Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering CVE-2026-41050, GHSA-765j-qfrp-hm3j, GO-2026-5207 | Critical | Not scored | 07 May, 2026 | Go github.com/rancher/fleet |
Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook CVE-2026-42596, GHSA-4vmc-gm8v-m35h, GO-2026-5132 | Critical | Not scored | 07 May, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection CVE-2026-42589, GHSA-rqgh-gxv4-6657, GO-2026-5636 | Critical | Not scored | 07 May, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening GHSA-9h64-2846-7x7f, GO-2026-5290 | Critical | Not scored | 06 May, 2026 | Go github.com/getaxonflow/axonflow |
Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore CVE-2026-42238, GHSA-4pvg-prr3-9cxr, GO-2026-5129 | Critical | Not scored | 06 May, 2026 | Go github.com/0xJacky/nginx-ui |
DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header CVE-2026-42300, GHSA-2g9v-7mr5-fgjg, GO-2026-4988 | Critical | Not scored | 05 May, 2026 | Go github.com/l3montree-dev/devguard |
S3-Proxy has Security Issues in its Resource Path Matching Implementation CVE-2026-42882, GHSA-rfgq-wgg8-662p, GO-2026-5616 | Critical | Not scored | 05 May, 2026 | Go github.com/oxyno-zeta/s3-proxy |
Pelican Web UI Affected by a Privilege Escalation Attack CVE-2026-42571, GHSA-rpfr-x88x-xwcw, GO-2026-5632 | Critical | Not scored | 04 May, 2026 | Go github.com/pelicanplatform/pelican |
auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation CVE-2026-42560, GHSA-f6qq-3m3h-4g42, GO-2026-5348 | Critical | Not scored | 30 Apr, 2026 | Go github.com/go-pkgz/auth Go github.com/go-pkgz/auth/v2 |
Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix) CVE-2026-40281, GHSA-q7r4-hc83-hf2q, GO-2026-5572 | Critical | Not scored | 30 Apr, 2026 | Go github.com/gotenberg/gotenberg/v7 Go github.com/gotenberg/gotenberg/v8 |
Netmaker does not verify JWT signatures for host tokens CVE-2026-38651, GHSA-qpv2-rwc8-c993, GO-2026-5588 | Critical | Not scored | 28 Apr, 2026 | Go github.com/gravitl/netmaker |
Note Mark: OIDC-registered users authenticated by submitting password "null" CVE-2026-41571, GHSA-pxf8-6wqm-r6hh, GO-2026-5557 | Critical | Not scored | 25 Apr, 2026 | Go github.com/enchant97/note-mark/backend |
go-zserio has Unbounded Memory Allocation for All Platforms GHSA-xhj4-g6w8-2xjw, GO-2026-5759 | Critical | Not scored | 24 Apr, 2026 | Go github.com/woven-planet/go-zserio |
Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars CVE-2026-41492, GHSA-vvf7-6rmr-m29q, GO-2026-5675 | Critical | Not scored | 24 Apr, 2026 | Go github.com/dgraph-io/dgraph Go github.com/dgraph-io/dgraph/v24 Go github.com/dgraph-io/dgraph/v25 Go github.com/hypermodeinc/dgraph/v24 |
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field CVE-2026-41328, GHSA-x92x-px7w-4gx4, GO-2026-5749 | Critical | Not scored | 24 Apr, 2026 | Go github.com/dgraph-io/dgraph Go github.com/dgraph-io/dgraph/v24 Go github.com/dgraph-io/dgraph/v25 Go github.com/hypermodeinc/dgraph/v24 |
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field CVE-2026-41327, GHSA-mrxx-39g5-ph77, GO-2026-5516 | Critical | Not scored | 24 Apr, 2026 | Go github.com/dgraph-io/dgraph Go github.com/dgraph-io/dgraph/v24 Go github.com/dgraph-io/dgraph/v25 Go github.com/hypermodeinc/dgraph/v24 |
ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function CVE-2026-39087, GHSA-pqhx-w72w-m393, GO-2026-5551 | Critical | Not scored | 23 Apr, 2026 | Go heckel.io/ntfy Go heckel.io/ntfy/v2 |
NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access CVE-2026-42072, GHSA-2hp7-65r3-wv54, GO-2026-4967 | Critical | Not scored | 22 Apr, 2026 | Go github.com/orneryd/nornicdb |
RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution BIT-rclone-2026-41179, CVE-2026-41179, GHSA-jfwf-28xr-xw6q, GO-2026-5466 | Critical | Not scored | 22 Apr, 2026 | Go github.com/ncw/rclone Go github.com/rclone/rclone |
Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution BIT-rclone-2026-41176, CVE-2026-41176, GHSA-25qr-6mpr-f7qx, GO-2026-4964 | Critical | Not scored | 22 Apr, 2026 | Go github.com/rclone/rclone |
openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access CVE-2026-41070, GHSA-246w-jgmq-88fg, GO-2026-4963 | Critical | Not scored | 22 Apr, 2026 | Go github.com/jkroepke/openvpn-auth-oauth2 |
Wish has SCP Path Traversal that allows arbitrary file read/write CVE-2026-41589, GHSA-xjvp-7243-rg9h, GO-2026-5762 | Critical | Not scored | 18 Apr, 2026 | Go charm.land/wish/v2 Go github.com/charmbracelet/wish |
Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass CVE-2026-41574, GHSA-6g38-8j4p-j3pr, GO-2026-5176 | Critical | Not scored | 18 Apr, 2026 | Go github.com/nhost/nhost |
Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints CVE-2026-40173, GHSA-95mq-xwj4-r47p, GO-2026-5274 | Critical | Not scored | 16 Apr, 2026 | Go github.com/dgraph-io/dgraph Go github.com/dgraph-io/dgraph/v24 Go github.com/dgraph-io/dgraph/v25 Go github.com/hypermodeinc/dgraph/v24 |
Pyroscope Exposes Storage Secret BIT-grafana-pyroscope-2025-41118, CVE-2025-41118, GHSA-m9hq-h476-h2g8, GO-2026-5501 | Critical | Not scored | 15 Apr, 2026 | Go github.com/grafana/pyroscope |
OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing BIT-oauth2-proxy-2026-40575, BIT-oauth2-proxy-2026-76835, CVE-2026-40575, CVE-2026-76835, GHSA-7x63-xv5r-3p2x, GO-2026-5236 | Critical | Not scored | 15 Apr, 2026 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token CVE-2026-6290, GHSA-hv5g-26jg-pc45, GO-2026-5438 | Critical | Not scored | 15 Apr, 2026 | Go www.velocidex.com/golang/velociraptor |
Oxia has an OIDC token audience validation bypass via SkipClientIDCheck CVE-2026-40946, GHSA-fhvp-9hcj-6m33, GO-2026-5364 | Critical | Not scored | 14 Apr, 2026 | Go github.com/oxia-db/oxia |
OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in auth_request Mode BIT-oauth2-proxy-2026-34457, CVE-2026-34457, GHSA-5hvv-m4w4-gf6v, GO-2026-5147 | Critical | Not scored | 14 Apr, 2026 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
goshs has an empty-username SFTP password authentication bypass CVE-2026-40884, GHSA-c29w-qq4m-2gcv, GO-2026-5303 | Critical | Not scored | 14 Apr, 2026 | Go github.com/patrickhener/goshs Go github.com/patrickhener/goshs/v2 |
Daptin has Unauthenticated Path Traversal and Zip Slip GHSA-9cp7-j3f8-p5jx, GO-2026-5285 | Critical | Not scored | 10 Apr, 2026 | Go github.com/daptin/daptin |
Juju: CloudSpec method leaking cloud credentials CVE-2026-5412, GHSA-w5fq-8965-c969, GO-2026-5692 | Critical | Not scored | 10 Apr, 2026 | Go github.com/juju/juju |
