Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mattermost allows unauthorized channel member management through playbook runs CVE-2025-3227, GHSA-qwwm-c582-82rx, GO-2025-3772 | Medium | 0.2% | 20 Jun, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows an unauthorized Guest user access to Playbook CVE-2025-3228, GHSA-4578-6gjh-f2jm, GO-2025-3771 | Medium | 0.3% | 20 Jun, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows authenticated users to write files to arbitrary locations CVE-2025-4981, GHSA-qh58-9v3j-wcjc, GO-2025-3769 | Critical | 1.0% | 20 Jun, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Velociraptor vulnerable to privilege escalation via UpdateConfig artifact CVE-2025-6264, GHSA-gpfc-mph4-qm24, GO-2025-3768 | Medium | 1.0% | 20 Jun, 2025 | Go www.velocidex.com/golang/velociraptor |
Grafana long dashboard title or panel name causes unresponsives BIT-grafana-2025-1088, CVE-2025-1088, GHSA-crvv-6w6h-cv34, GO-2025-3766 | Low | 0.5% | 18 Jun, 2025 | Go github.com/grafana/grafana |
OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal CVE-2025-5981, GHSA-2hcm-q3f4-fjgw, GO-2025-3767 | Medium | 0.2% | 18 Jun, 2025 | Go github.com/google/osv-scalibr |
Teleport allows remote authentication bypass CVE-2025-49825, GHSA-8cqv-pj7f-pwpc, GO-2025-3763 | Critical | 7.9% | 16 Jun, 2025 | Go github.com/gravitational/teleport |
New authd users logging in via SSH are members of the root group CVE-2025-5689, GHSA-g8qw-mgjx-rwjr, GO-2025-3762 | Medium | 0.3% | 16 Jun, 2025 | Go github.com/ubuntu/authd |
uptrace pgdriver SQL injection vulnerability CVE-2024-44906, GHSA-h4h6-vccr-44h2, GO-2025-3765 | Medium | 0.4% | 12 Jun, 2025 | Go github.com/uptrace/bun/driver/pgdriver |
go-pg SQL injection vulnerability via the component /types/append_value.go CVE-2024-44905, GHSA-6xp3-p59p-q4fj, GO-2025-3764 | Medium | 0.4% | 12 Jun, 2025 | Go github.com/go-pg/pg Go github.com/go-pg/pg/v10 Go github.com/go-pg/pg/v9 |
SSH public key login without private key challenge if mfa is enabled in jumpserver in github.com/jumpserver/koko in github.com/jumpserver/jumpserver CVE-2023-42818, GHSA-jv3c-27cv-w8jv, GO-2025-3570 | 0.7% | 12 Jun, 2025 | Go github.com/jumpserver/jumpserver Go github.com/jumpserver/koko | |
Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall BIT-golang-2025-0913, CVE-2025-0913, GO-2025-3750 | 0.3% | 11 Jun, 2025 | Go stdlib | |
Sensitive headers not cleared on cross-origin redirect in net/http BIT-golang-2025-4673, CVE-2025-4673, GO-2025-3751 | 0.7% | 11 Jun, 2025 | Go stdlib | |
Usage of ExtKeyUsageAny disables policy validation in crypto/x509 BIT-golang-2025-22874, CVE-2025-22874, GO-2025-3749 | 0.4% | 11 Jun, 2025 | Go stdlib | |
Hashicorp Nomad Incorrect Privilege Assignment vulnerability CVE-2025-4922, GHSA-rx97-6c62-55mf, GO-2025-3758 | High | 0.5% | 11 Jun, 2025 | Go github.com/hashicorp/nomad |
CWA-2025-006: wasmd's improper error handling may lead to IBC channel opening despite error GHSA-79xg-q4qm-7v9w, GO-2025-3755 | High | Not scored | 11 Jun, 2025 | Go github.com/CosmWasm/wasmd |
Mattermost allows guest users to view information about public teams they are not members of CVE-2025-4128, GHSA-jwhw-xf5v-qgxc, GO-2025-3757 | Low | 0.2% | 11 Jun, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows authenticated administrator to execute LDAP search filter injection CVE-2025-4573, GHSA-4r67-4x4p-fprg, GO-2025-3756 | Medium | 0.3% | 11 Jun, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
CIRCL-Fourq: Missing and wrong validation can lead to incorrect results CVE-2025-8556, GHSA-2x5j-vhc8-9cwm, GO-2025-3754 | Low | 0.5% | 10 Jun, 2025 | Go github.com/cloudflare/circl |
Pion Interceptor's improper RTP padding handling allows remote crash for SFU users (DoS) CVE-2025-49140, GHSA-f26w-gh5m-qq77, GO-2025-3748 | High | 0.5% | 09 Jun, 2025 | Go github.com/pion/interceptor |
listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user CVE-2025-49136, GHSA-jc7g-x28f-3v3h, GO-2025-3745 | Critical | 1.6% | 09 Jun, 2025 | Go github.com/knadh/listmonk |
Authorino Uncontrolled Resource Consumption vulnerability CVE-2025-25208, GHSA-vqvv-2wj5-q34w, GO-2025-3747 | Medium | 0.3% | 09 Jun, 2025 | Go github.com/kuadrant/authorino |
Authorino Uncontrolled Resource Consumption vulnerability CVE-2025-25207, GHSA-r8xr-pgv5-gxw3, GO-2025-3746 | Medium | 0.3% | 09 Jun, 2025 | Go github.com/kuadrant/authorino |
SpiceDB checks involving relations with caveats can result in no permission when permission is expected CVE-2025-49011, GHSA-cwwm-hr97-qfxm, GO-2025-3744 | Low | 0.3% | 06 Jun, 2025 | Go github.com/authzed/spicedb |
CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification CVE-2025-47950, GHSA-cvx7-x8pj-x2gw, GO-2025-3743 | High | 1.2% | 06 Jun, 2025 | Go github.com/coredns/coredns |
kro Confused Deputy vulnerability CVE-2025-48710, GHSA-7633-x85h-5mqh, GO-2025-3741 | Medium | 0.4% | 04 Jun, 2025 | Go github.com/kro-run/kro |
Gokapi vulnerable to stored XSS via uploading file with malicious file name CVE-2025-48494, GHSA-95rc-wc32-gm53, GO-2025-3737 | Medium | 0.2% | 03 Jun, 2025 | Go github.com/forceu/gokapi |
Gokapi has stored XSS vulnerability in friendly name for API keys CVE-2025-48495, GHSA-4xg4-54hm-9j77, GO-2025-3736 | Medium | 0.1% | 03 Jun, 2025 | Go github.com/forceu/gokapi |
quic-go Has Panic in Path Probe Loss Recovery Handling CVE-2025-29785, GHSA-j972-j939-p2v3, GO-2025-3735 | High | 0.5% | 03 Jun, 2025 | Go github.com/quic-go/quic-go |
Grafana vulnerable to authenticated users bypassing dashboard, folder permissions BIT-grafana-2025-3260, CVE-2025-3260, GHSA-3px7-c4j3-576r, GO-2025-3740 | High | 0.6% | 02 Jun, 2025 | Go github.com/grafana/grafana |
Grafana's datasource proxy API allows authorization checks to be bypassed BIT-grafana-2025-3454, CVE-2025-3454, GHSA-9j65-rv5x-4vrf, GO-2025-3742 | Medium | 0.5% | 02 Jun, 2025 | Go github.com/grafana/grafana |
Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server CVE-2025-48938, GHSA-g9f5-x53j-h563, GO-2025-3732 | Medium | 0.6% | 30 May, 2025 | Go github.com/cli/go-gh/v2 |
Mattermost fails to properly enforce access controls for guest users CVE-2025-1792, GHSA-hc6v-386m-93pq, GO-2025-3730 | Low | 0.3% | 30 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to clear Google OAuth credentials CVE-2025-2571, GHSA-8cgx-9ccj-3gwr, GO-2025-3729 | Medium | 0.2% | 30 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly invalidate personal access tokens upon user deactivation CVE-2025-3230, GHSA-mc2f-jgj6-6cp3, GO-2025-3731 | Medium | 0.2% | 30 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly enforce access control restrictions for System Manager roles CVE-2025-3611, GHSA-86jg-35xj-3vv5, GO-2025-3728 | Low | 0.2% | 30 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Navidrome Transcoding Permission Bypass Vulnerability Report CVE-2025-48948, GHSA-f238-rggp-82m3, GO-2025-3733 | High | 0.5% | 29 May, 2025 | Go github.com/navidrome/navidrome |
Mattermost improperly allows team administrators to modify team invites CVE-2025-3913, GHSA-4mmr-2w8p-whcr, GO-2025-3724 | Medium | 0.3% | 29 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Navidrome allows SQL Injection via role parameter CVE-2025-48949, GHSA-5wgp-vjxm-3x2r, GO-2025-3734 | High | 0.5% | 29 May, 2025 | Go github.com/navidrome/navidrome |
Fabio allows HTTP clients to manipulate custom headers it adds CVE-2025-48865, GHSA-q7p4-7xjv-j3wf, GO-2025-3722 | Critical | 0.5% | 29 May, 2025 | Go github.com/fabiolb/fabio |
ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection CVE-2025-48936, GHSA-93m4-mfpg-c3xf, GO-2025-3721 | High | 0.4% | 28 May, 2025 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
Argo CD allows cross-site scripting on repositories page BIT-argo-cd-2025-47933, CVE-2025-47933, GHSA-2hj5-g64g-fp6p, GO-2025-3720 | Critical | 0.5% | 28 May, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 Go github.com/argoproj/argo-cd/v3 |
Contrast workload secrets leak to logs on INFO level CVE-2025-71425, GHSA-h5f8-crrq-4pw8, GO-2025-3718 | High | 0.2% | 28 May, 2025 | Go github.com/edgelesssys/contrast |
Traefik allows path traversal using url encoding CVE-2025-47952, GHSA-vrch-868g-9jx5, GO-2025-3719 | Low | 1.0% | 28 May, 2025 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
ActiveMQ Artemis AMQ Broker Operator Starting Credentials Reuse CVE-2025-4057, GHSA-q5q7-8x6x-hcg2, GO-2025-3717 | Medium | 0.2% | 26 May, 2025 | Go github.com/arkmq-org/activemq-artemis-operator |
OpenFGA Authorization Bypass CVE-2025-48371, GHSA-c72g-53hw-82q7, GO-2025-3707 | Medium | 0.5% | 23 May, 2025 | Go github.com/openfga/openfga |
zot logs secrets CVE-2025-48374, GHSA-c37v-3c8w-crq8, GO-2025-3705 | Medium | 0.2% | 22 May, 2025 | Go zotregistry.dev/zot |
Fiber panics when fiber.Ctx.BodyParser parses invalid range index CVE-2025-48075, GHSA-hg3g-gphw-5hhm, GO-2025-3706 | High | 0.5% | 22 May, 2025 | Go github.com/gofiber/fiber Go github.com/gofiber/fiber/v2 |
Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin BIT-grafana-2025-4123, CVE-2025-4123, GHSA-q53q-gxq9-mgrj, GO-2025-3704 | High | 97.1% | 22 May, 2025 | Go github.com/grafana/grafana |
Ackites KillWxapkg vulnerable to OS Command Injection CVE-2025-5030, GHSA-w6p4-84vc-qc2w, GO-2025-3773 | Low | 2.4% | 21 May, 2025 | Go github.com/Ackites/KillWxapkg |