Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Ella Core has Privilege Escalation via Database Restore by NetworkManager role CVE-2026-33906, GHSA-87j9-m7x6-hvw2, GO-2026-4873 | High | 0.4% | 26 Mar, 2026 | Go github.com/ellanetworks/core |
Ella Core has a Denial of Service via SCTP connection cleanup deadlock CVE-2026-33904, GHSA-9h59-p45g-445h, GO-2026-4874 | Medium | 0.2% | 26 Mar, 2026 | Go github.com/ellanetworks/core |
Ella Core panics when processing a crafted NGAP LocationReport message CVE-2026-33903, GHSA-f2f3-9cx3-wcmf, GO-2026-4875 | Medium | 0.2% | 26 Mar, 2026 | Go github.com/ellanetworks/core |
Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions BIT-grafana-2026-21724, CVE-2026-21724, GHSA-7g92-g4vh-hp84, GO-2026-5219 | Medium | 0.3% | 26 Mar, 2026 | Go github.com/grafana/grafana |
Contrast BadAML injection allows arbitrary code execution CVE-2026-100839, GHSA-g9ww-x58f-9g6m, GO-2026-4863 | High | 0.1% | 26 Mar, 2026 | Go github.com/edgelesssys/contrast |
OpenBao has Reflected XSS in its OIDC authentication error message BIT-openbao-2026-33758, CVE-2026-33758, GHSA-cpj3-3r2f-xj59, GO-2026-4862 | Critical | 0.3% | 26 Mar, 2026 | Go github.com/openbao/openbao |
OpenBao lacks user confirmation for OIDC direct callback mode BIT-openbao-2026-33757, CVE-2026-33757, GHSA-7q7g-x6vg-xpc3, GO-2026-4860 | Critical | 0.4% | 26 Mar, 2026 | Go github.com/openbao/openbao |
Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences CVE-2026-3108, GHSA-3439-vqgj-2gcf, GO-2026-5067 | High | 0.3% | 26 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration CVE-2026-3112, GHSA-3mw5-466q-295q, GO-2026-5092 | Medium | 0.4% | 26 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't set permissions on downloaded bulk export CVE-2026-3113, GHSA-4765-v66x-rqx7, GO-2026-5112 | Medium | 0.1% | 26 Mar, 2026 | Go github.com/mattermost/mattermost-server |
Mattermost doesn't validate decompressed archive entry sizes during file extraction CVE-2026-3114, GHSA-vhgh-g7x8-4rx8, GO-2026-5663 | Medium | 0.4% | 26 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows authenticated guest users to enumerate user IDs outside their allowed visibility scope CVE-2026-3115, GHSA-mpc7-mm28-f6wq, GO-2026-5512 | Medium | 0.2% | 26 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
BuildKit Git URL subdir component can cause access to restricted files CVE-2026-33748, GHSA-4vrq-3vrq-g6gg, GO-2026-4859 | High | 0.5% | 26 Mar, 2026 | Go github.com/moby/buildkit |
BuildKit's Malicious frontend can cause file escape outside of storage root CVE-2026-33747, GHSA-4c29-8rgm-jvjj, GO-2026-4858 | High | 0.5% | 26 Mar, 2026 | Go github.com/moby/buildkit |
OpenFGA has an Authorization Bypass through cached keys CVE-2026-33729, GHSA-h6c8-cww8-35hf, GO-2026-4857 | Medium | 0.3% | 26 Mar, 2026 | Go github.com/openfga/openfga |
Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR CVE-2026-56765, GHSA-2pv8-4c52-mf8j, GO-2026-4855 | Critical | 0.5% | 26 Mar, 2026 | Go code.vikunja.io/api |
Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic BIT-cilium-2026-33726, BIT-cilium-operator-2026-33726, BIT-hubble-relay-2026-33726, CVE-2026-33726, GHSA-hxv8-4j4r-cqgv, GO-2026-4856 | Medium | 0.3% | 26 Mar, 2026 | Go github.com/cilium/cilium |
Mattermost has an Incorrect Authorization issue CVE-2026-4274, GHSA-g7fp-cqj5-x8hf, GO-2026-5393 | Medium | 0.1% | 26 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion CVE-2026-33700, GHSA-f95f-77jx-fcjc, GO-2026-4850 | Medium | 0.3% | 25 Mar, 2026 | Go code.vikunja.io/api |
Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation CVE-2026-33680, GHSA-8hp8-9fhr-pfm9, GO-2026-4848 | High | 0.4% | 25 Mar, 2026 | Go code.vikunja.io/api |
Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download CVE-2026-33679, GHSA-g9xj-752q-xh63, GO-2026-4852 | Medium | 0.4% | 25 Mar, 2026 | Go code.vikunja.io/api |
Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion CVE-2026-33678, GHSA-jfmm-mjcp-8wq2, GO-2026-4853 | High | 0.3% | 25 Mar, 2026 | Go code.vikunja.io/api |
Vikjuna: Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API CVE-2026-33677, GHSA-7c2g-p23p-4jg3, GO-2026-4846 | Medium | 0.3% | 25 Mar, 2026 | Go code.vikunja.io/api |
Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read CVE-2026-33676, GHSA-8cmm-j6c4-rr8v, GO-2026-4847 | Medium | 0.4% | 25 Mar, 2026 | Go code.vikunja.io/api |
Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources CVE-2026-33675, GHSA-g66v-54v9-52pr, GO-2026-4851 | Medium | 0.3% | 25 Mar, 2026 | Go code.vikunja.io/api |
Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect CVE-2026-33668, GHSA-94xm-jj8x-3cr4, GO-2026-4849 | High | 0.5% | 25 Mar, 2026 | Go code.vikunja.io/api |
Zoraxy: Authenticated Path Traversal in Config Import leads to RCE CVE-2026-33529, GHSA-7pq3-326h-f8q9, GO-2026-4844 | Low | 0.4% | 25 Mar, 2026 | Go github.com/tobychui/zoraxy |
SiYuan has directory traversal within its publishing service CVE-2026-33670, GHSA-xmw9-6r43-x9ww, GO-2026-4843 | Critical | 0.7% | 25 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan has Arbitrary Document Reading within the Publishing Service CVE-2026-33669, GHSA-34xj-66v3-6j83, GO-2026-4842 | Critical | 0.5% | 25 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw CVE-2026-27656, GHSA-fg35-5rf6-qg3g, GO-2026-5360 | Medium | 0.2% | 25 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't properly validate CSRF tokens CVE-2026-27659, GHSA-rmhw-c3xr-m3xx, GO-2026-5629 | Medium | 0.1% | 25 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't rate limit login requests, allowing DoS CVE-2026-26233, GHSA-247x-7qw8-fp98, GO-2026-4916 | Medium | 0.3% | 25 Mar, 2026 | Go github.com/mattermost/mattermost-server |
Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds CVE-2026-20719, GHSA-86vc-mg26-fj6x, GO-2026-5245 | Medium | 0.4% | 25 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Go Images vulnerable to an out-of-memory error via a crafted TIFF file CVE-2026-33809, GHSA-44p7-9xx4-hf2g, GO-2026-4815 | Medium | 0.3% | 25 Mar, 2026 | Go golang.org/x/image |
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead BIT-nats-2026-27889, CVE-2026-27889, GHSA-pq2q-rcw4-3hr6, GO-2026-4841 | High | 0.6% | 25 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint CVE-2026-33638, GHSA-m983-7426-5hrj, GO-2026-4838 | Medium | 0.5% | 24 Mar, 2026 | Go github.com/lin-snow/ech0 |
NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching BIT-nats-2026-33248, CVE-2026-33248, GHSA-3f24-pcvm-5jqc, GO-2026-4828 | Medium | 0.1% | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers BIT-nats-2026-33246, CVE-2026-33246, GHSA-55h8-8g96-x4hj, GO-2026-4830 | Medium | 0.1% | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing BIT-nats-2026-33223, CVE-2026-33223, GHSA-pwx7-fx9r-hr4h, GO-2026-4835 | Medium | 0.2% | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS JetStream has an authorization bypass through its Management API BIT-nats-2026-33222, CVE-2026-33222, GHSA-9983-vrx2-fg9c, GO-2026-4832 | Medium | 0.3% | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS is vulnerable to pre-auth DoS through WebSockets client service BIT-nats-2026-33219, CVE-2026-33219, GHSA-8r68-gvr4-jh7j, GO-2026-4831 | Medium | 0.5% | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS has pre-auth server panic via leafnode handling BIT-nats-2026-33218, CVE-2026-33218, GHSA-vprv-35vv-q339, GO-2026-4837 | High | 0.6% | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS allows MQTT clients to bypass ACL checks BIT-nats-2026-33217, CVE-2026-33217, GHSA-jxxm-27vp-c3m5, GO-2026-4834 | High | 0.3% | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS has MQTT plaintext password disclosure BIT-nats-2026-33216, CVE-2026-33216, GHSA-v722-jcv5-w7mc, GO-2026-4836 | High | 0.4% | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS is vulnerable to MQTT hijacking via Client ID BIT-nats-2026-33215, CVE-2026-33215, GHSA-fcjp-h8cc-6879, GO-2026-4833 | Medium | 0.2% | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS Server panic via malicious compression on leafnode port BIT-nats-2026-29785, CVE-2026-29785, GHSA-52jh-2xxh-pwh6, GO-2026-4829 | High | 0.7% | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS credentials are exposed in monitoring port via command-line argv BIT-nats-2026-33247, CVE-2026-33247, GHSA-x6g4-f6q3-fqvv, GO-2026-4827 | High | 0.4% | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
NATS: Message tracing can be redirected to arbitrary subject BIT-nats-2026-33249, CVE-2026-33249, GHSA-8m2x-3m6q-6w8j, GO-2026-4826 | Medium | 0.2% | 24 Mar, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token CVE-2026-33621, GHSA-j65m-hv65-r264, GO-2026-4821 | Medium | 0.3% | 24 Mar, 2026 | Go github.com/pinchtab/pinchtab |
PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution CVE-2026-33623, GHSA-p8mm-644p-phmh, GO-2026-4823 | Medium | 3.0% | 24 Mar, 2026 | Go github.com/pinchtab/pinchtab Go github.com/pinchtab/pinchtab/cmd/pinchtab |