Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Ollama Platform has missing authentication enabling attackers to perform model management operations CVE-2025-63389, GHSA-f6mr-38g8-39rg, GO-2025-4251 | Critical | 0.7% | 18 Dec, 2025 | Go github.com/ollama/ollama |
Mattermost fails to check Websocket request for proper UTF-8 format potentially crashing Calls plug-in CVE-2025-12689, GHSA-j5vq-62gr-8v3r, GO-2025-4255 | Medium | 0.3% | 17 Dec, 2025 | Go github.com/mattermost/mattermost-plugin-calls |
Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation CVE-2025-13324, GHSA-x3r8-2hmh-89f5, GO-2025-4256 | Medium | 0.2% | 17 Dec, 2025 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection CVE-2025-13352, GHSA-jf5h-xfw4-p8gp, GO-2025-4247 | Low | 0.2% | 17 Dec, 2025 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-plugin-github Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 +2 more |
Mattermost has CSRF vulnerability via Calls Widget page CVE-2025-62190, GHSA-gmx5-frv9-9m9f, GO-2025-4254 | Medium | 0.1% | 17 Dec, 2025 | Go github.com/mattermost/mattermost-plugin-calls |
Mattermost has missing redirect URL validation CVE-2025-62690, GHSA-q66g-q98c-q454, GO-2025-4248 | Low | 0.1% | 17 Dec, 2025 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Expr has Denial of Service via Unbounded Recursion in Builtin Functions CVE-2025-68156, GHSA-cfpf-hrx2-8rv6, GO-2025-4245 | High | 0.4% | 16 Dec, 2025 | Go github.com/expr-lang/expr |
SIPGO is Vulnerable to Response DoS via Nil Pointer Dereference CVE-2025-68274, GHSA-c623-f998-8hhv, GO-2025-4244 | High | 0.5% | 16 Dec, 2025 | Go github.com/emiago/sipgo |
Libredesk has Improper Neutralization of HTML Tags in a Web Page CVE-2025-68927, GHSA-wh6m-h6f4-rjf4, GO-2025-4243 | High | 0.2% | 16 Dec, 2025 | Go github.com/abhinavxd/libredesk |
openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References CVE-2025-14443, GHSA-gxvv-45f6-3ch8, GO-2026-4578 | High | 0.3% | 16 Dec, 2025 | Go github.com/openshift/openshift-apiserver |
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay CVE-2025-68113, GHSA-6gvq-jcmp-8959, GO-2025-4239, PYSEC-2026-1115 | Medium | 0.5% | 16 Dec, 2025 | Go github.com/altcha-org/altcha-lib-go Hex altcha Maven org.altcha:altcha Packagist altcha-org/altcha +3 more |
Misconfigured Internal Proxy in runtimes-inventory-rhel8-operator Grants Standard Users Full Cluster Administrator Access CVE-2025-11393, GHSA-cc8c-28gj-px38, GO-2025-4241 | High | 0.2% | 15 Dec, 2025 | Go github.com/RedHatInsights/runtimes-inventory-operator |
OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources CVE-2025-13888, GHSA-pcqx-8qww-7f4v, GO-2025-4242 | Critical | 0.7% | 15 Dec, 2025 | Go github.com/redhat-developer/gitops-operator |
kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass CVE-2025-13281, GHSA-r6j8-c6r2-37rr, GO-2025-4240 | Medium | 0.4% | 15 Dec, 2025 | Go k8s.io/kubernetes |
Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration GHSA-4jmp-x7mh-rgmr, GO-2025-4236 | High | Not scored | 12 Dec, 2025 | Go github.com/babylonlabs-io/finality-provider |
NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM) CVE-2025-66001, GHSA-4jj9-cgqc-x9h5, GO-2025-4235 | High | 0.4% | 12 Dec, 2025 | Go github.com/neuvector/neuvector |
Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip CVE-2025-67818, GHSA-7v39-2hx7-7c43, GO-2025-4237 | High | 0.9% | 12 Dec, 2025 | Go github.com/weaviate/weaviate |
Weaviate OSS has path traversal vulnerability via the Shard Movement API CVE-2025-67819, GHSA-hmmh-292h-3364, GO-2025-4238 | High | 0.5% | 12 Dec, 2025 | Go github.com/weaviate/weaviate |
gardenctl is vulnerable to Command Injection when used with non‑POSIX shells CVE-2025-67508, GHSA-fw33-qpx7-rhx2, GO-2025-4232 | High | 0.2% | 11 Dec, 2025 | Go github.com/gardener/gardenctl-v2 |
quic-go HTTP/3 QPACK Header Expansion DoS CVE-2025-64702, GHSA-g754-hx8w-x2g6, GO-2025-4233 | Medium | 0.9% | 11 Dec, 2025 | Go github.com/quic-go/quic-go |
1Panel contains a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality CVE-2025-34429, GHSA-wrvc-x3wf-j5f5, GO-2025-4231 | High | 0.2% | 10 Dec, 2025 | Go github.com/1Panel-dev/1Panel |
1Panel contains a cross-site request forgery (CSRF) vulnerability in the panel name management functionality CVE-2025-34430, GHSA-5xpq-2vmc-5cqp, GO-2025-4230 | Medium | 0.2% | 10 Dec, 2025 | Go github.com/1Panel-dev/1Panel |
1Panel contains a cross-site request forgery (CSRF) vulnerability in the Change Username functionality CVE-2025-34410, GHSA-rpr2-4hqj-hc4q, GO-2025-4229 | High | 0.2% | 10 Dec, 2025 | Go github.com/1Panel-dev/1Panel |
Zitadel Discloses the Total Number of Instance Users CVE-2025-67717, GHSA-f4cf-9rvr-2rcx, GO-2025-4227 | Medium | 0.2% | 10 Dec, 2025 | Go github.com/zitadel/zitadel |
Algernon Cross-Site Scripting vulnerability CVE-2025-65754, GHSA-8jqm-8qm3-qgqm, GO-2025-4228 | Medium | 0.4% | 10 Dec, 2025 | Go github.com/xyproto/algernon |
Miniflux has an Open Redirect via protocol-relative redirect_url CVE-2025-67713, GHSA-wqv2-4wpg-8hc9, GO-2025-4226 | Medium | 0.2% | 10 Dec, 2025 | Go miniflux.app Go miniflux.app/v2 |
Gogs vulnerable to a bypass of CVE-2024-55947 CVE-2025-8110, GHSA-mq8m-42gh-wq7r, GO-2025-4225 | HighExploited | 85.2% | 10 Dec, 2025 | Go gogs.io/gogs |
OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs GHSA-mjcp-gpgx-ggcg, GO-2025-4224 | Medium | Not scored | 09 Dec, 2025 | Go github.com/opentofu/opentofu |
CNA Plugins Portmap nftables backend can intercept non-local traffic CVE-2025-67499, GHSA-jv3w-x3r3-g6rm, GO-2025-4222 | Medium | 0.1% | 09 Dec, 2025 | Go github.com/containernetworking/plugins |
SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin GHSA-4r66-7rcv-x46x, GO-2025-4219 | High | Not scored | 09 Dec, 2025 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE CVE-2025-67488, GHSA-gqfv-g4v7-m366, GO-2025-4221 | High | 0.4% | 09 Dec, 2025 | Go github.com/siyuan-note/siyuan/kernel |
RCE via ZipSlip and symbolic links in argoproj/argo-workflows BIT-argo-workflows-2025-66626, CVE-2025-66626, GHSA-xrqc-7xgx-c9vh, GO-2025-4223 | High | 0.7% | 09 Dec, 2025 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond GHSA-4rmq-mc2c-r495, GO-2025-4214 | Medium | Not scored | 09 Dec, 2025 | Go github.com/babylonlabs-io/babylon Go github.com/babylonlabs-io/babylon/v2 Go github.com/babylonlabs-io/babylon/v3 Go github.com/babylonlabs-io/babylon/v4 |
