Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Sliver Vulnerable to Website Path Traversal / Arbitrary File Read (Authenticated) CVE-2026-25760, GHSA-2286-hxv5-cmp2, GO-2026-4445 | Medium | 0.5% | 05 Feb, 2026 | Go github.com/bishopfox/sliver |
OpenFGA Improper Policy Enforcement CVE-2026-24851, GHSA-jq9f-gm9w-rwm9, GO-2026-4446 | Medium | 0.3% | 05 Feb, 2026 | Go github.com/openfga/openfga |
OpenCloud Affected by Public Link Exploit GHSA-vf5j-r2hw-2hrw, GO-2026-4447 | High | Not scored | 05 Feb, 2026 | Go github.com/opencloud-eu/opencloud |
OpenCloud Reva has a Public Link Exploit CVE-2026-23989, GHSA-9j2f-3rj3-wgpg, GO-2026-4444 | High | 0.3% | 05 Feb, 2026 | Go github.com/opencloud-eu/reva Go github.com/opencloud-eu/reva/v2 |
FrankenPHP has delayed propagation of security fixes in upstream base images GHSA-x9p2-77v6-6vhf, GO-2026-4442 | Critical | Not scored | 05 Feb, 2026 | Go github.com/dunglas/frankenphp |
Infinite parsing loop in golang.org/x/net CVE-2025-58190, GO-2026-4441 | 0.5% | 05 Feb, 2026 | Go golang.org/x/net | |
golang.org/x/net/html has a Quadratic Parsing Complexity issue CVE-2025-47911, GHSA-w4gw-w5jq-g9jh, GO-2026-4440 | Medium | 0.6% | 05 Feb, 2026 | Go golang.org/x/net Go golang.org/x/net/html |
Unexpected session resumption in crypto/tls BIT-golang-2025-68121, CVE-2025-68121, GO-2026-4337 | 0.9% | 05 Feb, 2026 | Go stdlib | |
Potential code smuggling via doc comments in cmd/cgo BIT-golang-2025-61732, CVE-2025-61732, GO-2026-4433 | 0.5% | 05 Feb, 2026 | Go toolchain | |
EVE Has Partially Predetermined Vault Key CVE-2023-43637, GHSA-g7vp-j25f-h34p, GO-2026-4436 | Medium | 0.1% | 04 Feb, 2026 | Go github.com/lf-edge/eve |
EVE Doesn't Protect Rootfs CVE-2023-43636, GHSA-5h7v-g49c-h887, GO-2026-4435 | Medium | 0.1% | 04 Feb, 2026 | Go github.com/lf-edge/eve Go github.com/lf-edge/eve/pkg/grub |
EVE Seals Vault Key With SHA1 PCRs CVE-2023-43635, GHSA-4jvr-vj2c-8q37, GO-2026-4434 | Medium | 0.1% | 04 Feb, 2026 | Go github.com/lf-edge/eve |
Improper access to parent directory of root in os BIT-golang-2025-22873, CVE-2025-22873, GO-2026-4403 | 0.2% | 04 Feb, 2026 | Go stdlib | |
EVE Doesn't Protect Config Partition with Measured Boot CVE-2023-43634, GHSA-wc42-fcjp-v8vq, GO-2026-4432 | Medium | 0.2% | 04 Feb, 2026 | Go github.com/lf-edge/eve |
EVE's Debug Functions Unlockable Without Triggering Measured Boot CVE-2023-43633, GHSA-4c4v-42hc-72p6, GO-2026-4428 | Medium | 0.2% | 04 Feb, 2026 | Go github.com/lf-edge/eve |
EVE Freely Allocates Buffer on The Stack With Data From Socket CVE-2023-43632, GHSA-6jp5-grgh-jw42, GO-2026-4422 | Medium | 0.7% | 04 Feb, 2026 | Go github.com/lf-edge/eve |
EVE: SSH as Root Unlockable Without Triggering Measured Boot CVE-2023-43631, GHSA-3mq9-xhgq-r7gj, GO-2026-4418 | Medium | 0.2% | 04 Feb, 2026 | Go github.com/lf-edge/eve |
EVE Doesn't Measure Config Partition From 2 Fronts CVE-2023-43630, GHSA-phcg-h58r-gmcq, GO-2026-4430 | Medium | 0.1% | 04 Feb, 2026 | Go github.com/lf-edge/eve |
Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern CVE-2025-62878, GHSA-jr3w-9vfr-c746, GO-2026-4425 | Critical | 0.6% | 04 Feb, 2026 | Go github.com/rancher/local-path-provisioner |
Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage CVE-2026-25538, GHSA-8wpc-j9q9-j5m2, GO-2026-4416 | High | 0.4% | 04 Feb, 2026 | Go github.com/devtron-labs/devtron |
Alist vulnerable to Path Traversal in multiple file operation handlers CVE-2026-25161, GHSA-x4q4-7phh-42j9, GO-2026-4415 | High | 0.8% | 04 Feb, 2026 | Go github.com/alist-org/alist Go github.com/alist-org/alist/v3 |
Alist has Insecure TLS Config CVE-2026-25160, GHSA-8jmm-3xwx-w974, GO-2026-4414 | Critical | 0.3% | 04 Feb, 2026 | Go github.com/alist-org/alist Go github.com/alist-org/alist/v3 |
Apache Answer Exposure of Private Personal Information to an Unauthorized Actor vulnerability CVE-2026-24735, GHSA-5w5r-8xc6-2xhw, GO-2026-4421 | Medium | 0.6% | 04 Feb, 2026 | Go github.com/apache/answer |
ingress-nginx's `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx CVE-2026-1580, GHSA-9h3p-52vh-959w, GO-2026-4423 | High | 0.5% | 04 Feb, 2026 | Go k8s.io/ingress-nginx |
ingress-nginx's `rules.http.paths.path` Ingress field can be used to inject configuration into nginx CVE-2026-24512, GHSA-jx8c-56mg-h6vp, GO-2026-4426 | High | 0.5% | 04 Feb, 2026 | Go k8s.io/ingress-nginx |
ingress-nginx has Improper Check for Unusual or Exceptional Conditions CVE-2026-24513, GHSA-4g2f-xcph-2335, GO-2026-4419 | Low | 0.3% | 04 Feb, 2026 | Go k8s.io/ingress-nginx |
ingress-nginx vulnerable to Allocation of Resources Without Limits or Throttling CVE-2026-24514, GHSA-2pf9-vr92-6h3v, GO-2026-4417 | Medium | 0.5% | 04 Feb, 2026 | Go k8s.io/ingress-nginx |
Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints CVE-2026-25579, GHSA-hrr4-3wgr-68x3, GO-2026-4411 | Critical | 0.5% | 04 Feb, 2026 | Go github.com/navidrome/navidrome |
Navidrome has XSS via comment from song metadata CVE-2026-25578, GHSA-rh3r-8pxm-hg4w, GO-2026-4413 | Medium | 0.3% | 04 Feb, 2026 | Go github.com/navidrome/navidrome |
melange has a path traversal in license-path which allows reading files outside workspace CVE-2026-25145, GHSA-2w4f-9fgg-q2v9, GO-2026-4409 | Medium | 0.2% | 04 Feb, 2026 | Go chainguard.dev/melange |
melange affected by potential host command execution via license-check YAML mode patch pipeline CVE-2026-25143, GHSA-rf4g-89h5-crcr, GO-2026-4412 | High | 0.2% | 04 Feb, 2026 | Go chainguard.dev/melange |
apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams CVE-2026-25122, GHSA-6p9p-q6wh-9j89, GO-2026-4406 | Medium | 0.1% | 03 Feb, 2026 | Go chainguard.dev/apko |
apko has a path traversal in apko dirFS which allows filesystem writes outside base CVE-2026-25121, GHSA-5g94-c2wx-8pxw, GO-2026-4405 | High | 0.4% | 03 Feb, 2026 | Go chainguard.dev/apko |
melange pipeline working-directory could allow command injection CVE-2026-24844, GHSA-vqqr-rmpc-hhg2, GO-2026-4408 | High | 0.2% | 03 Feb, 2026 | Go chainguard.dev/melange |
melange QEMU runner could write files outside workspace directory CVE-2026-24843, GHSA-qxx2-7h4c-83f4, GO-2026-4407 | High | 0.2% | 03 Feb, 2026 | Go chainguard.dev/melange |
