Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OliveTin's unsafe parsing of UniqueTrackingId can be used to write files CVE-2026-31817, GHSA-364q-w7vh-vhpc, GO-2026-4670 | High | 0.7% | 11 Mar, 2026 | Go github.com/OliveTin/OliveTin |
SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS CVE-2026-31809, GHSA-pmc9-f5qr-2pcr, GO-2026-4669 | Medium | 0.5% | 10 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS CVE-2026-31807, GHSA-5hc8-qmg8-pw27, GO-2026-4667 | Medium | 0.5% | 10 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
zot’s create-only policy allows overwrite attempts of existing latest tag (update permission not required) CVE-2026-31801, GHSA-85jx-fm8m-x8c6, GO-2026-4668 | High | 0.2% | 10 Mar, 2026 | Go zotregistry.dev/zot Go zotregistry.dev/zot/v2 |
Envoy's global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly BIT-envoy-2026-26330, CVE-2026-26330, GHSA-c23c-rp3m-vpg3 | Medium | 0.3% | 10 Mar, 2026 | Go github.com/envoyproxy/envoy |
Envoy: HTTP - filter chain execution on reset streams causing UAF crash BIT-envoy-2026-26311, CVE-2026-26311, GHSA-84xm-r438-86px | Medium | 0.4% | 10 Mar, 2026 | Go github.com/envoyproxy/envoy |
Envoy affected by off-by-one write in JsonEscaper::escapeString() BIT-envoy-2026-26309, CVE-2026-26309, GHSA-56cj-wgg3-x943 | Medium | 0.4% | 10 Mar, 2026 | Go github.com/envoyproxy/envoy |
Envoy has RBAC Header Validation Bypass via Multi-Value Header Concatenation BIT-envoy-2026-26308, CVE-2026-26308, GHSA-ghc4-35x6-crw5 | High | 0.3% | 10 Mar, 2026 | Go github.com/envoyproxy/envoy |
Envoy vulnerable to crash for scoped ip address during DNS BIT-envoy-2026-26310, CVE-2026-26310, GHSA-3cw6-2j68-868p | Medium | 0.4% | 10 Mar, 2026 | Go github.com/envoyproxy/envoy |
Linkdave Missing Authentication on REST and WebSocket endpoints GHSA-xv8g-fj9h-6gmv, GO-2026-4661 | Critical | Not scored | 10 Mar, 2026 | Go github.com/shi-gg/linkdave |
FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse) CVE-2026-30934, GHSA-r633-fcgp-m532, GO-2026-4660 | High | 0.4% | 09 Mar, 2026 | Go github.com/gtsteffaniak/filebrowser |
FileBrowser Quantum: Password-Protected Share Bypass via /public/api/share/info CVE-2026-30933, GHSA-525j-95gf-766f, GO-2026-4659 | High | 0.6% | 09 Mar, 2026 | Go github.com/gtsteffaniak/filebrowser/backend |
SiYuan: Authorization Bypass Allows Low-Privilege Publish User to Modify Notebook Content via /api/block/appendHeadingChildren CVE-2026-30926, GHSA-f9cq-v43p-v523, GO-2026-4658 | High | 0.3% | 09 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Kubewarden: Cross-namespace data exfiltration via deprecated host callback binding CVE-2026-29773, GHSA-6r7f-3fwq-hq74, GO-2026-4652 | Medium | 0.2% | 09 Mar, 2026 | Go github.com/kubewarden/kubewarden-controller |
Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys CVE-2026-29196, GHSA-4hgg-c4rr-6h7f, GO-2026-4651 | High | 0.3% | 09 Mar, 2026 | Go github.com/gravitl/netmaker |
Netmaker has Privilege Escalation from Admin to Super-Admin via User Update CVE-2026-29195, GHSA-ch3w-9456-38v3, GO-2026-4654 | Medium | 0.3% | 09 Mar, 2026 | Go github.com/gravitl/netmaker |
