Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
ALPN negotiation error contains attacker controlled information in crypto/tls BIT-golang-2025-58189, CVE-2025-58189, GO-2025-4008 | 0.5% | 29 Oct, 2025 | Go stdlib | |
Quadratic complexity when checking name constraints in crypto/x509 BIT-golang-2025-58187, CVE-2025-58187, GO-2025-4007 | 0.4% | 29 Oct, 2025 | Go stdlib | |
Excessive CPU consumption in ParseAddress in net/mail BIT-golang-2025-61725, CVE-2025-61725, GO-2025-4006 | 0.6% | 29 Oct, 2025 | Go stdlib | |
Consul key/value endpoint is vulnerable to denial of service BIT-consul-2025-11374, CVE-2025-11374, GHSA-7g3r-8c6v-hfmr, GO-2025-4081 | Medium | 0.4% | 28 Oct, 2025 | Go github.com/hashicorp/consul |
Consul event endpoint is vulnerable to denial of service BIT-consul-2025-11375, CVE-2025-11375, GHSA-qh7p-pfq3-677h, GO-2025-4082 | Medium | 0.4% | 28 Oct, 2025 | Go github.com/hashicorp/consul |
Contrast has insecure LUKS2 persistent storage partitions may be opened and used CVE-2025-71422, GHSA-f5p4-p5q5-jv3h, GO-2025-4078 | Medium | 0.1% | 28 Oct, 2025 | Go github.com/edgelesssys/contrast |
Silver has unrestricted traffic between Wireguard clients CVE-2025-27093, GHSA-q8j9-34qf-7vq7, GO-2025-4079 | Medium | 0.3% | 28 Oct, 2025 | Go github.com/BishopFox/sliver Go github.com/bishopfox/sliver |
Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotations CVE-2025-62725, GHSA-gv8h-7v7w-r22q, GO-2025-4077 | High | 15.8% | 27 Oct, 2025 | Go github.com/docker/compose Go github.com/docker/compose/v2 |
Constellation has insecure LUKS2 persistent storage partitions which may be opened and used CVE-2025-58356, GHSA-hq76-6gh2-5g4q, GO-2025-4076 | High | 0.1% | 27 Oct, 2025 | Go github.com/edgelesssys/constellation Go github.com/edgelesssys/constellation/v2 |
Rancher exposes sensitive information through audit logs CVE-2024-58269, GHSA-mw39-9qc2-f7mg, GO-2025-4074 | Medium | 0.3% | 24 Oct, 2025 | Go github.com/rancher/rancher |
Karmada Dashboard API Unauthorized Access Vulnerability CVE-2025-62714, GHSA-5qjg-9mjh-4r92, GO-2025-4072 | Critical | 0.5% | 24 Oct, 2025 | Go github.com/karmada-io/dashboard |
Rancher user retains access to clusters despite Global Role removal CVE-2023-32199, GHSA-j4vr-pcmw-hx59, GO-2025-4073 | Medium | 0.2% | 24 Oct, 2025 | Go github.com/rancher/rancher |
Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON BIT-vault-2025-12044, CVE-2025-12044, GHSA-vp5w-xcfc-73wf, GO-2025-4071 | High | 0.5% | 23 Oct, 2025 | Go github.com/hashicorp/vault |
HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass BIT-vault-2025-11621, CVE-2025-11621, GHSA-9g4h-h484-3578, GO-2025-4070 | High | 0.5% | 23 Oct, 2025 | Go github.com/hashicorp/vault |
OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method CVE-2025-59048, GHSA-jp7h-4f3c-9rc7, GO-2025-4067 | High | 0.3% | 23 Oct, 2025 | Go github.com/openbao/openbao-plugins |
Slack Nebula may accept arbitrary source IP addresses CVE-2025-62820, GHSA-x6fh-7qmf-69xh, GO-2025-4068 | Medium | 0.2% | 23 Oct, 2025 | Go github.com/slackhq/nebula |
OpenBao and Vault Leak []byte Fields in Audit Logs BIT-openbao-2025-62705, CVE-2025-62705, GHSA-rc54-2g2c-g36g, GO-2025-4052 | Medium | 0.3% | 22 Oct, 2025 | Go github.com/openbao/openbao |
OpenBao leaks HTTPRawBody in Audit Logs BIT-openbao-2025-62513, CVE-2025-62513, GHSA-ghfh-fmx4-26h8, GO-2025-4049 | Medium | 0.3% | 22 Oct, 2025 | Go github.com/openbao/openbao |
NeuVector is shipping cryptographic material into its binary CVE-2025-54471, GHSA-h773-7gf7-9m2x, GO-2025-4043 | Medium | 0.3% | 21 Oct, 2025 | Go github.com/neuvector/neuvector |
NeuVector telemetry sender is vulnerable to MITM and DoS CVE-2025-54470, GHSA-qqj3-g7mx-5p4w, GO-2025-4044 | High | 0.2% | 21 Oct, 2025 | Go github.com/neuvector/neuvector |
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow CVE-2025-54469, GHSA-c8g6-qrwh-m3vp, GO-2025-4042 | Critical | 0.5% | 21 Oct, 2025 | Go github.com/neuvector/neuvector |
Cosmos EVM Vulnerability GHSA-8pfh-j44r-f654, GO-2025-4041 | Critical | Not scored | 21 Oct, 2025 | Go github.com/cosmos/evm |
NetBird VPN does not remove the default password of an admin account CVE-2025-10678, GHSA-g3j4-58mp-3x25, GO-2025-4040 | Critical | 0.4% | 20 Oct, 2025 | Go github.com/netbirdio/netbird |
OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requests BIT-openbao-2025-59043, CVE-2025-59043, GHSA-g46h-2rq9-gw5m, GO-2025-4039 | High | 0.7% | 17 Oct, 2025 | Go github.com/openbao/openbao |
Git LFS may write to arbitrary files via crafted symlinks BIT-git-lfs-2025-26625, CVE-2025-26625, GHSA-6pvw-g552-53c5, GO-2025-4038 | High | 1.1% | 17 Oct, 2025 | Go github.com/git-lfs/git-lfs Go github.com/git-lfs/git-lfs/v3 |
MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS CVE-2025-62506, GHSA-jjjj-jwhf-8rgr, GO-2025-4034 | High | 0.6% | 16 Oct, 2025 | Go github.com/minio/minio |
Apache Traffic Control has an Inefficient Regular Expression Complexity vulnerability CVE-2025-61581, GHSA-9m49-p2j3-c6xm, GO-2025-4033 | Low | 0.7% | 16 Oct, 2025 | Go github.com/apache/trafficcontrol Go github.com/apache/trafficcontrol/v8 |
Mattermost has an Incorrect Authorization vulnerability CVE-2025-10545, GHSA-424h-xj87-m937, GO-2025-4030 | Low | 0.3% | 16 Oct, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost has a Missing Authorization vulnerability CVE-2025-41410, GHSA-3q4q-wqm6-hvf3, GO-2025-4029 | Medium | 0.3% | 16 Oct, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost has a Missing Authorization vulnerability CVE-2025-41443, GHSA-7cr3-38jm-6p45, GO-2025-4031 | Medium | 0.3% | 16 Oct, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost/server/v8 |
Mattermost has an Observable Timing Discrepancy vulnerability CVE-2025-54499, GHSA-xr3w-rmvj-f6m7, GO-2025-4036 | Low | 0.3% | 16 Oct, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost has a Missing Authorization vulnerability CVE-2025-58073, GHSA-6q7m-p8cc-998r, GO-2025-4032 | High | 0.4% | 16 Oct, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost has a Missing Authorization vulnerability CVE-2025-58075, GHSA-r6qj-894f-5hr2, GO-2025-4035 | High | 0.3% | 16 Oct, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents CVE-2025-62375, GHSA-72c7-4g63-hpw5, GO-2025-4028 | Medium | 0.2% | 15 Oct, 2025 | Go github.com/in-toto/go-witness |
