.3% | 07 Apr, 2026 | Go stdlib | |
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 BIT-golang-2026-33810, CVE-2026-33810, GO-2026-4866 | 0.3% | 07 Apr, 2026 | Go stdlib | |
OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) CVE-2026-29181, GHSA-mh2q-q3fh-2475, GO-2026-5506 | High | 0.8% | 07 Apr, 2026 | Go go.opentelemetry.io/otel |
Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags GHSA-qmwh-9m9c-h36m, GO-2026-5587 | High | Not scored | 07 Apr, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
Gotenberg Vulnerable to ReDoS via extraHttpHeaders scope feature CVE-2026-35458, GHSA-fmwg-qcqh-m992, GO-2026-5372 | High | 0.5% | 07 Apr, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision CVE-2026-34972, GHSA-jwvj-g8pc-cx45, GO-2026-5483 | Medium | 0.2% | 07 Apr, 2026 | Go github.com/openfga/openfga |
Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation CVE-2026-4740, GHSA-q4gv-pjmh-c735, GO-2026-5564 | High | 0.2% | 07 Apr, 2026 | Go open-cluster-management.io/ocm |
pgx contains memory-safety vulnerability CVE-2026-33815, GHSA-xgrm-4fwx-7qm8, GO-2026-4771 | Critical | 0.6% | 07 Apr, 2026 | Go github.com/jackc/pgx/v5 |
Memory-safety vulnerability in github.com/jackc/pgx/v5. CVE-2026-33816, GHSA-9jj7-4m8r-rfcm, GO-2026-4772 | Critical | 0.6% | 07 Apr, 2026 | Go github.com/jackc/pgx/v5 |
go-ipld-prime: DAG-CBOR decoder unbounded memory allocation from CBOR headers CVE-2026-35480, GHSA-378j-3jfj-8r9f, GO-2026-5073 | Medium | 0.2% | 06 Apr, 2026 | Go github.com/ipld/go-ipld-prime |
Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri GHSA-x3f4-v83f-7wp2, GO-2026-5737 | High | Not scored | 06 Apr, 2026 | Go github.com/authorizerdev/authorizer |
Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation GHSA-jfwg-rxf3-p7r9, GO-2026-5467 | High | Not scored | 06 Apr, 2026 | Go github.com/authorizerdev/authorizer |
Distribution: stale blob access resurrection via repo-scoped redis descriptor cache invalidation BIT-distribution-2026-35172, CVE-2026-35172, GHSA-f2g3-hh2r-cwgc, GO-2026-4942 | High | 0.5% | 06 Apr, 2026 | Go github.com/distribution/distribution Go github.com/distribution/distribution/v3 |
Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm CVE-2026-33540, GHSA-3p65-76g6-3w7r, GO-2026-5094 | High | 0.3% | 06 Apr, 2026 | Go github.com/distribution/distribution Go github.com/distribution/distribution/v3 |
Code Extension Marketplace: Zip Slip Path Traversal CVE-2026-35454, GHSA-8x9r-hvwg-c55h, GO-2026-5270 | High | 0.3% | 04 Apr, 2026 | Go github.com/coder/code-marketplace |
Hugo: Certain markdown links are not properly escaped CVE-2026-35166, GHSA-mcv8-8m8x-48pg, GO-2026-5504 | Medium | 0.2% | 03 Apr, 2026 | Go github.com/gohugoio/hugo |
goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) CVE-2026-35471, GHSA-6qcc-6q27-whp8, GO-2026-5186 | Critical | 0.7% | 03 Apr, 2026 | Go github.com/patrickhener/goshs |
Juju has a resource poisoning vulnerability CVE-2025-68153, GHSA-245v-p8fj-vwm2, GO-2026-4924 | High | 0.2% | 03 Apr, 2026 | Go github.com/juju/juju |
Juju: Read All Controller Logs From Compromised Workload CVE-2025-68152, GHSA-j6f6-jp3p-53mw, GO-2026-5451 | Medium | 0.4% | 03 Apr, 2026 | Go github.com/juju/juju |
Focalboard doesn't sanitize category IDs before incorporating them into dynamic SQL statements CVE-2026-25773, GHSA-p32q-v29x-wq9r, GO-2026-5524 | High | 0.3% | 03 Apr, 2026 | Go github.com/mattermost/focalboard |
Focalboard doesn't validate file ownership when serving uploaded files CVE-2026-28736, GHSA-vph7-r229-qxpf, GO-2026-5670 | Medium | 0.2% | 03 Apr, 2026 | Go github.com/mattermost/focalboard |
