Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Withdrawn Advisory: Libredesk has a SSRF Vulnerability in Webhooks CVE-2026-26957, GHSA-wgm6-9rvv-3438, GO-2026-4505 | Medium | Not scored | 18 Feb, 2026 | Go github.com/abhinavxd/libredesk |
filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity CVE-2026-26958, GHSA-fw7p-63qq-7hpr, GO-2026-4503 | Low | 0.4% | 17 Feb, 2026 | Go filippo.io/edwards25519 |
emp3r0r Affected by Concurrent Map Access DoS (panic/crash) CVE-2026-26201, GHSA-f5p9-j34q-pwcc, GO-2026-4504 | High | 0.3% | 17 Feb, 2026 | Go github.com/jm33-m0/emp3r0r/core |
Echo has a Windows path traversal via backslash in middleware.Static default filesystem CVE-2026-25766, GHSA-pgvm-wxw2-hrv9, GO-2026-4502 | Medium | 0.4% | 17 Feb, 2026 | Go github.com/labstack/echo/v5 |
Unauthenticated File Upload in Gogs CVE-2026-25242, GHSA-fc3h-92p8-h36f, GO-2026-4500 | Medium | 0.7% | 17 Feb, 2026 | Go gogs.io/gogs |
Gogs has a Protected Branch Deletion Bypass in Web Interface CVE-2026-25232, GHSA-2c6v-8r3v-gh6p, GO-2026-4498 | High | 0.5% | 17 Feb, 2026 | Go gogs.io/gogs |
Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs CVE-2026-25229, GHSA-cv22-72px-f4gh, GO-2026-4499 | Medium | 0.3% | 17 Feb, 2026 | Go gogs.io/gogs |
Gogs Allows Cross-Repository Comment Deletion via DeleteComment CVE-2026-25120, GHSA-jj5m-h57j-5gv7, GO-2026-4501 | Medium | 0.3% | 17 Feb, 2026 | Go gogs.io/gogs |
Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change GHSA-hr7j-63v7-vj7g, GO-2026-4497 | High | Not scored | 17 Feb, 2026 | Go github.com/pterodactyl/wings Packagist pterodactyl/panel |
Mattermost fails to properly validate team membership when processing channel mentions CVE-2025-14350, GHSA-57cc-2pf4-mhmx, GO-2026-4521 | Medium | 0.2% | 16 Feb, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to enforce invite permissions when updating team settings CVE-2025-14573, GHSA-cgjg-p2m2-qm4p, GO-2026-4523 | Low | 0.2% | 16 Feb, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to sanitize sensitive data in WebSocket messages CVE-2025-13821, GHSA-pp9j-pf5c-659x, GO-2026-4524 | Medium | 0.2% | 16 Feb, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Plugin Zoom allows any logged-in user to change Zoom meeting restrictions for arbitrary channels CVE-2026-0997, GHSA-2phx-frhf-xr55, GO-2026-4519 | Medium | 0.2% | 16 Feb, 2026 | Go github.com/mattermost/mattermost-plugin-zoom |
Mattermost Plugin Zoom fail to validate user identity and post ownership in the {{/api/v1/askPMI}} endpoint CVE-2026-0998, GHSA-w65c-fvp5-fvc5, GO-2026-4525 | Medium | 0.2% | 16 Feb, 2026 | Go github.com/mattermost/mattermost-plugin-zoom |
Mattermost fails to properly validate login method restrictions CVE-2026-0999, GHSA-3c9r-7f29-qp32, GO-2026-4520 | Medium | 0.2% | 16 Feb, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access CVE-2026-26187, GHSA-699m-4v95-rmpm, GO-2026-4494 | High | 0.5% | 13 Feb, 2026 | Go github.com/treeverse/lakefs |
