Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mattermost fails to enforce invite permissions when updating team settings CVE-2025-14573, GHSA-cgjg-p2m2-qm4p, GO-2026-4523 | Low | Not scored | 16 Feb, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't properly validate channel membership at the time of data retrieval CVE-2026-20796, GHSA-2xf7-hmf6-p64j, GO-2026-4495 | Low | Not scored | 13 Feb, 2026 | Go github.com/mattermost/mattermost-server |
NeuVector scanner insecurely handles passwords as command arguments CVE-2025-67860, GHSA-3c9m-gq32-g4jx, GO-2026-4490 | Low | Not scored | 12 Feb, 2026 | Go github.com/neuvector/scanner |
LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic GHSA-vhvq-fv9f-wh4q, GO-2026-4465 | Low | Not scored | 06 Feb, 2026 | Go github.com/authzed/spicedb |
ingress-nginx has Improper Check for Unusual or Exceptional Conditions CVE-2026-24513, GHSA-4g2f-xcph-2335, GO-2026-4419 | Low | Not scored | 04 Feb, 2026 | Go k8s.io/ingress-nginx |
Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS) CVE-2025-70849, GHSA-mw8w-q3f7-2v85, GO-2026-4404 | Low | Not scored | 03 Feb, 2026 | Go github.com/stefanprodan/podinfo |
Juju has broken CMR authorization CVE-2026-1237, GHSA-j477-6vpg-6c8x, GO-2026-4388 | Low | Not scored | 29 Jan, 2026 | Go github.com/juju/juju |
Gitea may send release notification emails for private repositories to users whose access has been revoked BIT-gitea-2026-0798, CVE-2026-0798, GHSA-8fwc-qjw5-rvgp, GHSA-f4wq-6ww5-m56p, GO-2026-4365 | Low | Not scored | 23 Jan, 2026 | Go code.gitea.io/gitea |
Gitea has improper access control for uploaded attachments BIT-gitea-2026-20736, CVE-2026-20736, GHSA-hgr3-x44x-33hx, GHSA-jr6h-pwwp-c8g6, GO-2026-4367 | Low | Not scored | 23 Jan, 2026 | Go code.gitea.io/gitea |
Gitea improperly exposes issue and pull request titles BIT-gitea-2026-20800, CVE-2026-20800, GHSA-2vgv-hgv4-22mh, GHSA-g54m-9f6g-wj7q, GO-2026-4362 | Low | Not scored | 23 Jan, 2026 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Gitea improperly exposes issue titles and repository names through previously started stopwatches BIT-gitea-2026-20883, CVE-2026-20883, GHSA-644v-xv3j-xgqg, GHSA-j8xr-c56q-m8jj, GO-2026-4368 | Low | Not scored | 23 Jan, 2026 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
OpenTofu has High CPU usage in "tofu init" with maliciously-crafted module packages in .zip format CVE-2026-74797, GHSA-r92c-9c7f-3pj8, GO-2026-4352 | Low | Not scored | 21 Jan, 2026 | Go github.com/opentofu/opentofu |
SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon CVE-2026-23847, GHSA-w836-5gpm-7r93, GO-2026-4343 | Low | Not scored | 21 Jan, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Mattermost is vulnerable to CPU exhaustion via crafted HTTP request CVE-2025-14822, GHSA-9r42-rhw3-2222, GO-2026-4325 | Low | Not scored | 16 Jan, 2026 | Go github.com/mattermost/mattermost-server |
Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts CVE-2025-14986, GHSA-p2gr-hm8g-q772, GO-2025-4272 | Low | Not scored | 30 Dec, 2025 | Go go.temporal.io/server |
SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key CVE-2025-15107, GHSA-43h9-hc38-qph5, GO-2025-4269 | Low | Not scored | 27 Dec, 2025 | Go github.com/actiontech/sqle |
Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. BIT-gitea-2025-68940, CVE-2025-68940, GHSA-rrcw-5rjv-vj26, GO-2025-4267 | Low | Not scored | 26 Dec, 2025 | Go code.gitea.io/gitea |
Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection CVE-2025-13352, GHSA-jf5h-xfw4-p8gp, GO-2025-4247 | Low | Not scored | 17 Dec, 2025 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-plugin-github Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 +2 more |
Mattermost has missing redirect URL validation CVE-2025-62690, GHSA-q66g-q98c-q454, GO-2025-4248 | Low | Not scored | 17 Dec, 2025 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Envoy forwards early CONNECT data in TCP proxy mode BIT-envoy-2025-64763, CVE-2025-64763, GHSA-rj35-4m94-77jh | Low | Not scored | 05 Dec, 2025 | Go github.com/envoyproxy/envoy |
Mattermost fails to validate user permissions in Boards CVE-2025-13870, GHSA-58w6-w55x-6wq8, GO-2025-4178 | Low | Not scored | 02 Dec, 2025 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM CVE-2025-65942, GHSA-66jq-2c23-2xh5, GO-2025-4161 | Low | Not scored | 25 Nov, 2025 | Go github.com/VictoriaMetrics/VictoriaMetrics |
SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results CVE-2025-65111, GHSA-9m7r-g8hg-x3vr, GO-2025-4151 | Low | Not scored | 21 Nov, 2025 | Go github.com/authzed/spicedb |
OSV-SCALIBR has NULL Pointer Dereference CVE-2025-13425, GHSA-f786-75f3-74xj, GO-2025-4149 | Low | Not scored | 20 Nov, 2025 | Go github.com/google/osv-scalibr |
Mattermost allows other users to determine when users had read channels via channel member objects CVE-2025-55074, GHSA-9hh7-6558-qfp2, GO-2025-4133 | Low | Not scored | 18 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows regular users to access archived channel content and files CVE-2025-41436, GHSA-x3hx-ch7p-8xgg, GO-2025-4131 | Low | Not scored | 14 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
SpiceDB WriteRelationships fails silently if payload is too big CVE-2025-64529, GHSA-pm3x-jrhh-qcr7, GO-2025-4120 | Low | Not scored | 13 Nov, 2025 | Go github.com/authzed/spicedb |
Mattermost Incorrect Authorization vulnerability CVE-2025-11777, GHSA-mqcj-8c2g-h97q, GO-2025-4122 | Low | Not scored | 13 Nov, 2025 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +2 more |
OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses GHSA-w2jf-268q-mrvh, GO-2025-4101 | Low | Not scored | 06 Nov, 2025 | Go github.com/opentofu/opentofu |
Apache Traffic Control has an Inefficient Regular Expression Complexity vulnerability CVE-2025-61581, GHSA-9m49-p2j3-c6xm, GO-2025-4033 | Low | Not scored | 16 Oct, 2025 | Go github.com/apache/trafficcontrol Go github.com/apache/trafficcontrol/v8 |
Mattermost has an Incorrect Authorization vulnerability CVE-2025-10545, GHSA-424h-xj87-m937, GO-2025-4030 | Low | Not scored | 16 Oct, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost has an Observable Timing Discrepancy vulnerability CVE-2025-54499, GHSA-xr3w-rmvj-f6m7, GO-2025-4036 | Low | Not scored | 16 Oct, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
vet MCP Server SSE Transport DNS Rebinding Vulnerability CVE-2025-59163, GHSA-6q9c-m9fr-865m, GO-2025-3986 | Low | Not scored | 29 Sep, 2025 | Go github.com/safedep/vet |
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace GHSA-q6hv-wcjr-wp8h, GO-2025-3985 | Low | Not scored | 26 Sep, 2025 | Go github.com/kcp-dev/kcp |
Omni Wireguard SideroLink potential escape CVE-2025-59824, GHSA-hqrf-67pm-wgfq, GO-2025-3979 | Low | Not scored | 24 Sep, 2025 | Go github.com/siderolabs/omni |
Mattermost boards plugin fails to restrict download access to files CVE-2025-9081, GHSA-f72g-52v7-mg3p, GO-2025-3978 | Low | Not scored | 19 Sep, 2025 | Go github.com/mattermost/mattermost-plugin-boards Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Dragonfly's directories created via os.MkdirAll are not checked for permissions CVE-2025-59349, GHSA-8425-8r2f-mrv6, GO-2025-3964 | Low | Not scored | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
Mattermost Open Redirect vulnerability CVE-2025-9084, GHSA-hm95-jx66-g2gh, GO-2025-3960 | Low | Not scored | 15 Sep, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Atlantis Exposes Service Version Publicly on /status API Endpoint CVE-2025-58445, GHSA-xh7v-965r-23f7, GO-2025-3940 | Low | Not scored | 05 Sep, 2025 | Go github.com/runatlantis/atlantis |
Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token CVE-2025-71435, GHSA-3rw9-wmc8-8948, GO-2025-3921 | Low | Not scored | 28 Aug, 2025 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Mattermost Server SSRF Vulnerability via the Agents Plugin CVE-2025-47700, GHSA-vqwh-5jhh-vc9p, GO-2025-3906 | Low | Not scored | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Lack of Access Control Validation CVE-2025-49810, GHSA-pwvr-grqg-7vp2, GO-2025-3903 | Low | Not scored | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Fails to Properly Validate Team Role Modification CVE-2025-53971, GHSA-4276-cm8c-788h, GO-2025-3902 | Low | Not scored | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Confluence Plugin has Missing Authorization vulnerability CVE-2025-53857, GHSA-42m6-5vm7-fjv2, GO-2025-3864 | Low | Not scored | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Missing Authorization vulnerability CVE-2025-49221, GHSA-rfg4-2m63-fw2q, GO-2025-3862 | Low | Not scored | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
OpenBao has a Timing Side-Channel in the Userpass Auth Method BIT-openbao-2025-54999, CVE-2025-54999, GHSA-hh28-h22f-8357, GO-2025-3854 | Low | Not scored | 08 Aug, 2025 | Go github.com/openbao/openbao |
github.com/go-acme/lego/v4/acme/api does not enforce HTTPS CVE-2025-54799, GHSA-q82r-2j7m-9rv4, GO-2025-3847 | Low | Not scored | 06 Aug, 2025 | Go github.com/go-acme/lego Go github.com/go-acme/lego/v3 Go github.com/go-acme/lego/v4 |
Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users BIT-vault-2025-6011, CVE-2025-6011, GHSA-mwgr-84fv-3jh9, GO-2025-3839 | Low | Not scored | 01 Aug, 2025 | Go github.com/hashicorp/vault |
Moby firewalld reload removes bridge network isolation CVE-2025-54410, GHSA-4vq8-7jfc-9cvp, GO-2025-3829 | Low | Not scored | 29 Jul, 2025 | Go github.com/docker/docker |
Mattermost has Insufficiently Protected Credentials CVE-2025-6227, GHSA-4fwj-8595-wp25, GO-2025-3818 | Low | Not scored | 18 Jul, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |