Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mattermost is vulnerable to CPU exhaustion via crafted HTTP request CVE-2025-14822, GHSA-9r42-rhw3-2222, GO-2026-4325 | Low | 0.3% | 16 Jan, 2026 | Go github.com/mattermost/mattermost-server |
Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall CVE-2026-22045, GHSA-cwjm-3f7h-9hwq, GO-2026-4322 | Medium | 0.3% | 15 Jan, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
lakeFS is Missing Timestamp Validation in S3 Gateway Authentication CVE-2025-68671, GHSA-f2ph-gc9m-q55f, GO-2026-4321 | Medium | 0.3% | 15 Jan, 2026 | Go github.com/treeverse/lakefs |
Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE CVE-2026-23520, GHSA-gjqq-6r35-w3r8, GO-2026-4320 | Critical | 1.8% | 15 Jan, 2026 | Go github.com/getarcaneapp/arcane/backend |
Zitadel has a user enumeration vulnerability in Login UIs CVE-2026-23511, GHSA-pvm5-9frx-264r, GO-2026-4319 | Medium | 0.4% | 15 Jan, 2026 | Go github.com/zitadel/zitadel |
DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface CVE-2025-66292, GHSA-vh2x-fw87-4fxq, GO-2026-4318 | High | 0.6% | 15 Jan, 2026 | Go github.com/donknap/dpanel |
chi has an open redirect vulnerability in the RedirectSlashes middleware CVE-2025-69725, CVE-2026-122132, GHSA-mqqf-5wvp-8fh8, GO-2026-4316 | Medium | 0.3% | 14 Jan, 2026 | Go github.com/go-chi/chi Go github.com/go-chi/chi/v2 Go github.com/go-chi/chi/v3 Go github.com/go-chi/chi/v4 +1 more |
go-ethereum is vulnerable to high CPU usage leading to DoS via malicious p2p message CVE-2026-22868, GHSA-mq3p-rrmp-79jg, GO-2026-4314 | High | 0.6% | 13 Jan, 2026 | Go github.com/ethereum/go-ethereum |
go-ethereum is vulnerable to DoS via malicious p2p message affecting a vulnerable node CVE-2026-22862, GHSA-mr7q-c9w9-wh4h, GO-2026-4315 | High | 0.7% | 13 Jan, 2026 | Go github.com/ethereum/go-ethereum |
Metricbeat affected by multiple denial of service vulnerabilities CVE-2026-0528, GHSA-w2gr-585j-r428, GO-2026-4360 | Medium | 0.4% | 13 Jan, 2026 | Go github.com/elastic/beats Go github.com/elastic/beats/v7 |
Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal CVE-2026-22786, GHSA-3558-j79f-vvm6, GO-2026-4313 | High | 1.1% | 13 Jan, 2026 | Go github.com/flipped-aurora/gin-vue-admin |
Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass CVE-2026-22772, GHSA-59jp-pj84-45mr, GO-2026-4311 | Medium | 0.2% | 13 Jan, 2026 | Go github.com/sigstore/fulcio |
Envoy Extension Policy lua scripts injection causes arbitrary command execution BIT-envoy-gateway-2026-22771, CVE-2026-22771, GHSA-xrwg-mqj6-6m22, GO-2026-4312 | High | 0.6% | 13 Jan, 2026 | Go github.com/envoyproxy/gateway |
Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails CVE-2026-22689, GHSA-524m-q5m7-79mm, GO-2026-4310 | Medium | 0.2% | 13 Jan, 2026 | Go github.com/axllent/mailpit |
Cosign verification accepts any valid Rekor entry under certain conditions BIT-cosign-2026-22703, CVE-2026-22703, GHSA-whqx-f9j3-ch6m, GO-2026-4309 | Medium | 0.1% | 13 Jan, 2026 | Go github.com/sigstore/cosign Go github.com/sigstore/cosign/v2 Go github.com/sigstore/cosign/v3 |
Shiori is vulnerable to authentication bypass via a brute force attack CVE-2025-60538, GHSA-mw8h-g64c-rxv4, GO-2026-4308 | Medium | 0.4% | 09 Jan, 2026 | Go github.com/go-shiori/shiori |
WeKnora has Command Injection in MCP stdio test CVE-2026-22688, GHSA-78h3-63c4-5fqc, GO-2026-4292 | Critical | 1.9% | 09 Jan, 2026 | Go github.com/Tencent/WeKnora |
WeKnora vulnerable to SQL Injection CVE-2026-22687, GHSA-pcwc-3fw3-8cqv, GO-2026-4293 | Medium | 0.4% | 09 Jan, 2026 | Go github.com/Tencent/WeKnora |
Soft Serve is missing an authorization check in LFS lock deletion CVE-2026-22253, GHSA-6jm8-x3g6-r33j, GO-2026-4290 | Medium | 0.3% | 08 Jan, 2026 | Go github.com/charmbracelet/soft-serve |
CoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages CVE-2025-68151, GHSA-527x-5wrf-22m2, GO-2026-4289 | Medium | 0.5% | 08 Jan, 2026 | Go github.com/coredns/coredns |
Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources CVE-2026-21885, GHSA-xwh2-742g-w3wp, GO-2026-4287 | Medium | 0.3% | 07 Jan, 2026 | Go miniflux.app Go miniflux.app/v2 |
OpenFlagr contains an authentication bypass vulnerability in the HTTP middleware CVE-2026-0650, GHSA-rwp9-5g7q-73q3, GO-2026-4286 | Critical | 1.5% | 07 Jan, 2026 | Go github.com/openflagr/flagr |
Bypassing Kyverno Policies via Double Policy Exceptions BIT-kyverno-2026-84200, CVE-2026-84200, GHSA-gg4x-fgg2-h9w9, GO-2026-4285 | Critical | 0.3% | 06 Jan, 2026 | Go github.com/kyverno/kyverno |
Mailpit Proxy Endpoint has Server-Side Request Forgery (SSRF) vulnerability CVE-2026-21859, GHSA-8v65-47jx-7mfr, GO-2026-4284 | Medium | 0.8% | 06 Jan, 2026 | Go github.com/axllent/mailpit |
Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced CVE-2025-68954, GHSA-8c39-xppg-479c, GO-2026-4283 | High | 0.2% | 06 Jan, 2026 | Go github.com/pterodactyl/wings Packagist pterodactyl/panel |
Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer CVE-2025-62877, GHSA-6g8q-hp2j-gvwv, GO-2026-4281 | Critical | 0.5% | 05 Jan, 2026 | Go github.com/harvester/harvester-installer |
Sliver Vulnerable to Pre-Auth Memory Exhaustion via NoEncoder Bypass GHSA-hjr9-wj7v-7hv8, GO-2026-4280 | Medium | Not scored | 05 Jan, 2026 | Go github.com/bishopfox/sliver |
flagd: Multiple Go Runtime CVEs Impact Security and Availability GHSA-4c5f-9mj4-m247, GO-2026-4279 | High | Not scored | 05 Jan, 2026 | Go github.com/open-feature/flagd/core Go github.com/open-feature/flagd/flagd Go github.com/open-feature/flagd/flagd-proxy |
listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover CVE-2026-21483, GHSA-jmr4-p576-v565, GO-2026-4277 | Medium | 0.2% | 02 Jan, 2026 | Go github.com/knadh/listmonk |
Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists BIT-gitea-2025-69413, CVE-2025-69413, GHSA-pc73-rj2c-wvf9, GO-2026-4274 | Medium | 0.4% | 01 Jan, 2026 | Go code.gitea.io/gitea |
Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts CVE-2025-14986, GHSA-p2gr-hm8g-q772, GO-2025-4272 | Low | 0.4% | 30 Dec, 2025 | Go go.temporal.io/server |
Temporal has an Incorrect Authorization vulnerability CVE-2025-14987, GHSA-hmhp-gh8m-c8xp, GO-2026-4273 | Medium | 0.4% | 30 Dec, 2025 | Go go.temporal.io/server |
Visual Studio Code Go extension has unexpected untrusted code execution CVE-2025-68120, GHSA-fjmr-7667-8v4p, GO-2025-4249 | Medium | 0.5% | 29 Dec, 2025 | Go github.com/golang/vscode-go |
SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key CVE-2025-15107, GHSA-43h9-hc38-qph5, GO-2025-4269 | Low | 0.6% | 27 Dec, 2025 | Go github.com/actiontech/sqle |
Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order BIT-gitea-2025-68943, CVE-2025-68943, GHSA-jhx5-4vr4-f327, GO-2025-4266 | Medium | 0.4% | 26 Dec, 2025 | Go code.gitea.io/gitea |
Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries BIT-gitea-2025-68944, CVE-2025-68944, GHSA-f85h-c7m6-cfpm, GO-2025-4264 | Medium | 0.3% | 26 Dec, 2025 | Go code.gitea.io/gitea |
Gitea: anonymous user can visit private user's project BIT-gitea-2025-68945, CVE-2025-68945, GHSA-7xq4-mwcp-q8fx, GO-2025-4262 | Medium | 0.4% | 26 Dec, 2025 | Go code.gitea.io/gitea |
Gitea vulnerable to Cross-site Scripting BIT-gitea-2025-68946, CVE-2025-68946, GHSA-hq57-c72x-4774, GO-2025-4265 | Medium | 0.2% | 26 Dec, 2025 | Go code.gitea.io/gitea |
Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text BIT-gitea-2025-68942, CVE-2025-68942, GHSA-898p-hh3p-hf9r, GO-2025-4263 | Medium | 0.2% | 26 Dec, 2025 | Go code.gitea.io/gitea |
Gitea mishandles authorization for deletion of releases BIT-gitea-2025-68938, CVE-2025-68938, GHSA-cm54-pfmc-xrwx, GO-2025-4258 | Medium | 0.4% | 26 Dec, 2025 | Go code.gitea.io/gitea |
Gitea allows attackers to add attachments with forbidden file extensions BIT-gitea-2025-68939, CVE-2025-68939, GHSA-263q-5cv3-xq9g, GO-2025-4261 | High | 0.3% | 26 Dec, 2025 | Go code.gitea.io/gitea |
Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. BIT-gitea-2025-68940, CVE-2025-68940, GHSA-rrcw-5rjv-vj26, GO-2025-4267 | Low | 0.3% | 26 Dec, 2025 | Go code.gitea.io/gitea |
Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources BIT-gitea-2025-68941, CVE-2025-68941, GHSA-xfq3-qj7j-4565, GO-2025-4268 | Medium | 0.3% | 26 Dec, 2025 | Go code.gitea.io/gitea |
Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues CVE-2025-13767, GHSA-fmqf-pmcm-8cx9, GO-2025-4259 | Medium | 0.2% | 24 Dec, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin CVE-2025-64641, GHSA-vww6-79rv-3j4x, GO-2025-4260 | Medium | 0.2% | 24 Dec, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential CVE-2025-68476, GHSA-c4p6-qg4m-9jmr, GO-2025-4257 | High | 0.6% | 22 Dec, 2025 | Go github.com/kedacore/keda Go github.com/kedacore/keda/v2 |
Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm CVE-2025-14273, GHSA-qvmc-92vg-6r35, GO-2026-4275 | High | 0.3% | 22 Dec, 2025 | Go github.com/mattermost/mattermost-plugin-jira Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Filebeat Beats has Buffer Overflow via Malformed Syslog Message or Malicious Tokenizer Pattern in Dissect Configuration CVE-2025-68383, GHSA-2mj3-6grc-px38, GO-2025-4252 | Medium | 0.2% | 19 Dec, 2025 | Go github.com/elastic/beats Go github.com/elastic/beats/v7 |
Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments CVE-2025-68388, GHSA-fj69-23m4-ccvv, GO-2025-4253 | High | 0.4% | 19 Dec, 2025 | Go github.com/elastic/beats Go github.com/elastic/beats/v7 |
Amazon S3 Encryption Client has a Key Commitment Issue CVE-2025-14764, GHSA-3g75-q268-r9r6, GO-2025-4250 | Medium | 0.1% | 18 Dec, 2025 | Go github.com/aws/amazon-s3-encryption-client-go Go github.com/aws/amazon-s3-encryption-client-go/v3 Go github.com/aws/amazon-s3-encryption-client-go/v4 |