Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Handshake messages may be processed at the incorrect encryption level in crypto/tls BIT-golang-2025-61730, CVE-2025-61730, GO-2026-4340 | 0.3% | 28 Jan, 2026 | Go stdlib | |
Arbitrary file write using cgo pkg-config directive in cmd/go BIT-golang-2025-61731, CVE-2025-61731, GO-2026-4339 | 0.6% | 28 Jan, 2026 | Go toolchain | |
Unexpected code execution when invoking toolchain in cmd/go BIT-golang-2025-68119, CVE-2025-68119, GO-2026-4338 | 0.4% | 28 Jan, 2026 | Go toolchain | |
Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access CVE-2026-24748, GHSA-w5wv-wvrp-v5m5, GO-2026-4385 | Medium | 0.4% | 27 Jan, 2026 | Go github.com/akuity/kargo |
Kyverno Denial of Service via Context Variable Amplification in Policy Engine BIT-kyverno-2026-23881, CVE-2026-23881, GHSA-r2rj-wwm5-x6mq, GO-2026-4382 | High | 0.6% | 27 Jan, 2026 | Go github.com/kyverno/kyverno |
Kyverno Cross-Namespace Privilege Escalation via Policy apiCall BIT-kyverno-2026-22039, CVE-2026-22039, GHSA-8p9x-46gm-qfx2, GO-2026-4381 | Critical | 0.6% | 27 Jan, 2026 | Go github.com/kyverno/kyverno |
gmrtd ReadFile Vulnerable to Denial of Service via Excessive TLV Length Values CVE-2026-24738, GHSA-j49h-6577-5xwq, GO-2026-4379 | Medium | 0.3% | 27 Jan, 2026 | Go github.com/gmrtd/gmrtd |
Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access CVE-2026-24740, GHSA-m855-r557-5rc5, GO-2026-4380 | High | 0.4% | 27 Jan, 2026 | Go github.com/amir20/dozzle |
go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names CVE-2026-24686, GHSA-jqc5-w2xx-5vq4, GO-2026-4377 | Medium | 0.2% | 26 Jan, 2026 | Go github.com/theupdateframework/go-tuf/v2 |
Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName CVE-2026-24470, GHSA-mxxc-p822-2hx9, GO-2026-4378 | High | 0.3% | 26 Jan, 2026 | Go github.com/zalando/skipper |
KubeVirt Guest Agent DoS via Excessive Network Interface Reports CVE-2025-14525, GHSA-25mh-hp8x-cgrv, GO-2026-4384 | Medium | 0.3% | 26 Jan, 2026 | Go kubevirt.io/kubevirt |
Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value CVE-2025-66719, GHSA-q7c8-gfjh-8v4p, GO-2026-5570 | Critical | 0.4% | 23 Jan, 2026 | Go github.com/free5gc/nrf |
CometBFT has inconsistencies between how commit signatures are verified and how block time is derived GHSA-c32p-wcqj-j677, GO-2026-4361 | High | Not scored | 23 Jan, 2026 | Go github.com/cometbft/cometbft |
Gitea does not properly validate ownership when toggling OpenID URI visibility BIT-gitea-2026-20904, CVE-2026-20904, GHSA-jrpc-w85r-hgqx, GHSA-qqgv-v353-cv8p, GO-2026-4369 | Medium | 0.3% | 23 Jan, 2026 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Gitea does not properly validate repository ownership when linking attachments to releases BIT-gitea-2026-20912, CVE-2026-20912, GHSA-4xx9-vc8v-87hv, GHSA-vfmv-f93v-37mw, GO-2026-4364 | Medium | 0.5% | 23 Jan, 2026 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Gitea may send release notification emails for private repositories to users whose access has been revoked BIT-gitea-2026-0798, CVE-2026-0798, GHSA-8fwc-qjw5-rvgp, GHSA-f4wq-6ww5-m56p, GO-2026-4365 | Low | 0.3% | 23 Jan, 2026 | Go code.gitea.io/gitea |
Gitea has improper access control for uploaded attachments BIT-gitea-2026-20736, CVE-2026-20736, GHSA-hgr3-x44x-33hx, GHSA-jr6h-pwwp-c8g6, GO-2026-4367 | Low | 0.4% | 23 Jan, 2026 | Go code.gitea.io/gitea |
Gitea does not properly validate project ownership in organization project operations BIT-gitea-2026-20750, CVE-2026-20750, GHSA-h4fh-pc4w-8w27, GHSA-rw22-5hhq-pfpf, GO-2026-4370 | Medium | 0.4% | 23 Jan, 2026 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Gitea improperly exposes issue and pull request titles BIT-gitea-2026-20800, CVE-2026-20800, GHSA-2vgv-hgv4-22mh, GHSA-g54m-9f6g-wj7q, GO-2026-4362 | Low | 0.4% | 23 Jan, 2026 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Gitea improperly exposes issue titles and repository names through previously started stopwatches BIT-gitea-2026-20883, CVE-2026-20883, GHSA-644v-xv3j-xgqg, GHSA-j8xr-c56q-m8jj, GO-2026-4368 | Low | 0.4% | 23 Jan, 2026 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface BIT-gitea-2026-20888, CVE-2026-20888, GHSA-9cgq-wp42-4rpq, GHSA-ccq9-c5hv-cf64, GO-2026-4366 | Medium | 0.3% | 23 Jan, 2026 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Gitea does not properly validate repository ownership when deleting Git LFS locks BIT-gitea-2026-20897, CVE-2026-20897, GHSA-393c-qgvj-3xph, GHSA-rrq5-r9h5-pc7c, GO-2026-4363 | Medium | 0.5% | 23 Jan, 2026 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal CVE-2026-24137, GHSA-fcv2-xgw5-pqxf, GO-2026-4358 | Medium | 0.4% | 22 Jan, 2026 | Go github.com/sigstore/sigstore |
Incus container image templating arbitrary host file read and write CVE-2026-23954, GHSA-7f67-crqm-jgh7, GO-2026-4357 | High | 0.8% | 22 Jan, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 Go github.com/lxc/incus/v6/cmd/incusd |
Incus container environment configuration newline injection CVE-2026-23953, GHSA-x6jc-phwx-hp32, GO-2026-4359 | High | 0.5% | 22 Jan, 2026 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |
Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL CVE-2026-24117, GHSA-4c4x-jm2x-pf9j, GO-2026-4355 | Medium | 0.4% | 22 Jan, 2026 | Go github.com/sigstore/rekor |
Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message CVE-2026-23831, GHSA-273p-m2cw-6833, GO-2026-4354 | Medium | 0.4% | 22 Jan, 2026 | Go github.com/sigstore/rekor |
Dragonfly Manager Job API Unauthenticated Access CVE-2026-24124, GHSA-j8hf-cp34-g4j7, GO-2026-4356 | High | 0.8% | 22 Jan, 2026 | Go d7y.io/dragonfly/v2 |
Soft Serve Affected by an Authentication Bypass CVE-2026-24058, GHSA-pchf-49fh-w34r, GO-2026-4353 | High | 0.6% | 21 Jan, 2026 | Go github.com/charmbracelet/soft-serve |
OpenTofu has High CPU usage in "tofu init" with maliciously-crafted module packages in .zip format CVE-2026-74797, GHSA-r92c-9c7f-3pj8, GO-2026-4352 | Low | 0.3% | 21 Jan, 2026 | Go github.com/opentofu/opentofu |
Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims CVE-2026-23990, GHSA-4xh5-jcj2-ch8q, GO-2026-4351 | Medium | 0.4% | 21 Jan, 2026 | Go github.com/controlplaneio-fluxcd/flux-operator |
Argo Workflows affected by stored XSS in the artifact directory listing BIT-argo-workflows-2026-23960, CVE-2026-23960, GHSA-cv78-6m8q-ph82, GO-2026-4350 | High | 0.4% | 21 Jan, 2026 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