CometBFT's invalid BitArray handling can lead to network halt GHSA-hrhf-2vcr-ghch, GO-2025-4025 | High | Not scored | 14 Oct, 2025 | Go github.com/cometbft/cometbft |
Argo Workflow may expose artifact repository credentials BIT-argo-workflows-2025-62157, CVE-2025-62157, GHSA-c2hv-4pfj-mm2r, GO-2025-4024 | High | 0.5% | 14 Oct, 2025 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
Argo Workflow has a Zipslip Vulnerability BIT-argo-workflows-2025-62156, CVE-2025-62156, GHSA-p84v-gxvw-73pf, GO-2025-4023 | High | 0.6% | 14 Oct, 2025 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
Omni vulnerable to information leak via API CVE-2025-61688, GHSA-77r9-w39m-9xh5, GO-2025-4022 | High | 0.3% | 13 Oct, 2025 | Go github.com/siderolabs/omni |
Omni is Vulnerable to DoS via Empty Create/Update Resource Requests CVE-2025-59836, GHSA-4p3p-cr38-v5xp, GO-2025-4021 | Medium | 0.6% | 13 Oct, 2025 | Go github.com/siderolabs/omni |
Parallax is vulnerable to DoS via malicious p2p message GHSA-xc79-566c-j4qx, GO-2025-4019 | High | Not scored | 10 Oct, 2025 | Go github.com/microstack-tech/parallax |
Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret CVE-2025-61926, GHSA-33f4-mjch-7fpr, GO-2025-4018 | Medium | 0.5% | 10 Oct, 2025 | Go github.com/ossf/allstar |
quic-go: Panic occurs when queuing undecryptable packets after handshake completion CVE-2025-59530, GHSA-47m2-4cr7-mhcw, GO-2025-4017 | High | 0.5% | 10 Oct, 2025 | Go github.com/quic-go/quic-go |
rardecode: DoS risk due to unrestricted RAR dictionary sizes CVE-2025-11579, GHSA-rwvp-r38j-9rgg, GO-2025-4020 | Medium | 0.4% | 10 Oct, 2025 | Go github.com/nwaples/rardecode Go github.com/nwaples/rardecode/v2 |
Casdoor is vulnerable to Improper Authorization CVE-2025-61524, GHSA-5m9m-j5p7-m7f9, GO-2025-4026 | High | 0.7% | 08 Oct, 2025 | Go github.com/casdoor/casdoor |
Canonical LXD CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI CVE-2025-54286, GHSA-p8hw-rfjg-689h, GO-2025-4003 | High | 0.1% | 02 Oct, 2025 | Go github.com/canonical/lxd |
Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns CVE-2025-54287, GHSA-w2hg-2v4p-vmh6, GO-2025-4004 | High | 0.4% | 02 Oct, 2025 | Go github.com/lxc/lxd Go github.com/lxc/lxd/v6 |
Canonical LXD Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server CVE-2025-54288, GHSA-7232-97c6-j525, GO-2025-4001 | Medium | 0.4% | 02 Oct, 2025 | Go github.com/canonical/lxd |
Canonical LXD Vulnerable to Privilege Escalation via WebSocket Connection Hijacking in Operations API CVE-2025-54289, GHSA-3g72-chj4-2228, GO-2025-3999 | High | 0.2% | 02 Oct, 2025 | Go github.com/canonical/lxd |
Canonical LXD Project Existence Determination Through Error Handling in Image Export Function CVE-2025-54290, GHSA-p3x5-mvmp-5f35, GO-2025-4002 | Medium | 0.3% | 02 Oct, 2025 | Go github.com/canonical/lxd |
Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function CVE-2025-54293, GHSA-472f-vmf2-pr3h, GO-2025-4000 | High | 0.6% | 02 Oct, 2025 | Go github.com/canonical/lxd |