Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mattermost allows regular users to access archived channel content and files CVE-2025-41436, GHSA-x3hx-ch7p-8xgg, GO-2025-4131 | Low | 0.2% | 14 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost does not enforce MFA on WebSocket connections CVE-2025-55070, GHSA-xpg8-8xpv-948p, GO-2025-4128 | Medium | 0.3% | 14 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL CVE-2025-55073, GHSA-ff85-qw3h-g9vp, GO-2025-4129 | Medium | 0.2% | 14 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
LXD vulnerable to a local privilege escalation through custom storage volumes GHSA-3g2j-vm47-x4mj, GO-2025-4121 | High | Not scored | 13 Nov, 2025 | Go github.com/canonical/lxd |
SpiceDB WriteRelationships fails silently if payload is too big CVE-2025-64529, GHSA-pm3x-jrhh-qcr7, GO-2025-4120 | Low | 0.3% | 13 Nov, 2025 | Go github.com/authzed/spicedb |
File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency GHSA-6jqf-mv7m-3q7p, GO-2025-4118 | Critical | Not scored | 13 Nov, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion Function CVE-2025-64523, GHSA-6cqf-cfhv-659g, GO-2025-4117 | High | 0.5% | 13 Nov, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance GHSA-7wq2-32h4-9hc9, GO-2025-4119 | High | Not scored | 13 Nov, 2025 | Go github.com/aws/aws-advanced-go-wrapper/auth-helpers Go github.com/aws/aws-advanced-go-wrapper/aws-secrets-manager Go github.com/aws/aws-advanced-go-wrapper/awssql Go github.com/aws/aws-advanced-go-wrapper/federated-auth +6 more |
golang.org/x/crypto/ssh/agent has a potential denial of service CVE-2025-47913, GHSA-56w8-48fp-6mgv, GO-2025-4116 | High | 0.7% | 13 Nov, 2025 | Go golang.org/x/crypto Go golang.org/x/crypto/ssh/agent |
Mattermost Incorrect Authorization vulnerability CVE-2025-11777, GHSA-mqcj-8c2g-h97q, GO-2025-4122 | Low | 0.2% | 13 Nov, 2025 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +2 more |
Incus vulnerable to local privilege escalation through custom storage volumes CVE-2025-64507, GHSA-56mx-8g9f-5crf, GO-2025-4115 | High | 0.2% | 13 Nov, 2025 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |
Milvus Proxy has a Critical Authentication Bypass Vulnerability BIT-milvus-2025-64513, CVE-2025-64513, GHSA-mhjq-8c7m-3f7p, GO-2025-4114 | Critical | 0.9% | 13 Nov, 2025 | Go github.com/milvus-io/milvus |
Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves CVE-2025-64186, GHSA-88h9-77c7-p6w4, GO-2025-4112 | High | 0.1% | 12 Nov, 2025 | Go github.com/evervault/evervault-go |
OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation BIT-oauth2-proxy-2025-64484, CVE-2025-64484, GHSA-vjrc-mh2v-45x6, GO-2025-4113 | High | 0.7% | 12 Nov, 2025 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack CVE-2025-2843, GHSA-mj6p-p843-x5wc, GO-2025-4125 | High | 0.4% | 12 Nov, 2025 | Go github.com/rhobs/observability-operator |
jose2go is vulnerable to a JWT bomb attack through its decode function CVE-2025-63811, GHSA-9mj6-hxhv-w67j, GO-2025-4123 | High | 0.3% | 12 Nov, 2025 | Go github.com/dvsekhvalnov/jose2go |
Soft Serve is vulnerable to SSRF through its Webhooks CVE-2025-64522, GHSA-vwq2-jx9q-9h9f, GO-2025-4111 | Critical | 0.4% | 10 Nov, 2025 | Go github.com/charmbracelet/soft-serve |
KubeVirt Vulnerable to Arbitrary Host File Read and Write CVE-2025-64324, GHSA-46xp-26xh-hpqh, GO-2025-4110 | High | 0.2% | 07 Nov, 2025 | Go kubevirt.io/kubevirt |
Soft Serve does not sanitize ANSI escape sequences in user input CVE-2025-64494, GHSA-fv2r-r8mp-pg48, GO-2025-4106 | Medium | 0.2% | 06 Nov, 2025 | Go github.com/charmbracelet/soft-serve |
KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes CVE-2025-64437, GHSA-2r4r-5x78-mvqf, GO-2025-4102 | Medium | 0.2% | 06 Nov, 2025 | Go kubevirt.io/kubevirt |
KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes CVE-2025-64436, GHSA-7xgm-5prm-v5gc, GO-2025-4104 | Medium | 0.3% | 06 Nov, 2025 | Go github.com/kubevirt/kubevirt Go kubevirt.io/kubevirt |
KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation CVE-2025-64435, GHSA-9m94-w2vq-hcf9, GO-2025-4105 | Medium | 0.4% | 06 Nov, 2025 | Go kubevirt.io/kubevirt |
KubeVirt's Improper TLS Certificate Management Handling Allows API Identity Spoofing CVE-2025-64434, GHSA-ggp9-c99x-54gp, GO-2025-4107 | Medium | 0.2% | 06 Nov, 2025 | Go kubevirt.io/kubevirt |
KubeVirt Arbitrary Container File Read CVE-2025-64433, GHSA-qw6q-3pgr-5cwq, GO-2025-4109 | Medium | 0.5% | 06 Nov, 2025 | Go kubevirt.io/kubevirt |
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer CVE-2025-64432, GHSA-38jw-g2qx-4286, GO-2025-4103 | Medium | 0.1% | 06 Nov, 2025 | Go kubevirt.io/kubevirt |
