Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Envoy's TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte BIT-envoy-2025-66220, CVE-2025-66220, GHSA-rwjg-c3h2-f57p | Medium | 0.2% | 05 Dec, 2025 | Go github.com/envoyproxy/envoy |
Envoy forwards early CONNECT data in TCP proxy mode BIT-envoy-2025-64763, CVE-2025-64763, GHSA-rj35-4m94-77jh | Low | 0.3% | 05 Dec, 2025 | Go github.com/envoyproxy/envoy |
Envoy crashes when JWT authentication is configured with the remote JWKS fetching BIT-envoy-2025-64527, CVE-2025-64527, GHSA-mp85-7mrq-r866 | Medium | 0.6% | 05 Dec, 2025 | Go github.com/envoyproxy/envoy |
Logrus is vulnerable to DoS when using Entry.Writer() CVE-2025-65637, GHSA-4f99-4q7p-p3gh, GO-2025-4188 | High | 0.7% | 04 Dec, 2025 | Go github.com/sirupsen/logrus |
Step CA Has Authorization Bypass in ACME and SCEP Provisioners CVE-2025-44005, GHSA-h8cp-697h-8c8p, GO-2025-4180 | Critical | 9.1% | 03 Dec, 2025 | Go github.com/smallstep/certificates |
Coder logs sensitive objects unsanitized CVE-2025-66411, GHSA-jf75-p25m-pw74, GO-2025-4182 | High | 0.2% | 03 Dec, 2025 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
step-ca Has Improper Authorization Check for SSH Certificate Revocation CVE-2025-66406, GHSA-j7c9-79x7-8hpr, GO-2025-4181 | Medium | 0.2% | 03 Dec, 2025 | Go github.com/smallstep/certificates |
Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode CVE-2025-64443, GHSA-46gc-mwh4-cc5r, GO-2025-4179 | High | 0.5% | 03 Dec, 2025 | Go github.com/docker/mcp-gateway |
Apptainer ineffectively applies selinux and apparmor --security options CVE-2025-65105, GHSA-j3rw-fx6g-q46j, GO-2025-4176 | Medium | 0.2% | 02 Dec, 2025 | Go github.com/apptainer/apptainer |
Singluarity ineffectively applies selinux / apparmor LSM process labels CVE-2025-64750, GHSA-wwrx-w7c9-rf87, GO-2025-4177 | Medium | 0.2% | 02 Dec, 2025 | Go github.com/sylabs/singularity Go github.com/sylabs/singularity/v4 |
Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509 BIT-golang-2025-61727, CVE-2025-61727, GO-2025-4175 | 0.3% | 02 Dec, 2025 | Go stdlib | |
Excessive resource consumption when printing error string for host certificate validation in crypto/x509 BIT-golang-2025-61729, CVE-2025-61729, GO-2025-4155 | 0.5% | 02 Dec, 2025 | Go stdlib | |
gokey allows secret recovery from a seed file without the master password CVE-2025-13353, GHSA-69jw-4jj8-fcxm, GO-2025-4174 | High | 0.2% | 02 Dec, 2025 | Go github.com/cloudflare/gokey |
Mattermost fails to validate user permissions in Boards CVE-2025-13870, GHSA-58w6-w55x-6wq8, GO-2025-4178 | Low | 0.2% | 02 Dec, 2025 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes CVE-2025-10543, GHSA-32fw-gq77-f2f2, GO-2025-4173 | Medium | 0.2% | 02 Dec, 2025 | Go github.com/eclipse/paho.mqtt.golang |
Gin-vue-admin has an arbitrary file deletion vulnerability CVE-2025-66410, GHSA-jrhg-82w2-vvj7, GO-2025-4171 | High | 0.6% | 02 Dec, 2025 | Go github.com/flipped-aurora/gin-vue-admin |
