Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Curio exposes database credentials to users with network access through verbose HTTP error responses GHSA-gj6x-q8rh-wj6x, GO-2026-4568 | High | Not scored | 26 Feb, 2026 | Go github.com/filecoin-project/curio |
WireGuard Portal is Vulnerable to Privilege Escalation via User Self-Update to Admin Level CVE-2026-27899, GHSA-5rmx-256w-8mj9, GO-2026-4566 | High | 0.3% | 26 Feb, 2026 | Go github.com/h44z/wg-portal |
MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity CVE-2026-27896, GHSA-wvj2-96wp-fq3f, GO-2026-4569 | High | 0.3% | 26 Feb, 2026 | Go github.com/modelcontextprotocol/go-sdk |
Terraform Provider for Linode Debug Logs Vulnerable to Sensitive Information Exposure CVE-2026-27900, GHSA-5rc7-2jj6-mp64, GO-2026-4562 | Medium | 0.5% | 26 Feb, 2026 | Go github.com/linode/terraform-provider-linode Go github.com/linode/terraform-provider-linode/v2 Go github.com/linode/terraform-provider-linode/v3 |
Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users CVE-2026-27465, GHSA-2v6m-6xw3-6467, GO-2026-4560 | High | 0.3% | 26 Feb, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet: Authorization Bypass in certificate template batch deletion for team administrators CVE-2026-25963, GHSA-5jvp-m9h4-253h, GO-2026-4561 | Medium | 0.2% | 26 Feb, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint CVE-2026-24004, GHSA-9pm7-6g36-6j78, GO-2026-4563 | Medium | 0.3% | 26 Feb, 2026 | Go github.com/fleetdm/fleet/v4 |
Fleet: Device lock PIN can be predicted if lock time is known CVE-2026-23999, GHSA-ppwx-5jq7-px2w, GO-2026-4564 | Medium | 0.1% | 26 Feb, 2026 | Go github.com/fleetdm/fleet/v4 |
Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net CVE-2026-27141, GO-2026-4559 | 0.6% | 26 Feb, 2026 | Go golang.org/x/net | |
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko CVE-2026-25140, GHSA-f4w5-5xv9-85f6, GO-2026-4410 | 0.4% | 26 Feb, 2026 | Go chainguard.dev/apko | |
Vikunja has Path Traversal in CLI Restore CVE-2026-27819, GHSA-42wg-38gx-85rh, GO-2026-4556 | High | 0.8% | 26 Feb, 2026 | Go code.vikunja.io/api |
Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API CVE-2026-27808, GHSA-mpf7-p9x7-96r3, GO-2026-4558 | Medium | 0.5% | 26 Feb, 2026 | Go github.com/axllent/mailpit |
Fleet has an SQL Injection vulnerability via backtick escape in ORDER BY parameter CVE-2026-26186, GHSA-49xw-vfc4-7p43, GO-2026-4557 | Medium | 0.4% | 26 Feb, 2026 | Go github.com/fleetdm/fleet/v4 |
esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route CVE-2026-27730, GHSA-p2v6-84h2-5x4r, GO-2026-4554 | High | 0.4% | 25 Feb, 2026 | Go github.com/esm-dev/esm.sh |
Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure CVE-2026-27616, GHSA-7jp5-298q-jg98, GO-2026-4553 | High | 0.5% | 25 Feb, 2026 | Go code.vikunja.io/api |
Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change CVE-2026-27575, GHSA-3ccg-x393-96v8, GO-2026-4551 | Critical | 0.5% | 25 Feb, 2026 | Go code.vikunja.io/api |
Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module CVE-2026-27116, GHSA-4qgr-4h56-8895, GO-2026-4552 | Medium | 0.3% | 25 Feb, 2026 | Go code.vikunja.io/api |
