Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
goshs has Auth Bypass via Share Token CVE-2026-34581, GHSA-jgfx-74g2-9r6g, GO-2026-5469 | High | 0.4% | 01 Apr, 2026 | Go github.com/patrickhener/goshs |
Tinyauth has OAuth account confusion via shared mutable state on singleton service instances CVE-2026-33544, GHSA-9q5m-jfc4-wc92, GO-2026-5296 | High | 0.4% | 01 Apr, 2026 | Go github.com/steveiliop56/tinyauth |
Temporal Server: attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster CVE-2026-5199, GHSA-xpg8-3hhp-p7w8, GO-2026-5766 | Low | 0.3% | 01 Apr, 2026 | Go go.temporal.io/server |
SiYuan vulnerable to reflected XSS via SVG namespace prefix bypass in SanitizeSVG (getDynamicIcon, unauthenticated) CVE-2026-34605, GHSA-73g7-86qr-jrg3, GO-2026-5201 | High | 0.5% | 01 Apr, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan Desktop: Stored XSS in imported .sy.zip content leads to arbitrary command execution CVE-2026-34585, GHSA-ff66-236v-p4fg, GO-2026-5357 | High | 0.3% | 01 Apr, 2026 | Go github.com/siyuan-note/siyuan/kernel |
File Browser vulnerable to Stored Cross-site Scripting via text/template branding injection CVE-2026-34530, GHSA-xfqj-3vmx-63wv, GO-2026-5754 | Medium | 0.4% | 31 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution CVE-2026-34528, GHSA-x8jc-jvqm-pm3f, GO-2026-5747 | High | 0.7% | 31 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file CVE-2026-34529, GHSA-5vpr-4fgw-f69h, GO-2026-5156 | High | 0.3% | 31 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark CVE-2026-34453, GHSA-c77m-r996-jr3q, GO-2026-5318 | High | 1.2% | 31 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection CVE-2026-34449, GHSA-68p4-j234-43mv, GO-2026-5171 | Critical | 0.5% | 31 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client CVE-2026-34448, GHSA-rx4h-526q-4458, GO-2026-5644 | Critical | 0.5% | 31 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface CVE-2026-34227, GHSA-6fpf-248c-m7wm, GO-2026-5175 | Medium | 0.4% | 31 Mar, 2026 | Go github.com/bishopfox/sliver |
Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding) CVE-2026-25726, GHSA-f8xp-wvcx-p6f4, GO-2026-5350 | High | 0.4% | 31 Mar, 2026 | Go github.com/cloudreve/Cloudreve Go github.com/cloudreve/Cloudreve/v3 Go github.com/cloudreve/Cloudreve/v4 |
Fleet's user account creation via invite does not enforce invited email address CVE-2026-34389, GHSA-4f9r-x588-pp2h, GO-2026-4912 | Medium | 0.2% | 30 Mar, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint CVE-2026-34388, GHSA-w254-4hp5-7cvv, GO-2026-4915 | Medium | 0.3% | 30 Mar, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin CVE-2026-34386, GHSA-9p23-p2m4-2r4m, GO-2026-4913 | Medium | 0.3% | 30 Mar, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database CVE-2026-34385, GHSA-v895-833r-8c45, GO-2026-4914 | Medium | 0.2% | 30 Mar, 2026 | Go github.com/fleetdm/fleet/v4 |
go-git: Maliciously crafted idx file can cause asymmetric memory consumption CVE-2026-34165, GHSA-jhf3-xxhw-2wpp, GO-2026-4910 | Medium | 0.2% | 30 Mar, 2026 | Go github.com/go-git/go-git Go github.com/go-git/go-git/v4 Go github.com/go-git/go-git/v5 |
Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF) CVE-2026-33990, GHSA-x2f5-332j-9xwq, GO-2026-4911 | Medium | 0.3% | 30 Mar, 2026 | Go github.com/docker/model-runner |
go-git missing validation decoding Index v4 files leads to panic CVE-2026-33762, GHSA-gm2x-2g9h-ccm8, GO-2026-4909 | Low | 0.2% | 30 Mar, 2026 | Go github.com/go-git/go-git Go github.com/go-git/go-git/v4 Go github.com/go-git/go-git/v5 |
nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover CVE-2026-33032, GHSA-h6c2-x2m2-mwhf, GO-2026-4904 | Critical | 35.3% | 30 Mar, 2026 | Go github.com/0xJacky/Nginx-UI |
nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys CVE-2026-33030, GHSA-5hf2-vhj6-gj9m, GO-2026-4901 | High | 0.3% | 30 Mar, 2026 | Go github.com/0xJacky/nginx-ui |
nginx-ui Vulnerable to DoS via Negative Integer Input in Logrotate Interval CVE-2026-33029, GHSA-cp8r-8jvw-v3qg, GO-2026-4902 | Medium | 1.0% | 30 Mar, 2026 | Go github.com/0xJacky/Nginx-UI |
nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse CVE-2026-33028, GHSA-m468-xcm6-fxg4, GO-2026-4906 | High | 0.6% | 30 Mar, 2026 | Go github.com/0xJacky/Nginx-UI Go github.com/uozi-tech/cosy |
Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation CVE-2026-33027, GHSA-m8p8-53vf-8357, GO-2026-4907 | Medium | 0.4% | 30 Mar, 2026 | Go github.com/0xJacky/Nginx-UI |
nginx-ui Backup Restore Allows Tampering with Encrypted Backups CVE-2026-33026, GHSA-fhh2-gg7w-gwpq, GO-2026-4903 | Critical | 0.3% | 30 Mar, 2026 | Go github.com/0xJacky/Nginx-UI |
Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3) CVE-2026-27018, GHSA-jjwv-57xh-xr6r, GO-2026-4905 | High | 1.7% | 30 Mar, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186) GHSA-46wh-3698-f2cx, GO-2026-4897 | High | Not scored | 29 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Sliver: Nil Pointer Dereference in tunnelCloseHandler causes panic when a reverse tunnel (rportfwd) close is attempted GHSA-c279-989m-238f, GO-2026-4899 | High | Not scored | 29 Mar, 2026 | Go github.com/bishopfox/sliver |
MinIO is Vulnerable to SSE Metadata Injection via Replication Headers CVE-2026-34204, GHSA-3rh2-v3gr-35p9, GO-2026-4896 | High | 0.1% | 27 Mar, 2026 | Go github.com/minio/minio |
Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField CVE-2026-33433, GHSA-qr99-7898-vr7c, GO-2026-4893 | Medium | 0.5% | 27 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Flannel has cross-node remote code execution via extension backend BackendData injection CVE-2026-32241, GHSA-vchx-5pr6-ffx2, GO-2026-4894 | High | 2.8% | 27 Mar, 2026 | Go github.com/flannel-io/flannel |
A Fleet team maintainer can transfer hosts from any team via missing source team authorization CVE-2026-29180, GHSA-m2h6-4xpq-qw3m, GO-2026-4892 | Medium | 0.3% | 27 Mar, 2026 | Go github.com/fleetdm/fleet/v4 |
act: actions/cache server allows malicious cache injection CVE-2026-34042, GHSA-x34h-54cw-9825, GO-2026-4890 | High | 0.5% | 27 Mar, 2026 | Go github.com/nektos/act |
act: Unrestricted set-env and add-path command processing enables environment injection CVE-2026-34041, GHSA-xmgr-9pqc-h5vw, GO-2026-4891 | High | 0.6% | 27 Mar, 2026 | Go github.com/nektos/act |
Fleet's unbounded request body read allows remote Denial of Service CVE-2026-26061, GHSA-99hj-44vg-hfcp, GO-2026-4889 | High | 0.5% | 27 Mar, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet: Password reset tokens remain valid after password change for 24 hours CVE-2026-26060, GHSA-3458-r943-hmx4, GO-2026-4888 | Medium | 0.3% | 27 Mar, 2026 | Go github.com/fleetdm/fleet/v4 |
Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass CVE-2026-32695, GHSA-67jx-r9pv-98rj, GO-2026-4880 | Medium | 0.5% | 27 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Moby has AuthZ plugin bypass when provided oversized request bodies CVE-2026-34040, GHSA-x744-4wpc-v9h2, GO-2026-4887 | High | 9.3% | 27 Mar, 2026 | Go github.com/docker/docker Go github.com/moby/moby Go github.com/moby/moby/v2 |
Moby has an Off-by-one error in its plugin privilege validation CVE-2026-33997, GHSA-pxq6-2prw-chj9, GO-2026-4883 | Medium | 0.4% | 27 Mar, 2026 | Go github.com/docker/docker Go github.com/moby/moby Go github.com/moby/moby/v2 |
Incus has an abitrary file write through its systemd-creds options CVE-2026-33945, GHSA-q4q8-7f2j-9h9f, GO-2026-4884 | Critical | 0.5% | 27 Mar, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |
Local Incus UI web server vulnerable to nuthentication bypass CVE-2026-33898, GHSA-453r-g2pg-cxxq, GO-2026-4879 | High | 0.4% | 27 Mar, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incus |
Incus vulnerable to arbitrary file read and write through pongo templates CVE-2026-33897, GHSA-83xr-5xxr-mh92, GO-2026-4881 | Critical | 0.5% | 27 Mar, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |
Incus vulnerable to denial of source through crafted bucket backup file CVE-2026-33743, GHSA-vg76-xmhg-j5x3, GO-2026-4886 | Medium | 0.4% | 27 Mar, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |
Incus vulnerable to local privilege escalation through VM screenshot path CVE-2026-33711, GHSA-q9vp-3wcg-8p4x, GO-2026-4885 | Medium | 0.4% | 27 Mar, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |
Incus does not verify combined fingerprint when downloading images from simplestreams servers CVE-2026-33542, GHSA-p8mm-23gg-jc9r, GO-2026-4882 | High | 0.2% | 27 Mar, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/client |
Grafana public dashboards disclose all direct mode datasources BIT-grafana-2026-27877, CVE-2026-27877, GHSA-3q27-7qjq-p9c5, GO-2026-5095 | Medium | 0.3% | 27 Mar, 2026 | Go github.com/grafana/grafana |
Grafana Tempo has Inadequate Encryption Strength CVE-2026-28377, GHSA-ffqx-q65f-36jf, GO-2026-5359 | High | 0.2% | 27 Mar, 2026 | Go github.com/grafana/tempo |
Harbor: LDAP password and OIDC secret are not redacted in the audit log GHSA-prh4-vhfh-24mj, GO-2026-4876 | Medium | Not scored | 26 Mar, 2026 | Go github.com/goharbor/harbor |
Ella Core Panics during NAS Authentication Response/Failure with missing IEs CVE-2026-33907, GHSA-55q8-2gwx-29pc, GO-2026-4872 | Medium | 0.2% | 26 Mar, 2026 | Go github.com/ellanetworks/core |