Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Gogs: Stored XSS in branch and wiki views through author and committer names CVE-2026-26195, GHSA-vgvf-m4fw-938j, GO-2026-4618 | Medium | 0.2% | 05 Mar, 2026 | Go gogs.io/gogs |
Gogs: Release tag option injection in release deletion CVE-2026-26194, GHSA-v9vm-r24h-6rqm, GO-2026-4617 | High | 0.5% | 05 Mar, 2026 | Go gogs.io/gogs |
Gogs: Stored XSS via data URI in issue comments CVE-2026-26022, GHSA-xrcr-gmf5-2r8j, GO-2026-4620 | High | 0.4% | 05 Mar, 2026 | Go gogs.io/gogs |
Gogs: Cross-repository LFS object overwrite via missing content hash verification CVE-2026-25921, GHSA-cj4v-437j-jq4c, GO-2026-4616 | Critical | 0.4% | 05 Mar, 2026 | Go gogs.io/gogs |
Gokapi has privilege escalation with auth token CVE-2026-29060, GHSA-m2hx-wjxc-9fp4, GO-2026-4615 | Medium | 0.1% | 05 Mar, 2026 | Go github.com/forceu/gokapi |
Gokapi has Stored XSS in SVG Hotlinks CVE-2026-28683, GHSA-3c22-5j5m-4jq7, GO-2026-4612 | High | 0.2% | 05 Mar, 2026 | Go github.com/forceu/gokapi |
Gokapi has Data Leak in Upload Status Stream CVE-2026-28682, GHSA-c36c-7pc2-f2ph, GO-2026-4613 | Medium | 0.1% | 05 Mar, 2026 | Go github.com/forceu/gokapi |
Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure CVE-2026-27944, GHSA-g9w5-qffc-6762, GO-2026-4614 | Critical | 22.8% | 05 Mar, 2026 | Go github.com/0xJacky/Nginx-UI |
Agentgateway is missing parameter sanitization in MCP to OpenAPI conversion CVE-2026-29791, GHSA-v2x6-wwfw-r2rq | Medium | 0.2% | 05 Mar, 2026 | Go github.com/agentgateway/agentgateway |
Sliver is Vulnerable to Authenticated Nil-Pointer Dereference through its Handlers CVE-2026-29781, GHSA-hx52-cv84-jr5v, GO-2026-4609 | Low | 0.6% | 05 Mar, 2026 | Go github.com/bishopfox/sliver |
Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows BIT-docker-cli-2025-15558, CVE-2025-15558, GHSA-p436-gjf2-799p, GO-2026-4610 | High | 0.5% | 05 Mar, 2026 | Go github.com/docker/cli Go github.com/docker/compose Go github.com/docker/compose/v2 Go github.com/docker/compose/v5 |
ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover CVE-2026-29192, GHSA-6rx5-m2rc-hmf7, GO-2026-4605 | High | 0.4% | 04 Mar, 2026 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and Authentication CVE-2026-29193, GHSA-25rw-g6ff-fmg8, GO-2026-4604 | High | 0.4% | 04 Mar, 2026 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint CVE-2026-29191, GHSA-pr34-2v5x-6qjq, GO-2026-4607 | Critical | 0.5% | 04 Mar, 2026 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
File Browser's TUS Delete Endpoint Bypasses Delete Permission Check CVE-2026-29188, GHSA-79pf-vx4x-7jmm, GO-2026-4606 | Critical | 0.5% | 04 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Netmaker Vulnerable to Denial of Service via Server Shutdown Endpoint CVE-2026-29771, GHSA-rhr9-hgcm-x289, GO-2026-4608 | High | 0.4% | 04 Mar, 2026 | Go github.com/gravitl/netmaker |
SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint CVE-2026-29183, GHSA-6865-qjcf-286f, GO-2026-4596 | Critical | 0.7% | 04 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
traefik CVE-2024-45410 fix bypass: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`) CVE-2026-29054, GHSA-92mv-8f8w-wq52, GO-2026-4597 | High | 0.5% | 04 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Nuclio Shell Runtime Command Injection Leading to Privilege Escalation CVE-2026-29042, GHSA-95fj-3w7g-4r27, GO-2026-4598 | High | 2.6% | 04 Mar, 2026 | Go github.com/nuclio/nuclio |
lxd's non-recursive certificate listing bypasses per-object authorization and leaks all fingerprints CVE-2026-3351, GHSA-crmg-9m86-636r, GO-2026-4595 | Medium | 0.2% | 04 Mar, 2026 | Go github.com/canonical/lxd |
Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (Slowloris DOS) CVE-2026-26999, GHSA-xw98-5q62-jx94, GO-2026-4594 | High | 0.6% | 04 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS CVE-2026-26998, GHSA-fw45-f5q2-2p4x, GO-2026-4593 | Medium | 0.5% | 04 Mar, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access CVE-2026-29073, GHSA-jqwg-75qf-vmf9, GO-2026-4592 | Medium | 0.4% | 03 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Rancher Backup Operator pod's logs leak S3 tokens CVE-2025-62879, GHSA-wj3p-5h3x-c74q, GO-2026-4591 | Medium | 0.4% | 03 Mar, 2026 | Go github.com/rancher/backup-restore-operator |
Rancher cloud credentials can be used through proxy API by users without access CVE-2021-25320, GHSA-gqf8-rvrh-g7w6, GO-2026-4589 | Critical | 0.9% | 03 Mar, 2026 | Go github.com/rancher/rancher |
Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged user GHSA-hwm2-4ph6-w6m5, GO-2026-4590 | High | Not scored | 03 Mar, 2026 | Go github.com/rancher/rancher |
Rancher's weave CNI password is not configured when a cluster is created from an RKE template CVE-2022-21951, GHSA-vrph-m5jj-c46c | Medium | 0.4% | 03 Mar, 2026 | Go github.com/rancher/rancher |
Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB) CVE-2022-31247, GHSA-6x34-89p7-95wg | Critical | 1.0% | 03 Mar, 2026 | Go github.com/rancher/rancher |
Rancher doesn't properly sanitize credentials in cluster template answers CVE-2021-36783, GHSA-8w87-58w6-hfv8 | Critical | 0.8% | 03 Mar, 2026 | Go github.com/rancher/rancher |
Rancher's Azure AD permission changes are not reflected on active sessions CVE-2023-22648, GHSA-vf6j-6739-78m8 | High | 0.5% | 03 Mar, 2026 | Go github.com/rancher/rancher |
`melange update-cache` has unbounded HTTP download that can exhaust disk in CI CVE-2026-29049, GHSA-7rp8-r62p-q6wc, GO-2026-4588 | Medium | 0.3% | 02 Mar, 2026 | Go chainguard.dev/melange |
OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login CVE-2026-28790, GHSA-4fqm-6fmh-82mq, GO-2026-4587 | High | 0.7% | 02 Mar, 2026 | Go github.com/OliveTin/OliveTin |
OliveTin has unauthenticated DoS via concurrent map writes in OAuth2 state handling CVE-2026-28789, GHSA-45m3-398w-m2m9, GO-2026-4586 | High | 0.5% | 02 Mar, 2026 | Go github.com/OliveTin/OliveTin |
FileBrowser has Path Traversal in Public Share Links that Exposes Files Outside Shared Directory CVE-2026-28492, GHSA-mr74-928f-rw69, GO-2026-4585 | High | 0.4% | 02 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint CVE-2026-28342, GHSA-pc8g-78pf-4xrp, GO-2026-4584 | High | 0.8% | 02 Mar, 2026 | Go github.com/OliveTin/OliveTin |
malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability GHSA-54p8-x2m9-c593, GO-2026-4583 | Medium | Not scored | 02 Mar, 2026 | Go github.com/chainguard-dev/malcontent |
Bytebase vulnerable to Improper Authentication CVE-2022-51026, GHSA-5r3p-6rj5-7937 | Medium | 0.6% | 02 Mar, 2026 | Go github.com/bytebase/bytebase |
kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories CVE-2026-28406, GHSA-6rxq-q92g-4rmf, GO-2026-4580 | High | 0.7% | 01 Mar, 2026 | Go github.com/chainguard-dev/kaniko |
INSATutorat has an authorization bypass vulnerability in its /api/admin/* endpoints GHSA-xfx2-prg5-jq3g, GO-2026-4581 | High | Not scored | 01 Mar, 2026 | Go github.com/romitou/insatutorat |
malcontent: Nested archive extraction failure can drop content from scan inputs CVE-2026-28407, GHSA-945p-3jhm-6rcp, GO-2026-4577 | Medium | 0.4% | 28 Feb, 2026 | Go github.com/chainguard-dev/malcontent |
osctrl has Stored Cross-Site Scripting (XSS) in On-Demand Query List CVE-2026-28280, GHSA-4rv8-5cmm-2r22, GO-2026-4576 | Medium | 0.3% | 28 Feb, 2026 | Go github.com/jmpsec/osctrl |
osctrl is Vulnerable to OS Command Injection via Environment Configuration CVE-2026-28279, GHSA-rchw-322g-f7rm, GO-2026-4579 | High | 1.0% | 28 Feb, 2026 | Go github.com/jmpsec/osctrl |
Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse CVE-2026-28268, GHSA-rfjg-6m84-crj2, GO-2026-4575 | Critical | 0.7% | 28 Feb, 2026 | Go code.vikunja.io/api |
ZITADEL has potential SSRF via Actions CVE-2026-27945, GHSA-7777-fhq9-592v, GO-2026-4574 | Low | 0.3% | 27 Feb, 2026 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API CVE-2026-27946, GHSA-282g-fhmx-xf54, GO-2026-4572 | High | 0.2% | 27 Feb, 2026 | Go github.com/zitadel/zitadel |
ZITADEL's truncated opaque tokens are still valid CVE-2026-27840, GHSA-6mq3-xmgp-pjm5, GO-2026-4573 | Medium | 0.2% | 27 Feb, 2026 | Go github.com/zitadel/zitadel |
Beszel: Docker API has a Path Traversal Vulnerability via Unsanitized Container ID CVE-2026-27734, GHSA-phwh-4f42-gwf3, GO-2026-4571 | Medium | 0.5% | 27 Feb, 2026 | Go github.com/henrygd/beszel |
Vitess users with backup storage access can write to arbitrary file paths on restore CVE-2026-27969, GHSA-r492-hjgh-c9gw, GO-2026-4570 | Critical | 0.5% | 27 Feb, 2026 | Go vitess.io/vitess |
Vitess users with backup storage access can gain unauthorized access to production deployment environments CVE-2026-27965, GHSA-8g8j-r87h-p36x, GO-2026-4567 | High | 0.5% | 26 Feb, 2026 | Go vitess.io/vitess |
Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations BIT-sealed-secrets-2026-22728, CVE-2026-22728, GHSA-465p-v42x-3fmj, GO-2026-4565 | Medium | 0.4% | 26 Feb, 2026 | Go github.com/bitnami-labs/sealed-secrets |