Netmaker has Insufficient Authorization in Host Token Verification CVE-2026-29194, GHSA-hmqr-wjmj-376c, GO-2026-4655 | High | 0.5% | 09 Mar, 2026 | Go github.com/gravitl/netmaker |
Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange CVE-2026-28513, GHSA-qh6q-598w-w6m2, GO-2026-4656 | High | 0.3% | 09 Mar, 2026 | Go github.com/pocket-id/pocket-id/backend |
Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion CVE-2026-28512, GHSA-9h33-g3ww-mqff, GO-2026-4653 | High | 0.2% | 09 Mar, 2026 | Go github.com/pocket-id/pocket-id/backend |
x402 SDK Security Advisory GHSA-qr2g-p6q7-w82m, GO-2026-4647 | High | Not scored | 07 Mar, 2026 | Go github.com/coinbase/x402/go PyPI x402 npm @x402/svm |
SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage CVE-2026-30869, GHSA-2h2p-mvfx-868w, GO-2026-4646 | Critical | 1.2% | 07 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
WeKnora has Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation CVE-2026-30861, GHSA-r55h-3rwj-hcmg, GO-2026-4645 | Critical | 2.4% | 07 Mar, 2026 | Go github.com/Tencent/WeKnora |
WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool CVE-2026-30860, GHSA-8w32-6mrw-q5wv, GO-2026-4641 | Critical | 0.7% | 06 Mar, 2026 | Go github.com/Tencent/WeKnora |
WeKnora has Broken Access Control - Cross-Tenant Data Exposure CVE-2026-30859, GHSA-2f4c-vrjq-rcgv, GO-2026-4637 | High | 0.2% | 06 Mar, 2026 | Go github.com/Tencent/WeKnora |
WeKnora has DNS Rebinding Vulnerability in web_fetch Tool that Allows SSRF to Internal Resources CVE-2026-30858, GHSA-h6gw-8f77-mmmp, GO-2026-4643 | High | 0.4% | 06 Mar, 2026 | Go github.com/Tencent/WeKnora |
WeKnora has Unauthorized Cross‑Tenant Knowledge Base Cloning CVE-2026-30857, GHSA-8rf9-c59g-f82f, GO-2026-4640 | Medium | 0.3% | 06 Mar, 2026 | Go github.com/Tencent/WeKnora |
WeKnora Vulnerable to Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection CVE-2026-30856, GHSA-67q9-58vj-32qx, GO-2026-4638 | Medium | 0.3% | 06 Mar, 2026 | Go github.com/Tencent/WeKnora |
WeKnora Vulnerable to Broken Access Control in Tenant Management CVE-2026-30855, GHSA-ccj6-79j6-cq5q, GO-2026-4642 | Critical | 0.4% | 06 Mar, 2026 | Go github.com/Tencent/WeKnora |
Caddy's vars_regexp double-expands user input, leaking env vars and files CVE-2026-30852, GHSA-m2w3-8f23-hxxf, GO-2026-4644 | Medium | 0.5% | 06 Mar, 2026 | Go github.com/caddyserver/caddy/v2 Go github.com/caddyserver/caddy/v2/modules/caddyhttp |
Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation CVE-2026-30851, GHSA-7r4p-vjf4-gxv4, GO-2026-4639 | High | 0.3% | 06 Mar, 2026 | Go github.com/caddyserver/caddy/v2 Go github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy |
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import CVE-2026-30832, GHSA-3fvx-xrxq-8jvv, GO-2026-4634 | Critical | 0.4% | 06 Mar, 2026 | Go github.com/charmbracelet/soft-serve |
Zarf's symlink targets in archives are not validated against destination directory CVE-2026-29064, GHSA-hcm4-6hpj-vghm, GO-2026-4636 | High | 0.3% | 06 Mar, 2026 | Go github.com/zarf-dev/zarf Go github.com/zarf-dev/zarf/src/pkg/archive |