CIRCL has an incorrect calculation in secp384r1 CombinedMult CVE-2026-1229, GHSA-q9hv-hpm4-hj6x, GO-2026-4550 | Low | 0.4% | 25 Feb, 2026 | Go github.com/cloudflare/circl |
OpenKruise PodProbeMarker is Vulnerable to SSRF via Unrestricted Host Field CVE-2026-24005, GHSA-9fj4-3849-rv9g, GO-2026-4549 | Low | 0.3% | 25 Feb, 2026 | Go github.com/openkruise/kruise |
Sliver has Potential Zip Bomb Denial of Service in GzipEncoder GHSA-2phg-qgmm-r638, GO-2026-4548 | High | Not scored | 25 Feb, 2026 | Go github.com/bishopfox/sliver |
OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks CVE-2026-27626, GHSA-49gm-hh7w-wfvf, GO-2026-4547 | Critical | 0.6% | 25 Feb, 2026 | Go github.com/OliveTin/OliveTin |
FileBrowser Quantum: Password Protection Not Enforced on Shared File Links CVE-2026-27611, GHSA-8vrh-3pm2-v4v6, GO-2026-4546 | High | 0.4% | 25 Feb, 2026 | Go github.com/gtsteffaniak/filebrowser/backend |
esm.sh is vulnerable to full-response SSRF CVE-2025-50180, GHSA-3c9r-837r-qqm4, GO-2026-4545 | High | 0.4% | 25 Feb, 2026 | Go github.com/esm-dev/esm.sh |
Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory CVE-2026-27598, GHSA-6v48-fcq6-ff23, GO-2026-4542 | High | 0.6% | 24 Feb, 2026 | Go github.com/dagu-org/dagu |
Fiber has a Denial of Service Vulnerability via Route Parameter Overflow CVE-2026-25882, GHSA-mrq8-rjmw-wpq3, GO-2026-4543 | Medium | 0.7% | 24 Feb, 2026 | Go github.com/gofiber/fiber/v2 Go github.com/gofiber/fiber/v3 |
Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation CVE-2026-25899, GHSA-2mr3-m5q5-wgp6, GO-2026-4534 | High | 0.4% | 24 Feb, 2026 | Go github.com/gofiber/fiber/v3 |
Fiber has an Arbitrary File Read in Static Middleware on Windows CVE-2026-25891, GHSA-m3c2-496v-cw3v, GO-2026-4540 | High | 0.7% | 24 Feb, 2026 | Go github.com/gofiber/fiber/v3 |
Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport CVE-2026-27590, GHSA-5r3v-vc8m-m96g, GO-2026-4536 | High | 0.6% | 24 Feb, 2026 | Go github.com/caddyserver/caddy/v2 |
Caddy is vulnerable to cross-origin config application via local admin API /load CVE-2026-27589, GHSA-879p-475x-rqh2, GO-2026-4537 | Medium | 0.2% | 24 Feb, 2026 | Go github.com/caddyserver/caddy/v2 |
Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass CVE-2026-27588, GHSA-x76f-jf84-rqj8, GO-2026-4541 | High | 0.4% | 24 Feb, 2026 | Go github.com/caddyserver/caddy/v2 |
Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass CVE-2026-27587, GHSA-g7pc-pc7g-h8jh, GO-2026-4538 | High | 0.4% | 24 Feb, 2026 | Go github.com/caddyserver/caddy/v2 |
Caddy: mTLS client authentication silently fails open when CA certificate file is missing or malformed CVE-2026-27586, GHSA-hffm-g8v7-wrv7, GO-2026-4539 | High | 0.3% | 24 Feb, 2026 | Go github.com/caddyserver/caddy/v2 |
Caddy: Improper sanitization of glob characters in file matcher may lead to bypassing security protections CVE-2026-27585, GHSA-4xrr-hq4w-6vf4, GO-2026-4535 | Medium | 0.4% | 24 Feb, 2026 | Go github.com/caddyserver/caddy/v2 |
nats-server websockets are vulnerable to pre-auth memory DoS BIT-nats-2026-27571, CVE-2026-27571, GHSA-qrvq-68c2-7grw, GO-2026-4533 | Medium | 0.5% | 24 Feb, 2026 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