goshs has a file-based ACL authorization bypass in goshs state-changing routes CVE-2026-40189, GHSA-wvhv-qcqf-f3cx, GO-2026-5728 | Critical | Not scored | 10 Apr, 2026 | Go github.com/patrickhener/goshs |
LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf CVE-2026-34177, GHSA-fm2x-c5qw-4h6f, GO-2026-5368 | Critical | Not scored | 10 Apr, 2026 | Go github.com/canonical/lxd |
LXD: Importing a crafted backup leads to project restriction bypass CVE-2026-34178, GHSA-q96j-3fmm-7fv4, GO-2026-5576 | Critical | Not scored | 10 Apr, 2026 | Go github.com/canonical/lxd |
LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin CVE-2026-34179, GHSA-c3h3-89qf-jqm5, GO-2026-5306 | Critical | Not scored | 10 Apr, 2026 | Go github.com/canonical/lxd |
SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions CVE-2026-39846, GHSA-phhp-9rm9-6gr2, GO-2026-5540 | Critical | Not scored | 08 Apr, 2026 | Go github.com/siyuan-note/siyuan/kernel |
pgx contains memory-safety vulnerability CVE-2026-33815, GHSA-xgrm-4fwx-7qm8, GO-2026-4771 | Critical | Not scored | 07 Apr, 2026 | Go github.com/jackc/pgx/v5 |
Memory-safety vulnerability in github.com/jackc/pgx/v5. CVE-2026-33816, GHSA-9jj7-4m8r-rfcm, GO-2026-4772 | Critical | Not scored | 07 Apr, 2026 | Go github.com/jackc/pgx/v5 |
goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) CVE-2026-35471, GHSA-6qcc-6q27-whp8, GO-2026-5186 | Critical | Not scored | 03 Apr, 2026 | Go github.com/patrickhener/goshs |
goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload CVE-2026-35393, GHSA-jg56-wf8x-qrv5, GO-2026-5468 | Critical | Not scored | 03 Apr, 2026 | Go github.com/patrickhener/goshs |
goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload CVE-2026-35392, GHSA-g8mv-vp7j-qp64, GO-2026-5394 | Critical | Not scored | 03 Apr, 2026 | Go github.com/patrickhener/goshs |
Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization CVE-2026-34976, GHSA-p5rh-vmhp-gvcw, GO-2026-5529 | Critical | Not scored | 02 Apr, 2026 | Go github.com/dgraph-io/dgraph Go github.com/dgraph-io/dgraph/v24 Go github.com/dgraph-io/dgraph/v25 Go github.com/hypermodeinc/dgraph/v24 |
Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster CVE-2026-4370, GHSA-gvrj-cjch-728p, GO-2026-5405 | Critical | Not scored | 02 Apr, 2026 | Go github.com/juju/juju |
SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection CVE-2026-34449, GHSA-68p4-j234-43mv, GO-2026-5171 | Critical | Not scored | 31 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client CVE-2026-34448, GHSA-rx4h-526q-4458, GO-2026-5644 | Critical | Not scored | 31 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover CVE-2026-33032, GHSA-h6c2-x2m2-mwhf, GO-2026-4904 | Critical | Not scored | 30 Mar, 2026 | Go github.com/0xJacky/Nginx-UI |
nginx-ui Backup Restore Allows Tampering with Encrypted Backups CVE-2026-33026, GHSA-fhh2-gg7w-gwpq, GO-2026-4903 | Critical | Not scored | 30 Mar, 2026 | Go github.com/0xJacky/Nginx-UI |
Incus has an abitrary file write through its systemd-creds options CVE-2026-33945, GHSA-q4q8-7f2j-9h9f, GO-2026-4884 | Critical | Not scored | 27 Mar, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |
Incus vulnerable to arbitrary file read and write through pongo templates CVE-2026-33897, GHSA-83xr-5xxr-mh92, GO-2026-4881 | Critical | Not scored | 27 Mar, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |