Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Komari vulnerable to Cross-site WebSocket Hijacking CVE-2025-55300, GHSA-q355-h244-969h, GO-2025-3874 | High | 0.6% | 12 Aug, 2025 | Go github.com/komari-monitor/komari |
Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions CVE-2025-52931, GHSA-vc77-c2hx-h5x2, GO-2025-3870 | High | 0.4% | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions CVE-2025-53514, GHSA-w92j-c6gr-hj8r, GO-2025-3871 | Medium | 0.3% | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Missing Authorization vulnerability CVE-2025-53857, GHSA-42m6-5vm7-fjv2, GO-2025-3864 | Low | 0.2% | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Missing Authorization vulnerability CVE-2025-53910, GHSA-v6c8-g53h-mc2h, GO-2025-3869 | Medium | 0.2% | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Missing Authorization vulnerability CVE-2025-54458, GHSA-j66h-xhpr-7q5g, GO-2025-3867 | Medium | 0.2% | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Improper Check for Unusual or Exceptional Conditions CVE-2025-54463, GHSA-gjpm-6w34-ppvf, GO-2025-3866 | Medium | 0.3% | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin is Missing Authentication for Critical Function CVE-2025-54478, GHSA-qpjq-c5hr-7925, GO-2025-3875 | Medium | 0.3% | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Improper Validation of Specified Type of Input CVE-2025-54525, GHSA-3cg3-3mmr-w8hj, GO-2025-3872 | High | 0.4% | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Missing Authorization vulnerability CVE-2025-8285, GHSA-qjrx-j8wm-xf83, GO-2025-3868 | Medium | 0.2% | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin is Missing Authentication for Critical Function CVE-2025-44004, GHSA-6ff3-jgxh-vffj, GO-2025-3865 | High | 0.2% | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Missing Authorization vulnerability CVE-2025-48731, GHSA-cmpr-8prq-w5p5, GO-2025-3861 | Medium | 0.2% | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Missing Authorization vulnerability CVE-2025-49221, GHSA-rfg4-2m63-fw2q, GO-2025-3862 | Low | 0.3% | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
Mattermost Confluence Plugin has Missing Authorization vulnerability CVE-2025-44001, GHSA-vpcr-fqpc-386h, GO-2025-3863 | Medium | 0.2% | 11 Aug, 2025 | Go github.com/mattermost/mattermost-plugin-confluence |
OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias BIT-openbao-2025-55001, CVE-2025-55001, GHSA-2q8q-8fgw-9p6p, GO-2025-3859 | Medium | 0.2% | 08 Aug, 2025 | Go github.com/openbao/openbao |
OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse BIT-openbao-2025-55003, CVE-2025-55003, GHSA-rxp7-9q75-vj3p, GO-2025-3856 | Medium | 0.3% | 08 Aug, 2025 | Go github.com/openbao/openbao |
OpenBao TOTP Secrets Engine Code Reuse BIT-openbao-2025-55000, CVE-2025-55000, GHSA-f7c3-mhj2-9pvg, GO-2025-3853 | Medium | 0.2% | 08 Aug, 2025 | Go github.com/openbao/openbao |
OpenBao has a Timing Side-Channel in the Userpass Auth Method BIT-openbao-2025-54999, CVE-2025-54999, GHSA-hh28-h22f-8357, GO-2025-3854 | Low | 0.2% | 08 Aug, 2025 | Go github.com/openbao/openbao |