New API has Potential XSS in its MarkdownRenderer component CVE-2026-25802, GHSA-299v-8pq9-5gjq, GO-2026-4532 | High | 0.3% | 23 Feb, 2026 | Go github.com/QuantumNous/new-api |
New API has an SQL LIKE Wildcard Injection DoS via Token Search CVE-2026-25591, GHSA-w6x6-9fp7-fqm4, GO-2026-4531 | High | 0.6% | 23 Feb, 2026 | Go github.com/QuantumNous/new-api |
Traefik affected by TLS ClientAuth Bypass on HTTP/3 GHSA-gv8r-9rw9-9697, GO-2026-4530 | High | Not scored | 20 Feb, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped BIT-cosign-2026-24122, CVE-2026-24122, GHSA-wfqv-66vq-46rm, GO-2026-4529 | Low | 0.2% | 19 Feb, 2026 | Go github.com/sigstore/cosign Go github.com/sigstore/cosign/v2 Go github.com/sigstore/cosign/v3 |
Centrifugo v6.6.0 dependency vulnerabilities GHSA-j9wf-6r2x-hqmx, GO-2026-4528 | Medium | Not scored | 19 Feb, 2026 | Go github.com/centrifugal/centrifugo Go github.com/centrifugal/centrifugo/v3 Go github.com/centrifugal/centrifugo/v4 Go github.com/centrifugal/centrifugo/v5 +1 more |
Dagu affected by unauthenticated RCE via inline DAG spec in default configuration GHSA-6qr9-g2xw-cw92, GO-2026-4527 | Critical | Not scored | 19 Feb, 2026 | Go github.com/dagu-org/dagu |
Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled BIT-cilium-2026-26963, BIT-cilium-operator-2026-26963, BIT-hubble-relay-2026-26963, CVE-2026-26963, GHSA-5r23-prx4-mqg3, GO-2026-4522 | Medium | 0.1% | 19 Feb, 2026 | Go github.com/cilium/cilium |
Kata Container to Guest micro VM privilege escalation CVE-2026-24834, GHSA-wwj6-vghv-5p64, GO-2026-4517 | Medium | 0.2% | 19 Feb, 2026 | Go github.com/kata-containers/kata-containers/src/runtime |
Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints CVE-2026-27112, GHSA-7g9x-cp9g-92mr, GO-2026-4516 | Critical | 0.5% | 19 Feb, 2026 | Go github.com/akuity/kargo |
Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints CVE-2026-27111, GHSA-5vvm-67pj-72g4, GO-2026-4515 | Medium | 0.2% | 19 Feb, 2026 | Go github.com/akuity/kargo |
Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake CVE-2026-26315, GHSA-m6j8-rg6r-7mv8, GO-2026-4511 | Medium | 0.5% | 18 Feb, 2026 | Go github.com/ethereum/go-ethereum |
Go Ethereum affected by DoS via malicious p2p message CVE-2026-26314, GHSA-2gjw-fg97-vg3r, GO-2026-4507 | High | 0.7% | 18 Feb, 2026 | Go github.com/ethereum/go-ethereum |
Go Ethereum affected by DoS via malicious p2p message CVE-2026-26313, GHSA-689v-6xwf-5jf3, GO-2026-4508 | Medium | 0.7% | 18 Feb, 2026 | Go github.com/ethereum/go-ethereum |
uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120 CVE-2026-26995, GHSA-rrxv-pmq9-x67r, GO-2026-4512 | Low | Not scored | 18 Feb, 2026 | Go github.com/refraction-networking/utls |
uTLS has a fingerprint vulnerability from GREASE ECH mismatch for Chrome parrots CVE-2026-27017, GHSA-7m29-f4hw-g2vx, GO-2026-4509 | Low | 0.2% | 18 Feb, 2026 | Go github.com/refraction-networking/utls |
opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path CVE-2026-26205, GHSA-9f29-v6mm-pw6w, GO-2026-4506 | High | 0.5% | 18 Feb, 2026 | Go github.com/open-policy-agent/opa-envoy-plugin |