Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
jwt-go allows excessive memory allocation during header parsing CVE-2025-30204, GHSA-mh63-6h87-95cp, GO-2025-3553 | High | 0.8% | 21 Mar, 2025 | Go github.com/golang-jwt/jwt Go github.com/golang-jwt/jwt/v4 Go github.com/golang-jwt/jwt/v5 |
PipeCD Vulnerable to Privilege Escalation CVE-2024-53351, GHSA-4jhw-c53w-w5r7, GO-2025-3546 | High | 0.5% | 21 Mar, 2025 | Go github.com/pipe-cd/pipecd |
Envoy crashes when HTTP ext_proc processes local replies BIT-envoy-2025-30157, CVE-2025-30157, GHSA-cf3q-gqg7-3fm9 | Medium | 0.4% | 21 Mar, 2025 | Go github.com/envoyproxy/envoy |
Mattermost fail to prompt for explicit approval before adding a team admin to a private channel BIT-mattermost-2025-27715, CVE-2025-27715, GHSA-cw7q-5cgc-h3h9, GO-2025-3555 | Low | 0.2% | 21 Mar, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows members with permission to convert public channels to private and convert private to public BIT-mattermost-2025-27933, CVE-2025-27933, GHSA-h5v9-xw2g-7hrq, GO-2025-3556 | Medium | 0.2% | 21 Mar, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Fails to Enforce Certain Search APIs BIT-mattermost-2025-30179, CVE-2025-30179, GHSA-3gpx-p63p-pr5r, GO-2025-3549 | Medium | 0.3% | 21 Mar, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels BIT-mattermost-2025-24920, CVE-2025-24920, GHSA-rp74-x43m-cpw3, GO-2025-3552 | Medium | 0.2% | 21 Mar, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Fails to Enforce MFA on Plugin Endpoints BIT-mattermost-2025-25068, CVE-2025-25068, GHSA-72qv-j8vr-xvfv, GO-2025-3551 | High | 0.3% | 21 Mar, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Fails to Restrict Command Execution in Archived Channels BIT-mattermost-2025-25274, CVE-2025-25274, GHSA-4v65-xqcj-wpgg, GO-2025-3550 | Medium | 0.4% | 21 Mar, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment CVE-2025-29923, GHSA-92cp-5422-2mw7, GO-2025-3540 | Low | 0.8% | 20 Mar, 2025 | Go github.com/redis/go-redis Go github.com/redis/go-redis/v7 Go github.com/redis/go-redis/v8 Go github.com/redis/go-redis/v9 |
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace CVE-2025-29922, GHSA-w2rr-38wv-8rrp, GO-2025-3538 | Critical | 0.4% | 20 Mar, 2025 | Go github.com/kcp-dev/kcp |
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME` CVE-2025-29914, GHSA-q9f5-625g-xm39, GO-2025-3537 | Medium | 0.3% | 20 Mar, 2025 | Go github.com/corazawaf/coraza Go github.com/corazawaf/coraza/v2 Go github.com/corazawaf/coraza/v3 Go github.com/jptosso/coraza-waf |
Kubernetes kube-apiserver Vulnerable to Race Condition CVE-2024-7598, GHSA-r56h-j38w-hrqq, GO-2025-3547 | Low | 0.3% | 20 Mar, 2025 | Go k8s.io/kubernetes Go k8s.io/kubernetes/cmd/kube-apiserver |
Ollama Denial of Service (DoS) via Null Pointer Dereference CVE-2025-0312, GHSA-p2wh-w96x-w232, GO-2025-3582 | High | 0.6% | 20 Mar, 2025 | Go github.com/ollama/ollama |
Ollama Allocation of Resources Without Limits or Throttling vulnerability CVE-2025-0315, GHSA-fccc-8m69-8r78, GO-2025-3557 | High | 0.7% | 20 Mar, 2025 | Go github.com/ollama/ollama |
Ollama Divide By Zero vulnerability CVE-2025-0317, GHSA-9gcr-28rp-cc24, GO-2025-3559 | High | 14.5% | 20 Mar, 2025 | Go github.com/ollama/ollama |
LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality CVE-2024-9900, GHSA-w6hh-w36c-vxmw, GO-2025-3542 | Medium | 0.5% | 20 Mar, 2025 | Go github.com/mudler/LocalAI |
Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIP CVE-2024-12886, GHSA-v464-r2r9-www7, GO-2025-3548 | High | 0.7% | 20 Mar, 2025 | Go github.com/ollama/ollama |
Ollama Allows Out-of-Bounds Read CVE-2024-12055, GHSA-89qx-m49c-8crf, GO-2025-3558 | High | 0.8% | 20 Mar, 2025 | Go github.com/ollama/ollama |
Ollama Divide by Zero Vulnerability CVE-2024-8063, GHSA-2xf2-gjm6-g2c6, GO-2025-3689, PYSEC-2025-144 | High | 0.6% | 20 Mar, 2025 | Go github.com/ollama/ollama PyPI ollama |
Malicious release: Malicious code in github.com/belatedplanet/hypert (Go) MAL-2025-2544 | Malicious | Not scored | 19 Mar, 2025 | Go github.com/belatedplanet/hypert |
Malicious release: Malicious code in github.com/ornatedoctrin/layout (Go) MAL-2025-2546 | Malicious | Not scored | 19 Mar, 2025 | Go github.com/ornatedoctrin/layout |
Malicious release: Malicious code in github.com/shadowybulk/hypert (Go) MAL-2025-2547 | Malicious | Not scored | 19 Mar, 2025 | Go github.com/shadowybulk/hypert |
Malicious release: Malicious code in github.com/shallowmulti/hypert (Go) MAL-2025-2548 | Malicious | Not scored | 19 Mar, 2025 | Go github.com/shallowmulti/hypert |
Malicious release: Malicious code in github.com/thankfulmai/hypert (Go) MAL-2025-2549 | Malicious | Not scored | 19 Mar, 2025 | Go github.com/thankfulmai/hypert |
Malicious release: Malicious code in github.com/utilizedsun/layout (Go) MAL-2025-2550 | Malicious | Not scored | 19 Mar, 2025 | Go github.com/utilizedsun/layout |
Malicious release: Malicious code in github.com/vainreboot/layout (Go) MAL-2025-2551 | Malicious | Not scored | 19 Mar, 2025 | Go github.com/vainreboot/layout |
Malicious release: Malicious code in github.com/boltdb-go/bolt (Go) MAL-2025-2545 | Malicious | Not scored | 19 Mar, 2025 | Go github.com/boltdb-go/bolt |
OpenShift Console Has a Path Traversal Vulnerability CVE-2024-7631, GHSA-69x5-hjg4-m267, GO-2025-3539 | Medium | 0.5% | 19 Mar, 2025 | Go github.com/openshift/console |
OpenShift Hive Has an Uncontrolled Resource Consumption Vulnerability CVE-2024-25132, GHSA-c392-wrgw-jjfw, GO-2025-3536 | Medium | 0.3% | 19 Mar, 2025 | Go github.com/openshift/hive |
Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter CVE-2025-30153, GHSA-wq9g-9vfc-cfq9, GO-2025-3533 | High | 0.6% | 19 Mar, 2025 | Go github.com/getkin/kin-openapi |
Mattermost Fails to Properly Perform Viewer Role Authorization CVE-2025-1472, GHSA-fqrq-xmxj-v47x, GO-2025-3534 | Medium | 0.3% | 19 Mar, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
buildx allows a possible credential leakage to telemetry endpoint CVE-2025-0495, GHSA-m4gq-fm9h-8q75, GO-2025-3527 | Medium | 0.2% | 17 Mar, 2025 | Go github.com/docker/buildx |
Memory Exhaustion in Expr Parser with Unrestricted Input CVE-2025-29786, GHSA-93mq-9ffx-83m2, GO-2025-3525 | High | 0.6% | 17 Mar, 2025 | Go github.com/expr-lang/expr |
Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD CVE-2025-29781, GHSA-c98h-7hp9-v9hq, GO-2025-3530 | Medium | 0.2% | 17 Mar, 2025 | Go github.com/metal3-io/baremetal-operator/apis |
containerd has an integer overflow in User ID handling CVE-2024-40635, GHSA-265r-hfxg-fhmg, GO-2025-3528 | Medium | 0.3% | 17 Mar, 2025 | Go github.com/containerd/containerd Go github.com/containerd/containerd/v2 |
Openshift Hive Exposes VCenter Credentials via ClusterProvision CVE-2025-2241, GHSA-c339-mwfc-fmr2, GO-2025-3529 | High | 0.5% | 17 Mar, 2025 | Go github.com/openshift/hive |
onos-lib-go allows an index out-of-range panic CVE-2025-30077, GHSA-jrqj-6vq2-7r63, GO-2025-3526 | Medium | 0.2% | 16 Mar, 2025 | Go github.com/onosproject/onos-lib-go |
Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API CVE-2024-9042, GHSA-vv39-3w5q-974q, GO-2025-3522 | Medium | 1.4% | 13 Mar, 2025 | Go k8s.io/kubernetes |
Kubernetes GitRepo Volume Inadvertent Local Repository Access CVE-2025-1767, GHSA-3wgm-2gw2-vh5m, GO-2025-3521 | Medium | 0.7% | 13 Mar, 2025 | Go k8s.io/kubernetes |
cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002) GHSA-h2rp-8vpx-q9r4, GO-2025-3520 | Critical | Not scored | 13 Mar, 2025 | Go github.com/cheqd/cheqd-node |
IBC-Go: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt GHSA-4wf3-5qj9-368v, GO-2025-3517 | Critical | Not scored | 12 Mar, 2025 | Go github.com/cosmos/ibc-go Go github.com/cosmos/ibc-go/v2 Go github.com/cosmos/ibc-go/v3 Go github.com/cosmos/ibc-go/v4 +4 more |
Cosmos SDK: x/group can halt when erroring in EndBlocker GHSA-47ww-ff84-4jrg, GO-2025-3516 | High | Not scored | 12 Mar, 2025 | Go github.com/cosmos/cosmos-sdk |
HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net CVE-2025-22870, GHSA-qxp5-gwg8-xv66, GO-2025-3503 | Medium | 0.4% | 12 Mar, 2025 | Go golang.org/x/net Go stdlib |
cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement GHSA-33cr-m232-xqch, GO-2025-3514 | Critical | Not scored | 11 Mar, 2025 | Go github.com/cheqd/cheqd-node |
Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries CVE-2025-27403, GHSA-44f7-5fj5-h4px, GO-2025-3511 | High | 0.5% | 11 Mar, 2025 | Go github.com/deislabs/ratify Go github.com/ratify-project/ratify |
Vela Server Has Insufficient Webhook Payload Data Verification CVE-2025-27616, GHSA-9m63-33q3-xq5x, GO-2025-3509 | High | 0.3% | 10 Mar, 2025 | Go github.com/go-vela/server |
LF Edge eKuiper allows Stored XSS in Rules Functionality CVE-2024-52812, GHSA-6hrw-x7pr-4mp8, GO-2025-3508 | Medium | 0.3% | 10 Mar, 2025 | Go github.com/lf-edge/ekuiper Go github.com/lf-edge/ekuiper/v2 |
Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs CVE-2025-1296, GHSA-c3q9-q986-vrwh, GO-2025-3510 | Medium | 0.5% | 10 Mar, 2025 | Go github.com/hashicorp/nomad |
Horcrux Double Sign Possibility GHSA-6wxf-7784-62fp, GO-2025-3507 | High | Not scored | 07 Mar, 2025 | Go github.com/strangelove-ventures/horcrux Go github.com/strangelove-ventures/horcrux/v3 |