Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OPKSSH Vulnerable to Authentication Bypass CVE-2025-4658, GHSA-56wx-66px-9j66, GO-2025-3680 | Critical | Not scored | 13 May, 2025 | Go github.com/openpubkey/opkssh |
OpenPubkey Vulnerable to Authentication Bypass CVE-2025-3757, GHSA-537f-gxgm-3jjq, GO-2025-3679 | Critical | Not scored | 13 May, 2025 | Go github.com/openpubkey/openpubkey |
goshs route not protected, allows command execution CVE-2025-46816, GHSA-rwj2-w85g-5cmm, GO-2025-3672 | Critical | Not scored | 06 May, 2025 | Go github.com/patrickhener/goshs |
Traefik affected by Go HTTP Request Smuggling Vulnerability GHSA-5423-jcjm-2gpv, GO-2025-3627 | Critical | Not scored | 18 Apr, 2025 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
NATS Server may fail to authorize certain Jetstream admin APIs BIT-nats-2025-30215, CVE-2025-30215, GHSA-fhg8-qxh5-7q3w, GO-2025-3600 | Critical | Not scored | 15 Apr, 2025 | Go github.com/nats-io/nats-server/v2 |
Dpanel's hard-coded JWT secret leads to remote code execution CVE-2025-30206, GHSA-j752-cjcj-w847, GO-2025-3612 | Critical | Not scored | 15 Apr, 2025 | Go github.com/donknap/dpanel |
Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR CVE-2025-32445, GHSA-hmp7-x699-cvhq, GO-2025-3608 | Critical | Not scored | 14 Apr, 2025 | Go github.com/argoproj/argo-events |
RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency BIT-golang-2025-22871, CVE-2025-22871, GHSA-g9pc-8g42-g6vq, GO-2025-3563 | Critical | 0.8% | 08 Apr, 2025 | Go stdlib Packagist spiral/roadrunner |
Rancher: Restricted Administrator can change Administrator's passwords CVE-2025-23391, GHSA-8p83-cpfg-fj3g, GO-2025-3586 | Critical | Not scored | 01 Apr, 2025 | Go github.com/rancher/rancher |
Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input CVE-2025-30223, GHSA-2j42-h78h-q4fg, GO-2025-3585 | Critical | Not scored | 31 Mar, 2025 | Go github.com/beego/beego Go github.com/beego/beego/v2 |
ingress-nginx admission controller RCE escalation CVE-2025-1974, GHSA-mgvx-rpfc-9mpv, GO-2025-3567 | Critical | Not scored | 25 Mar, 2025 | Go k8s.io/ingress-nginx |
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace CVE-2025-29922, GHSA-w2rr-38wv-8rrp, GO-2025-3538 | Critical | Not scored | 20 Mar, 2025 | Go github.com/kcp-dev/kcp |
cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002) GHSA-h2rp-8vpx-q9r4, GO-2025-3520 | Critical | Not scored | 13 Mar, 2025 | Go github.com/cheqd/cheqd-node |
IBC-Go: Non-deterministic JSON Unmarshalling of IBC Acknowledgement can result in a chain halt GHSA-4wf3-5qj9-368v, GO-2025-3517 | Critical | Not scored | 12 Mar, 2025 | Go github.com/cosmos/ibc-go Go github.com/cosmos/ibc-go/v2 Go github.com/cosmos/ibc-go/v3 Go github.com/cosmos/ibc-go/v4 +4 more |
cheqd-node affected by Non-deterministic JSON Unmarshalling of IBC Acknowledgement GHSA-33cr-m232-xqch, GO-2025-3514 | Critical | Not scored | 11 Mar, 2025 | Go github.com/cheqd/cheqd-node |
Fleet has SAML authentication vulnerability due to improper SAML response validation CVE-2025-27509, GHSA-52jx-g6m5-h735, GO-2025-3505 | Critical | Not scored | 06 Mar, 2025 | Go github.com/fleetdm/fleet/v4 |
