Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service BIT-kyverno-2025-47281, CVE-2025-47281, GHSA-r5p3-955p-5ggq, GO-2025-3823 | High | 0.6% | 22 Jul, 2025 | Go github.com/kyverno/kyverno |
melange's world-writable permissions expose SBOM files to potential image tampering CVE-2025-54059, GHSA-5662-cv6m-63wh, GO-2025-3815 | Medium | 0.2% | 18 Jul, 2025 | Go chainguard.dev/melange |
apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files CVE-2025-53945, GHSA-x6ph-r535-3vjw, GO-2025-3816 | High | 0.1% | 18 Jul, 2025 | Go chainguard.dev/apko |
Mattermost has Insufficiently Protected Credentials CVE-2025-6227, GHSA-4fwj-8595-wp25, GO-2025-3818 | Low | 0.2% | 18 Jul, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Path Traversal vulnerability CVE-2025-6233, GHSA-wvw2-3jh4-4c39, GO-2025-3820 | Medium | 0.4% | 18 Jul, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Missing Authentication for Critical Function CVE-2025-6226, GHSA-7h34-9chr-58qh, GO-2025-3819 | Medium | 0.4% | 18 Jul, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Grafana is vulnerable to XSS attacks through open redirects and path traversal BIT-grafana-2025-6023, CVE-2025-6023, GHSA-vqph-p5vc-g644, GO-2025-3817 | High | 57.7% | 18 Jul, 2025 | Go github.com/grafana/grafana |
NVIDIA Container Toolkit for all platforms contains an Untrusted Search Path CVE-2025-23266, GHSA-vmg3-7v43-9g23, GO-2025-3992 | Critical | 3.3% | 17 Jul, 2025 | Go github.com/NVIDIA/gpu-operator Go github.com/NVIDIA/k8s-device-plugin Go github.com/NVIDIA/mig-parted Go github.com/NVIDIA/nvidia-container-toolkit |
NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook CVE-2025-23267, GHSA-67jc-hmvg-q4c7, GO-2025-3998 | High | 0.9% | 17 Jul, 2025 | Go github.com/NVIDIA/gpu-operator Go github.com/NVIDIA/k8s-device-plugin Go github.com/NVIDIA/mig-parted Go github.com/NVIDIA/nvidia-container-toolkit |
Grafana's insecure DingDing Alert integration exposes sensitive information BIT-grafana-2025-3415, CVE-2025-3415, GHSA-46m5-8hpj-p5p5, GO-2025-3814 | Medium | 1.1% | 17 Jul, 2025 | Go github.com/grafana/grafana |
File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing CVE-2025-53893, GHSA-7xqm-7738-642x, GO-2025-3811 | High | 0.4% | 16 Jul, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser’s insecure JWT handling can lead to session replay attacks after logout CVE-2025-53826, GHSA-7xwp-2cpp-p8r7, GO-2025-3812 | High | 0.6% | 16 Jul, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
ZPan Uses Hard-Coded Password CVE-2025-7453, GHSA-2hfh-94w5-wxvf, GO-2026-6014 | Low | 0.4% | 11 Jul, 2025 | Go github.com/saltbo/zpan |
Chall-Manager's HTTP Gateway is vulnerable to DoS due to missing header timeout CVE-2025-53634, GHSA-ggmv-j932-q89q, GO-2025-3809 | High | 0.5% | 10 Jul, 2025 | Go github.com/ctfer-io/chall-manager |
Chall-Manager's scenario decoding process does not check for zip bombs CVE-2025-53633, GHSA-r7fm-3pqm-ww5w, GO-2025-3810 | High | 0.5% | 10 Jul, 2025 | Go github.com/ctfer-io/chall-manager |
Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive CVE-2025-53632, GHSA-3gv2-v3jx-r9fh, GO-2025-3808 | High | 0.8% | 10 Jul, 2025 | Go github.com/ctfer-io/chall-manager |
Contrast vulnerability allows arbitrary host data Injection into container VOLUME mount points CVE-2025-71424, GHSA-phhq-63jg-fp7r, GO-2025-3807 | Low | 0.2% | 09 Jul, 2025 | Go github.com/edgelesssys/contrast |
Juju allows arbitrary executable uploads via authenticated endpoint without authorization CVE-2025-0928, GHSA-4vc8-wvhw-m5gv, GO-2025-3805 | High | 0.7% | 09 Jul, 2025 | Go github.com/juju/juju |
Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization CVE-2025-53512, GHSA-r64v-82fh-xc63, GO-2025-3806 | Medium | 0.4% | 09 Jul, 2025 | Go github.com/juju/juju |
Juju zip slip vulnerability via authenticated endpoint CVE-2025-53513, GHSA-24ch-w38v-xmh8, GO-2025-3804 | High | 0.8% | 09 Jul, 2025 | Go github.com/juju/juju |
Cosmos SDK's Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt GHSA-p22h-3m2v-cmgh, GO-2025-3803 | High | Not scored | 08 Jul, 2025 | Go github.com/cosmos/cosmos-sdk |
Helm vulnerable to Code Injection through malicious chart.yaml content BIT-helm-2025-53547, CVE-2025-53547, GHSA-557j-xg8c-q2mm, GO-2025-3802 | High | 0.5% | 08 Jul, 2025 | Go helm.sh/helm/v3 |
Babylon vulnerable to chain halt when a message modifies the validator set at the epoch boundary GHSA-rj53-j6jw-7f7g, GO-2025-3801 | High | Not scored | 08 Jul, 2025 | Go github.com/babylonlabs-io/babylon Go github.com/babylonlabs-io/babylon/v2 |
eKuiper /config/uploads API arbitrary file writing may lead to RCE GHSA-gj54-gwj9-x2c6, GO-2025-3800 | High | Not scored | 03 Jul, 2025 | Go github.com/lf-edge/ekuiper Go github.com/lf-edge/ekuiper/v2 |
LF Edge eKuiper vulnerable to File Path Traversal leading to file replacement GHSA-fv2p-qj5p-wqq4, GO-2025-3799 | High | Not scored | 03 Jul, 2025 | Go github.com/lf-edge/ekuiper Go github.com/lf-edge/ekuiper/v2 |
juju/utils leaks private key in certs CVE-2025-6224, GHSA-h34r-jxqm-qgpr, GO-2025-3798 | Medium | 0.2% | 01 Jul, 2025 | Go github.com/juju/utils Go github.com/juju/utils/v2 Go github.com/juju/utils/v3 Go github.com/juju/utils/v4 +1 more |
Mattermost Incorrect Authorization vulnerability CVE-2025-46702, GHSA-v8fr-vxmw-6mf6, GO-2025-3796 | Medium | 0.2% | 30 Jun, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Incorrect Authorization vulnerability CVE-2025-47871, GHSA-wgvp-jj4w-88hf, GO-2025-3797 | Medium | 0.2% | 30 Jun, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Babylon vulnerable to chain half when transaction has fees different than `ubbn` GHSA-56j4-446m-qrf6, GO-2025-3791 | High | Not scored | 30 Jun, 2025 | Go github.com/babylonlabs-io/babylon Go github.com/babylonlabs-io/babylon/v2 |
File Browser vulnerable to insecure password handling CVE-2025-52997, GHSA-cm2r-rg7r-p7gg, GO-2025-3792 | Medium | 0.5% | 30 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser's password protection of links is bypassable CVE-2025-52996, GHSA-3v48-283x-f2w4, GO-2025-3790 | Low | 0.4% | 30 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser vulnerable to command execution allowlist bypass CVE-2025-52995, GHSA-w7qc-6grj-w7r8, GO-2025-3795 | High | 0.6% | 30 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser: Command Execution not Limited to Scope CVE-2025-52904, GHSA-hc8f-m8g5-8362, GO-2025-3793 | High | 1.1% | 30 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
File Browser allows sensitive data to be transferred in URL CVE-2025-52901, GHSA-rmwh-g367-mj4x, GO-2025-3794 | Medium | 0.5% | 30 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data GHSA-fv92-fjc5-jj9h, GO-2025-3787 | Medium | Not scored | 27 Jun, 2025 | Go github.com/go-viper/mapstructure Go github.com/go-viper/mapstructure/v2 |
filebrowser Allows Shell Commands to Spawn Other Commands CVE-2025-52903, GHSA-3q2w-42mv-cph4, GO-2025-3786 | High | 1.2% | 27 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
filebrowser allows Stored Cross-Site Scripting through the Markdown preview function CVE-2025-52902, GHSA-4wx8-5gm2-2j97, GO-2025-3784 | High | 0.3% | 27 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
filebrowser Sets Insecure File Permissions CVE-2025-52900, GHSA-jj2r-455p-5gvf, GO-2025-3785 | Medium | 0.2% | 27 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Vault Community Edition rekey and recovery key operations can cause denial of service BIT-vault-2025-4656, CVE-2025-4656, GHSA-fhc2-8qx8-6vj7, GO-2025-3788 | Low | 0.3% | 26 Jun, 2025 | Go github.com/hashicorp/vault |
OpenBao allows cancellation of root rekey and recovery rekey operations without authentication BIT-openbao-2025-52894, CVE-2025-52894, GHSA-prpj-rchp-9j5h, GO-2025-3783 | Medium | 0.4% | 26 Jun, 2025 | Go github.com/openbao/openbao |
OpenBao Inserts Sensitive Information into Log File when processing malformed data BIT-openbao-2025-52893, CVE-2025-52893, GHSA-8f5r-8cmq-7fmq, GO-2025-3780 | Medium | 0.3% | 26 Jun, 2025 | Go github.com/openbao/openbao/sdk Go github.com/openbao/openbao/sdk/v2 |
Incus creates nftables rules that partially bypass security options CVE-2025-52890, GHSA-p7fw-vjjm-2rwp, GO-2025-3782 | High | 0.2% | 26 Jun, 2025 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |
Incus Allocation of Resources Without Limits allows firewall rule bypass on managed bridge networks CVE-2025-52889, GHSA-9q7c-qmhm-jv86, GO-2025-3781 | Low | 0.3% | 26 Jun, 2025 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |
Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens CVE-2025-52477, GHSA-h3qp-hwvr-9xcq, GO-2025-3779 | High | 0.5% | 26 Jun, 2025 | Go github.com/octo-sts/app |
Gogs XSS allowed by stored call in PDF renderer CVE-2025-47943, GHSA-xh32-cx6c-cp4v, GO-2025-3778 | Medium | 0.4% | 26 Jun, 2025 | Go github.com/gogs/gogs Go gogs.io/gogs |
Snyk CLI Insertion of Sensitive Information into Log File allowed in DEBUG or DEBUG/TRACE mode CVE-2025-6624, GHSA-6hwc-9h8r-3vmf, GO-2025-3789 | Low | 0.2% | 26 Jun, 2025 | Go github.com/snyk/go-application-framework npm snyk |
Podman Improper Certificate Validation; machine missing TLS verification CVE-2025-6032, GHSA-65gg-3w2w-hr4h, GO-2025-3777 | High | 0.5% | 25 Jun, 2025 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 +1 more |
Gogs allows deletion of internal files which leads to remote command execution CVE-2024-56731, GHSA-wj44-9vcg-wjq7, GO-2025-3776 | Critical | 1.1% | 24 Jun, 2025 | Go gogs.io/gogs |
kubernetes allows nodes to bypass dynamic resource allocation authorization checks CVE-2025-4563, GHSA-hj2p-8wj8-pfq4, GO-2025-3774 | Low | 0.8% | 23 Jun, 2025 | Go k8s.io/kubernetes |
chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes CVE-2025-71405, GHSA-vrw8-fxc6-2r93, GO-2025-3770 | Medium | 0.4% | 20 Jun, 2025 | Go github.com/go-chi/chi/v5 |