Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
SiYuan globalCopyFiles: incomplete sensitive path blocklist allows reading /proc and Docker secrets CVE-2026-32747, GHSA-h5vh-m7fg-w5h6, GO-2026-4705 | Medium | 0.4% | 16 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute CVE-2026-30405, GHSA-4p9m-8gc4-rw2h, GO-2026-4736 | High | 0.4% | 16 Mar, 2026 | Go github.com/osrg/gobgp Go github.com/osrg/gobgp/v3 Go github.com/osrg/gobgp/v4 |
IncusOS has a LUKS encryption bypass due to insufficient TPM policy CVE-2026-32606, GHSA-wj2j-qwcf-cfcc, GO-2026-4704 | High | 0.1% | 16 Mar, 2026 | Go github.com/lxc/incus-os/incus-osd |
Mattermost fails to validate user's authentication method when processing account auth type switch CVE-2026-22545, GHSA-rv67-7w2g-7976, GO-2026-4786 | Low | 0.2% | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation CVE-2026-2455, GHSA-gqv7-j2j8-qmwq, GO-2026-4746 | Medium | 0.2% | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly enforce read permissions in search API endpoints CVE-2026-24692, GHSA-cwfj-642j-gfh4, GO-2026-4745 | Medium | 0.2% | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to use consistent error responses when handling the /mute command CVE-2026-21386, GHSA-5mr9-crcg-8wh2, GO-2026-4744 | Medium | 0.2% | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to validate team-specific upload_file permissions CVE-2026-4265, GHSA-xpvf-6qcc-9jqc, GO-2026-4749 | Medium | 0.2% | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to limit the size of responses from integration action endpoints CVE-2026-2456, GHSA-34g8-9fpp-46ch, GO-2026-4726 | Medium | 0.2% | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows a removed team member to enumerate all public channels within a private team CVE-2026-2458, GHSA-679f-wmrg-qf57, GO-2026-4729 | Medium | 0.2% | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Boards Plugin fails to implement authorisation checks on comment block modifications CVE-2026-2461, GHSA-hf8w-x9h5-5gf9, GO-2026-4782 | Medium | 0.2% | 16 Mar, 2026 | Go github.com/mattermost/mattermost-plugin-boards |
Mattermost fails to filter invite IDs based on user permissions CVE-2026-2463, GHSA-fx49-m253-27jj, GO-2026-4735 | Medium | 0.2% | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Microsoft Teams Plugin fails to properly mask sensitive configuration values CVE-2026-2476, GHSA-4ppj-6chv-5pgc, GO-2026-4784 | High | 0.2% | 16 Mar, 2026 | Go github.com/mattermost/mattermost-plugin-msteams |
Mattermost fails to preserve the redacted state of burn-on-read posts during deletion CVE-2026-2578, GHSA-3rhr-jr63-hwq5, GO-2026-4734 | Medium | 0.2% | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly handle very long passwords CVE-2026-24458, GHSA-m5rv-56xx-hfc6, GO-2026-4731 | High | 0.3% | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows attackers to spoof permalink embeds CVE-2026-2457, GHSA-ph22-fw5m-w2q9, GO-2026-4732 | Medium | 0.1% | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to bound memory allocation when processing DOC files CVE-2026-25780, GHSA-xv2p-wchj-qjhp, GO-2026-4733 | Medium | 0.3% | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly validate User-Agent header tokens CVE-2026-25783, GHSA-2v3w-6g35-5f9v, GO-2026-4725 | Medium | 0.3% | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to bound memory allocation when processing PSD image files CVE-2026-26246, GHSA-44mv-jq72-gj49, GO-2026-4727 | Medium | 0.2% | 16 Mar, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
github.com/ctfer-io/monitoring Vulnerable to Improper Access Control CVE-2026-32720, GHSA-7x23-j8gv-v54x, GO-2026-4701 | High | 0.3% | 13 Mar, 2026 | Go github.com/ctfer-io/monitoring |
SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB CVE-2026-32704, GHSA-4j3x-hhg2-fm2x, GO-2026-4700 | Medium | 0.3% | 13 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning GHSA-q926-c743-49qj, GO-2026-4703 | Low | Not scored | 13 Mar, 2026 | Go github.com/centrifugal/centrifugo Go github.com/centrifugal/centrifugo/v3 Go github.com/centrifugal/centrifugo/v4 Go github.com/centrifugal/centrifugo/v5 +1 more |
Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL CVE-2026-32301, GHSA-j77h-rr39-c552, GO-2026-4702 | Critical | 0.3% | 13 Mar, 2026 | Go github.com/centrifugal/centrifugo Go github.com/centrifugal/centrifugo/v3 Go github.com/centrifugal/centrifugo/v4 Go github.com/centrifugal/centrifugo/v5 +1 more |
Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload CVE-2026-30961, GHSA-45vh-rpc8-hxpp, GO-2026-4695 | Medium | 0.3% | 13 Mar, 2026 | Go github.com/forceu/gokapi |
Gokapi vulnerable to DoS in E2E Metadata Parser CVE-2026-30955, GHSA-qwc6-vc2v-2ggj, GO-2026-4698 | Medium | 0.3% | 13 Mar, 2026 | Go github.com/forceu/gokapi |