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations CVE-2025-27507, GHSA-f3gh-529w-v32x, GO-2025-3499 | Critical | Not scored | 04 Mar, 2025 | Go github.com/zitadel/zitadel Go github.com/zitadel/zitadel/v2 |
IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement GHSA-jg6f-48ff-5xrw, GO-2025-3494 | Critical | Not scored | 28 Feb, 2025 | Go github.com/cosmos/ibc-go Go github.com/cosmos/ibc-go/v2 Go github.com/cosmos/ibc-go/v3 Go github.com/cosmos/ibc-go/v4 +4 more |
Mattermost allows reading arbitrary files related to importing boards CVE-2025-25279, GHSA-5fwx-p6xh-vjrh, GO-2025-3480 | Critical | Not scored | 24 Feb, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows reading arbitrary files CVE-2025-20051, GHSA-v469-7wp6-7cvp, GO-2025-3483 | Critical | Not scored | 24 Feb, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
MaysWind ezBookkeeping has Improper Privilege Management CVE-2024-57604, GHSA-mpg8-8x9c-p9gv, GO-2025-3474 | Critical | Not scored | 13 Feb, 2025 | Go github.com/mayswind/ezbookkeeping |
Wazuh server vulnerable to remote code execution CVE-2025-24016, GHSA-hcrc-79hj-m3qh, GO-2025-3459 | CriticalExploited | 93.8% | 10 Feb, 2025 | Go github.com/wazuh/wazuh |
WhoDB has a path traversal opening Sqlite3 database CVE-2025-24786, GHSA-9r4c-jwx3-3j76, GO-2025-3456 | Critical | Not scored | 06 Feb, 2025 | Go github.com/clidey/whodb/core |
go-git has an Argument Injection via the URL field CVE-2025-21613, GHSA-v725-9546-7q7m, GO-2025-3368 | Critical | Not scored | 06 Jan, 2025 | Go github.com/go-git/go-git/v4 Go github.com/go-git/go-git/v5 Go gopkg.in/src-d/go-git.v4 |
GoCast OS Command Injection vulnerability CVE-2024-28892, GHSA-5qww-56gc-f66c, GO-2024-3359 | Critical | Not scored | 20 Dec, 2024 | Go github.com/mayuresh82/gocast |
Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45337, GHSA-v778-237x-gjrc, GO-2024-3321 | Critical | Not scored | 11 Dec, 2024 | Go golang.org/x/crypto |
unstructured XML External Entity (XXE) CVE-2024-46455, GHSA-32r8-54hf-c9p3, GO-2024-3315, PYSEC-2026-1993 | Critical | 0.6% | 09 Dec, 2024 | Go github.com/Unstructured-IO/unstructured PyPI unstructured |
Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE CVE-2024-51735, GHSA-wvv7-wm5v-w2gv, GO-2024-3254 | Critical | Not scored | 05 Nov, 2024 | Go github.com/j3ssie/osmedeus |
NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability CVE-2024-0132, GHSA-mjjw-553x-87pq, GO-2024-3239 | Critical | Not scored | 29 Oct, 2024 | Go github.com/NVIDIA/nvidia-container-toolkit |
github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses GHSA-7h65-4p22-39j6, GO-2024-3219 | Critical | Not scored | 25 Oct, 2024 | Go github.com/crossplane/crossplane |
RKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists GHSA-x7xj-jvwp-97rv, GO-2024-3222 | Critical | Not scored | 25 Oct, 2024 | Go github.com/rancher/rke2 |
Rancher Remote Code Execution via Cluster/Node Drivers CVE-2024-22036, GHSA-h99m-6755-rgwc, GO-2024-3221 | Critical | Not scored | 25 Oct, 2024 | Go github.com/rancher/rancher |