OpenBao Userpass and LDAP User Lockout Bypass BIT-openbao-2025-54998, CVE-2025-54998, GHSA-j3xv-7fxp-gfhx, GO-2025-3855 | Medium | 0.2% | 08 Aug, 2025 | Go github.com/openbao/openbao |
Privileged OpenBao Operator May Execute Code on the Underlying Host BIT-openbao-2025-54997, CVE-2025-54997, GHSA-xp75-r577-cvhp, GO-2025-3858 | Critical | 0.4% | 08 Aug, 2025 | Go github.com/openbao/openbao |
OpenBao Root Namespace Operator May Elevate Token Privileges BIT-openbao-2025-54996, CVE-2025-54996, GHSA-vf84-mxrq-crqc, GO-2025-3857 | High | 0.4% | 08 Aug, 2025 | Go github.com/openbao/openbao |
operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd CVE-2025-7195, GHSA-856v-8qm2-9wjv, GO-2025-3852 | Medium | 0.2% | 07 Aug, 2025 | Go github.com/operator-framework/operator-sdk |
Ollama allows deletion of arbitrary files CVE-2025-44779, GHSA-93jv-pvg8-hf3v, GO-2025-3851, PYSEC-2025-146 | Medium | 0.2% | 07 Aug, 2025 | Go github.com/ollama/ollama PyPI ollama |
Incorrect results returned from Rows.Scan in database/sql BIT-golang-2025-47907, CVE-2025-47907, GO-2025-3849 | 0.4% | 07 Aug, 2025 | Go stdlib | |
github.com/go-acme/lego/v4/acme/api does not enforce HTTPS CVE-2025-54799, GHSA-q82r-2j7m-9rv4, GO-2025-3847 | Low | 0.2% | 06 Aug, 2025 | Go github.com/go-acme/lego Go github.com/go-acme/lego/v3 Go github.com/go-acme/lego/v4 |
HashiCorp Vault ldap auth method may not have correctly enforced MFA BIT-vault-2025-6013, CVE-2025-6013, GHSA-7rx2-769v-hrwf, GO-2025-3848 | Medium | 0.5% | 06 Aug, 2025 | Go github.com/hashicorp/vault |
Fiber Crashes in BodyParser Due to Unvalidated Large Slice Index in Decoder CVE-2025-54801, GHSA-qx2q-88mx-vhg7, GO-2025-3845 | High | 0.4% | 05 Aug, 2025 | Go github.com/gofiber/fiber/v2 |
RatPanel can perform remote command execution without authorization CVE-2025-53534, GHSA-fm3m-jrgm-5ppg, GO-2025-3844 | High | 0.7% | 04 Aug, 2025 | Go github.com/TheTNB/panel Go github.com/TheTNB/panel/v2 Go github.com/tnb-labs/panel Go github.com/tnborg/panel |
Grafana Infinity Datasource Plugin SSRF Vulnerability CVE-2025-8341, GHSA-3c93-92r7-j934, GO-2025-3843 | Medium | 0.3% | 04 Aug, 2025 | Go github.com/grafana/grafana-infinity-datasource |
Hashicorp Vault has Privilege Escalation Vulnerability BIT-vault-2025-5999, CVE-2025-5999, GHSA-6h4p-m86h-hhgh, GO-2025-3837 | High | 0.5% | 01 Aug, 2025 | Go github.com/hashicorp/vault |
Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration BIT-vault-2025-6000, CVE-2025-6000, GHSA-mr4h-qf9j-f665, GO-2025-3838 | Critical | 1.0% | 01 Aug, 2025 | Go github.com/hashicorp/vault |
Hashicorp Vault has Lockout Feature Authentication Bypass BIT-vault-2025-6004, CVE-2025-6004, GHSA-qgj7-fmq2-6cc4, GO-2025-3840 | Medium | 0.5% | 01 Aug, 2025 | Go github.com/hashicorp/vault |
Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users BIT-vault-2025-6011, CVE-2025-6011, GHSA-mwgr-84fv-3jh9, GO-2025-3839 | Low | 0.4% | 01 Aug, 2025 | Go github.com/hashicorp/vault |
Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse BIT-vault-2025-6014, CVE-2025-6014, GHSA-qv3p-fmv3-9hww, GO-2025-3841 | Medium | 0.4% | 01 Aug, 2025 | Go github.com/hashicorp/vault |
Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability BIT-vault-2025-6015, CVE-2025-6015, GHSA-v6r4-35f9-9rpw, GO-2025-3842 | Medium | 0.4% | 01 Aug, 2025 | Go github.com/hashicorp/vault |
Hashicorp Vault has Incorrect Validation for Non-CA Certificates BIT-vault-2025-6037, CVE-2025-6037, GHSA-6c5r-4wfc-3mcx, GO-2025-3836 | Medium | 0.3% | 01 Aug, 2025 | Go github.com/hashicorp/vault |
1Panel agent certificate verification bypass leading to arbitrary command execution CVE-2025-54424, GHSA-8j63-96wh-wh3j, GO-2025-3834 | High | 1.1% | 01 Aug, 2025 | Go github.com/1Panel-dev/1Panel/core |
Traefik Client Plugin's Path Traversal Vulnerability Allows Arbitrary File Overwrite and Remote Code Execution CVE-2025-54386, GHSA-q6gg-9f92-r9wg, GO-2025-3835 | High | 1.4% | 01 Aug, 2025 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion BIT-oauth2-proxy-2025-54576, CVE-2025-54576, GHSA-7rh7-c77v-6434, GO-2025-3833 | Critical | 1.2% | 30 Jul, 2025 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
OAuth2-Proxy's `--gitlab-group` GitLab Group Authorization config flag stopped working in v7.0.0 BIT-oauth2-proxy-2021-21411, CVE-2021-21411, GHSA-652x-m2gr-hppm, GO-2025-3832 | Medium | 1.1% | 30 Jul, 2025 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
Unexpected command execution in untrusted VCS repositories in cmd/go BIT-golang-2025-4674, CVE-2025-4674, GO-2025-3828 | 0.5% | 29 Jul, 2025 | Go toolchain | |
Couchbase Sync Gateway shows cleartext passwords in redacted and unredacted output CVE-2025-52490, GHSA-pqhp-4xfc-hjgq, GO-2026-5550, PYSEC-2025-101 | High | 0.2% | 29 Jul, 2025 | Go github.com/couchbase/sync_gateway PyPI couchbase |
Moby firewalld reload removes bridge network isolation CVE-2025-54410, GHSA-4vq8-7jfc-9cvp, GO-2025-3829 | Low | 0.2% | 29 Jul, 2025 | Go github.com/docker/docker |
Moby firewalld reload makes published container ports accessible from remote hosts CVE-2025-54388, GHSA-x4rx-4gw3-53p4, GO-2025-3830 | Medium | 0.3% | 29 Jul, 2025 | Go github.com/docker/docker |
Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs CVE-2025-50738, GHSA-hfcf-79gh-f3jc, GO-2025-3831 | Medium | 2.4% | 29 Jul, 2025 | Go github.com/usememos/memos |
eKuiper API endpoints handling SQL queries with user-controlled table names. CVE-2025-54379, GHSA-526j-mv3p-f4vv, GO-2025-3827, PYSEC-2025-241 | High | 0.9% | 24 Jul, 2025 | Go github.com/lf-edge/ekuiper Go github.com/lf-edge/ekuiper/v2 PyPI ekuiper |
Possible ORM Leak Vulnerability in the Harbor CVE-2025-30086, GHSA-h27m-3qw8-3pw8, GO-2025-3826 | Medium | 0.7% | 23 Jul, 2025 | Go github.com/goharbor/harbor |
Harbor repository description page has Cross-site Scripting vulnerability BIT-harbor-2025-32019, CVE-2025-32019, GHSA-f9vc-vf3r-pqqq, GO-2025-3825 | Medium | 0.4% | 23 Jul, 2025 | Go github.com/goharbor/harbor |
Ollama vulnerable to Cross-Domain Token Exposure CVE-2025-51471, GHSA-x9hg-5q6g-q3jr, GO-2025-3824, PYSEC-2025-147 | Medium | 18.5% | 22 Jul, 2025 | Go github.com/ollama/ollama PyPI ollama |
Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources BIT-authentik-2025-53942, CVE-2025-53942, GHSA-9g4j-v8w5-7x42, GO-2025-3822 | High | 0.6% | 22 Jul, 2025 | Go goauthentik.io |