Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion CVE-2025-58063, GHSA-93mf-426m-g6x9, GO-2025-3942 | High | 0.5% | 09 Sep, 2025 | Go github.com/coredns/coredns |
pREST has a Systemic SQL Injection Vulnerability CVE-2025-58450, GHSA-p46v-f2x8-qp98, GO-2025-3941 | Critical | 0.4% | 08 Sep, 2025 | Go github.com/prest/prest Go github.com/prest/prest/v2 |
Atlantis Exposes Service Version Publicly on /status API Endpoint CVE-2025-58445, GHSA-xh7v-965r-23f7, GO-2025-3940 | Low | 0.5% | 05 Sep, 2025 | Go github.com/runatlantis/atlantis |
secrets-store-sync-controller discloses service account tokens in logs CVE-2025-7445, GHSA-rcw7-pqfp-735x, GO-2025-3939 | Medium | 0.2% | 05 Sep, 2025 | Go sigs.k8s.io/secrets-store-sync-controller |
Coder vulnerable to privilege escalation could lead to a cross workspace compromise CVE-2025-58437, GHSA-j6xf-jwrj-v5qp, GO-2025-3938 | High | 0.4% | 05 Sep, 2025 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
podman kube play symlink traversal vulnerability CVE-2025-9566, GHSA-wp3j-xq48-xpjw, GO-2025-3935 | High | 1.2% | 04 Sep, 2025 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 +1 more |
Argo CD's Project API Token Exposes Repository Credentials BIT-argo-cd-2025-55190, CVE-2025-55190, GHSA-786q-9hcg-v9ff, GO-2025-3934 | Critical | 5.7% | 04 Sep, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 Go github.com/argoproj/argo-cd/v3 |
Memos Vulnerable to Path Traversal via the CreateResource Endpoint CVE-2025-56760, GHSA-78j5-8vq7-jxv5, GO-2025-3936 | Medium | 0.4% | 04 Sep, 2025 | Go github.com/usememos/memos |
Memos Vulnerable to Stored Cross-Site Scripting CVE-2025-56761, GHSA-cgrg-86m5-xm4w, GO-2025-3937 | Medium | 0.3% | 04 Sep, 2025 | Go github.com/usememos/memos |
Soft Serve vulnerable to arbitrary file writing through SSH API CVE-2025-58355, GHSA-33pr-m977-5w97, GO-2025-3930 | High | 0.3% | 02 Sep, 2025 | Go github.com/charmbracelet/soft-serve |
Rancher Fleet Helm Values are stored inside BundleDeployment in plain text CVE-2024-52284, GHSA-6h9x-9j5v-7w9h, GO-2025-3927 | High | 0.2% | 29 Aug, 2025 | Go github.com/rancher/fleet |
gnark affected by denial of service when computing scalar multiplication using fake-GLV algorithm CVE-2025-58157, GHSA-9fvj-xqr2-xwg8, GO-2025-3929 | High | 0.5% | 29 Aug, 2025 | Go github.com/consensys/gnark |
Harness Allows Arbitrary File Write in Gitness LFS server CVE-2025-58158, GHSA-w469-hj2f-jpr5, GO-2025-3926 | High | 0.5% | 29 Aug, 2025 | Go github.com/harness/gitness |
Versity panic induced by AWS chunked data sent to port GHSA-v2ch-c8v8-fgr7, GO-2025-3925 | High | Not scored | 29 Aug, 2025 | Go github.com/versity/versitygw |
github.com/gorilla/csrf improperly validates TrustedOrigins allowing CSRF attacks CVE-2025-47909, GHSA-82ff-hg59-8x73, GO-2025-3884 | Medium | 0.2% | 29 Aug, 2025 | Go github.com/gorilla/csrf |
Rancher affected by unauthenticated Denial of Service CVE-2024-58259, GHSA-4h45-jpvh-6p5j, GO-2025-3923 | High | 0.5% | 29 Aug, 2025 | Go github.com/rancher/rancher |
HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads BIT-vault-2025-6203, CVE-2025-6203, GHSA-8f82-53h8-2p34, GO-2025-3924 | High | 0.7% | 28 Aug, 2025 | Go github.com/hashicorp/vault |
github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives CVE-2025-58058, GHSA-jc7w-c686-c4v9, GO-2025-3922 | Medium | 0.4% | 28 Aug, 2025 | Go github.com/ulikunitz/xz |
Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token CVE-2025-71435, GHSA-3rw9-wmc8-8948, GO-2025-3921 | Low | 0.2% | 28 Aug, 2025 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Contrast leaks workload secrets to logs on INFO level CVE-2025-71423, GHSA-vxg3-w9rv-rhr2, GO-2025-3920 | High | 0.2% | 28 Aug, 2025 | Go github.com/edgelesssys/contrast |
NeuVector admin account has insecure default password CVE-2025-8077, GHSA-8pxw-9c75-6w56, GO-2025-3918 | Critical | 0.6% | 28 Aug, 2025 | Go github.com/neuvector/neuvector |
NeuVector process with sensitive arguments lead to leakage CVE-2025-54467, GHSA-w54x-xfxg-4gxq, GO-2025-3919 | Medium | 0.3% | 28 Aug, 2025 | Go github.com/neuvector/neuvector |
NeuVector has an insecure password storage and is vulnerable to rainbow attack CVE-2025-53884, GHSA-8ff6-pc43-jwv3, GO-2025-3917 | Medium | 0.2% | 28 Aug, 2025 | Go github.com/neuvector/neuvector |
simple-admin-core SQL Injection vulnerability CVE-2025-51667, GHSA-f2m2-4q6r-cwc4, GO-2025-3916 | High | 0.3% | 27 Aug, 2025 | Go github.com/suyuan32/simple-admin-core |
