Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
GoBGP panics due to a zero value for softwareVersionLen CVE-2025-43971, GHSA-7m35-vw2c-696v, GO-2025-3631 | High | 0.6% | 21 Apr, 2025 | Go github.com/osrg/gobgp Go github.com/osrg/gobgp/v3 |
one-api Cross-site Scripting vulnerability CVE-2025-3801, GHSA-wvcx-j62q-45qw, GO-2025-3636 | Medium | 0.3% | 19 Apr, 2025 | Go github.com/songquanpeng/one-api |
Traefik affected by Go HTTP Request Smuggling Vulnerability GHSA-5423-jcjm-2gpv, GO-2025-3627 | Critical | Not scored | 18 Apr, 2025 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Traefik affected by Go oauth2/jws Improper Validation of Syntactic Correctness of Input vulnerability GHSA-3wqc-mwfx-672p | High | Not scored | 18 Apr, 2025 | Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Mattermost Incorrect Authorization vulnerability CVE-2025-2564, GHSA-mj2p-v2c2-vh4v, GO-2025-3623 | Medium | 0.3% | 16 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
golang.org/x/net vulnerable to Cross-site Scripting CVE-2025-22872, GHSA-vvgc-356p-c3xw, GO-2025-3595 | Medium | 0.5% | 16 Apr, 2025 | Go golang.org/x/net |
Mattermost vulnerable to Observable Timing Discrepancy CVE-2025-27936, GHSA-2j87-p623-8cc2, GO-2025-3618 | Medium | 0.3% | 16 Apr, 2025 | Go github.com/mattermost/mattermost-plugin-msteams Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Mattermost doesn't restrict domains LLM can request to contact upstream CVE-2025-31363, GHSA-9h6j-4ffx-cm84, GO-2025-3622 | Low | 0.3% | 16 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Incorrect Authorization vulnerability CVE-2025-24839, GHSA-j639-m367-75cf, GO-2025-3621 | Low | 0.2% | 16 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Missing Authentication for Critical Function CVE-2025-27538, GHSA-j5jw-m2ph-3jjf, GO-2025-3620 | Low | 0.2% | 16 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Incorrect Authorization vulnerability CVE-2025-27571, GHSA-h4rr-f37j-4hh7, GO-2025-3619 | Medium | 0.3% | 16 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
NATS Server may fail to authorize certain Jetstream admin APIs BIT-nats-2025-30215, CVE-2025-30215, GHSA-fhg8-qxh5-7q3w, GO-2025-3600 | Critical | 0.6% | 15 Apr, 2025 | Go github.com/nats-io/nats-server/v2 |
Kyverno vulnerable to SSRF via Service Calls BIT-kyverno-2025-15613, CVE-2025-15613, GHSA-459x-q9hg-4gpq, GO-2025-3615 | High | 0.4% | 15 Apr, 2025 | Go github.com/kyverno/kyverno |
Dpanel's hard-coded JWT secret leads to remote code execution CVE-2025-30206, GHSA-j752-cjcj-w847, GO-2025-3612 | Critical | 0.9% | 15 Apr, 2025 | Go github.com/donknap/dpanel |
Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR CVE-2025-32445, GHSA-hmp7-x699-cvhq, GO-2025-3608 | Critical | 0.8% | 14 Apr, 2025 | Go github.com/argoproj/argo-events |
Mattermost Incorrect Authorization vulnerability CVE-2025-2424, GHSA-wwhj-pw6h-f8hw, GO-2025-3611 | Low | 0.3% | 14 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm CVE-2025-2475, GHSA-6rqh-8465-2xcw, GO-2025-3610 | Medium | 0.2% | 14 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
gorilla/csrf CSRF vulnerability due to broken Referer validation CVE-2025-24358, GHSA-rq77-p4h8-4crw, GO-2025-3607 | Medium | 0.4% | 14 Apr, 2025 | Go github.com/gorilla/csrf |
Mattermost Fails to Restrict Certain Operations on System Admins CVE-2025-32093, GHSA-322v-vh2g-qvpv, GO-2025-3609 | Medium | 0.2% | 14 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
mholt/archiver Vulnerable to Path Traversal via Crafted ZIP File CVE-2025-3445, GHSA-7vpp-9cxj-q8gv, GO-2025-3605 | High | 0.5% | 14 Apr, 2025 | Go github.com/mholt/archiver Go github.com/mholt/archiver/v3 |
CVE-2025-1386- Query smuggling in ch-go library CVE-2025-1386, GHSA-m454-3xv7-qj85, GO-2025-3603 | Medium | 0.4% | 12 Apr, 2025 | Go github.com/ClickHouse/ch-go |
Mattermost Fails to Enforce Proper Access Controls on `/api/v4/audits` Endpoint CVE-2025-24866, GHSA-xfq9-hh5x-xfq9, GO-2025-3604 | Low | 0.3% | 10 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow BIT-helm-2025-32387, CVE-2025-32387, GHSA-5xqw-8hwv-wg92, GO-2025-3602 | Medium | 0.5% | 10 Apr, 2025 | Go helm.sh/helm/v3 |
Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination BIT-helm-2025-32386, CVE-2025-32386, GHSA-4hfp-h4cw-hj8p, GO-2025-3601 | Medium | 0.5% | 10 Apr, 2025 | Go helm.sh/helm/v3 |
bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing CVE-2025-32025, GHSA-fmhh-rw3h-785m, GO-2025-3599 | Medium | 0.2% | 09 Apr, 2025 | Go github.com/bep/imagemeta |
bep/imagemeta allows excessively large EXIF data structures CVE-2025-32024, GHSA-q7rw-w4cq-2j6w, GO-2025-3598 | Medium | 0.2% | 09 Apr, 2025 | Go github.com/bep/imagemeta |
RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency BIT-golang-2025-22871, CVE-2025-22871, GHSA-g9pc-8g42-g6vq, GO-2025-3563 | Critical | 0.8% | 08 Apr, 2025 | Go stdlib Packagist spiral/roadrunner |
MinIO performs incomplete signature validation for unsigned-trailer uploads CVE-2025-31489, GHSA-wg47-6jq2-q2hh, GO-2025-3594 | High | 2.5% | 04 Apr, 2025 | Go github.com/minio/minio |
Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration CVE-2025-31483, GHSA-cq88-842x-2jhp, GO-2025-3591 | Medium | 0.4% | 04 Apr, 2025 | Go miniflux.app Go miniflux.app/v2 |
Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler CVE-2023-27592, GHSA-mqqg-xjhj-wfgw | Medium | 0.6% | 02 Apr, 2025 | Go miniflux.app/v2 |
Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics CVE-2023-27591, GHSA-3qjf-qh38-x73v | High | 0.8% | 02 Apr, 2025 | Go miniflux.app Go miniflux.app/v2 |
Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2025-2786, GHSA-28gr-56hr-prp6, GO-2026-4996 | Medium | 0.4% | 02 Apr, 2025 | Go github.com/grafana/tempo-operator |
Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2025-2842, GHSA-5xf3-gmx4-529v, GO-2026-5161 | Medium | 0.4% | 02 Apr, 2025 | Go github.com/grafana/tempo-operator |
Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times CVE-2025-31135, GHSA-c2c3-pqw5-5p7c, GO-2025-3588 | Medium | 0.4% | 01 Apr, 2025 | Go github.com/phires/go-guerrilla |
Rancher: Restricted Administrator can change Administrator's passwords CVE-2025-23391, GHSA-8p83-cpfg-fj3g, GO-2025-3586 | Critical | 0.5% | 01 Apr, 2025 | Go github.com/rancher/rancher |
Apache Answer User Using External Images Potentially Discloses User Information CVE-2025-29868, GHSA-wqcc-mfhw-53pc, GO-2025-3587 | Low | 1.0% | 01 Apr, 2025 | Go github.com/apache/answer |
Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input CVE-2025-30223, GHSA-2j42-h78h-q4fg, GO-2025-3585 | Critical | 0.6% | 31 Mar, 2025 | Go github.com/beego/beego Go github.com/beego/beego/v2 |
go.rgst.io/stencil/v2 vulnerable to Path Traversal GHSA-p799-q2pr-6mxj, GO-2025-3584 | Medium | Not scored | 29 Mar, 2025 | Go go.rgst.io/stencil Go go.rgst.io/stencil/v2 |
github.com/jaredallard/archives Has Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2025-64346, GHSA-j95m-rcjp-q69h, GO-2025-3581 | Medium | 0.4% | 28 Mar, 2025 | Go github.com/jaredallard/archives |
Nethermind Juno Potential Denial of Service (DoS) via Integer Overflow CVE-2025-29072, GHSA-wq32-8rp4-w2mc, GO-2025-3583 | High | 0.5% | 27 Mar, 2025 | Go github.com/NethermindEth/juno |
CVE-2024-53348 in github.com/loxilb-io/loxilb CVE-2024-53348, GO-2025-3545 | 0.3% | 25 Mar, 2025 | Go github.com/loxilb-io/loxilb | |
ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation CVE-2025-1097, GHSA-823x-fv5p-h7hw, GO-2025-3565 | High | 37.0% | 25 Mar, 2025 | Go k8s.io/ingress-nginx |
ingress-nginx controller - configuration injection via unsanitized mirror annotations CVE-2025-1098, GHSA-vg63-w3p9-jc9m, GO-2025-3568 | High | 86.1% | 25 Mar, 2025 | Go k8s.io/ingress-nginx |
ingress-nginx admission controller RCE escalation CVE-2025-1974, GHSA-mgvx-rpfc-9mpv, GO-2025-3567 | Critical | 99.4% | 25 Mar, 2025 | Go k8s.io/ingress-nginx |
ingress-nginx controller - auth secret file path traversal vulnerability CVE-2025-24513, GHSA-242m-6h72-7hgp, GO-2025-3564 | Medium | 3.3% | 25 Mar, 2025 | Go k8s.io/ingress-nginx |
ingress-nginx controller - configuration injection via unsanitized auth-url annotation CVE-2025-24514, GHSA-fwwp-xcxw-39vq, GO-2025-3566 | High | 37.3% | 25 Mar, 2025 | Go k8s.io/ingress-nginx |
Cilium node based network policies may incorrectly allow workload traffic BIT-cilium-2025-30163, BIT-cilium-operator-2025-30163, BIT-hubble-relay-2025-30163, CVE-2025-30163, GHSA-c6pf-2v8j-96mc, GO-2025-3561 | Low | 0.2% | 24 Mar, 2025 | Go github.com/cilium/cilium |
Kyverno ignores subjectRegExp and IssuerRegExp BIT-kyverno-2025-29778, CVE-2025-29778, GHSA-46mp-8w32-6g94, GO-2025-3562 | Medium | 0.3% | 24 Mar, 2025 | Go github.com/kyverno/kyverno |
Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers BIT-cilium-2025-30162, BIT-cilium-operator-2025-30162, BIT-hubble-relay-2025-30162, CVE-2025-30162, GHSA-24qp-4xx8-3jvj, GO-2025-3560 | Low | 0.2% | 24 Mar, 2025 | Go github.com/cilium/cilium |
Reflected XSS in go-httpbin due to unrestricted client control over Content-Type CVE-2025-45286, GHSA-528q-4pgm-wvg2, GO-2025-3554 | Medium | 0.3% | 21 Mar, 2025 | Go github.com/mccutchen/go-httpbin Go github.com/mccutchen/go-httpbin/v2 |