Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Juju affected by timing ownership claim attack on new external back-end secrets CVE-2026-32691, GHSA-gfgr-6hrj-85ww, GO-2026-4769 | Medium | 0.2% | 19 Mar, 2026 | Go github.com/juju/juju |
Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload CVE-2026-33221, GHSA-g9f6-9775-hffm, GO-2026-4759 | Low | 0.2% | 18 Mar, 2026 | Go github.com/nhost/nhost |
Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod CVE-2026-33211, GHSA-j5q5-j9gm-2w5c, GO-2026-4761 | Critical | 0.6% | 18 Mar, 2026 | Go github.com/tektoncd/pipeline |
Unsigned SAML LogoutRequest Acceptance in gosaml2 GHSA-pcgw-qcv5-h8ch, GO-2026-4764 | High | Not scored | 18 Mar, 2026 | Go github.com/russellhaering/gosaml2 |
gosaml2 CBC Padding Panic — Unauthenticated Process Crash GHSA-hwqm-qvj9-4jr2, GO-2026-4760 | High | Not scored | 18 Mar, 2026 | Go github.com/russellhaering/gosaml2 |
validateSignature Loop Variable Capture Signature Bypass in goxmldsig CVE-2026-33487, GHSA-479m-364c-43vc, GO-2026-4753 | High | 0.3% | 18 Mar, 2026 | Go github.com/russellhaering/goxmldsig |
mo has a XSS via inline SVG script tags in Markdown rendering GHSA-vccx-p757-pv6h, GO-2026-4765 | Low | Not scored | 18 Mar, 2026 | Go github.com/k1LoW/mo |
free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques CVE-2026-33192, GHSA-5rvc-5cwx-g5x8, GO-2026-4755 | High | 0.3% | 18 Mar, 2026 | Go github.com/free5gc/udm |
free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error CVE-2026-33191, GHSA-p9hg-pq3q-v9gv, GO-2026-4763 | High | 0.4% | 18 Mar, 2026 | Go github.com/free5gc/udm |
SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass CVE-2026-33203, GHSA-3g9h-9hp4-654v, GO-2026-4752 | High | 0.5% | 18 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (GHSA-h5vh-m7fg-w5h6 Bypass) CVE-2026-33194, GHSA-vm69-h85x-8p85, GO-2026-4766 | Medium | 0.5% | 18 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
gRPC-Go has an authorization bypass via missing leading slash in :path CVE-2026-33186, GHSA-p77j-4mvh-x3m3, GO-2026-4762 | Critical | 1.6% | 18 Mar, 2026 | Go google.golang.org/grpc |
free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request CVE-2026-33065, GHSA-958m-gxmc-mccm, GO-2026-4758 | Medium | 0.3% | 18 Mar, 2026 | Go github.com/free5gc/udm |
free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference CVE-2026-33064, GHSA-7g27-v5wj-jr75, GO-2026-4757 | High | 0.5% | 18 Mar, 2026 | Go github.com/free5gc/udm |
free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion CVE-2026-33063, GHSA-4jrw-92fg-4jwx, GO-2026-4754 | High | 0.7% | 18 Mar, 2026 | Go github.com/free5gc/ausf |
free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter CVE-2026-33062, GHSA-7c47-xr7q-p6hg, GO-2026-4756 | High | 0.7% | 18 Mar, 2026 | Go github.com/free5gc/nrf |
Out-of-Bounds Slice Access in free5GC CHF Leading to DoS CVE-2026-32937, GHSA-6g43-577r-wf4x, GO-2026-4750 | High | 0.4% | 18 Mar, 2026 | Go github.com/free5gc/chf |
Zitadel is missing enforcement of organization scopes CVE-2026-33132, GHSA-g2pf-ww5m-2r9m, GO-2026-4751 | Medium | 0.3% | 18 Mar, 2026 | Go github.com/zitadel/zitadel |
PinchTab has a Blind SSRF via browser-side redirect bypass in /download URL validation CVE-2026-33081, GHSA-qwxp-6qf9-wr4m, GO-2026-4748 | Medium | 0.3% | 18 Mar, 2026 | Go github.com/pinchtab/pinchtab |
SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata CVE-2026-33067, GHSA-mvpm-v6q4-m2pf, GO-2026-4747 | Medium | 0.6% | 18 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering CVE-2026-33066, GHSA-4663-4mpg-879v, GO-2026-4743 | Medium | 0.6% | 18 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Heimdall: Path received via Envoy gRPC corrupted when containing query string CVE-2026-32811, GHSA-r8x2-fhmf-6mxp, GO-2026-4742 | High | 0.3% | 18 Mar, 2026 | Go github.com/dadrus/heimdall |
File Browser has an Authorization Policy Bypass in Public Share Download Flow CVE-2026-32761, GHSA-68j5-4m99-w9w9, GO-2026-4738 | Medium | 0.4% | 18 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 Go https://github.com/filebrowser/filebrowser |
Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121 GHSA-594f-3595-c47v, GO-2026-4737 | Medium | Not scored | 18 Mar, 2026 | Go github.com/argoproj-labs/terraform-provider-argocd |
XPath: Boolean expression infinite loop leads to denial of service via CPU exhaustion CVE-2026-32287, GHSA-65xw-vw82-r86x, GO-2026-4526 | High | 0.5% | 17 Mar, 2026 | Go github.com/antchfx/xpath |
Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun CVE-2026-33022, GHSA-cv4x-93xx-wgfj, GO-2026-4730 | Medium | 0.4% | 17 Mar, 2026 | Go github.com/tektoncd/pipeline |
Tillitis TKey Client has an Error in Protocol Implementation CVE-2026-32953, GHSA-4w7r-3222-8h6v, GO-2026-4728 | Medium | 0.3% | 17 Mar, 2026 | Go github.com/tillitis/tkeyclient |
Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports CVE-2026-32941, GHSA-97vp-pwqj-46qc, GO-2026-4723 | Medium | 0.3% | 17 Mar, 2026 | Go github.com/bishopfox/sliver |
Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS CVE-2026-32254, GHSA-phqm-jgc3-qf8g, GO-2026-4724 | High | 0.3% | 17 Mar, 2026 | Go github.com/cloudnativelabs/kube-router Go github.com/cloudnativelabs/kube-router/v2 |
SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183) CVE-2026-32940, GHSA-4mx9-3c2h-hwhg, GO-2026-4721 | Critical | 0.3% | 17 Mar, 2026 | Go github.com/siyuan-note/siyuan |
SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service CVE-2026-32938, GHSA-fq2j-j8hc-8vw8, GO-2026-4722 | Critical | 0.4% | 17 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Mattermost fails to verify run_create permission for empty playbookId CVE-2026-26304, GHSA-4pmx-622h-x359, GO-2026-4812 | Medium | 0.2% | 16 Mar, 2026 | Go github.com/mattermost/mattermost-plugin-playbooks |
Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration CVE-2026-32828, GHSA-j94x-8wcp-x7hm, GO-2026-4717 | Medium | 0.3% | 16 Mar, 2026 | Go github.com/akuity/kargo |
Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace CVE-2026-32769, GHSA-hxm7-9q36-c77f, GO-2026-4715 | High | 0.5% | 16 Mar, 2026 | Go github.com/ctfer-io/fullchain |
Romeo is vulnerable to Archive Slip due to missing checks in sanitization CVE-2026-32805, GHSA-p799-g7vv-f279, GO-2026-4719 | High | 0.5% | 16 Mar, 2026 | Go github.com/ctfer-io/romeo/webserver |
Monitoring is vulnerable to Archive Slip due to missing checks in sanitization CVE-2026-32771, GHSA-f7cq-gvh6-qr25, GO-2026-4712 | High | 0.7% | 16 Mar, 2026 | Go github.com/ctfer-io/monitoring |
Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace CVE-2026-32737, GHSA-fgm3-q9r5-43v9, GO-2026-4714 | High | 0.4% | 16 Mar, 2026 | Go github.com/ctfer-io/romeo/environment/deploy |
Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace CVE-2026-32768, GHSA-mw24-f3xh-j3qv, GO-2026-4718 | High | 0.3% | 16 Mar, 2026 | Go github.com/ctfer-io/chall-manager/deploy Go github.com/ctfer-io/chall-manager/sdk |
File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter CVE-2026-32758, GHSA-9f3r-2vgw-m8xp, GO-2026-4711 | Medium | 0.4% | 16 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API CVE-2026-32767, GHSA-j7wh-x834-p3r7, GO-2026-4716 | Critical | 0.5% | 16 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
File Browser Signup Grants Admin When Default Permissions Include Admin CVE-2026-32760, GHSA-5gg9-5g7w-hm73, GO-2026-4710 | Critical | 0.7% | 16 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS CVE-2026-56395, CVE-2026-56397, GHSA-v3mg-9v85-fcm7, GO-2026-4720 | Medium | 0.5% | 16 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely CVE-2026-32759, GHSA-ffx7-75gc-jg7c, GO-2026-4713 | Medium | 1.9% | 16 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Denial of service in github.com/shamaton/msgpack CVE-2026-32284, GHSA-h9q6-hc68-35rp, GO-2026-4513, GO-2026-4740 | High | 0.4% | 16 Mar, 2026 | Go github.com/shamaton/msgpack Go github.com/shamaton/msgpack/v2 Go github.com/shamaton/msgpack/v3 |
github.com/buger/jsonparser has a denial of service vulnerability CVE-2026-32285, GHSA-6g7g-w4f8-9c9x, GO-2026-4514 | High | 0.8% | 16 Mar, 2026 | Go github.com/buger/jsonparser |
Denial of service in github.com/jackc/pgproto3/v2 CVE-2026-32286, GHSA-jqcq-xjh3-6g23, GO-2026-4518 | High | 0.7% | 16 Mar, 2026 | Go github.com/jackc/pgproto3/v2 |
SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface CVE-2026-32751, GHSA-qr46-rcv3-4hq3, GO-2026-4706 | Medium | 0.8% | 16 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes CVE-2026-32750, GHSA-rjhh-m223-9qqv, GO-2026-4708 | Medium | 0.4% | 16 Mar, 2026 | Go github.com/siyuan-note/siyuan |
SiYuan importSY/importZipMd: path traversal via multipart filename enables arbitrary file write CVE-2026-32749, GHSA-qvvf-q994-x79v, GO-2026-4707 | High | 0.4% | 16 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan Vulnerable to Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure CVE-2026-32815, GHSA-xp2m-98x8-rpj6, GO-2026-4709 | Medium | 0.4% | 16 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |