Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Ackites KillWxapkg Zip Bomb Resource Exhaustion CVE-2025-5031, GHSA-pqqp-7cp8-vxvf, GO-2025-3703 | Low | 0.4% | 21 May, 2025 | Go github.com/Ackites/KillWxapkg |
Insufficient input sanitization in ejson2env CVE-2025-48069, GHSA-2c47-m757-32g6, GO-2025-3702 | Medium | 1.4% | 21 May, 2025 | Go github.com/Shopify/ejson2env Go github.com/Shopify/ejson2env/v2 RubyGems ejson2env |
containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. CVE-2025-47291, GHSA-cxfp-7pvr-95ff, GO-2025-3701 | Medium | 0.3% | 21 May, 2025 | Go github.com/containerd/containerd/v2 |
Character injection in Hubble CLI CVE-2025-48056, GHSA-274q-79q9-52j7, GO-2025-3700 | Medium | 0.3% | 21 May, 2025 | Go github.com/cilium/hubble |
containerd allows host filesystem access on pull CVE-2025-47290, GHSA-cm76-qm8v-3j95, GO-2025-3699 | High | 0.5% | 21 May, 2025 | Go github.com/containerd/containerd/v2 |
Gardener allows metadata injection for a project secret which can lead to privilege escalation CVE-2025-47284, GHSA-9x73-87fh-54w9, GO-2025-3698 | Critical | 0.5% | 19 May, 2025 | Go github.com/gardener/gardener |
Gardener allows bypassing project secret validation which can lead to privilege escalation CVE-2025-47283, GHSA-3hw7-qj9h-r835, GO-2025-3696 | Critical | 0.7% | 19 May, 2025 | Go github.com/gardener/gardener |
Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation CVE-2025-47282, GHSA-xwgg-m7fx-83wx, GO-2025-3697 | Critical | 0.7% | 19 May, 2025 | Go github.com/gardener/external-dns-management Go github.com/gardener/gardener-extension-shoot-dns-service |
SeaweedFS Vulnerable to SQL Injection BIT-seaweedfs-2024-40120, CVE-2024-40120, GHSA-q97m-8853-pq76, GO-2025-3690 | Medium | 0.3% | 16 May, 2025 | Go github.com/seaweedfs/seaweedfs |
Ollama Server Vulnerable to Denial of Service (DoS) Attack CVE-2025-1975, GHSA-wrh5-cmwx-q2qr, GO-2025-3695, PYSEC-2025-145 | High | 0.5% | 16 May, 2025 | Go github.com/ollama/ollama PyPI ollama |
Ring: some aes functions may panic when overflow checking is enabled in ring in github.com/briansmith/ring CVE-2025-4432, GHSA-4p46-pwfr-66x6, GHSA-c86p-w88r-qvqr, GO-2025-3678, RUSTSEC-2025-0009 | 1.0% | 15 May, 2025 | Go github.com/briansmith/ring | |
Mattermost Fails to Verify User's Permissions When Accessing Groups CVE-2025-2527, GHSA-h356-3mfw-x368, GO-2025-3691 | Medium | 0.3% | 15 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Fails to Check User Access to `ExperimentalSettings` CVE-2025-2570, GHSA-fpff-wj6m-grvr, GO-2025-3694 | Low | 0.3% | 15 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt GHSA-869w-47c6-fq8q, GO-2025-3687 | High | Not scored | 15 May, 2025 | Go github.com/babylonlabs-io/babylon |
Babylon Finality Provider `MsgCommitPubRandList` replay attack GHSA-7mm3-vfg8-7rg6, GO-2025-3686 | High | Not scored | 15 May, 2025 | Go github.com/babylonlabs-io/babylon |
Mattermost Fails to Validate Team Invite Permissions CVE-2025-3446, GHSA-r7r2-m3vr-c8qc, GO-2025-3693 | Medium | 0.3% | 15 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Fails to Lockout LDAP Users After Repeated Login Failures CVE-2025-31947, GHSA-qgwx-rffp-6cx9, GO-2025-3692 | Medium | 0.4% | 15 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
LF Edge eKuiper Vulnerable to Stored XSS in Configuration Key Functionality CVE-2024-52290, GHSA-9cwv-pxcr-hfjc, GO-2025-3682 | Medium | 0.3% | 14 May, 2025 | Go github.com/lf-edge/ekuiper Go github.com/lf-edge/ekuiper/v2 |
Cosmos EVM Allows Partial Precompile State Writes GHSA-mjfq-3qr2-6g84, GO-2025-3684 | High | Not scored | 14 May, 2025 | Go github.com/cosmos/evm |
nosurf vulnerable to CSRF due to non-functional same-origin request checks CVE-2025-46721, GHSA-w9hf-35q4-vcjw, GO-2025-3683 | Medium | 0.2% | 14 May, 2025 | Go github.com/justinas/nosurf |
Yggdrasil Vulnerable to Local Privilege Escalation CVE-2025-3931, GHSA-rpg2-jvhp-h354, GO-2025-3688 | High | 0.2% | 14 May, 2025 | Go github.com/redhatinsights/yggdrasil |
OPKSSH Vulnerable to Authentication Bypass CVE-2025-4658, GHSA-56wx-66px-9j66, GO-2025-3680 | Critical | 0.3% | 13 May, 2025 | Go github.com/openpubkey/opkssh |
OpenPubkey Vulnerable to Authentication Bypass CVE-2025-3757, GHSA-537f-gxgm-3jjq, GO-2025-3679 | Critical | 0.4% | 13 May, 2025 | Go github.com/openpubkey/openpubkey |
ZITADEL Allows IdP Intent Token Reuse CVE-2025-46815, GHSA-g4r8-mp7g-85fq, GO-2025-3671 | High | 0.5% | 06 May, 2025 | Go github.com/zitadel/zitadel |
goshs route not protected, allows command execution CVE-2025-46816, GHSA-rwj2-w85g-5cmm, GO-2025-3672 | Critical | 0.7% | 06 May, 2025 | Go github.com/patrickhener/goshs |
Terraform WinDNS Provider improperly sanitizes input variables in `windns_record` CVE-2025-46735, GHSA-4vgf-2cm4-mp7c, GO-2025-3670 | Low | 0.6% | 06 May, 2025 | Go github.com/nrkno/terraform-provider-windns |
Inspektor Gadget Security Policies Can be Bypassed GHSA-pv22-fqcj-7xwh, GO-2025-3665 | Medium | Not scored | 06 May, 2025 | Go github.com/inspektor-gadget/inspektor-gadget |
Linkerd resource exhaustion vulnerability CVE-2025-43915, GHSA-42mr-jpwh-m9rv, GO-2025-3664 | Medium | 0.3% | 05 May, 2025 | Go github.com/linkerd/linkerd2 |
Hashicorp Vault Community vulnerable to Incorrect Authorization BIT-vault-2025-3879, CVE-2025-3879, GHSA-f9ch-h8j7-8jwg, GO-2025-3662 | Medium | 0.4% | 02 May, 2025 | Go github.com/hashicorp/vault |
Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization in github.com/casdoor/casdoor CVE-2025-4210, GHSA-8w8f-h4cm-c4pg, GO-2025-3661 | Medium | 1.8% | 02 May, 2025 | Go github.com/casdoor/casdoor |
Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information BIT-openbao-2025-4166, BIT-vault-2025-4166, CVE-2025-4166, GHSA-gcqf-f89c-68hv, GO-2025-3663 | Medium | 0.5% | 02 May, 2025 | Go github.com/hashicorp/vault |
OPA server Data API HTTP path injection of Rego CVE-2025-46569, GHSA-6m8w-jc87-6cr7, GO-2025-3660 | High | 0.5% | 01 May, 2025 | Go github.com/open-policy-agent/opa Go github.com/open-policy-agent/opa/server Go github.com/open-policy-agent/opa/v1/server |
OpenFGA Authorization Bypass CVE-2025-46331, GHSA-w222-m46c-mgh6, GO-2025-3657 | Medium | 0.4% | 30 Apr, 2025 | Go github.com/openfga/openfga |
Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin CVE-2025-32777, GHSA-hg79-fw4p-25p8, GO-2025-3656 | High | 0.5% | 30 Apr, 2025 | Go volcano.sh/volcano |
Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements BIT-kyverno-2025-46342, CVE-2025-46342, GHSA-jrr2-x33p-6hvc, GO-2025-3652 | High | 0.8% | 29 Apr, 2025 | Go github.com/kyverno/kyverno |
Go Snowflake Driver has race condition when checking access to Easy Logging configuration file CVE-2025-46327, GHSA-6jgm-j7h2-2fqg, GO-2025-3650 | Low | 0.1% | 28 Apr, 2025 | Go github.com/snowflakedb/gosnowflake |
Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks CVE-2023-32198, GHSA-95fc-g4gj-mqmx, GO-2025-3648 | High | 0.3% | 25 Apr, 2025 | Go github.com/rancher/steve |
Fleet doesn’t validate a server’s certificate when connecting through SSH CVE-2025-23390, GHSA-xgpc-q899-67p8, GO-2025-3649 | Medium | 0.2% | 25 Apr, 2025 | Go github.com/rancher/fleet |
Rancher users who can create Projects can gain access to arbitrary projects CVE-2024-22031, GHSA-8h6m-wv39-239m, GO-2025-3647 | High | 0.4% | 25 Apr, 2025 | Go github.com/rancher/rancher |
CNCF K3s Kubernetes kubelet configuration exposes credentials CVE-2025-46599, GHSA-864f-7xjm-2jp2, GO-2025-3646 | Medium | 0.5% | 25 Apr, 2025 | Go github.com/k3s-io/k3s |
Mattermost Playbooks fails to validate the uniqueness and quantity of task actions CVE-2025-35965, GHSA-689c-xq7x-xjwf, GO-2025-3643 | Medium | 0.4% | 24 Apr, 2025 | Go github.com/mattermost/mattermost-plugin-playbooks Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type CVE-2025-41395, GHSA-3g36-gf7c-75qw, GO-2025-3642 | Medium | 0.5% | 24 Apr, 2025 | Go github.com/mattermost/mattermost-plugin-playbooks Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Mattermost Playbooks fails to properly validate permissions CVE-2025-41423, GHSA-fr22-5377-f3p7, GO-2025-3644 | Low | 0.3% | 24 Apr, 2025 | Go github.com/mattermost/mattermost-plugin-playbooks Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canaries CVE-2026-26994, GHSA-pmc3-p9hx-jq96, GO-2025-3638 | Medium | 0.3% | 23 Apr, 2025 | Go github.com/refraction-networking/utls |
Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS CVE-2025-32963, GHSA-7m6v-q233-q9j9, GO-2025-3637 | Medium | 0.6% | 21 Apr, 2025 | Go github.com/minio/operator |
In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters BIT-cilium-2025-32793, BIT-cilium-operator-2025-32793, BIT-hubble-relay-2025-32793, CVE-2025-32793, GHSA-5vxx-c285-pcq4, GO-2025-3635 | Medium | 0.1% | 21 Apr, 2025 | Go github.com/cilium/cilium |
Traefik has a possible vulnerability with its path matchers CVE-2025-32431, GHSA-6p68-w45g-48j7, GO-2025-3634 | High | 0.9% | 21 Apr, 2025 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
GoBGP crashes in the flowspec parser CVE-2025-43972, GHSA-mfvv-mgf6-q25r, GO-2025-3632 | Medium | 0.6% | 21 Apr, 2025 | Go github.com/osrg/gobgp Go github.com/osrg/gobgp/v3 |
GoBGP does not verify that the input length CVE-2025-43973, GHSA-c5jg-wr5v-2wp2, GO-2025-3633 | Medium | 0.6% | 21 Apr, 2025 | Go github.com/osrg/gobgp Go github.com/osrg/gobgp/v3 |
GoBGP does not properly check the input length CVE-2025-43970, GHSA-hqhq-hp5x-xp3w, GO-2025-3630 | Medium | 0.4% | 21 Apr, 2025 | Go github.com/osrg/gobgp Go github.com/osrg/gobgp/v3 |