go-tuf improperly validates the configured threshold for delegations CVE-2026-23992, GHSA-fphv-w9fq-2525, GO-2026-4349 | Medium | 0.2% | 21 Jan, 2026 | Go github.com/theupdateframework/go-tuf/v2 |
go-tuf affected by client DoS via malformed server response CVE-2026-23991, GHSA-846p-jg2w-w324, GO-2026-4348 | Medium | 0.6% | 21 Jan, 2026 | Go github.com/theupdateframework/go-tuf/v2 |
File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login CVE-2026-23849, GHSA-43mm-m3h2-3prc, GO-2026-4344 | Medium | 0.5% | 21 Jan, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
SiYuan vulnerable to Arbitrary file Read / SSRF CVE-2026-23850, GHSA-cv54-7wv7-qxcw, GO-2026-4347 | High | 0.6% | 21 Jan, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality CVE-2026-23851, GHSA-94c7-g2fj-7682, GO-2026-4346 | High | 0.5% | 21 Jan, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Mailpit has a Server-Side Request Forgery (SSRF) via HTML Check API CVE-2026-23845, GHSA-6jxm-fv7w-rw5j, GO-2026-4345 | Medium | 0.4% | 21 Jan, 2026 | Go github.com/axllent/mailpit |
SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon CVE-2026-23847, GHSA-w836-5gpm-7r93, GO-2026-4343 | Low | 0.3% | 21 Jan, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment CVE-2026-23518, GHSA-63m5-974w-448v, GO-2026-4335 | Critical | 0.3% | 20 Jan, 2026 | Go github.com/fleetdm/fleet Go github.com/fleetdm/fleet/v4 |
Fleet has an Access Control vulnerability in debug/pprof endpoints CVE-2026-23517, GHSA-4r5r-ccr6-q6f6, GO-2026-4334 | High | 0.3% | 20 Jan, 2026 | Go github.com/fleetdm/fleet Go github.com/fleetdm/fleet/v4 |
Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability CVE-2026-22808, GHSA-gfpw-jgvr-cw4j, GO-2026-4336 | Medium | 0.2% | 20 Jan, 2026 | Go github.com/fleetdm/fleet Go github.com/fleetdm/fleet/v4 |
Mailpit has an SMTP Header Injection via Regex Bypass CVE-2026-23829, GHSA-54wq-72mp-cq7c, GO-2026-4333 | Medium | 1.4% | 20 Jan, 2026 | Go github.com/axllent/mailpit |
esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages CVE-2026-23644, GHSA-2657-3c98-63jq, GO-2026-4332 | High | 0.6% | 20 Jan, 2026 | Go github.com/esm-dev/esm.sh |
External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function CVE-2026-22822, GHSA-77v3-r3jw-j2v2, GO-2026-4330 | Critical | 0.2% | 20 Jan, 2026 | Go github.com/external-secrets/external-secrets |
Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered CVE-2026-21696, GHSA-2497-gp99-2m74, GO-2026-4329 | High | 0.6% | 20 Jan, 2026 | Go github.com/pterodactyl/wings |
Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks CVE-2025-69199, GHSA-8w7m-w749-rx98, GO-2026-4331 | High | 0.3% | 20 Jan, 2026 | Go github.com/pterodactyl/wings |
Skipper is vulnerable to arbitrary code execution through lua filters CVE-2026-23742, GHSA-cc8m-98fm-rc9g, GO-2026-4327 | High | 0.5% | 16 Jan, 2026 | Go github.com/zalando/skipper |
SiYuan Has a Stored Cross-Site Scripting (XSS) Vulnerability via Unrestricted SVG File Upload CVE-2026-23645, GHSA-pcjq-j3mq-jv5j, GO-2026-4324 | Medium | 0.3% | 16 Jan, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Mattermost is vulnerable to DoS due to infinite re-renders on API errors CVE-2025-14435, GHSA-mx8m-v8qm-xwr8, GO-2026-4326 | Medium | 0.3% | 16 Jan, 2026 | Go github.com/mattermost/mattermost-server |