Casdoor vulnerable to Stored XSS via Application formCss / formSideHtml CVE-2026-5468, GHSA-w799-7525-rpr6, GO-2026-5697 | Low | 0.2% | 03 Apr, 2026 | Go github.com/casdoor/casdoor |
Casdoor vulnerable to SSRF via crafted Webhook URL CVE-2026-5469, GHSA-p8c7-hjc4-gwf8, GO-2026-5535 | Medium | 0.3% | 03 Apr, 2026 | Go github.com/casdoor/casdoor |
Casdoor vulnerable to Open Redirect CVE-2026-5467, GHSA-mj24-pqx2-6788, GO-2026-5509 | Low | 0.3% | 03 Apr, 2026 | Go github.com/casdoor/casdoor |
goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload CVE-2026-35393, GHSA-jg56-wf8x-qrv5, GO-2026-5468 | Critical | 0.7% | 03 Apr, 2026 | Go github.com/patrickhener/goshs |
goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload CVE-2026-35392, GHSA-g8mv-vp7j-qp64, GO-2026-5394 | Critical | 0.7% | 03 Apr, 2026 | Go github.com/patrickhener/goshs |
Antrea has Missing Encryption of Sensitive Data CVE-2026-34992, GHSA-qcmw-8mm4-4p28, GO-2026-5579 | High | 0.1% | 03 Apr, 2026 | Go antrea.io/antrea |
Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata CVE-2026-35037, GHSA-cqgf-f4x7-g6wc, GO-2026-5331 | High | 0.6% | 03 Apr, 2026 | Go github.com/lin-snow/ech0 |
Ech0 has Unauthenticated Server-Side Request Forgery in Website Preview Feature CVE-2026-35036, GHSA-wc4h-2348-jc3p, GO-2026-5704 | High | 0.3% | 03 Apr, 2026 | Go github.com/lin-snow/ech0 |
Go JOSE Panics in JWE decryption CVE-2026-34986, GHSA-78h2-9frx-2jm8, GO-2026-4945 | High | 0.7% | 03 Apr, 2026 | Go github.com/go-jose/go-jose Go github.com/go-jose/go-jose/v3 Go github.com/go-jose/go-jose/v4 |
Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization CVE-2026-34976, GHSA-p5rh-vmhp-gvcw, GO-2026-5529 | Critical | 2.1% | 02 Apr, 2026 | Go github.com/dgraph-io/dgraph Go github.com/dgraph-io/dgraph/v24 Go github.com/dgraph-io/dgraph/v25 Go github.com/hypermodeinc/dgraph/v24 |
Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster CVE-2026-4370, GHSA-gvrj-cjch-728p, GO-2026-5405 | Critical | 0.4% | 02 Apr, 2026 | Go github.com/juju/juju |
listmonk's active sessions remain valid after password reset and password change CVE-2026-34828, GHSA-h5j9-cvrw-v5qh, GO-2026-5414 | High | 0.3% | 01 Apr, 2026 | Go github.com/knadh/listmonk |
Ferret: Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites CVE-2026-34783, GHSA-j6v5-g24h-vg4j, GO-2026-5452 | High | 0.5% | 01 Apr, 2026 | Go github.com/MontFerret/ferret Go github.com/MontFerret/ferret/v2 |
Nhost Leaks Refresh Tokens via URL Query Parameter in OAuth Provider Callback CVE-2026-34969, GHSA-g2qj-prgh-4g9r, GO-2026-5388 | Low | 0.3% | 01 Apr, 2026 | Go github.com/nhost/nhost |
KubeAI: OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods CVE-2026-34940, GHSA-324q-cwx9-7crr, GO-2026-4920 | High | 0.5% | 01 Apr, 2026 | Go github.com/kubeai-project/kubeai |
Tesla Fleet Telemetry allows spoofing telemetry for arbitrary vehicles via compromised vehicle credentials GHSA-prxj-3gcv-cqrh, GO-2026-5553 | Medium | Not scored | 01 Apr, 2026 | Go github.com/teslamotors/fleet-telemetry |
Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber CVE-2026-34762, GHSA-xw45-cc32-442f, GO-2026-5770 | Low | 0.2% | 01 Apr, 2026 | Go github.com/ellanetworks/core |
Ella Core Panics Upon NGAP handover failure CVE-2026-34761, GHSA-6gm8-3g4h-w82m, GO-2026-5177 | Medium | 0.3% | 01 Apr, 2026 | Go github.com/ellanetworks/core |
DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost CVE-2026-34742, GHSA-xw59-hvm2-8pj6, GO-2026-5771 | High | 0.5% | 01 Apr, 2026 | Go github.com/modelcontextprotocol/go-sdk |
NetBird has Race Condition on UpdateUser Function, Resulting in Privilege Escalation From Admin to Owner GHSA-rxmp-8h9v-56cx, GO-2026-5646 | Medium | Not scored | 01 Apr, 2026 | Go github.com/netbirdio/netbird |