Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenBao has Reflected XSS in its OIDC authentication error message BIT-openbao-2026-33758, CVE-2026-33758, GHSA-cpj3-3r2f-xj59, GO-2026-4862 | Critical | Not scored | 26 Mar, 2026 | Go github.com/openbao/openbao |
OpenBao lacks user confirmation for OIDC direct callback mode BIT-openbao-2026-33757, CVE-2026-33757, GHSA-7q7g-x6vg-xpc3, GO-2026-4860 | Critical | Not scored | 26 Mar, 2026 | Go github.com/openbao/openbao |
Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR CVE-2026-56765, GHSA-2pv8-4c52-mf8j, GO-2026-4855 | Critical | Not scored | 26 Mar, 2026 | Go code.vikunja.io/api |
SiYuan has directory traversal within its publishing service CVE-2026-33670, GHSA-xmw9-6r43-x9ww, GO-2026-4843 | Critical | Not scored | 25 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan has Arbitrary Document Reading within the Publishing Service CVE-2026-33669, GHSA-34xj-66v3-6j83, GO-2026-4842 | Critical | Not scored | 25 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Trivy ecosystem supply chain was briefly compromised CVE-2026-33634, GHSA-69fq-xp46-6x23, GO-2026-4919 | CriticalExploited | 59.7% | 23 Mar, 2026 | GitHub Actions aquasecurity/setup-trivy GitHub Actions aquasecurity/trivy-action Go github.com/aquasecurity/trivy |
Harbor allows the use of the default password for web UI login BIT-harbor-2026-4404, CVE-2026-4404, GHSA-hj7x-hmf2-hc2p, GO-2026-4845 | Critical | Not scored | 23 Mar, 2026 | Go github.com/goharbor/harbor |
Ory Oathkeeper has a path traversal authorization bypass CVE-2026-33494, GHSA-p224-6x5r-fjpm, GO-2026-4804 | Critical | Not scored | 20 Mar, 2026 | Go github.com/ory/oathkeeper |
MinIO LDAP login brute-force via user enumeration and missing rate limit CVE-2026-33419, GHSA-jv87-32hw-hh99, GO-2026-4803 | Critical | Not scored | 20 Mar, 2026 | Go github.com/minio/minio |
MinIO has JWT Algorithm Confusion in OIDC Authentication CVE-2026-33322, GHSA-5cx5-wh4m-82fh, GO-2026-4779 | Critical | Not scored | 19 Mar, 2026 | Go github.com/minio/minio |
qui CORS Misconfiguration: Arbitrary Origins Trusted CVE-2026-30924, GHSA-h8vw-ph9r-xpch, GO-2026-4774 | Critical | Not scored | 19 Mar, 2026 | Go github.com/autobrr/qui |
step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) CVE-2026-30836, GHSA-q4r8-xm5f-56gw, GO-2026-4775 | Critical | Not scored | 19 Mar, 2026 | Go github.com/smallstep/certificates |
Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod CVE-2026-33211, GHSA-j5q5-j9gm-2w5c, GO-2026-4761 | Critical | Not scored | 18 Mar, 2026 | Go github.com/tektoncd/pipeline |
gRPC-Go has an authorization bypass via missing leading slash in :path CVE-2026-33186, GHSA-p77j-4mvh-x3m3, GO-2026-4762 | Critical | Not scored | 18 Mar, 2026 | Go google.golang.org/grpc |
SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183) CVE-2026-32940, GHSA-4mx9-3c2h-hwhg, GO-2026-4721 | Critical | Not scored | 17 Mar, 2026 | Go github.com/siyuan-note/siyuan |
SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service CVE-2026-32938, GHSA-fq2j-j8hc-8vw8, GO-2026-4722 | Critical | Not scored | 17 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API CVE-2026-32767, GHSA-j7wh-x834-p3r7, GO-2026-4716 | Critical | Not scored | 16 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
File Browser Signup Grants Admin When Default Permissions Include Admin CVE-2026-32760, GHSA-5gg9-5g7w-hm73, GO-2026-4710 | Critical | Not scored | 16 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL CVE-2026-32301, GHSA-j77h-rr39-c552, GO-2026-4702 | Critical | Not scored | 13 Mar, 2026 | Go github.com/centrifugal/centrifugo Go github.com/centrifugal/centrifugo/v3 Go github.com/centrifugal/centrifugo/v4 Go github.com/centrifugal/centrifugo/v5 +1 more |
SM9 Infinity-Point Ciphertext Forgery Vulnerability CVE-2026-32614, GHSA-5xxp-2vrj-x855, GO-2026-4694 | Critical | Not scored | 13 Mar, 2026 | Go github.com/emmansun/gmsm |
Dagu: Path Traversal via `dagRunId` in Inline DAG Execution CVE-2026-31886, GHSA-m4q3-457p-hh2x, GO-2026-4693 | Critical | Not scored | 13 Mar, 2026 | Go github.com/dagu-org/dagu |
AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass CVE-2026-32136, GHSA-5fg6-wrq4-w5gh, GO-2026-4686 | Critical | Not scored | 12 Mar, 2026 | Go github.com/AdguardTeam/AdGuardHome |
Cosmos EVM: incorrect state handling during nested EVM execution paths GHSA-54gx-3cgr-7mfm, GO-2026-4677 | Critical | Not scored | 11 Mar, 2026 | Go github.com/cosmos/evm |
Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go GHSA-j443-wcqq-xprh, GO-2026-4673 | Critical | Not scored | 11 Mar, 2026 | Go github.com/arslanbekov/terraform-provider-sendgrid |
Linkdave Missing Authentication on REST and WebSocket endpoints GHSA-xv8g-fj9h-6gmv, GO-2026-4661 | Critical | Not scored | 10 Mar, 2026 | Go github.com/shi-gg/linkdave |
SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage CVE-2026-30869, GHSA-2h2p-mvfx-868w, GO-2026-4646 | Critical | Not scored | 07 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
WeKnora has Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation CVE-2026-30861, GHSA-r55h-3rwj-hcmg, GO-2026-4645 | Critical | Not scored | 07 Mar, 2026 | Go github.com/Tencent/WeKnora |
WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool CVE-2026-30860, GHSA-8w32-6mrw-q5wv, GO-2026-4641 | Critical | Not scored | 06 Mar, 2026 | Go github.com/Tencent/WeKnora |
WeKnora Vulnerable to Broken Access Control in Tenant Management CVE-2026-30855, GHSA-ccj6-79j6-cq5q, GO-2026-4642 | Critical | Not scored | 06 Mar, 2026 | Go github.com/Tencent/WeKnora |
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import CVE-2026-30832, GHSA-3fvx-xrxq-8jvv, GO-2026-4634 | Critical | Not scored | 06 Mar, 2026 | Go github.com/charmbracelet/soft-serve |
Gogs: Cross-repository LFS object overwrite via missing content hash verification CVE-2026-25921, GHSA-cj4v-437j-jq4c, GO-2026-4616 | Critical | Not scored | 05 Mar, 2026 | Go gogs.io/gogs |
Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure CVE-2026-27944, GHSA-g9w5-qffc-6762, GO-2026-4614 | Critical | Not scored | 05 Mar, 2026 | Go github.com/0xJacky/Nginx-UI |
ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint CVE-2026-29191, GHSA-pr34-2v5x-6qjq, GO-2026-4607 | Critical | Not scored | 04 Mar, 2026 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
File Browser's TUS Delete Endpoint Bypasses Delete Permission Check CVE-2026-29188, GHSA-79pf-vx4x-7jmm, GO-2026-4606 | Critical | Not scored | 04 Mar, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint CVE-2026-29183, GHSA-6865-qjcf-286f, GO-2026-4596 | Critical | Not scored | 04 Mar, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Rancher cloud credentials can be used through proxy API by users without access CVE-2021-25320, GHSA-gqf8-rvrh-g7w6, GO-2026-4589 | Critical | Not scored | 03 Mar, 2026 | Go github.com/rancher/rancher |
Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB) CVE-2022-31247, GHSA-6x34-89p7-95wg | Critical | Not scored | 03 Mar, 2026 | Go github.com/rancher/rancher |
Rancher doesn't properly sanitize credentials in cluster template answers CVE-2021-36783, GHSA-8w87-58w6-hfv8 | Critical | Not scored | 03 Mar, 2026 | Go github.com/rancher/rancher |
Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse CVE-2026-28268, GHSA-rfjg-6m84-crj2, GO-2026-4575 | Critical | Not scored | 28 Feb, 2026 | Go code.vikunja.io/api |
Vitess users with backup storage access can write to arbitrary file paths on restore CVE-2026-27969, GHSA-r492-hjgh-c9gw, GO-2026-4570 | Critical | Not scored | 27 Feb, 2026 | Go vitess.io/vitess |
Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change CVE-2026-27575, GHSA-3ccg-x393-96v8, GO-2026-4551 | Critical | Not scored | 25 Feb, 2026 | Go code.vikunja.io/api |
OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks CVE-2026-27626, GHSA-49gm-hh7w-wfvf, GO-2026-4547 | Critical | Not scored | 25 Feb, 2026 | Go github.com/OliveTin/OliveTin |
Dagu affected by unauthenticated RCE via inline DAG spec in default configuration GHSA-6qr9-g2xw-cw92, GO-2026-4527 | Critical | Not scored | 19 Feb, 2026 | Go github.com/dagu-org/dagu |
Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints CVE-2026-27112, GHSA-7g9x-cp9g-92mr, GO-2026-4516 | Critical | Not scored | 19 Feb, 2026 | Go github.com/akuity/kargo |
Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise BIT-milvus-2026-26190, CVE-2026-26190, GHSA-7ppg-37fh-vcr6, GO-2026-4481 | Critical | Not scored | 11 Feb, 2026 | Go github.com/milvus-io/milvus |
Fiber has an insecure fallback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure CVE-2025-66630, GHSA-68rr-p4fp-j59v, GO-2026-4471 | Critical | Not scored | 09 Feb, 2026 | Go github.com/gofiber/fiber Go github.com/gofiber/fiber/v2 |
Gogs's update .git/config file allows remote command execution CVE-2025-64111, GHSA-gg64-xxr9-qhjp, GO-2026-4448 | Critical | Not scored | 06 Feb, 2026 | Go gogs.io/gogs |
FrankenPHP has delayed propagation of security fixes in upstream base images GHSA-x9p2-77v6-6vhf, GO-2026-4442 | Critical | Not scored | 05 Feb, 2026 | Go github.com/dunglas/frankenphp |
Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern CVE-2025-62878, GHSA-jr3w-9vfr-c746, GO-2026-4425 | Critical | Not scored | 04 Feb, 2026 | Go github.com/rancher/local-path-provisioner |
Alist has Insecure TLS Config CVE-2026-25160, GHSA-8jmm-3xwx-w974, GO-2026-4414 | Critical | Not scored | 04 Feb, 2026 | Go github.com/alist-org/alist Go github.com/alist-org/alist/v3 |