Mattermost doesn't properly validate channel membership at the time of data retrieval CVE-2026-20796, GHSA-2xf7-hmf6-p64j, GO-2026-4495 | Low | 0.2% | 13 Feb, 2026 | Go github.com/mattermost/mattermost-server |
Mattermost doesn't validate user permissions when creating Jira issues from Mattermost posts CVE-2026-22892, GHSA-9pj7-jh2r-87g8, GO-2026-4496 | Medium | 0.3% | 13 Feb, 2026 | Go github.com/mattermost/mattermost-server |
NeuVector scanner insecurely handles passwords as command arguments CVE-2025-67860, GHSA-3c9m-gq32-g4jx, GO-2026-4490 | Low | 0.1% | 12 Feb, 2026 | Go github.com/neuvector/scanner |
Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC CVE-2026-26056, GHSA-wj8p-jj64-h7ff, GO-2026-4493 | High | 0.5% | 12 Feb, 2026 | Go github.com/yokecd/yoke |
Unauthenticated Admission Webhook Endpoints in Yoke ATC CVE-2026-26055, GHSA-965m-v4cc-6334, GO-2026-4491 | High | 0.5% | 12 Feb, 2026 | Go github.com/yokecd/yoke |
Traefik: TCP readTimeout bypass via STARTTLS on Postgres CVE-2026-25949, GHSA-89p3-4642-cr2w, GO-2026-4484 | High | 0.8% | 12 Feb, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP CVE-2026-24895, GHSA-g966-83w7-6w38, GO-2026-4486 | High | 0.7% | 12 Feb, 2026 | Go github.com/dunglas/frankenphp |
FrankenPHP leaks session data between requests in worker mode CVE-2026-24894, GHSA-r3xh-3r3w-47gp, GO-2026-4489 | High | 0.5% | 12 Feb, 2026 | Go github.com/dunglas/frankenphp |
webtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map CVE-2026-21438, GHSA-2f2x-8mwp-p2gc, GO-2026-4483 | Medium | 0.4% | 12 Feb, 2026 | Go github.com/quic-go/webtransport-go |
webtransport-go: CloseWithError can block indefinitely CVE-2026-21435, GHSA-px4r-g4p3-hhqv, GO-2026-4488 | Medium | 0.5% | 12 Feb, 2026 | Go github.com/quic-go/webtransport-go |
webtransport-go: Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule CVE-2026-21434, GHSA-g6x7-jq8p-6q9q, GO-2026-4485 | Medium | 0.5% | 12 Feb, 2026 | Go github.com/marten-seemann/webtransport-go Go github.com/quic-go/webtransport-go |
Grafana has a Cross-site Scripting issue BIT-grafana-2025-41117, CVE-2025-41117, GHSA-cqp7-wf4c-3xgc, GO-2026-5332 | Medium | 0.3% | 12 Feb, 2026 | Go github.com/grafana/grafana |
Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise BIT-milvus-2026-26190, CVE-2026-26190, GHSA-7ppg-37fh-vcr6, GO-2026-4481 | Critical | 39.3% | 11 Feb, 2026 | Go github.com/milvus-io/milvus |
Vikunja Vulnerable to XSS Via Task Preview CVE-2026-25935, GHSA-m4g2-2q66-vc9v, GO-2026-4480 | High | 0.3% | 11 Feb, 2026 | Go code.vikunja.io/api |
Pion DTLS's usage of random nonce generation with AES GCM ciphers risks leaking the authentication key CVE-2026-26014, GHSA-9f3f-wv7r-qc8r, GO-2026-4479 | Medium | 0.7% | 11 Feb, 2026 | Go github.com/pion/dtls Go github.com/pion/dtls/v2 Go github.com/pion/dtls/v3 |
mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling CVE-2026-2303, GHSA-cp6g-7hqx-qxhp, GO-2026-5327 | Medium | 0.3% | 10 Feb, 2026 | Go go.mongodb.org/mongo-driver Go go.mongodb.org/mongo-driver/v2 |
