Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries CVE-2025-27403, GHSA-44f7-5fj5-h4px, GO-2025-3511 | High | 0.5% | 11 Mar, 2025 | Go github.com/deislabs/ratify Go github.com/ratify-project/ratify |
Vela Server Has Insufficient Webhook Payload Data Verification CVE-2025-27616, GHSA-9m63-33q3-xq5x, GO-2025-3509 | High | 0.3% | 10 Mar, 2025 | Go github.com/go-vela/server |
LF Edge eKuiper allows Stored XSS in Rules Functionality CVE-2024-52812, GHSA-6hrw-x7pr-4mp8, GO-2025-3508 | Medium | 0.3% | 10 Mar, 2025 | Go github.com/lf-edge/ekuiper Go github.com/lf-edge/ekuiper/v2 |
Nomad is vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs CVE-2025-1296, GHSA-c3q9-q986-vrwh, GO-2025-3510 | Medium | 0.5% | 10 Mar, 2025 | Go github.com/hashicorp/nomad |
Horcrux Double Sign Possibility GHSA-6wxf-7784-62fp, GO-2025-3507 | High | Not scored | 07 Mar, 2025 | Go github.com/strangelove-ventures/horcrux Go github.com/strangelove-ventures/horcrux/v3 |
Fleet has SAML authentication vulnerability due to improper SAML response validation CVE-2025-27509, GHSA-52jx-g6m5-h735, GO-2025-3505 | Critical | 0.7% | 06 Mar, 2025 | Go github.com/fleetdm/fleet/v4 |
Envoy Gateway Log Injection Vulnerability BIT-envoy-gateway-2025-25294, CVE-2025-25294, GHSA-mf24-chxh-hmvj, GO-2025-3504 | Medium | 0.3% | 06 Mar, 2025 | Go github.com/envoyproxy/gateway |
In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim CVE-2025-27155, GHSA-fr62-mg2q-7wqv, GO-2025-3500 | Medium | 0.2% | 04 Mar, 2025 | Go github.com/matrix-org/pinecone |
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations CVE-2025-27507, GHSA-f3gh-529w-v32x, GO-2025-3499 | Critical | 0.6% | 04 Mar, 2025 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution CVE-2025-24976, GHSA-phw4-mc57-4hwc, GO-2025-3460 | 0.4% | 03 Mar, 2025 | Go github.com/distribution/distribution | |
MinIO allows an SFTP authentication bypass due to improperly trusted SSH key CVE-2025-27414, GHSA-wc79-7x8x-2p58, GO-2025-3495 | Medium | 0.6% | 03 Mar, 2025 | Go github.com/minio/minio |
Goroutine Leak in Abacus SSE Implementation CVE-2025-27421, GHSA-vh64-54px-qgf8, GO-2025-3498 | High | 0.4% | 03 Mar, 2025 | Go github.com/jasonlovesdoggo/abacus |
IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement GHSA-jg6f-48ff-5xrw, GO-2025-3494 | Critical | Not scored | 28 Feb, 2025 | Go github.com/cosmos/ibc-go Go github.com/cosmos/ibc-go/v2 Go github.com/cosmos/ibc-go/v3 Go github.com/cosmos/ibc-go/v4 +4 more |
Memos Server-Side Request Forgery (SSRF) CVE-2025-22952, GHSA-wfxg-v3j4-7qmj, GO-2025-3492 | Medium | 2.9% | 27 Feb, 2025 | Go github.com/usememos/memos |
Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login CVE-2025-23389, GHSA-mq23-vvg7-xfm4, GO-2025-3490 | High | 0.5% | 27 Feb, 2025 | Go github.com/rancher/rancher |
Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API CVE-2025-23388, GHSA-xr9q-h9c7-xw8q, GO-2025-3491 | High | 0.6% | 27 Feb, 2025 | Go github.com/rancher/rancher |
Rancher's SAML-based login via CLI can be denied by unauthenticated users CVE-2025-23387, GHSA-5qmp-9x47-92q8, GO-2025-3489 | Medium | 0.6% | 27 Feb, 2025 | Go github.com/rancher/rancher |
golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability CVE-2025-22868, GHSA-6v2p-p543-phr9, GO-2025-3488 | High | 0.9% | 26 Feb, 2025 | Go golang.org/x/oauth2 |
golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange CVE-2025-22869, GHSA-hcg3-q754-cr77, GO-2025-3487 | High | 0.9% | 26 Feb, 2025 | Go golang.org/x/crypto |
Navidrome allows an authentication bypass in Subsonic API with non-existent username CVE-2025-27112, GHSA-c3p4-vm8f-386p, GO-2025-3484 | Medium | 1.0% | 25 Feb, 2025 | Go github.com/navidrome/navidrome |
DoS in go-jose Parsing CVE-2025-27144, GHSA-c6gw-w398-hv78, GO-2025-3485 | Medium | 0.4% | 24 Feb, 2025 | Go github.com/go-jose/go-jose Go github.com/go-jose/go-jose/v3 Go github.com/go-jose/go-jose/v4 Go github.com/square/go-jose |
Mattermost fails to restrict channel export of archived channels CVE-2025-24526, GHSA-q8p2-2hwc-jw64, GO-2025-3481 | Medium | 0.3% | 24 Feb, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows reading arbitrary files related to importing boards CVE-2025-25279, GHSA-5fwx-p6xh-vjrh, GO-2025-3480 | Critical | 24.2% | 24 Feb, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to invalidate all active sessions when converting a user to a bot CVE-2025-1412, GHSA-rhvr-6w8c-6v7w, GO-2025-3482 | Low | 0.3% | 24 Feb, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows reading arbitrary files CVE-2025-20051, GHSA-v469-7wp6-7cvp, GO-2025-3483 | Critical | 0.6% | 24 Feb, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
lakeFS allows an authenticated user to cause a crash by exhausting server memory CVE-2025-27100, GHSA-j7jw-28jm-whr6, GO-2025-3479 | Medium | 0.4% | 21 Feb, 2025 | Go github.com/treeverse/lakefs |
S3-Proxy allows Reflected Cross-site Scripting (XSS) in template implementation CVE-2025-27088, GHSA-pp9m-qf39-hxjc, GO-2025-3477 | High | 0.5% | 20 Feb, 2025 | Go github.com/oxyno-zeta/s3-proxy Go github.com/oxyno-zeta/s3-proxy/cmd/s3-proxy |
Cosmos SDK: Groups module can halt chain when handling a malicious proposal GHSA-x5vx-95h7-rv4p, GO-2025-3476 | High | Not scored | 20 Feb, 2025 | Go github.com/cosmos/cosmos-sdk |
Hermes improperly validates a JWT CVE-2025-1293, GHSA-vxm9-8mfw-vc6g, GO-2025-3475 | High | 0.3% | 20 Feb, 2025 | Go github.com/hashicorp-forge/hermes |
SSRF in sliver teamserver CVE-2025-27090, GHSA-fh4v-v779-4g2w, GO-2025-3472 | Medium | 0.6% | 19 Feb, 2025 | Go github.com/bishopfox/sliver |
OpenFGA Authorization Bypass CVE-2025-25196, GHSA-g4v5-6f5p-m38j, GO-2025-3470 | Medium | 0.4% | 19 Feb, 2025 | Go github.com/openfga/openfga |
Authelia applies regulation separately to Username-based logins to Email-based logins CVE-2025-24806, GHSA-m5mf-3963-4x26, GO-2025-3468 | Low | 0.4% | 19 Feb, 2025 | Go github.com/authelia/authelia Go github.com/authelia/authelia/v4 |
`gh attestation verify` returns incorrect exit code during verification if no attestations are present CVE-2025-25204, GHSA-fgw4-v983-mgp8, GO-2025-3467 | Medium | 0.4% | 14 Feb, 2025 | Go github.com/cli/cli Go github.com/cli/cli/v2 |
Node Denial of Service via kubelet Checkpoint API CVE-2025-0426, GHSA-jgfp-53c3-624w, GO-2025-3465 | Medium | 0.4% | 13 Feb, 2025 | Go k8s.io/kubernetes |
Missing rate limit in MaysWind ezBookkeeping CVE-2024-57603, GHSA-772m-773g-qmhc, GO-2025-3466 | Medium | 0.4% | 13 Feb, 2025 | Go github.com/mayswind/ezbookkeeping |
MaysWind ezBookkeeping has Improper Privilege Management CVE-2024-57604, GHSA-mpg8-8x9c-p9gv, GO-2025-3474 | Critical | 0.7% | 13 Feb, 2025 | Go github.com/mayswind/ezbookkeeping |
Potential Denial-of-Service condition leading to temporary disability in IBC transfers to the native chain GHSA-6fgm-x6ff-w78f, GO-2025-3463 | Medium | Not scored | 12 Feb, 2025 | Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v4 Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v5 Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v6 Go github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v7 +1 more |
go-crypto-winnative BCryptGenerateSymmetricKey memory leak CVE-2025-25199, GHSA-29c6-3hcj-89cf, GO-2025-3461 | High | 1.4% | 12 Feb, 2025 | Go github.com/microsoft/go-crypto-winnative |
Unencrypted transmission in Temporal api-go library CVE-2025-1243, GHSA-q9w6-cwj4-gf4p, GO-2025-3462 | Low | 0.1% | 12 Feb, 2025 | Go go.temporal.io/api |
Wazuh server vulnerable to remote code execution CVE-2025-24016, GHSA-hcrc-79hj-m3qh, GO-2025-3459 | CriticalExploited | 93.8% | 10 Feb, 2025 | Go github.com/wazuh/wazuh |
SFTPGo has insufficient sanitization of user provided rsync command CVE-2025-24366, GHSA-vj7w-3m8c-6vpx, GO-2025-3458 | High | 0.7% | 07 Feb, 2025 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |
WhoDB allows parameter injection in DB connection URIs leading to local file inclusion CVE-2025-24787, GHSA-c7w4-9wv8-7x7c, GO-2025-3457 | High | 0.6% | 06 Feb, 2025 | Go github.com/clidey/whodb/core |
WhoDB has a path traversal opening Sqlite3 database CVE-2025-24786, GHSA-9r4c-jwx3-3j76, GO-2025-3456 | Critical | 2.7% | 06 Feb, 2025 | Go github.com/clidey/whodb/core |
Arbitrary code execution during build on darwin in cmd/go BIT-golang-2025-22867, CVE-2025-22867, GO-2025-3428 | 0.6% | 06 Feb, 2025 | Go toolchain | |
Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec BIT-golang-2025-22866, CVE-2025-22866, GO-2025-3447 | 0.3% | 06 Feb, 2025 | Go stdlib | |
Plenti - Code Injection - Denial of Services CVE-2025-26260, GHSA-mj4v-hp69-27x5, GO-2025-3454, GO-2025-3515 | Medium | 0.8% | 05 Feb, 2025 | Go github.com/plentico/plenti |
Contrast's unauthenticated recovery allows Coordinator impersonation CVE-2025-71426, GHSA-vqv5-385r-2hf8, GO-2025-3455 | High | 0.1% | 05 Feb, 2025 | Go github.com/edgelesssys/contrast |
Vulnerability in github.com/boltdb-go/bolt GO-2025-3451 | Not scored | 05 Feb, 2025 | Go github.com/boltdb-go/bolt | |
Improper Access Control in wazuh-agent in github.com/wazuh/wazuh CVE-2024-35177, GHSA-pmr2-2r83-h3cv, GO-2025-3444 | 0.3% | 04 Feb, 2025 | Go github.com/wazuh/wazuh | |
Ability to view Agent list with no privilege access in wazuh-dashboard in github.com/wazuh/wazuh CVE-2024-47770, GHSA-648q-8m78-5cwv, GO-2025-3445 | 0.3% | 04 Feb, 2025 | Go github.com/wazuh/wazuh |