Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root CVE-2026-61625, GHSA-8q3c-rjr9-xxrp, GO-2026-6366 | Medium | Not scored | 03 Sep, 2026 | Go github.com/VictoriaMetrics/VictoriaMetrics |
OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool CVE-2026-75602, GHSA-h6cj-26g5-67fv, GO-2026-6368 | Medium | Not scored | 03 Sep, 2026 | Go github.com/OpenListTeam/OpenList Go github.com/OpenListTeam/OpenList/v3 Go github.com/OpenListTeam/OpenList/v4 |
Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match BIT-cilium-2026-56743, BIT-cilium-operator-2026-56743, BIT-hubble-relay-2026-56743, CVE-2026-56743, GHSA-fm8w-2m5w-9j7r, GO-2026-6367 | Medium | Not scored | 03 Sep, 2026 | Go github.com/cilium/cilium |
SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f) CVE-2026-65607, GHSA-gw25-m53r-qh88, GO-2026-6365 | Medium | Not scored | 03 Sep, 2026 | Go github.com/siyuan-note/siyuan/kernel |
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) CVE-2026-73840, GHSA-c5f6-2rm9-2w8g, GO-2026-6360 | Medium | Not scored | 02 Sep, 2026 | Go github.com/openchoreo/openchoreo |
SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets BIT-seaweedfs-2026-55873, CVE-2026-55873, GHSA-hgpf-8634-g44c, GO-2026-6329 | Medium | Not scored | 28 Aug, 2026 | Go github.com/seaweedfs/seaweedfs |
arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset CVE-2026-55678, GHSA-p378-jp5r-gpgw, GO-2026-6322 | Medium | Not scored | 28 Aug, 2026 | Go github.com/basekick-labs/arc |
Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment CVE-2026-55067, GHSA-569v-q83c-3j3g, GO-2026-6307 | Medium | Not scored | 28 Aug, 2026 | Go code.vikunja.io/api |
Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0 CVE-2026-55064, GHSA-44v6-7fxq-vgf4, GO-2026-6306 | Medium | Not scored | 28 Aug, 2026 | Go code.vikunja.io/api |
Vikunja has a project duplication bypasses write-permission check on the target parent project CVE-2026-54766, GHSA-f27p-pw2p-9pr4, GO-2026-6311 | Medium | Not scored | 28 Aug, 2026 | Go code.vikunja.io/api |
Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none CVE-2026-55834, GHSA-2wvm-8mvp-22qv, GO-2026-6305 | Medium | Not scored | 28 Aug, 2026 | Go github.com/pocket-id/pocket-id/backend |
Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory CVE-2026-55569, GHSA-mf5c-hw34-4hpp, GO-2026-6314 | Medium | Not scored | 28 Aug, 2026 | Go github.com/aquaproj/aqua Go github.com/aquaproj/aqua/v2 |
Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe CVE-2026-54746, GHSA-8x7x-83cf-c3pg, GO-2026-6309 | Medium | Not scored | 28 Aug, 2026 | Go github.com/hatchet-dev/hatchet |
Cloudreve's remote download file paths can escape the selected destination directory CVE-2026-101051, GHSA-w8j7-39hp-8x59, GO-2026-6289 | Medium | Not scored | 24 Aug, 2026 | Go github.com/cloudreve/Cloudreve Go github.com/cloudreve/Cloudreve/v3 Go github.com/cloudreve/Cloudreve/v4 |
Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint CVE-2026-101056, GHSA-vx2m-jpxr-xv7w, GO-2026-6287 | Medium | Not scored | 24 Aug, 2026 | Go github.com/cloudreve/Cloudreve Go github.com/cloudreve/Cloudreve/v3 Go github.com/cloudreve/Cloudreve/v4 |
Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key GHSA-w67g-5rqw-f597, GO-2026-6278 | Medium | Not scored | 24 Aug, 2026 | Go github.com/gorilla/websocket |
Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689) CVE-2026-67448, GHSA-8r62-w5wh-fc5m, GO-2026-6271 | Medium | Not scored | 20 Aug, 2026 | Go github.com/axllent/mailpit |
Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement CVE-2026-67447, GHSA-r553-m4fv-5v97, GO-2026-6272 | Medium | Not scored | 20 Aug, 2026 | Go github.com/axllent/mailpit |
Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs CVE-2026-101047, GHSA-q9c5-pp7m-fm2g, GO-2026-6268 | Medium | Not scored | 20 Aug, 2026 | Go github.com/fleetdm/fleet/v4 |
Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution CVE-2026-54168, GHSA-6f2p-296r-cc28, GO-2026-6263 | Medium | Not scored | 20 Aug, 2026 | Go github.com/openshift-pipelines/pipelines-as-code |
Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI CVE-2026-54162, GHSA-x3g7-qrwc-f6c5, GO-2026-6270 | Medium | Not scored | 20 Aug, 2026 | Go github.com/alexandre-daubois/ember |
OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access CVE-2026-45404, GHSA-42cj-99w8-cp2p, GO-2026-6258 | Medium | Not scored | 20 Aug, 2026 | Go go.opentelemetry.io/otel/bridge/opentracing |
Velero vulnerable to file path traversal when extracting from backup's tarball CVE-2026-32637, GHSA-j2g6-362q-6qc6, GO-2026-6259 | Medium | Not scored | 20 Aug, 2026 | Go github.com/vmware-tanzu/velero |
BuildKit: Custom frontend could bypass Seccomp/AppArmor CVE-2026-61711, GHSA-7236-3392-c5c6, GO-2026-6255 | Medium | Not scored | 19 Aug, 2026 | Go github.com/moby/buildkit |
Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS CVE-2026-53941, GHSA-vjhx-2cqw-3q6q, GO-2026-6254 | Medium | Not scored | 19 Aug, 2026 | Go github.com/inspektor-gadget/inspektor-gadget |
Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data CVE-2026-65959, GHSA-mhc4-g3wh-cw7m, GO-2026-6356 | Medium | Not scored | 18 Aug, 2026 | Go vitess.io/vitess |
Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write CVE-2026-63328, GHSA-8rc5-4fr6-64pw, GO-2026-6250 | Medium | Not scored | 18 Aug, 2026 | Go github.com/aquasecurity/trivy |
uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability CVE-2026-55062, GHSA-m6jg-wr9m-cg2f, GO-2026-6247 | Medium | Not scored | 17 Aug, 2026 | Go gitlab.com/uniget-org/cli |
uniget CLI has an EDITOR Command Injection CVE-2026-55061, GHSA-qmcq-xw74-w667, GO-2026-6248 | Medium | Not scored | 17 Aug, 2026 | Go gitlab.com/uniget-org/cli |
Terragrunt: Arbitrary File Deletion via Malicious Module Manifest CVE-2026-45099, GHSA-8394-6f8r-whxg, GO-2026-6241 | Medium | Not scored | 17 Aug, 2026 | Go github.com/gruntwork-io/terragrunt |
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass CVE-2026-64865, GHSA-j6gc-4893-qwmp, GO-2026-6243 | Medium | Not scored | 17 Aug, 2026 | Go github.com/QuantumNous/new-api |
New API: Admin can reset passkeys for same-level or higher-privileged users CVE-2026-64866, GHSA-p845-629j-rcj6, GO-2026-6244 | Medium | Not scored | 17 Aug, 2026 | Go github.com/QuantumNous/new-api |
Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter CVE-2026-53658, GHSA-xghw-p77p-3r7x, GO-2026-6234 | Medium | Not scored | 14 Aug, 2026 | Go github.com/hyperledger/fabric-ca |
Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint CVE-2026-48786, GHSA-88p2-jj8w-j8qg, GO-2026-6220 | Medium | Not scored | 12 Aug, 2026 | Go github.com/fleetdm/fleet/v4 |
go-git: Malicious reference names may modify files outside the reference storage CVE-2026-71557, GHSA-qgq7-7hm3-q39j, GO-2026-6214 | Medium | Not scored | 07 Aug, 2026 | Go github.com/go-git/go-git/v5 Go github.com/go-git/go-git/v6 |
Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port CVE-2026-54765, GHSA-6p8f-p8j2-rqmv, GO-2026-6205 | Medium | Not scored | 06 Aug, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef CVE-2026-71325, GHSA-62fc-8686-hfmq, GO-2026-6203 | Medium | Not scored | 06 Aug, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false CVE-2026-54764, GHSA-3q9r-p662-5j8m, GO-2026-6202 | Medium | Not scored | 06 Aug, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass CVE-2026-65602, GHSA-42cj-m3vj-89wv, GO-2026-6192 | Medium | Not scored | 05 Aug, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion CVE-2026-65601, GHSA-qq9q-x9w4-chhj, GO-2026-6198 | Medium | Not scored | 05 Aug, 2026 | Go Traefik Go github.com/traefik/traefik |
rclone: Local Encoding Path Traversal BIT-rclone-2026-71313, CVE-2026-71313, GHSA-7p4m-qxvv-g567, GO-2026-6186 | Medium | Not scored | 05 Aug, 2026 | Go github.com/rclone/rclone |
rclone archive extract allows S3 destination prefix escape via crafted archive paths BIT-rclone-2026-59732, CVE-2026-59732, GHSA-4vr5-p2gc-h23p, GO-2026-6185 | Medium | Not scored | 05 Aug, 2026 | Go github.com/rclone/rclone |
rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect BIT-rclone-2026-79779, CVE-2026-79779, GHSA-h4mf-4v27-hggj, GO-2026-6197 | Medium | Not scored | 05 Aug, 2026 | Go github.com/rclone/rclone |
rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines BIT-rclone-2026-71311, CVE-2026-71311, GHSA-8c48-q9wj-3w37, GO-2026-6187 | Medium | Not scored | 05 Aug, 2026 | Go github.com/rclone/rclone |
rclone: S3 Redirect Sanitization Omits IBM IAM Bearer Tokens and SSE-C Keys BIT-rclone-2026-79780, CVE-2026-79780, GHSA-8mxv-9xhp-86h4, GO-2026-6188 | Medium | Not scored | 05 Aug, 2026 | Go github.com/rclone/rclone |
rclone: Path traversal in serve s3 allows reading and overwriting root-level files BIT-rclone-2026-79781, CVE-2026-79781, GHSA-8v25-v8p6-qf7v, GO-2026-6189 | Medium | Not scored | 05 Aug, 2026 | Go github.com/rclone/rclone |
rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic BIT-rclone-2026-79778, CVE-2026-79778, GHSA-3x6r-wxxg-53vv, GO-2026-6183 | Medium | Not scored | 05 Aug, 2026 | Go github.com/rclone/rclone |
rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory BIT-rclone-2026-71310, CVE-2026-71310, GHSA-xhf4-832v-7xcr, GO-2026-6199 | Medium | Not scored | 05 Aug, 2026 | Go github.com/rclone/rclone |
Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message CVE-2026-54908, GHSA-wg4g-wm44-ch5j, GO-2026-6165 | Medium | Not scored | 31 Jul, 2026 | Go github.com/pion/dtls/v3 |
Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute CVE-2026-54909, GHSA-34rh-wp3j-6cxc, GO-2026-6163 | Medium | Not scored | 31 Jul, 2026 | Go github.com/pion/stun Go github.com/pion/stun/v2 Go github.com/pion/stun/v3 |