Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE CVE-2026-52833, GHSA-3v79-m2cg-89ww, GO-2026-6004 | High | Not scored | 16 Jul, 2026 | Go github.com/nuclio/nuclio |
Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode BIT-envoy-gateway-2026-53714, CVE-2026-53714, GHSA-22xc-xg2r-9j7v, GO-2026-6003 | High | Not scored | 16 Jul, 2026 | Go github.com/envoyproxy/gateway |
Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback CVE-2026-50285, GHSA-ggw3-5987-rx77 | High | Not scored | 15 Jul, 2026 | Go github.com/pomerium/pomerium |
dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS CVE-2026-50274, GHSA-74j5-xf3v-crq8, GO-2026-6000 | High | Not scored | 15 Jul, 2026 | Go github.com/DataDog/dd-trace-go Go github.com/DataDog/dd-trace-go/v2 |
Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend CVE-2026-61549, GHSA-qf34-295c-26v8, GO-2026-5992 | High | Not scored | 14 Jul, 2026 | Go github.com/woodpecker-ci/woodpecker Go go.woodpecker-ci.org/woodpecker Go go.woodpecker-ci.org/woodpecker/v2 Go go.woodpecker-ci.org/woodpecker/v3 |
Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` CVE-2026-63464, GHSA-7rx3-5wx3-5v76, GO-2026-5985 | High | Not scored | 14 Jul, 2026 | Go github.com/forgekeep/nebula-mesh |
nebula-mesh: Certificate revocation is never enforced at the mesh CVE-2026-61699, GHSA-cm26-5974-52h8, GO-2026-5986 | High | Not scored | 14 Jul, 2026 | Go github.com/forgekeep/nebula-mesh |
Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode CVE-2026-54629, GHSA-mf78-3rpf-r784, GO-2026-5990 | High | Not scored | 14 Jul, 2026 | Go github.com/julien040/anyquery |
nebula-mesh: Operator session tokens stored in plaintext in the database CVE-2026-53603, GHSA-q4vm-pq3q-8wgq, GO-2026-5991 | High | Not scored | 14 Jul, 2026 | Go github.com/forgekeep/nebula-mesh |
nebula-mesh: CA private key not zeroized on web mobile-bundle error paths CVE-2026-53604, GHSA-2p2f-px33-4vv5, GO-2026-5984 | High | Not scored | 14 Jul, 2026 | Go github.com/forgekeep/nebula-mesh |
Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode CVE-2026-54628, GHSA-hwrq-8wxh-q4xv, GO-2026-5988 | High | Not scored | 14 Jul, 2026 | Go github.com/julien040/anyquery |
Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware GHSA-mqxv-9rm6-w8qc, GO-2026-5981 | High | Not scored | 14 Jul, 2026 | Go github.com/lin-snow/ech0 |
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser CVE-2026-54448, GHSA-q3fv-x8vg-qqm4, GO-2026-5983 | High | Not scored | 14 Jul, 2026 | Go github.com/aquasecurity/trivy |
TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services GHSA-pqg7-v6wh-3pfp, GO-2026-5982 | High | Not scored | 14 Jul, 2026 | Go github.com/almeidapaulopt/tsdproxy |
yutu: Arbitrary File Write via MCP `caption-download` Tool CVE-2026-50158, GHSA-2c7f-fxww-6w6c, GO-2026-5980 | High | Not scored | 14 Jul, 2026 | Go github.com/eat-pray-ai/yutu |
Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation CVE-2026-50141, GHSA-g7mm-9vx7-jm7h, GO-2026-5976 | High | Not scored | 14 Jul, 2026 | Go go.woodpecker-ci.org/woodpecker Go go.woodpecker-ci.org/woodpecker/v2 Go go.woodpecker-ci.org/woodpecker/v3 |
MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion CVE-2026-50125, GHSA-qw5r-ppcg-f8rj, GO-2026-5978 | High | Not scored | 14 Jul, 2026 | Go github.com/StacklokLabs/mkp |
Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode CVE-2026-50013, GHSA-qrh4-p6v4-mrfg, GO-2026-5977 | High | Not scored | 14 Jul, 2026 | Go github.com/SpectoLabs/hoverfly |
OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection CVE-2026-44300, GHSA-wmj8-9953-vff5, GO-2026-5974 | High | Not scored | 14 Jul, 2026 | Go github.com/opencost/opencost |
melange: Incomplete package integrity verification allows data section substitution CVE-2026-54174, GHSA-fpg8-7664-jc5q, GO-2026-5968 | High | Not scored | 10 Jul, 2026 | Go chainguard.dev/apko Go chainguard.dev/melange |
SiYuan: Stored XSS in Bazaar marketplace via package README event handlers CVE-2026-54070, GHSA-w7cg-whh7-xp28, GO-2026-5965 | High | Not scored | 10 Jul, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) CVE-2026-54063, GHSA-h69g-9hx6-f3v4, GO-2026-5960 | High | Not scored | 10 Jul, 2026 | Go github.com/xuri/excelize/v2 |
SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894 CVE-2026-54066, GHSA-p4m3-mgmm-c664, GO-2026-5964 | High | Not scored | 10 Jul, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) CVE-2026-50553, GHSA-rqrh-8wpv-x7hh, GO-2026-5949 | High | Not scored | 09 Jul, 2026 | Go github.com/enchant97/note-mark/backend |
Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests CVE-2026-50197, GHSA-659f-rgp5-w4wf, GO-2026-5944 | High | Not scored | 08 Jul, 2026 | Go github.com/zalando/skipper |
Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise CVE-2026-114665, CVE-2026-53553, GHSA-4g5x-hcwm-82jw, GO-2026-5938 | High | Not scored | 07 Jul, 2026 | Go github.com/zhenorzz/goploy |
New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs CVE-2026-33655, GHSA-6qcr-qxgr-m7fv, GO-2026-5930 | High | Not scored | 07 Jul, 2026 | Go github.com/QuantumNous/new-api |
Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write CVE-2026-63443, GHSA-qrwj-vh9x-gw5v, GO-2026-5923 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder's AI Bridge Proxy skips TLS certificate verification in default configuration CVE-2026-55436, GHSA-84rm-42xw-mx52, GO-2026-5920 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps CVE-2026-55431, GHSA-v54h-cp2w-9x4g, GO-2026-5924 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator CVE-2026-55428, GHSA-wrq8-fcv5-8hvp, GO-2026-5915 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID CVE-2026-55429, GHSA-9rjw-3gwp-f59v, GO-2026-5909 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` CVE-2026-55427, GHSA-mcqq-fqgf-rxwm, GO-2026-5913 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder: User-admin role can reset owner account password CVE-2026-55077, GHSA-29xf-69gq-m9jx, GO-2026-5906 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass CVE-2026-55075, GHSA-9r87-mvcw-x35f, GO-2026-5908 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking CVE-2026-55076, GHSA-75vm-6w67-gwvp, GO-2026-5907 | High | Not scored | 06 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Gitea forwarded-proto validation allows canonical URL spoofing CVE-2026-27779, GHSA-v8f2-2ghq-9whv, GO-2026-6345 | High | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea pull request branch permission checks allow unauthorized updates and rebases CVE-2026-24690, GHSA-47rq-xp99-92mx, GO-2026-6334 | High | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea organization permission APIs expose hidden membership and private organization data CVE-2026-25712, GHSA-37w2-86g3-h4qh, GO-2026-6333 | High | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea git grep searches allow server resource exhaustion CVE-2026-26307, GHSA-h9c5-x7g8-4q7f, GO-2026-6341 | High | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea primary email ownership bypass allows cross-user email changes CVE-2026-27657, GHSA-4c8f-3m6h-m56r, GO-2026-6335 | High | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Gitea draft releases and attachments are exposed without write permission CVE-2026-27660, GHSA-x92v-f5gc-r34v, GO-2026-6347 | High | Not scored | 03 Jul, 2026 | Go code.gitea.io/gitea |
Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename CVE-2026-52792, GHSA-mm6c-5j6x-hq8m, GO-2026-5903 | High | Not scored | 02 Jul, 2026 | Go github.com/xyproto/algernon |
Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent CVE-2026-44454, GHSA-m3cr-vc2j-pm27, GO-2026-5897 | High | Not scored | 02 Jul, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags CVE-2026-50138, GHSA-3whc-qvhv-xqjp, GO-2026-5878 | High | Not scored | 01 Jul, 2026 | Go goshs.de/goshs Go goshs.de/goshs/v2 |
`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution CVE-2026-50163, GHSA-fxhp-mv3v-67qp, GO-2026-5880 | High | Not scored | 01 Jul, 2026 | Go oras.land/oras-go/v2 |
oras-go blob upload vulnerable to credential forwarding via unvalidated Location header CVE-2026-50151, GHSA-jxpm-75mh-9fp7, GO-2026-5882 | High | Not scored | 01 Jul, 2026 | Go oras.land/oras-go/v2 |
Rancher has over-inclusive team membership expansion in GitHub App authentication provider CVE-2026-41053, GHSA-4j6x-2764-m8gh, GO-2026-5869 | High | Not scored | 01 Jul, 2026 | Go github.com/rancher/rancher |
Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components CVE-2026-44937, GHSA-jmf4-m7j9-g72r, GO-2026-5874 | High | Not scored | 01 Jul, 2026 | Go github.com/rancher/fleet |
Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent CVE-2026-44938, GHSA-864g-863m-vcvq, GO-2026-5871 | High | Not scored | 01 Jul, 2026 | Go github.com/rancher/fleet |