CoreDNS Loop Detection Denial of Service Vulnerability CVE-2026-26018, GHSA-h75p-j8xm-m278, GO-2026-4635 | High | 1.2% | 06 Mar, 2026 | Go github.com/coredns/coredns |
Incorrect parsing of IPv6 host literals in net/url BIT-golang-2026-25679, CVE-2026-25679, GO-2026-4601 | 0.8% | 06 Mar, 2026 | Go stdlib | |
Incorrect enforcement of email constraints in crypto/x509 BIT-golang-2026-27137, CVE-2026-27137, GO-2026-4599 | 0.7% | 06 Mar, 2026 | Go stdlib | |
Panic in name constraint checking for malformed certificates in crypto/x509 BIT-golang-2026-27138, CVE-2026-27138, GO-2026-4600 | 0.4% | 06 Mar, 2026 | Go stdlib | |
FileInfo can escape from a Root in os BIT-golang-2026-27139, CVE-2026-27139, GO-2026-4602 | 0.2% | 06 Mar, 2026 | Go stdlib | |
URLs in meta content attribute actions are not escaped in html/template BIT-golang-2026-27142, CVE-2026-27142, GO-2026-4603 | 0.4% | 06 Mar, 2026 | Go stdlib | |
PinchTab has SSRF with Full Response Exfiltration via Download Handler CVE-2026-30834, GHSA-rw8p-c6hf-q3pg, GO-2026-4631 | High | 0.5% | 06 Mar, 2026 | Go github.com/pinchtab/pinchtab Go github.com/pinchtab/pinchtab/cmd/pinchtab |
CoreDNS ACL Bypass CVE-2026-26017, GHSA-c9v3-4pv7-87pr, GO-2026-4630 | High | 0.4% | 06 Mar, 2026 | Go github.com/coredns/coredns |
WeKnora is Vulnerable to SSRF via Redirection CVE-2026-30247, GHSA-595m-wc8g-6qgc, GO-2026-4628 | Medium | 0.4% | 05 Mar, 2026 | Go github.com/Tencent/WeKnora |
OliveTin doesn't check view permission when returning dashboards CVE-2026-30233, GHSA-jf73-858c-54pg, GO-2026-4629 | Medium | 0.5% | 05 Mar, 2026 | Go github.com/OliveTin/OliveTin |
OliveTin has crash on NPE by calling APIs with invalid bindings or log references GHSA-fwhj-785h-43hh, GO-2026-4621 | Medium | Not scored | 05 Mar, 2026 | Go github.com/OliveTin/OliveTin |
OliveTin's RestartAction always runs actions as guest CVE-2026-30225, GHSA-p443-p7w5-2f7f, GO-2026-4625 | Medium | 0.5% | 05 Mar, 2026 | Go github.com/OliveTin/OliveTin |
OliveTin Session Fixation: Logout Fails to Invalidate Server-Side Session CVE-2026-30224, GHSA-gq2m-77hf-vwgh, GO-2026-4623 | Medium | 0.3% | 05 Mar, 2026 | Go github.com/OliveTin/OliveTin |
OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes CVE-2026-30223, GHSA-g962-2j28-3cg9, GO-2026-4622 | High | 0.3% | 05 Mar, 2026 | Go github.com/OliveTin/OliveTin |
Gokapi has CSRF in Login Endpoint CVE-2026-29084, GHSA-hcff-qv74-7hr4, GO-2026-4624 | Medium | 0.1% | 05 Mar, 2026 | Go github.com/forceu/gokapi |
Gokapi has privilege escalation via incomplete API-key permission revocation on user rank demotion CVE-2026-29061, GHSA-q658-hfpg-35qc, GO-2026-4626 | Medium | 0.1% | 05 Mar, 2026 | Go github.com/forceu/gokapi |
Gogs: DOM-based XSS via milestone selection CVE-2026-26276, GHSA-vgjm-2cpf-4g7c, GO-2026-4627 | High | 0.2% | 05 Mar, 2026 | Go gogs.io/gogs |
Gogs: Access tokens get exposed through URL params in API requests CVE-2026-26196, GHSA-x9p5-w45c-7ffc, GO-2026-4619 | Medium | 0.3% | 05 Mar, 2026 | Go gogs.io/gogs |