Babylon Nil BlockHash in BLS vote extensions triggers panics in consensus handlers GHSA-m6wq-66p2-c8pc, GO-2025-4211 | High | Not scored | 08 Dec, 2025 | Go github.com/babylonlabs-io/babylon Go github.com/babylonlabs-io/babylon/v2 Go github.com/babylonlabs-io/babylon/v3 Go github.com/babylonlabs-io/babylon/v4 |
ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login CVE-2025-67495, GHSA-v959-qxv6-6f8p, GO-2025-4213 | High | 0.3% | 08 Dec, 2025 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 Login CVE-2026-29067, GHSA-pfrf-9r5f-73f5, GO-2025-4212 | High | 0.4% | 08 Dec, 2025 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login CVE-2025-67494, GHSA-7wfc-4796-gmg5, GO-2025-4210 | Critical | 0.4% | 08 Dec, 2025 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
CVE-2017-18870 in github.com/mattermost/mattermost-server CVE-2017-18870, GHSA-9j9j-mm2r-9rfm, GO-2025-4183 | 0.6% | 08 Dec, 2025 | Go github.com/mattermost/mattermost-server | |
memos vulnerability allows the creation of arbitrary accounts CVE-2025-65795, GHSA-mg56-wc4q-rw4w, GO-2025-4217 | High | 0.3% | 08 Dec, 2025 | Go github.com/usememos/memos |
memos vulnerability allows arbitrarily modification or deletion registered identity providers CVE-2025-65797, GHSA-99m2-qwx6-2w6f, GO-2025-4220 | Medium | 0.3% | 08 Dec, 2025 | Go github.com/usememos/memos |
memos lacks file name validation or verification CVE-2025-65799, GHSA-qgjp-5g5x-vhq2, GO-2025-4218 | Medium | 0.2% | 08 Dec, 2025 | Go github.com/usememos/memos |
memos vulnerability allows arbitrarily reactions deletion CVE-2025-65796, GHSA-8jcj-g9f4-qx42, GO-2025-4215 | Medium | 0.2% | 08 Dec, 2025 | Go github.com/usememos/memos |
memos vulnerability allows arbitrarily modification or deletion of attachments CVE-2025-65798, GHSA-8p44-g572-557h, GO-2025-4216 | Medium | 0.2% | 08 Dec, 2025 | Go github.com/usememos/memos |
Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values CVE-2025-66565, GHSA-m98w-cqp3-qcqr, GO-2025-4208 | Critical | 0.5% | 08 Dec, 2025 | Go github.com/gofiber/utils Go github.com/gofiber/utils/v2 |
1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers CVE-2025-66508, GHSA-7cqv-qcq2-r765, GO-2025-4207 | Medium | 0.3% | 08 Dec, 2025 | Go github.com/1Panel-dev/1Panel Go github.com/1Panel-dev/1Panel/agent |
1Panel – CAPTCHA Bypass via Client-Controlled Flag CVE-2025-66507, GHSA-qmg5-v42x-qqhq, GO-2025-4209 | High | 0.5% | 08 Dec, 2025 | Go github.com/1Panel-dev/1Panel Go github.com/1Panel-dev/1Panel/core |
Traefik Inverted TLS Verification Logic in ingress-nginx Provider CVE-2025-66491, GHSA-7vww-mvcr-x6vj, GO-2025-4205 | Medium | 0.2% | 08 Dec, 2025 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Path Normalization Bypass in Traefik Router + Middleware Rules CVE-2025-66490, GHSA-gm3x-23wp-hc2c, GO-2025-4206 | Medium | 0.4% | 08 Dec, 2025 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Sigstore Timestamp Authority allocates excessive memory during request parsing CVE-2025-66564, GHSA-4qg8-fj49-pxjh, GO-2025-4192 | High | 0.5% | 05 Dec, 2025 | Go github.com/sigstore/timestamp-authority Go github.com/sigstore/timestamp-authority/v2 |
Fulcio allocates excessive memory during token parsing CVE-2025-66506, GHSA-f83f-xpx7-ffpw, GO-2025-4193 | High | 0.2% | 05 Dec, 2025 | Go github.com/sigstore/fulcio |