Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints CVE-2026-25579, GHSA-hrr4-3wgr-68x3, GO-2026-4411 | Critical | Not scored | 04 Feb, 2026 | Go github.com/navidrome/navidrome |
SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE CVE-2026-25539, GHSA-c4jr-5q7w-f6r9, GO-2026-4387 | Critical | Not scored | 29 Jan, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Kyverno Cross-Namespace Privilege Escalation via Policy apiCall BIT-kyverno-2026-22039, CVE-2026-22039, GHSA-8p9x-46gm-qfx2, GO-2026-4381 | Critical | Not scored | 27 Jan, 2026 | Go github.com/kyverno/kyverno |
Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value CVE-2025-66719, GHSA-q7c8-gfjh-8v4p, GO-2026-5570 | Critical | Not scored | 23 Jan, 2026 | Go github.com/free5gc/nrf |
Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment CVE-2026-23518, GHSA-63m5-974w-448v, GO-2026-4335 | Critical | Not scored | 20 Jan, 2026 | Go github.com/fleetdm/fleet Go github.com/fleetdm/fleet/v4 |
External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function CVE-2026-22822, GHSA-77v3-r3jw-j2v2, GO-2026-4330 | Critical | Not scored | 20 Jan, 2026 | Go github.com/external-secrets/external-secrets |
Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE CVE-2026-23520, GHSA-gjqq-6r35-w3r8, GO-2026-4320 | Critical | Not scored | 15 Jan, 2026 | Go github.com/getarcaneapp/arcane/backend |
WeKnora has Command Injection in MCP stdio test CVE-2026-22688, GHSA-78h3-63c4-5fqc, GO-2026-4292 | Critical | Not scored | 09 Jan, 2026 | Go github.com/Tencent/WeKnora |
OpenFlagr contains an authentication bypass vulnerability in the HTTP middleware CVE-2026-0650, GHSA-rwp9-5g7q-73q3, GO-2026-4286 | Critical | Not scored | 07 Jan, 2026 | Go github.com/openflagr/flagr |
Bypassing Kyverno Policies via Double Policy Exceptions BIT-kyverno-2026-84200, CVE-2026-84200, GHSA-gg4x-fgg2-h9w9, GO-2026-4285 | Critical | Not scored | 06 Jan, 2026 | Go github.com/kyverno/kyverno |
Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer CVE-2025-62877, GHSA-6g8q-hp2j-gvwv, GO-2026-4281 | Critical | Not scored | 05 Jan, 2026 | Go github.com/harvester/harvester-installer |
Ollama Platform has missing authentication enabling attackers to perform model management operations CVE-2025-63389, GHSA-f6mr-38g8-39rg, GO-2025-4251 | Critical | Not scored | 18 Dec, 2025 | Go github.com/ollama/ollama |
OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources CVE-2025-13888, GHSA-pcqx-8qww-7f4v, GO-2025-4242 | Critical | Not scored | 15 Dec, 2025 | Go github.com/redhat-developer/gitops-operator |
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login CVE-2025-67494, GHSA-7wfc-4796-gmg5, GO-2025-4210 | Critical | Not scored | 08 Dec, 2025 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values CVE-2025-66565, GHSA-m98w-cqp3-qcqr, GO-2025-4208 | Critical | Not scored | 08 Dec, 2025 | Go github.com/gofiber/utils Go github.com/gofiber/utils/v2 |
Step CA Has Authorization Bypass in ACME and SCEP Provisioners CVE-2025-44005, GHSA-h8cp-697h-8c8p, GO-2025-4180 | Critical | Not scored | 03 Dec, 2025 | Go github.com/smallstep/certificates |
Mattermost fails to to verify the token used during code exchange CVE-2025-12421, GHSA-mp6x-97xj-9x62, GO-2025-4170 | Critical | Not scored | 27 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication CVE-2025-12419, GHSA-3x39-62h4-f8j6, GO-2025-4168 | Critical | Not scored | 27 Nov, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction GHSA-rj4j-2jph-gg43, GO-2025-4158 | Critical | Not scored | 24 Nov, 2025 | Go github.com/lf-edge/ekuiper Go github.com/lf-edge/ekuiper/v2 |
Grafana Incorrect Privilege Assignment vulnerability BIT-grafana-2025-41115, CVE-2025-41115, GHSA-w62r-7c53-fmc5, GO-2025-4153 | Critical | Not scored | 21 Nov, 2025 | Go github.com/grafana/grafana |
File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency GHSA-6jqf-mv7m-3q7p, GO-2025-4118 | Critical | Not scored | 13 Nov, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Milvus Proxy has a Critical Authentication Bypass Vulnerability BIT-milvus-2025-64513, CVE-2025-64513, GHSA-mhjq-8c7m-3f7p, GO-2025-4114 | Critical | Not scored | 13 Nov, 2025 | Go github.com/milvus-io/milvus |
Soft Serve is vulnerable to SSRF through its Webhooks CVE-2025-64522, GHSA-vwq2-jx9q-9h9f, GO-2025-4111 | Critical | Not scored | 10 Nov, 2025 | Go github.com/charmbracelet/soft-serve |
Karmada Dashboard API Unauthorized Access Vulnerability CVE-2025-62714, GHSA-5qjg-9mjh-4r92, GO-2025-4072 | Critical | Not scored | 24 Oct, 2025 | Go github.com/karmada-io/dashboard |
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow CVE-2025-54469, GHSA-c8g6-qrwh-m3vp, GO-2025-4042 | Critical | Not scored | 21 Oct, 2025 | Go github.com/neuvector/neuvector |
Cosmos EVM Vulnerability GHSA-8pfh-j44r-f654, GO-2025-4041 | Critical | Not scored | 21 Oct, 2025 | Go github.com/cosmos/evm |
NetBird VPN does not remove the default password of an admin account CVE-2025-10678, GHSA-g3j4-58mp-3x25, GO-2025-4040 | Critical | Not scored | 20 Oct, 2025 | Go github.com/netbirdio/netbird |
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning CVE-2025-59823, GHSA-227x-7mh8-3cf6, GO-2025-3981 | Critical | Not scored | 25 Sep, 2025 | Go github.com/gardener/gardener-extension-provider-aws Go github.com/gardener/gardener-extension-provider-azure Go github.com/gardener/gardener-extension-provider-gcp Go github.com/gardener/gardener-extension-provider-openstack |
Chaos Controller Manager is vulnerable to OS command injection CVE-2025-59359, GHSA-369h-6j28-wwcg, GO-2025-3952 | Critical | Not scored | 15 Sep, 2025 | Go github.com/chaos-mesh/chaos-mesh |
Chaos Controller Manager is vulnerable to OS command injection CVE-2025-59360, GHSA-xv9f-728h-9jgv, GO-2025-3954 | Critical | Not scored | 15 Sep, 2025 | Go github.com/chaos-mesh/chaos-mesh |
Chaos Controller Manager is vulnerable to OS command injection CVE-2025-59361, GHSA-2gcv-3qpf-c5qr, GO-2025-3949 | Critical | Not scored | 15 Sep, 2025 | Go github.com/chaos-mesh/chaos-mesh |
Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation CVE-2025-54123, GHSA-r4h8-hfp2-ggmf, GO-2025-3944 | Critical | Not scored | 10 Sep, 2025 | Go github.com/SpectoLabs/hoverfly |
pREST has a Systemic SQL Injection Vulnerability CVE-2025-58450, GHSA-p46v-f2x8-qp98, GO-2025-3941 | Critical | Not scored | 08 Sep, 2025 | Go github.com/prest/prest Go github.com/prest/prest/v2 |
Argo CD's Project API Token Exposes Repository Credentials BIT-argo-cd-2025-55190, CVE-2025-55190, GHSA-786q-9hcg-v9ff, GO-2025-3934 | Critical | Not scored | 04 Sep, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 Go github.com/argoproj/argo-cd/v3 |
NeuVector admin account has insecure default password CVE-2025-8077, GHSA-8pxw-9c75-6w56, GO-2025-3918 | Critical | Not scored | 28 Aug, 2025 | Go github.com/neuvector/neuvector |
HydrAIDE Authentication Bypass Vulnerability GHSA-qp7j-x725-g67f, GO-2025-3895 | Critical | Not scored | 19 Aug, 2025 | Go github.com/hydraide/hydraide |
Capsule tenant owners with "patch namespace" permission can hijack system namespaces label CVE-2025-55205, GHSA-fcpm-6mxq-m5vv, GO-2025-3893 | Critical | Not scored | 18 Aug, 2025 | Go github.com/projectcapsule/capsule |
Privileged OpenBao Operator May Execute Code on the Underlying Host BIT-openbao-2025-54997, CVE-2025-54997, GHSA-xp75-r577-cvhp, GO-2025-3858 | Critical | Not scored | 08 Aug, 2025 | Go github.com/openbao/openbao |
Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration BIT-vault-2025-6000, CVE-2025-6000, GHSA-mr4h-qf9j-f665, GO-2025-3838 | Critical | Not scored | 01 Aug, 2025 | Go github.com/hashicorp/vault |
OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion BIT-oauth2-proxy-2025-54576, CVE-2025-54576, GHSA-7rh7-c77v-6434, GO-2025-3833 | Critical | Not scored | 30 Jul, 2025 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
NVIDIA Container Toolkit for all platforms contains an Untrusted Search Path CVE-2025-23266, GHSA-vmg3-7v43-9g23, GO-2025-3992 | Critical | Not scored | 17 Jul, 2025 | Go github.com/NVIDIA/gpu-operator Go github.com/NVIDIA/k8s-device-plugin Go github.com/NVIDIA/mig-parted Go github.com/NVIDIA/nvidia-container-toolkit |
Gogs allows deletion of internal files which leads to remote command execution CVE-2024-56731, GHSA-wj44-9vcg-wjq7, GO-2025-3776 | Critical | Not scored | 24 Jun, 2025 | Go gogs.io/gogs |
Mattermost allows authenticated users to write files to arbitrary locations CVE-2025-4981, GHSA-qh58-9v3j-wcjc, GO-2025-3769 | Critical | Not scored | 20 Jun, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Teleport allows remote authentication bypass CVE-2025-49825, GHSA-8cqv-pj7f-pwpc, GO-2025-3763 | Critical | Not scored | 16 Jun, 2025 | Go github.com/gravitational/teleport |
listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user CVE-2025-49136, GHSA-jc7g-x28f-3v3h, GO-2025-3745 | Critical | Not scored | 09 Jun, 2025 | Go github.com/knadh/listmonk |
Fabio allows HTTP clients to manipulate custom headers it adds CVE-2025-48865, GHSA-q7p4-7xjv-j3wf, GO-2025-3722 | Critical | Not scored | 29 May, 2025 | Go github.com/fabiolb/fabio |
Argo CD allows cross-site scripting on repositories page BIT-argo-cd-2025-47933, CVE-2025-47933, GHSA-2hj5-g64g-fp6p, GO-2025-3720 | Critical | Not scored | 28 May, 2025 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 Go github.com/argoproj/argo-cd/v3 |
Gardener allows metadata injection for a project secret which can lead to privilege escalation CVE-2025-47284, GHSA-9x73-87fh-54w9, GO-2025-3698 | Critical | Not scored | 19 May, 2025 | Go github.com/gardener/gardener |
Gardener allows bypassing project secret validation which can lead to privilege escalation CVE-2025-47283, GHSA-3hw7-qj9h-r835, GO-2025-3696 | Critical | Not scored | 19 May, 2025 | Go github.com/gardener/gardener |
Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation CVE-2025-47282, GHSA-xwgg-m7fx-83wx, GO-2025-3697 | Critical | Not scored | 19 May, 2025 | Go github.com/gardener/external-dns-management Go github.com/gardener/gardener-extension-shoot-dns-service |