go-git improperly verifies data integrity values for .idx and .pack files CVE-2026-25934, GHSA-37cx-329c-33x3, GO-2026-4473 | Medium | 0.2% | 10 Feb, 2026 | Go github.com/go-git/go-git Go github.com/go-git/go-git/v4 Go github.com/go-git/go-git/v5 |
File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL CVE-2026-25890, GHSA-4mh3-h929-w968, GO-2026-4474 | High | 0.5% | 10 Feb, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser has an Authentication Bypass in User Password Update CVE-2026-25889, GHSA-hxw8-4h9j-hq2r, GO-2026-4475 | Medium | 0.4% | 10 Feb, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure CVE-2025-66630, GHSA-68rr-p4fp-j59v, GO-2026-4471 | Critical | 0.5% | 09 Feb, 2026 | Go github.com/gofiber/fiber Go github.com/gofiber/fiber/v2 |
Sliver has DNS C2 OTP Bypass that Allows Unauthenticated Session Flooding and Denial of Service CVE-2026-25791, GHSA-wxrw-gvg8-fqjp, GO-2026-4466 | High | 0.5% | 06 Feb, 2026 | Go github.com/bishopfox/sliver |
Antrea has invalid enforcement order for network policy rules caused by integer overflow CVE-2026-25804, GHSA-86x4-wp9f-wrr9, GO-2026-4461 | High | 0.5% | 06 Feb, 2026 | Go antrea.io/antrea |
LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic GHSA-vhvq-fv9f-wh4q, GO-2026-4465 | Low | Not scored | 06 Feb, 2026 | Go github.com/authzed/spicedb |
Blocklist Bypass possible via ECDSA Signature Malleability CVE-2026-25793, GHSA-69x3-g4r3-p962, GO-2026-4458 | High | 0.1% | 06 Feb, 2026 | Go github.com/slackhq/nebula |
Gogs has authorization bypass in repository deletion API CVE-2025-65852, GHSA-rjv5-9px2-fqw6, GO-2026-4457 | Medium | Not scored | 06 Feb, 2026 | Go gogs.io/gogs |
Gogs vulnerable to Stored XSS via Mermaid diagrams GHSA-26gq-grmh-6xm6, GO-2026-4454 | High | Not scored | 06 Feb, 2026 | Go gogs.io/gogs |
Gophish is vulnerable to Incorrect Access Control CVE-2025-70963, GHSA-9f8m-9547-2gqm, GO-2026-4455 | Medium | 0.3% | 06 Feb, 2026 | Go github.com/gophish/gophish |
Mattermost Confluence plugin doesn't properly escape user-controlled display names in HTML template rendering CVE-2025-13523, GHSA-ffx7-34p2-vm3w, GO-2026-4456 | High | 0.2% | 06 Feb, 2026 | Go github.com/mattermost/mattermost-plugin-confluence |
Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update CVE-2026-24135, GHSA-jp7c-wj6q-3qf2, GO-2026-4452 | High | 1.0% | 06 Feb, 2026 | Go gogs.io/gogs |
Gogs has arbitrary file read/write via Path Traversal in Git hook editing CVE-2026-23633, GHSA-mrph-w4hh-gx3g, GO-2026-4453 | Medium | 0.5% | 06 Feb, 2026 | Go gogs.io/gogs |
Gogs user can update repository content with read-only permission CVE-2026-23632, GHSA-5qhx-gwfj-6jqr, GO-2026-4450 | Medium | 0.3% | 06 Feb, 2026 | Go gogs.io/gogs |
Gogs has a Denial of Service issue CVE-2026-22592, GHSA-cr88-6mqm-4g57, GO-2026-4451 | Medium | 0.4% | 06 Feb, 2026 | Go gogs.io/gogs |
Gogs Vulnerable to 2FA Bypass via Recovery Code CVE-2025-64175, GHSA-p6x6-9mx6-26wj, GO-2026-4449 | High | 0.5% | 06 Feb, 2026 | Go gogs.io/gogs |
Gogs's update .git/config file allows remote command execution CVE-2025-64111, GHSA-gg64-xxr9-qhjp, GO-2026-4448 | Critical | 1.4% | 06 Feb, 2026 | Go gogs.io/gogs |