Gokapi vulnerable to Privilege Escalation in File Replace CVE-2026-30943, GHSA-j6jp-78w8-34x6, GO-2026-4696 | Medium | 0.2% | 13 Mar, 2026 | Go github.com/forceu/gokapi |
SFTPGo improperly sanitizes placeholders in group home directories/key prefixes CVE-2026-30915, GHSA-m83q-5wr4-4gfp, GO-2026-4697 | Medium | 0.3% | 13 Mar, 2026 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |
SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy CVE-2026-30914, GHSA-x8qh-7475-c5mp, GO-2026-4699 | Medium | 0.6% | 13 Mar, 2026 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |
SM9 Infinity-Point Ciphertext Forgery Vulnerability CVE-2026-32614, GHSA-5xxp-2vrj-x855, GO-2026-4694 | Critical | 0.2% | 13 Mar, 2026 | Go github.com/emmansun/gmsm |
Dagu: Path Traversal via `dagRunId` in Inline DAG Execution CVE-2026-31886, GHSA-m4q3-457p-hh2x, GO-2026-4693 | Critical | 0.4% | 13 Mar, 2026 | Go github.com/dagu-org/dagu |
Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstrings CVE-2026-32320, GHSA-j478-p7vq-3347, GO-2026-4691 | Medium | 0.2% | 12 Mar, 2026 | Go github.com/ellanetworks/core |
Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload CVE-2026-32319, GHSA-m9pm-w3gv-c68f, GO-2026-4692 | High | 0.3% | 12 Mar, 2026 | Go github.com/ellanetworks/core |
Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint CVE-2026-32246, GHSA-3q28-qjrv-qr39, GO-2026-4688 | High | 0.3% | 12 Mar, 2026 | Go github.com/steveiliop56/tinyauth |
Tinyauth's OIDC authorization codes are not bound to client on token exchange CVE-2026-32245, GHSA-xg2q-62g2-cvcm, GO-2026-4689 | Medium | 0.3% | 12 Mar, 2026 | Go github.com/steveiliop56/tinyauth |
Traefik: HTTP/2 frames can cause a running server to panic GHSA-4hjq-9h5c-252j, GO-2026-4684 | High | Not scored | 12 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass CVE-2026-32136, GHSA-5fg6-wrq4-w5gh, GO-2026-4686 | Critical | 0.8% | 12 Mar, 2026 | Go github.com/AdguardTeam/AdGuardHome |
SiYuan has a Full-Read SSRF via /api/network/forwardProxy CVE-2026-32110, GHSA-56cv-c5p2-j2wg, GO-2026-4685 | High | 0.4% | 12 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
OliveTin's email argument makes compliance harder, enables log injection GHSA-xx6g-43w2-9g6g, GO-2026-4687 | Medium | Not scored | 12 Mar, 2026 | Go github.com/OliveTin/OliveTin |
OliveTin Vulnerable to Unauthorized Action Output Disclosure via EventStream CVE-2026-32102, GHSA-228v-wc5r-j8m7, GO-2026-4683 | High | 0.5% | 12 Mar, 2026 | Go github.com/OliveTin/OliveTin |
Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication BIT-consul-2026-2808, CVE-2026-2808, GHSA-cpfq-66p2-336j, GO-2026-4690 | Medium | 0.5% | 12 Mar, 2026 | Go github.com/hashicorp/consul |
Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode BIT-argo-workflows-2026-31892, CVE-2026-31892, GHSA-3wf5-g532-rcrr, GO-2026-4681 | High | 0.5% | 11 Mar, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 Go github.com/argoproj/argo-workflows/v4 |
Anytype Heart's gRPC API client challenge verification can be bypassed on localhost CVE-2026-31863, GHSA-vv3h-7qwr-722v, GO-2026-4680 | Low | 0.1% | 11 Mar, 2026 | Go github.com/anyproto/anytype-cli Go github.com/anyproto/anytype-heart |
Cosmos EVM: incorrect state handling during nested EVM execution paths GHSA-54gx-3cgr-7mfm, GO-2026-4677 | Critical | Not scored | 11 Mar, 2026 | Go github.com/cosmos/evm |
Traefik: kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values CVE-2026-29777, GHSA-8q2w-wr49-whqj, GO-2026-4679 | Medium | 0.3% | 11 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Unauthorized access to Argo Workflows Template BIT-argo-workflows-2026-28229, CVE-2026-28229, GHSA-56px-hm34-xqj5, GO-2026-4678 | High | 0.7% | 11 Mar, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 Go github.com/argoproj/argo-workflows/v4 |
Quill has DoS via unbounded read of HTTP response body during notarization CVE-2026-31960, GHSA-g32c-4pvp-769g, GO-2026-4672 | Medium | 0.1% | 11 Mar, 2026 | Go github.com/anchore/quill |
Quill has unbounded memory allocation via unvalidated size fields in Mach-O binary parsing CVE-2026-31961, GHSA-xj69-m9qq-8m94, GO-2026-4675 | Medium | 0.1% | 11 Mar, 2026 | Go github.com/anchore/quill |
Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval CVE-2026-31959, GHSA-7q3q-5px6-4c5p, GO-2026-4671 | Medium | 0.1% | 11 Mar, 2026 | Go github.com/anchore/quill |
flagd Vulnerable to Allocation of Resources Without Limits or Throttling CVE-2026-31866, GHSA-rmrf-g9r3-73pm, GO-2026-4674 | High | 0.4% | 11 Mar, 2026 | Go github.com/open-feature/flagd/flagd |
Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go GHSA-j443-wcqq-xprh, GO-2026-4673 | Critical | Not scored | 11 Mar, 2026 | Go github.com/arslanbekov/terraform-provider-sendgrid |