Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution CVE-2026-33622, GHSA-w5pc-m664-r62v, GO-2026-4824 | Medium | 0.5% | 24 Mar, 2026 | Go github.com/pinchtab/pinchtab Go github.com/pinchtab/pinchtab/cmd/pinchtab |
PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems CVE-2026-33620, GHSA-mrqc-3276-74f8, GO-2026-4822 | Medium | 0.3% | 24 Mar, 2026 | Go github.com/pinchtab/pinchtab |
PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl CVE-2026-33619, GHSA-xqq2-4j46-vwp7, GO-2026-4825 | Medium | 0.3% | 24 Mar, 2026 | Go github.com/pinchtab/pinchtab |
FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel CVE-2026-54685, GHSA-7789-65hx-f26w, GO-2026-4820 | Medium | 0.3% | 24 Mar, 2026 | Go github.com/gtsteffaniak/filebrowser/backend |
GoDoxy has a Path Traversal Vulnerability in its File API CVE-2026-33528, GHSA-4753-cmc8-8j9v, GO-2026-4817 | Medium | 0.5% | 24 Mar, 2026 | Go github.com/yusing/godoxy |
Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting CVE-2026-33525, GHSA-gmfg-3v4q-9qr4, GO-2026-4818 | Low | 0.2% | 24 Mar, 2026 | Go github.com/authelia/authelia Go github.com/authelia/authelia/v4 |
Trivy ecosystem supply chain was briefly compromised CVE-2026-33634, GHSA-69fq-xp46-6x23, GO-2026-4919 | CriticalExploited | 59.7% | 23 Mar, 2026 | GitHub Actions aquasecurity/setup-trivy GitHub Actions aquasecurity/trivy-action Go github.com/aquasecurity/trivy |
New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check CVE-2026-30886, GHSA-f35r-v9x5-r8mc, GO-2026-4814 | Medium | 0.3% | 23 Mar, 2026 | Go github.com/QuantumNous/new-api |
New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure CVE-2026-32879, GHSA-5353-f8fq-65vc, GO-2026-4813 | Medium | 0.3% | 23 Mar, 2026 | Go github.com/QuantumNous/new-api |
DigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint CVE-2026-24516, GHSA-fh3m-562m-w4f6, GO-2026-4854 | High | 2.6% | 23 Mar, 2026 | Go github.com/digitalocean/droplet-agent |
Harbor allows the use of the default password for web UI login BIT-harbor-2026-4404, CVE-2026-4404, GHSA-hj7x-hmf2-hc2p, GO-2026-4845 | Critical | 0.5% | 23 Mar, 2026 | Go github.com/goharbor/harbor |
Free5GC AMF is vulnerable to DoS through its HandleRegistrationComplete function CVE-2026-4531, GHSA-xq44-64rg-8g3h, GO-2026-5767 | Medium | 0.4% | 22 Mar, 2026 | Go github.com/free5gc/amf |
NFS CSI driver for Kubernetes is Vulnerable to Path Traversal through Volume Identifier Parameter CVE-2026-3864, GHSA-2mjq-54qg-7w6j, GO-2026-4816 | Medium | 0.7% | 21 Mar, 2026 | Go github.com/kubernetes-csi/csi-driver-nfs |
Ory Keto has a SQL injection via forged pagination tokens CVE-2026-33505, GHSA-c38g-mx2c-9wf2, GO-2026-4800 | High | 0.2% | 20 Mar, 2026 | Go github.com/ory/keto |
Ory Hydra has a SQL injection via forged pagination tokens CVE-2026-33504, GHSA-r9w3-57w2-gch2, GO-2026-4807 | High | 0.4% | 20 Mar, 2026 | Go github.com/ory/hydra Go github.com/ory/hydra/v2 |
Ory Kratos has a SQL injection via forged pagination tokens CVE-2026-33503, GHSA-hgx2-28f8-6g2r, GO-2026-4801 | High | 0.3% | 20 Mar, 2026 | Go github.com/ory/kratos |