Podinfo affected by Arbitrary File Upload that leads to Stored Cross-Site Scripting (XSS) CVE-2025-70849, GHSA-mw8w-q3f7-2v85, GO-2026-4404 | Low | 0.3% | 03 Feb, 2026 | Go github.com/stefanprodan/podinfo |
cert-manager-controller DoS via Specially Crafted DNS Response BIT-cert-manager-2026-25518, CVE-2026-25518, GHSA-gx3x-vq4p-mhhv, GO-2026-4399 | Medium | 0.4% | 02 Feb, 2026 | Go github.com/cert-manager/cert-manager |
WireGuard Portal v2 has Open Redirect Vulnerability in OAuth Authentication Flow GHSA-grh9-37g7-53mj, GO-2026-4398 | Medium | Not scored | 02 Feb, 2026 | Go github.com/h44z/wg-portal |
terraform-provider-proxmox has insecure sudo recommendation in the documentation CVE-2026-25499, GHSA-gwch-7m8v-7544, GO-2026-4395 | High | 0.5% | 02 Feb, 2026 | Go github.com/bpg/terraform-provider-proxmox |
OpenList has Insecure TLS Default Configuration CVE-2026-25060, GHSA-wf93-3ghh-h389, GO-2026-4397 | High | 0.3% | 02 Feb, 2026 | Go github.com/OpenListTeam/OpenList Go github.com/OpenListTeam/OpenList/v3 Go github.com/OpenListTeam/OpenList/v4 |
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking CVE-2026-24051, GHSA-9h8m-3fm2-qjrq, GO-2026-4394 | High | 0.2% | 02 Feb, 2026 | Go go.opentelemetry.io/otel/sdk |
OpenList vulnerable to Path Traversal in file copy and remove handlers CVE-2026-25059, GHSA-qmj2-8r24-xxcq, GO-2026-4396 | High | 0.7% | 02 Feb, 2026 | Go github.com/OpenListTeam/OpenList Go github.com/OpenListTeam/OpenList/v3 Go github.com/OpenListTeam/OpenList/v4 |
Rancher CLI skips TLS verification on Rancher CLI login command CVE-2025-67601, GHSA-mc24-7m59-4q5p, GO-2026-4393 | High | 0.2% | 01 Feb, 2026 | Go github.com/rancher/rancher |
malcontent vulnerable to symlink Path Traversal via handleSymlink argument confusion in archive extraction CVE-2026-24846, GHSA-923j-vrcg-hxwh, GO-2026-4391 | Medium | 0.2% | 29 Jan, 2026 | Go github.com/chainguard-dev/malcontent |
malcontent OCI image pull credential exfiltration via malicious registry token realm CVE-2026-24845, GHSA-9m43-p3cx-w8j5, GO-2026-4392 | Medium | 0.4% | 29 Jan, 2026 | Go github.com/chainguard-dev/bincapz Go github.com/chainguard-dev/malcontent |
Juju has broken CMR authorization CVE-2026-1237, GHSA-j477-6vpg-6c8x, GO-2026-4388 | Low | 0.1% | 29 Jan, 2026 | Go github.com/juju/juju |
SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE CVE-2026-25539, GHSA-c4jr-5q7w-f6r9, GO-2026-4387 | Critical | 1.1% | 29 Jan, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan File Read API Case Sensitivity Bypass can Lead to Path Traversal CVE-2026-25992, GHSA-f72r-2h5j-7639, GO-2026-4386 | High | 0.6% | 28 Jan, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Excessive CPU consumption when building archive index in archive/zip BIT-golang-2025-61728, CVE-2025-61728, GO-2026-4342 | 0.7% | 28 Jan, 2026 | Go stdlib | |
Memory exhaustion in query parameter parsing in net/url BIT-golang-2025-61726, CVE-2025-61726, GO-2026-4341 | 2.3% | 28 Jan, 2026 | Go stdlib |