containerd CRI server: Host memory exhaustion through Attach goroutine leak CVE-2025-64329, GHSA-m6hq-p25p-ffr2, GO-2025-4108 | Medium | 0.2% | 06 Nov, 2025 | Go github.com/containerd/containerd Go github.com/containerd/containerd/v2 |
OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses GHSA-w2jf-268q-mrvh, GO-2025-4101 | Low | Not scored | 06 Nov, 2025 | Go github.com/opentofu/opentofu |
containerd affected by a local privilege escalation via wide permissions on CRI directory CVE-2024-25621, GHSA-pwhc-rpq9-4c8w, GO-2025-4100 | High | 0.2% | 06 Nov, 2025 | Go github.com/containerd/containerd Go github.com/containerd/containerd/v2 |
IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering CVE-2025-64431, GHSA-cpf4-pmr4-w6cx, GO-2025-4099 | High | 0.3% | 05 Nov, 2025 | Go github.com/zitadel/zitadel |
runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects CVE-2025-52881, GHSA-cgrx-mc8f-2prm, GO-2025-4098 | High | 0.8% | 05 Nov, 2025 | Go github.com/opencontainers/runc Go github.com/opencontainers/selinux |
runc container escape with malicious config due to /dev/console mount and related races CVE-2025-52565, GHSA-qw9x-cqr3-wc7r, GO-2025-4097 | High | 0.8% | 05 Nov, 2025 | Go github.com/opencontainers/runc |
runc container escape via "masked path" abuse due to mount race conditions CVE-2025-31133, GHSA-9493-h29p-rfm2, GO-2025-4096 | High | 1.2% | 05 Nov, 2025 | Go github.com/opencontainers/runc |
Kgateway transformation policy template can emit files from the container GHSA-5pmx-7r6r-wfqq, GO-2025-4095 | Medium | Not scored | 04 Nov, 2025 | Go github.com/kgateway-dev/kgateway Go github.com/kgateway-dev/kgateway/v2 |
kgateway is missing xDS authorization CVE-2025-64323, GHSA-4766-x535-jw3r, GO-2025-4094 | Medium | 0.2% | 04 Nov, 2025 | Go github.com/kgateway-dev/kgateway Go github.com/kgateway-dev/kgateway/v2 |
MARIN3R: Cross-Namespace Vulnerability in the Operator CVE-2025-64171, GHSA-gf93-xccm-5g6j, GO-2025-4093 | High | 0.2% | 04 Nov, 2025 | Go github.com/3scale-sre/marin3r |
Jellysweep uses uncontrolled data in image cache API endpoint CVE-2025-64178, GHSA-xc93-q32j-cpcg, GO-2025-4091 | High | 0.3% | 04 Nov, 2025 | Go github.com/jon4hz/jellysweep |
lakeFS affected by unauthenticated access to API usage metrics CVE-2025-64179, GHSA-h238-5mwf-8xw8, GO-2025-4090 | Medium | 0.3% | 03 Nov, 2025 | Go github.com/treeverse/lakefs |
sqls-server/sqls is vulnerable to command injection in the config command CVE-2025-61141, GHSA-f9f4-5859-29mf, GO-2025-4088 | High | 1.1% | 30 Oct, 2025 | Go github.com/sqls-server/sqls |
gnark-crypto allows unchecked memory allocation during vector deserialization GHSA-fj2x-735w-74vq, GO-2025-4087 | High | Not scored | 30 Oct, 2025 | Go github.com/consensys/gnark-crypto |
Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode CVE-2025-64716, GHSA-cf57-c578-7jvv, GO-2025-4086 | Medium | 0.4% | 30 Oct, 2025 | Go github.com/TecharoHQ/anubis |
Zitadel May Bypass Second Authentication Factor CVE-2025-64103, GHSA-cfjq-28r2-4jv5, GO-2025-4083 | High | 0.4% | 29 Oct, 2025 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
Zitadel allows brute-forcing authentication factors CVE-2025-64102, GHSA-xrw9-r35x-x878, GO-2025-4085 | High | 0.4% | 29 Oct, 2025 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection CVE-2025-64101, GHSA-mwmh-7px9-4c23, GO-2025-4084 | High | 0.4% | 29 Oct, 2025 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
Excessive CPU consumption in Reader.ReadResponse in net/textproto BIT-golang-2025-61724, CVE-2025-61724, GO-2025-4015 | 0.6% | 29 Oct, 2025 | Go stdlib | |
Unbounded allocation when parsing GNU sparse map in archive/tar BIT-golang-2025-58183, CVE-2025-58183, GO-2025-4014 | 0.4% | 29 Oct, 2025 | Go stdlib | |
Panic when validating certificates with DSA public keys in crypto/x509 BIT-golang-2025-58188, CVE-2025-58188, GO-2025-4013 | 0.4% | 29 Oct, 2025 | Go stdlib | |
Lack of limit when parsing cookies can cause memory exhaustion in net/http BIT-golang-2025-58186, CVE-2025-58186, GO-2025-4012 | 0.6% | 29 Oct, 2025 | Go stdlib | |
Parsing DER payload can cause memory exhaustion in encoding/asn1 BIT-golang-2025-58185, CVE-2025-58185, GO-2025-4011 | 0.6% | 29 Oct, 2025 | Go stdlib | |
Insufficient validation of bracketed IPv6 hostnames in net/url BIT-golang-2025-47912, CVE-2025-47912, GO-2025-4010 | 0.5% | 29 Oct, 2025 | Go stdlib | |
Quadratic complexity when parsing some invalid inputs in encoding/pem BIT-golang-2025-61723, CVE-2025-61723, GO-2025-4009 | 0.7% | 29 Oct, 2025 | Go stdlib |