Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Canonical LXD Project Existence Determination Through Error Handling in Image Get Function CVE-2025-54291, GHSA-xch9-h8qw-85c7, GO-2025-4005 | Medium | 0.4% | 02 Oct, 2025 | Go github.com/canonical/lxd |
github.com/MANTRA-Chain/mantrachain/x/tokenfactory tx gas limit is not enforced in send hooks CVE-2025-61595, GHSA-qwvm-wqq8-8j69, GO-2025-3997 | High | 0.3% | 30 Sep, 2025 | Go github.com/MANTRA-Chain/mantrachain Go github.com/MANTRA-Chain/mantrachain/v2 Go github.com/MANTRA-Chain/mantrachain/v3 Go github.com/MANTRA-Chain/mantrachain/v4 |
Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook BIT-argo-cd-2025-59538, CVE-2025-59538, GHSA-gpx4-37g2-c8pv, GO-2025-3995 | High | 9.4% | 30 Sep, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 Go github.com/argoproj/argo-cd/v3 |
argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload BIT-argo-cd-2025-59537, CVE-2025-59537, GHSA-wp4p-9pxh-cgx2, GO-2025-3996 | High | 0.6% | 30 Sep, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 Go github.com/argoproj/argo-cd/v3 |
Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload BIT-argo-cd-2025-59531, CVE-2025-59531, GHSA-f9gq-prrc-hrhc, GO-2025-3993 | High | 0.6% | 30 Sep, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 Go github.com/argoproj/argo-cd/v3 |
Repository Credentials Race Condition Crashes Argo CD Server BIT-argo-cd-2025-55191, CVE-2025-55191, GHSA-g88p-r42r-ppp9, GO-2025-3994 | Medium | 0.5% | 30 Sep, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 Go github.com/argoproj/argo-cd/v3 |
Coder AgentAPI exposed user chat history via a DNS rebinding attack CVE-2025-59956, GHSA-w64r-2g3w-w8w4, GO-2025-3991 | Medium | 0.4% | 29 Sep, 2025 | Go github.com/coder/agentapi |
go-f3 module vulnerable to integer overflow leading to panic CVE-2025-59942, GHSA-g99p-47x7-mq88, GO-2025-3990 | High | 0.3% | 29 Sep, 2025 | Go github.com/filecoin-project/go-f3 |
go-f3 Vulnerable to Cached Justification Verification Bypass CVE-2025-59941, GHSA-7pq9-rf9p-wcrf, GO-2025-3989 | Medium | 0.2% | 29 Sep, 2025 | Go github.com/filecoin-project/go-f3 |
go-mail has insufficient address encoding when passing mail addresses to the SMTP client CVE-2025-59937, GHSA-wpwj-69cm-q9c5, GO-2025-3988 | High | 0.5% | 29 Sep, 2025 | Go github.com/wneessen/go-mail |
vet MCP Server SSE Transport DNS Rebinding Vulnerability CVE-2025-59163, GHSA-6q9c-m9fr-865m, GO-2025-3986 | Low | 0.4% | 29 Sep, 2025 | Go github.com/safedep/vet |
github.com/nyaruka/phonenumbers Vulnerable to Improper Validation of Syntactic Correctness of Input CVE-2025-10954, GHSA-fmjh-f678-cv3x, GO-2025-3987 | Medium | 0.5% | 27 Sep, 2025 | Go github.com/nyaruka/phonenumbers |
kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace GHSA-q6hv-wcjr-wp8h, GO-2025-3985 | Low | Not scored | 26 Sep, 2025 | Go github.com/kcp-dev/kcp |
Rancher update on users can deny the service to the admin CVE-2024-58260, GHSA-q82v-h4rq-5c86, GO-2025-3983 | High | 0.5% | 26 Sep, 2025 | Go github.com/rancher/rancher |
Rancher CLI SAML authentication is vulnerable to phishing attacks CVE-2024-58267, GHSA-v3vj-5868-2ch2, GO-2025-3984 | High | 0.2% | 26 Sep, 2025 | Go github.com/rancher/rancher |
Rancher sends sensitive information to external services through the `/meta/proxy` endpoint CVE-2025-54468, GHSA-mjcp-rj3c-36fr, GO-2025-3982 | Medium | 0.4% | 26 Sep, 2025 | Go github.com/rancher/rancher |
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning CVE-2025-59823, GHSA-227x-7mh8-3cf6, GO-2025-3981 | Critical | 0.5% | 25 Sep, 2025 | Go github.com/gardener/gardener-extension-provider-aws Go github.com/gardener/gardener-extension-provider-azure Go github.com/gardener/gardener-extension-provider-gcp Go github.com/gardener/gardener-extension-provider-openstack |
Omni Wireguard SideroLink potential escape CVE-2025-59824, GHSA-hqrf-67pm-wgfq, GO-2025-3979 | Low | 0.2% | 24 Sep, 2025 | Go github.com/siderolabs/omni |
CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http BIT-golang-2025-47910, CVE-2025-47910, GO-2025-3955 | 0.3% | 22 Sep, 2025 | Go stdlib | |
Mattermost Path Traversal vulnerability CVE-2025-9079, GHSA-qx3f-6vq3-8j8m, GO-2025-3977 | High | 0.6% | 19 Sep, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost boards plugin fails to restrict download access to files CVE-2025-9081, GHSA-f72g-52v7-mg3p, GO-2025-3978 | Low | 0.3% | 19 Sep, 2025 | Go github.com/mattermost/mattermost-plugin-boards Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Grafana-Zabbix ReDoS vulnerability CVE-2025-10630, GHSA-g4rr-88fc-26fj, GO-2025-3976 | Medium | 0.4% | 19 Sep, 2025 | Go github.com/alexanderzobnin/grafana-zabbix |
Unexpected paths returned from LookPath in os/exec BIT-golang-2025-47906, CVE-2025-47906, GO-2025-3956 | 0.5% | 18 Sep, 2025 | Go stdlib | |
DragonFly's tiny file download uses hard coded HTTP protocol CVE-2025-59410, GHSA-mcvp-rpgg-9273, GO-2025-3974 | Medium | 0.1% | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
DragonFly has weak integrity checks for downloaded files CVE-2025-59354, GHSA-hx2h-vjw2-8r54, GO-2025-3973 | Medium | 0.2% | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
DragonFly's manager generates mTLS certificates for arbitrary IP addresses CVE-2025-59353, GHSA-255v-qv84-29p5, GO-2025-3969 | High | 0.2% | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
DragonFly vulnerable to arbitrary file read and write on a peer machine CVE-2025-59352, GHSA-79hx-3fp8-hj66, GO-2025-3971 | Medium | 0.7% | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error CVE-2025-59351, GHSA-4mhv-8rh3-4ghw, GO-2025-3970 | Medium | 0.3% | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
Dragonfly vulnerable to timing attacks against Proxy’s basic authentication CVE-2025-59350, GHSA-c2fc-9q9c-5486, GO-2025-3972 | Medium | 0.3% | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
Dragonfly's directories created via os.MkdirAll are not checked for permissions CVE-2025-59349, GHSA-8425-8r2f-mrv6, GO-2025-3964 | Low | 0.1% | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
Dragonfly incorrectly handles a task structure’s usedTrac field CVE-2025-59348, GHSA-2qgr-gfvj-qpcr, GO-2025-3963 | Medium | 0.4% | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
Dragonfly's manager makes requests to external endpoints with disabled TLS authentication CVE-2025-59347, GHSA-98x5-jw98-6c97, GO-2025-3966 | Medium | 0.2% | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
Dragonfly vulnerable to server-side request forgery CVE-2025-59346, GHSA-g2rq-jv54-wcpr, GO-2025-3968 | High | 0.2% | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
Dragonfly doesn't have authentication enabled for some Manager’s endpoints CVE-2025-59345, GHSA-89vc-vf32-ch59, GO-2025-3965 | High | 0.4% | 17 Sep, 2025 | Go d7y.io/dragonfly/v2 Go github.com/dragonflyoss/dragonfly |
esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header CVE-2025-59342, GHSA-g2h5-cvvr-7gmw, GO-2025-3967 | Medium | 3.2% | 17 Sep, 2025 | Go github.com/esm-dev/esm.sh |
esm.sh has File Inclusion issue CVE-2025-59341, GHSA-49pv-gwxp-532r, GO-2025-3962 | High | 1.6% | 17 Sep, 2025 | Go github.com/esm-dev/esm.sh |
Podman Creates Temporary File with Insecure Permissions CVE-2025-4953, GHSA-m68q-4hqr-mc6f, GO-2025-3961 | High | 0.6% | 16 Sep, 2025 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 +1 more |
Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults BIT-envoy-2025-54588, CVE-2025-54588, GHSA-g9vw-6pvx-7gmw | High | 0.5% | 15 Sep, 2025 | Go github.com/envoyproxy/envoy |
Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling CVE-2025-8396, GHSA-p768-c3pr-6459, GO-2025-3953 | Medium | 0.4% | 15 Sep, 2025 | Go go.temporal.io/server |
Chaos Mesh's Chaos Controller Manager is Missing Authentication for Critical Function CVE-2025-59358, GHSA-2gg8-85m5-8r2p, GO-2025-3951 | High | 0.8% | 15 Sep, 2025 | Go github.com/chaos-mesh/chaos-mesh |
Chaos Controller Manager is vulnerable to OS command injection CVE-2025-59359, GHSA-369h-6j28-wwcg, GO-2025-3952 | Critical | 3.0% | 15 Sep, 2025 | Go github.com/chaos-mesh/chaos-mesh |
Chaos Controller Manager is vulnerable to OS command injection CVE-2025-59360, GHSA-xv9f-728h-9jgv, GO-2025-3954 | Critical | 2.9% | 15 Sep, 2025 | Go github.com/chaos-mesh/chaos-mesh |
Chaos Controller Manager is vulnerable to OS command injection CVE-2025-59361, GHSA-2gcv-3qpf-c5qr, GO-2025-3949 | Critical | 3.4% | 15 Sep, 2025 | Go github.com/chaos-mesh/chaos-mesh |
Mattermost Open Redirect vulnerability CVE-2025-9072, GHSA-69j8-prx2-vx98, GO-2025-3958 | High | 0.2% | 15 Sep, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost makes Use of Weak Hash CVE-2025-9078, GHSA-9p92-x77w-9fw2, GO-2025-3959 | Medium | 0.2% | 15 Sep, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Open Redirect vulnerability CVE-2025-9084, GHSA-hm95-jx66-g2gh, GO-2025-3960 | Low | 0.2% | 15 Sep, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Missing Authorization vulnerability CVE-2025-9076, GHSA-3vcm-c42p-3hhf, GO-2025-3950 | Medium | 0.3% | 15 Sep, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled CVE-2025-54376, GHSA-jxmr-2h4q-rhxp, GO-2025-3945 | High | 0.7% | 10 Sep, 2025 | Go github.com/SpectoLabs/hoverfly |
Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation CVE-2025-54123, GHSA-r4h8-hfp2-ggmf, GO-2025-3944 | Critical | 10.9% | 10 Sep, 2025 | Go github.com/SpectoLabs/hoverfly |
listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover CVE-2025-58430, GHSA-rf24-wg77-gq7w, GO-2025-3943 | High | 0.1% | 09 Sep, 2025 | Go github.com/knadh/listmonk |