Mattermost fails to validate user permissions when deleting comments in Boards CVE-2025-12756, GHSA-p6gj-jc38-x2m7, GO-2025-4172 | Medium | 0.2% | 01 Dec, 2025 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic BIT-cilium-2025-64715, BIT-cilium-operator-2025-64715, BIT-hubble-relay-2025-64715, CVE-2025-64715, GHSA-38pp-6gcp-rqvm, GO-2025-4167 | Medium | 0.2% | 01 Dec, 2025 | Go github.com/cilium/cilium |
Mattermost fails to to verify the token used during code exchange CVE-2025-12421, GHSA-mp6x-97xj-9x62, GO-2025-4170 | Critical | 0.4% | 27 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication CVE-2025-12419, GHSA-3x39-62h4-f8j6, GO-2025-4168 | Critical | 0.4% | 27 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to sanitize team email addresses CVE-2025-12559, GHSA-4g87-9x45-cx2h, GO-2025-4169 | Medium | 0.2% | 27 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM CVE-2025-65942, GHSA-66jq-2c23-2xh5, GO-2025-4161 | Low | 0.4% | 25 Nov, 2025 | Go github.com/VictoriaMetrics/VictoriaMetrics |
Grype has a credential disclosure vulnerability in its JSON output CVE-2025-65965, GHSA-6gxw-85q2-q646, GO-2025-4160 | High | 0.2% | 25 Nov, 2025 | Go github.com/anchore/grype |
Babylon's BIP322 signature implementation is not fully compliant to the spec GHSA-xq4h-wqm2-668w, GO-2025-4159 | Medium | Not scored | 24 Nov, 2025 | Go github.com/babylonlabs-io/babylon Go github.com/babylonlabs-io/babylon/v2 Go github.com/babylonlabs-io/babylon/v3 Go github.com/babylonlabs-io/babylon/v4 |
Babylon's malformed vote extensions are not rejected GHSA-2fcv-qww3-9v6h, GO-2025-4157 | High | Not scored | 24 Nov, 2025 | Go github.com/babylonlabs-io/babylon Go github.com/babylonlabs-io/babylon/v2 Go github.com/babylonlabs-io/babylon/v3 Go github.com/babylonlabs-io/babylon/v4 |
LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction GHSA-rj4j-2jph-gg43, GO-2025-4158 | Critical | Not scored | 24 Nov, 2025 | Go github.com/lf-edge/ekuiper Go github.com/lf-edge/ekuiper/v2 |
OpenBao is Vulnerable to Privileged Operator Identity Group Root Escalation BIT-openbao-2025-64761, CVE-2025-64761, GHSA-7ff4-jw48-3436, GO-2025-4156 | High | 0.4% | 24 Nov, 2025 | Go github.com/openbao/openbao |
new-api is vulnerable to SSRF Bypass CVE-2025-62155, GHSA-9f46-w24h-69w4, GO-2025-4154 | High | 0.3% | 24 Nov, 2025 | Go github.com/QuantumNous/new-api |
Free5GC is vulnerable to DoS through its Npcf_BDTPolicyControl POST API CVE-2025-60632, GHSA-vgq7-9r5r-j9v3, GO-2025-4164 | Medium | 0.3% | 24 Nov, 2025 | Go github.com/free5gc/pcf |
Free5GC is vulnerable to DoS via the Nudm_SubscriberDataManagement API CVE-2025-60633, GHSA-3j9f-7w24-pcqg, GO-2025-4162 | Medium | 0.4% | 24 Nov, 2025 | Go github.com/free5gc/openapi Go github.com/free5gc/udm |
NSSF panic due to nil pointer dereference when expiry field is omitted in NSSAIAvailability POST CVE-2025-60638, GHSA-f2hj-vpp9-6vm2, GO-2025-4163 | High | 0.4% | 24 Nov, 2025 | Go github.com/free5gc/nssf |
SpiceDB: LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results CVE-2025-65111, GHSA-9m7r-g8hg-x3vr, GO-2025-4151 | Low | 0.2% | 21 Nov, 2025 | Go github.com/authzed/spicedb |
Vault’s Terraform Provider incorrectly set default deny_null_bind parameter for LDAP auth method to false by default CVE-2025-13357, GHSA-gmm6-j2g5-r52m, GO-2025-4152 | High | 0.5% | 21 Nov, 2025 | Go github.com/hashicorp/terraform-provider-vault |