Grafana Command Injection And Local File Inclusion Via Sql Expressions BIT-grafana-2024-9264, CVE-2024-9264, GHSA-q99m-qcv4-fpm7, GO-2024-3215 | Critical | Not scored | 18 Oct, 2024 | Go github.com/grafana/grafana |
VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder CVE-2024-9486, GHSA-9224-ggvw-wh7v, GO-2024-3203 | Critical | Not scored | 15 Oct, 2024 | Go github.com/kubernetes-sigs/image-builder |
SSOReady has an XML Signature Bypass via differential XML parsing CVE-2024-47832, GHSA-j2hr-q93x-gxvh, GO-2024-3185 | Critical | Not scored | 11 Oct, 2024 | Go github.com/ssoready/ssoready |
Mellium allows Authentication Bypass by Spoofing CVE-2024-46957, GHSA-98hf-m87w-cq6h, GO-2024-3157 | Critical | Not scored | 25 Sep, 2024 | Go mellium.im/xmpp |
Navidrome has Multiple SQL Injections and ORM Leak CVE-2024-47062, GHSA-58vj-cv5w-v4v6, GO-2024-3153 | Critical | Not scored | 20 Sep, 2024 | Go github.com/navidrome/navidrome |
HTTP client can manipulate custom HTTP headers that are added by Traefik CVE-2024-45410, GHSA-62c8-mh53-4cqv, GO-2024-3135 | Critical | Not scored | 19 Sep, 2024 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Dragonfly2 has hard coded cyptographic key CVE-2023-27584, GHSA-hpc8-7wpm-889w, GO-2024-3136 | Critical | Not scored | 19 Sep, 2024 | Go d7y.io/dragonfly/v2 |
Grafana plugin SDK Information Leakage CVE-2024-8986, GHSA-xxxw-3j6h-q7h6, GO-2024-3140 | Critical | Not scored | 19 Sep, 2024 | Go github.com/grafana/grafana-plugin-sdk-go |
Chaosblade vulnerable to OS command execution CVE-2023-47105, GHSA-723h-x37g-f8qm, GO-2024-3133 | Critical | Not scored | 18 Sep, 2024 | Go github.com/chaosblade-io/chaosblade |
GoAuthentik vulnerable to Insufficient Authorization for several API endpoints BIT-authentik-2024-42490, CVE-2024-42490, GHSA-qxqc-27pr-wgc8, GO-2024-3085 | Critical | Not scored | 22 Aug, 2024 | Go goauthentik.io |
SQL injection in github.com/stashapp/stash CVE-2024-32231, GHSA-75jf-52jg-qqh4, GO-2024-3070 | Critical | Not scored | 15 Aug, 2024 | Go github.com/stashapp/stash |
RBAC Roles for `etcd` created by Kamaji are not disjunct CVE-2024-42480, GHSA-6r4j-4rjc-8vw5, GO-2024-3063 | Critical | Not scored | 12 Aug, 2024 | Go github.com/clastix/kamaji |
Gitea Cross-site Scripting Vulnerability CVE-2024-6886, GHSA-4h4p-553m-46qh, GO-2024-3056 | Critical | Not scored | 06 Aug, 2024 | Go code.gitea.io/gitea |
rudder-server is vulnerable to SQL injection CVE-2023-30625, GHSA-3jmm-f6jj-rcc3, GO-2023-1863 | Critical | Not scored | 05 Aug, 2024 | Go github.com/rudderlabs/rudder-server |
CasaOS Command Injection vulnerability CVE-2023-37469, GHSA-92vc-4fcw-g68q, GO-2023-2026 | Critical | Not scored | 05 Aug, 2024 | Go github.com/IceWhaleTech/CasaOS |
Mattermost allows unsolicited invites to expose access to local channels CVE-2024-39777, GHSA-q22q-2rrf-m27p, GO-2024-3092 | Critical | Not scored | 01 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel CVE-2024-39274, GHSA-cmc8-222c-vqp9, GO-2024-3028 | Critical | Not scored | 01 Aug, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
pREST vulnerable to jwt bypass + sql injection GHSA-wm25-j4gw-6vr3, GO-2024-3011 | Critical | Not scored | 30 Jul, 2024 | Go github.com/prest/prest |