Kubernetes Nodes can delete themselves by adding an OwnerReference CVE-2025-5187, GHSA-4x4m-3c2p-qppc, GO-2025-3915 | Medium | 0.6% | 27 Aug, 2025 | Go k8s.io/kubernetes |
traQ Allows Insertion of Sensitive Information into Log File CVE-2025-57813, GHSA-27r7-3m9x-r533, GO-2025-3913 | Medium | 0.4% | 26 Aug, 2025 | Go github.com/traPtitech/traQ |
gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks CVE-2025-57801, GHSA-95v9-hv42-pwrj, GO-2025-3912 | High | 0.2% | 22 Aug, 2025 | Go github.com/consensys/gnark |
Dpanel has an arbitrary file read vulnerability CVE-2025-53363, GHSA-gcqf-pxgg-gw8q, GO-2025-3909 | Medium | 0.5% | 22 Aug, 2025 | Go github.com/donknap/dpanel |
Mattermost Fails to Sanitize File Names CVE-2025-6465, GHSA-pj6f-rc94-gw53, GO-2025-3910 | Medium | 0.8% | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost has Potential Server Crash due to Unvalidated Import Data CVE-2025-8402, GHSA-h469-4fcf-p23h, GO-2025-3911 | Medium | 0.3% | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data CVE-2025-11065, GHSA-2464-8j7c-4cjm, GO-2025-3900 | Medium | 0.4% | 21 Aug, 2025 | Go github.com/go-viper/mapstructure Go github.com/go-viper/mapstructure/v2 |
Mattermost Fails to Sanitize Path Traversal Sequences CVE-2025-8023, GHSA-x67c-v8jr-p29r, GO-2025-3907 | Medium | 0.4% | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Fails to Validate File Paths CVE-2025-36530, GHSA-gq3r-5833-5532, GO-2025-3901 | Medium | 0.5% | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Server SSRF Vulnerability via the Agents Plugin CVE-2025-47700, GHSA-vqwh-5jhh-vc9p, GO-2025-3906 | Low | 0.2% | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Does Not Sanitize the Team Invite ID CVE-2025-47870, GHSA-qj47-w9f2-qg44, GO-2025-3905 | Medium | 0.2% | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Fails to Validate Remote Cluster Upload Sessions CVE-2025-49222, GHSA-q453-638c-h4mr, GO-2025-3904 | Medium | 0.3% | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Lack of Access Control Validation CVE-2025-49810, GHSA-pwvr-grqg-7vp2, GO-2025-3903 | Low | 0.2% | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Fails to Properly Validate Team Role Modification CVE-2025-53971, GHSA-4276-cm8c-788h, GO-2025-3902 | Low | 0.2% | 21 Aug, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
CRI-O has Potential High Memory Consumption from File Read CVE-2025-4437, GHSA-8f93-j3fx-72f3, GO-2025-3897 | Medium | 0.2% | 20 Aug, 2025 | Go github.com/cri-o/cri-o |
Default Credentials in nginx-defender Configuration Files CVE-2025-55740, GHSA-pr72-8fxw-xx22, GO-2025-3896 | Medium | 0.2% | 19 Aug, 2025 | Go github.com/Anipaleja/nginx-defender |
HydrAIDE Authentication Bypass Vulnerability GHSA-qp7j-x725-g67f, GO-2025-3895 | Critical | Not scored | 19 Aug, 2025 | Go github.com/hydraide/hydraide |
OpenFGA Authorization Bypass CVE-2025-55213, GHSA-mgh9-4mwp-fg55, GO-2025-3894 | Medium | 0.3% | 18 Aug, 2025 | Go github.com/openfga/openfga |
Capsule tenant owners with "patch namespace" permission can hijack system namespaces label CVE-2025-55205, GHSA-fcpm-6mxq-m5vv, GO-2025-3893 | Critical | 0.5% | 18 Aug, 2025 | Go github.com/projectcapsule/capsule |
HashiCorp go-getter Vulnerable to Symlink Attacks CVE-2025-8959, GHSA-wjrx-6529-hcj3, GO-2025-3892 | High | 0.6% | 15 Aug, 2025 | Go github.com/hashicorp/go-getter |
Information Disclosure in Amazon ECS Container Agent CVE-2025-9039, GHSA-wm7x-ww72-r77q, GO-2025-3891 | Medium | 0.3% | 14 Aug, 2025 | Go github.com/aws/amazon-ecs-agent |
Helm May Panic Due To Incorrect YAML Content BIT-helm-2025-55198, CVE-2025-55198, GHSA-f9f8-9pmf-xv68, GO-2025-3888 | Medium | 0.4% | 14 Aug, 2025 | Go helm.sh/helm Go helm.sh/helm/v3 |
Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion BIT-helm-2025-55199, CVE-2025-55199, GHSA-9h84-qmv7-982p, GO-2025-3887 | Medium | 0.4% | 14 Aug, 2025 | Go helm.sh/helm Go helm.sh/helm/v3 |
External Secrets Operator's Missing Namespace Restriction Allows Unauthorized Secret Access CVE-2025-55196, GHSA-fcxq-v2r3-cc8h, GO-2025-3885 | High | 0.4% | 13 Aug, 2025 | Go github.com/external-secrets/external-secrets |
OliveTin OS Command Injection vulnerability CVE-2025-50946, GHSA-p3qf-84rg-jxfc, GO-2025-3886 | High | 1.3% | 13 Aug, 2025 | Go github.com/OliveTin/OliveTin |
Komari vulnerable to 2FA Authentication Bypass GHSA-jhmr-57cj-q6g9, GO-2025-3873 | High | Not scored | 12 Aug, 2025 | Go github.com/komari-monitor/komari |