Ory Oathkeeper has a path traversal authorization bypass CVE-2026-33494, GHSA-p224-6x5r-fjpm, GO-2026-4804 | Critical | 0.5% | 20 Mar, 2026 | Go github.com/ory/oathkeeper |
Ory Oathkeeper has an authentication bypass by cache key confusion CVE-2026-33496, GHSA-4mq7-pvjg-xp2r, GO-2026-4799 | High | 0.4% | 20 Mar, 2026 | Go github.com/ory/oathkeeper |
Ory Oathkeeper has an authentication bypass by usage of untrusted header CVE-2026-33495, GHSA-vhr5-ggp3-qq85, GO-2026-4810 | Medium | 0.2% | 20 Mar, 2026 | Go github.com/ory/oathkeeper |
etcd: Authorization bypasses in multiple APIs BIT-etcd-2026-33413, CVE-2026-33413, GHSA-q8m4-xhhv-38mg, GO-2026-4806 | High | 0.3% | 20 Mar, 2026 | Go go.etcd.io/etcd Go go.etcd.io/etcd/v3 |
MinIO LDAP login brute-force via user enumeration and missing rate limit CVE-2026-33419, GHSA-jv87-32hw-hh99, GO-2026-4803 | Critical | 0.5% | 20 Mar, 2026 | Go github.com/minio/minio |
Syft improper temporary file cleanup CVE-2026-33481, GHSA-rjcw-vg7j-m9rc, GO-2026-4809 | Medium | 0.4% | 20 Mar, 2026 | Go github.com/anchore/syft |
Siyuan has an Unauthenticated Arbitrary File Read via Path Traversal CVE-2026-33476, GHSA-hhgj-gg9h-rjp7, GO-2026-4802 | High | 3.3% | 20 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Vikunja Affected by DoS via Image Preview Generation CVE-2026-33474, GHSA-wc83-79hj-hpmq, GO-2026-4811 | Medium | 0.3% | 20 Mar, 2026 | Go code.vikunja.io/api |
Vikunja has TOTP Reuse During Validity Window CVE-2026-33473, GHSA-p747-qc5p-773r, GO-2026-4805 | Medium | 0.3% | 20 Mar, 2026 | Go code.vikunja.io/api |
etcd: Nested etcd transactions bypass RBAC authorization checks BIT-etcd-2026-33343, CVE-2026-33343, GHSA-rfx7-8w68-q57q, GO-2026-4808 | Low | 0.2% | 20 Mar, 2026 | Go go.etcd.io/etcd Go go.etcd.io/etcd/v3 |
Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement CVE-2026-33316, GHSA-vq4q-79hh-q767, GO-2026-4798 | High | 0.4% | 20 Mar, 2026 | Go code.vikunja.io/api |
Vikunja has a 2FA Bypass via Caldav Basic Auth CVE-2026-33315, GHSA-47cr-f226-r4pq, GO-2026-4794 | Medium | 0.3% | 20 Mar, 2026 | Go code.vikunja.io/api |
Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments CVE-2026-33313, GHSA-mr3j-p26x-72x4, GO-2026-4797 | Medium | 0.3% | 20 Mar, 2026 | Go code.vikunja.io/api |
Vikunja read-only users can delete project background images via broken object-level authorization CVE-2026-33312, GHSA-564f-wx8x-878h, GO-2026-4795 | Medium | 0.2% | 20 Mar, 2026 | Go code.vikunja.io/api |
Traefik Affected by BasicAuth Middleware Timing Attack Allows Username Enumeration CVE-2026-32595, GHSA-g3hg-j4jv-cwfr, GO-2026-4792 | Medium | 0.4% | 20 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Traefik has a Potential mTLS Bypass via Fragmented TLS ClientHello Causing Pre-SNI Sniff Fallback to Default Non-mTLS TLS Config CVE-2026-32305, GHSA-wvvq-wgcr-9q48, GO-2026-4793 | High | 0.4% | 20 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers CVE-2026-29794, GHSA-m547-hp4w-j6jx, GO-2026-4791 | Medium | 0.3% | 20 Mar, 2026 | Go code.vikunja.io/api |
ingress-nginx comment-based nginx configuration injection CVE-2026-4342, GHSA-f53h-mxv9-cp98, GO-2026-4796 | High | 1.4% | 20 Mar, 2026 | Go k8s.io/ingress-nginx |
In Soft Serve, an authenticated repo import can clone server-local private repositories CVE-2026-33353, GHSA-xgxp-f695-6vrp, GO-2026-4788 | High | 0.4% | 19 Mar, 2026 | Go github.com/charmbracelet/soft-serve |
Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG CVE-2026-33344, GHSA-ph8x-4jfv-v9v8, GO-2026-4785 | High | 0.5% | 19 Mar, 2026 | Go github.com/dagu-org/dagu |
Packetbeat does not properly validate an array index in multiple protocol parser components CVE-2026-26933, GHSA-27qj-9gvp-8rh9, GO-2026-4789 | Medium | 0.3% | 19 Mar, 2026 | Go github.com/elastic/beats Go github.com/elastic/beats/v7 |
Metricbeat Allocates Memory with Excessive Size Value Leading to Denial of Service CVE-2026-26931, GHSA-5vrw-qjxw-89r5, GO-2026-4790 | Medium | 0.2% | 19 Mar, 2026 | Go github.com/elastic/beats Go github.com/elastic/beats/v7 |
MinIO has JWT Algorithm Confusion in OIDC Authentication CVE-2026-33322, GHSA-5cx5-wh4m-82fh, GO-2026-4779 | Critical | 0.4% | 19 Mar, 2026 | Go github.com/minio/minio |
Ella Core panics on malformed ULNASTransport Message without a Request Type CVE-2026-33283, GHSA-3366-gw57-fcm5, GO-2026-4776 | Medium | 0.4% | 19 Mar, 2026 | Go github.com/ellanetworks/core |
Ella Core panics on malformed NGAP Location Report CVE-2026-33282, GHSA-826q-wrq4-p23x, GO-2026-4780 | High | 0.4% | 19 Mar, 2026 | Go github.com/ellanetworks/core |
Ella Core panics on invalid PDU Session IDs in NGAP messages CVE-2026-33281, GHSA-q669-4gmv-g8mf, GO-2026-4783 | Medium | 0.4% | 19 Mar, 2026 | Go github.com/ellanetworks/core |
Juju affected by Confused Deputy IDOR attack via Predictable user specified ID in Juju Secrets CVE-2026-32694, GHSA-5cj2-rqqf-hx9p, GO-2026-4778 | Medium | 0.3% | 19 Mar, 2026 | Go github.com/juju/juju |
Juju has unauthorized access to out-of-scope Kubernetes secrets CVE-2026-32693, GHSA-439w-v2p7-pggc, GO-2026-4777 | High | 0.3% | 19 Mar, 2026 | Go github.com/juju/juju |
Juju has unauthorized update of out-of-scope Vault secrets CVE-2026-32692, GHSA-89x7-5m5m-mcmm, GO-2026-4781 | High | 0.2% | 19 Mar, 2026 | Go github.com/juju/juju |
Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk CVE-2026-33252, GHSA-89xv-2j6f-qhc8, GO-2026-4773 | High | 0.2% | 19 Mar, 2026 | Go github.com/modelcontextprotocol/go-sdk |
qui CORS Misconfiguration: Arbitrary Origins Trusted CVE-2026-30924, GHSA-h8vw-ph9r-xpch, GO-2026-4774 | Critical | 0.3% | 19 Mar, 2026 | Go github.com/autobrr/qui |
step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) CVE-2026-30836, GHSA-q4r8-xm5f-56gw, GO-2026-4775 | Critical | 0.3% | 19 Mar, 2026 | Go github.com/smallstep/certificates |
Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service CVE-2026-33320, GHSA-4fcp-jxh7-23x8, GO-2026-4768 | Medium | 0.2% | 19 Mar, 2026 | Go github.com/tomwright/dasel Go github.com/tomwright/dasel/v2 Go github.com/tomwright/dasel/v3 |
Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk GHSA-q382-vc8q-7jhj, GO-2026-4770 | High | Not scored | 19 Mar, 2026 | Go github.com/modelcontextprotocol/go-sdk |