Grafana Incorrect Privilege Assignment vulnerability BIT-grafana-2025-41115, CVE-2025-41115, GHSA-w62r-7c53-fmc5, GO-2025-4153 | Critical | 17.5% | 21 Nov, 2025 | Go github.com/grafana/grafana |
OpenFGA Improper Policy Enforcement CVE-2025-64751, GHSA-2c64-vmv2-hgfc, GO-2025-4150 | Medium | 0.3% | 20 Nov, 2025 | Go github.com/openfga/openfga |
Minder does not sandbox http.send in Rego programs CVE-2025-65109, GHSA-6xvf-4vh9-mw47, GO-2025-4147 | High | 0.3% | 20 Nov, 2025 | Go github.com/mindersec/minder |
OSV-SCALIBR has NULL Pointer Dereference CVE-2025-13425, GHSA-f786-75f3-74xj, GO-2025-4149 | Low | 0.1% | 20 Nov, 2025 | Go github.com/google/osv-scalibr |
esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript CVE-2025-65026, GHSA-hcpf-qv9m-vfgp, GO-2025-4139 | Medium | 0.5% | 19 Nov, 2025 | Go github.com/esm-dev/esm.sh |
esm.sh CDN service has arbitrary file write via tarslip CVE-2025-65025, GHSA-h3mw-4f23-gwpw, GO-2025-4138 | High | 0.6% | 19 Nov, 2025 | Go github.com/esm-dev/esm.sh |
golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read CVE-2025-47914, GHSA-f6x5-jh6r-wrfv, GO-2025-4135 | Medium | 0.5% | 19 Nov, 2025 | Go golang.org/x/crypto |
golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption CVE-2025-58181, GHSA-j5w8-q4qc-rx2x, GO-2025-4134 | Medium | 0.6% | 19 Nov, 2025 | Go golang.org/x/crypto |
authentik's invitation expiry is delayed by at least 5 minutes BIT-authentik-2025-64708, CVE-2025-64708, GHSA-ch7q-53v8-73pc, GO-2025-4136 | Medium | 0.3% | 19 Nov, 2025 | Go goauthentik.io |
authentik allows a deactivated Service account to authenticate to OAuth BIT-authentik-2025-64521, CVE-2025-64521, GHSA-xr73-jq5p-ch8r, GO-2025-4137, PYSEC-2025-237 | Medium | 0.2% | 19 Nov, 2025 | Go goauthentik.io PyPI authentik-client |
Mattermost allows other users to determine when users had read channels via channel member objects CVE-2025-55074, GHSA-9hh7-6558-qfp2, GO-2025-4133 | Low | 0.2% | 18 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Memos' Access Tokens Stay Valid after User Password Change CVE-2024-21635, GHSA-mr34-8733-grr2, GO-2025-4127 | High | 0.3% | 14 Nov, 2025 | Go github.com/usememos/memos |
ZITADEL is vulnerable to Account Takeover with deactivated Instance IdP CVE-2025-64717, GHSA-j4g7-v4m4-77px, GO-2025-4124 | High | 0.5% | 14 Nov, 2025 | Go github.com/zitadel/zitadel |
Mattermost allows system administrators to access password hashes and MFA secrets CVE-2025-11794, GHSA-mqp8-pgg5-7x7m, GO-2025-4130 | Medium | 0.3% | 14 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly restrict access to archived channel search API CVE-2025-11776, GHSA-j6gg-r5jc-47cm, GO-2025-4126 | Medium | 0.2% | 14 Nov, 2025 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +2 more |
Mattermost allows regular users to access archived channel content and files CVE-2025-41436, GHSA-x3hx-ch7p-8xgg, GO-2025-4131 | Low | 0.2% | 14 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost does not enforce MFA on WebSocket connections CVE-2025-55070, GHSA-xpg8-8xpv-948p, GO-2025-4128 | Medium | 0.3% | 14 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |