Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass CVE-2026-49998, GHSA-g6vg-wj8f-48cj, GO-2026-5872 | High | Not scored | 01 Jul, 2026 | Go github.com/centrifugal/centrifugo Go github.com/centrifugal/centrifugo/v3 Go github.com/centrifugal/centrifugo/v4 Go github.com/centrifugal/centrifugo/v5 +1 more |
Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage CVE-2026-49478, GHSA-f5mr-q85p-6hh6, GO-2026-5853 | High | Not scored | 30 Jun, 2026 | Go github.com/sigstore/fulcio |
Nightingale exposes datasource credentials to low-privilege users CVE-2026-58167, GHSA-27c6-wp53-387x, GO-2026-6638 | High | Not scored | 30 Jun, 2026 | Go github.com/ccfos/nightingale Go github.com/ccfos/nightingale/v4 Go github.com/ccfos/nightingale/v5 Go github.com/ccfos/nightingale/v6 |
Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook CVE-2026-49824, GHSA-cvw6-gfvv-953q, GO-2026-5852 | High | Not scored | 30 Jun, 2026 | Go github.com/fission/fission |
Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook CVE-2026-49823, GHSA-3r8v-2xmj-5c39, GO-2026-5846 | High | Not scored | 30 Jun, 2026 | Go github.com/fission/fission |
Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance CVE-2026-49822, GHSA-gc3j-79f2-7vvw, GO-2026-5854 | High | Not scored | 30 Jun, 2026 | Go github.com/fission/fission |
Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration CVE-2026-49821, GHSA-vjhc-cf4p-72q4, GO-2026-5859 | High | Not scored | 30 Jun, 2026 | Go github.com/fission/fission |
Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec GHSA-7m8x-qg2j-4m3v, GO-2026-5849 | High | Not scored | 30 Jun, 2026 | Go github.com/fission/fission |
Kahi has privilege-drop and socket/log permission issues GHSA-55f6-4pr5-c7m5, GO-2026-5847 | High | Not scored | 30 Jun, 2026 | Go github.com/kahiteam/kahi |
Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query CVE-2026-44840, GHSA-q2m9-6jp9-c6mc, GO-2026-5837 | High | Not scored | 29 Jun, 2026 | Go github.com/dgraph-io/dgraph Go github.com/dgraph-io/dgraph/v25 Go github.com/hypermodeinc/dgraph/v24 |
Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR) CVE-2026-49338, GHSA-hmgp-w9jm-vp95, GO-2026-5830 | High | Not scored | 26 Jun, 2026 | Go go.senan.xyz/gonic |
gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists CVE-2026-49339, GHSA-2fp4-5v5c-4448, GO-2026-5825 | High | Not scored | 26 Jun, 2026 | Go go.senan.xyz/gonic |
gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host CVE-2026-49340, GHSA-4gxv-p5g5-j7w7, GO-2026-5827 | High | Not scored | 26 Jun, 2026 | Go go.senan.xyz/gonic |
Blnk has an API key authorization bypass in owner and scope enforcement GHSA-wcr3-9x4c-f5gj, GO-2026-5823 | High | Not scored | 26 Jun, 2026 | Go github.com/blnkfinance/blnk |
Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete) CVE-2026-49258, GHSA-c6v2-3ffm-vcmc, GO-2026-5816 | High | Not scored | 26 Jun, 2026 | Go github.com/juev/nebula-mesh |
Hysteria: http large header with sniff cause server DoS GHSA-jqc5-2p7q-fqfc, GO-2026-5813 | High | Not scored | 26 Jun, 2026 | Go github.com/apernet/hysteria |
Hysteria vulnerable to server crash when max_datagram_frame_size very small GHSA-qh5x-rfwf-rvfv, GO-2026-5807 | High | Not scored | 26 Jun, 2026 | Go github.com/apernet/hysteria |
Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF GHSA-vgrc-hq28-p3xp, GO-2026-5809 | High | Not scored | 26 Jun, 2026 | Go github.com/apernet/hysteria/core Go github.com/apernet/hysteria/core/v2 |
Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing CVE-2026-48788, GHSA-4c8j-mgm4-qqvp, GO-2026-5804 | High | Not scored | 26 Jun, 2026 | Go github.com/umputun/remark42 |
Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic CVE-2026-48702, GHSA-47q9-m4ww-924m, GO-2026-5778 | High | Not scored | 25 Jun, 2026 | Go github.com/sigstore/rekor |
chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header CVE-2026-72816, GHSA-rjr7-jggh-pgcp, GO-2026-5777 | High | Not scored | 25 Jun, 2026 | Go github.com/go-chi/chi/middleware Go github.com/go-chi/chi/v2/middleware Go github.com/go-chi/chi/v3/middleware Go github.com/go-chi/chi/v4/middleware +2 more |
chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution CVE-2026-72817, GHSA-9g5q-2w5x-hmxf, GO-2026-5775 | High | Not scored | 25 Jun, 2026 | Go github.com/go-chi/chi/middleware Go github.com/go-chi/chi/v2/middleware Go github.com/go-chi/chi/v3/middleware Go github.com/go-chi/chi/v4/middleware +2 more |
OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination CVE-2026-48708, GHSA-7fq5-7wr8-rjwj, GO-2026-5216 | High | Not scored | 24 Jun, 2026 | Go github.com/OliveTin/OliveTin |
Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir CVE-2026-48126, GHSA-jc3j-x6pg-4hmv, GO-2026-5460 | High | Not scored | 23 Jun, 2026 | Go github.com/xyproto/algernon |
Gogs: LFS dedupe path leaks private repo content across tenants CVE-2026-52812, GHSA-6p9m-q3jp-47h4, GO-2026-5184 | High | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion CVE-2026-52810, GHSA-wmfg-5p4h-5fw3, GO-2026-5712 | High | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs's write-level collaborators can mutate admin-only repository settings via API CVE-2026-52808, GHSA-268j-37xf-pp52, GO-2026-5065 | High | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft CVE-2026-52805, GHSA-g2f5-gjr4-qjvm, GO-2026-5387 | High | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs has the ability to import local repositories via Mirror Settings CVE-2026-52801, GHSA-wv27-2vqp-j7g5, GO-2026-5724 | High | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs Vulnerable to CSRF Leading to Organization Owner Takeover CVE-2026-52800, GHSA-pwx3-qcgw-vh7h, GO-2026-5556 | High | Not scored | 23 Jun, 2026 | Go gogs.io/gogs |
Gogs Missing Authorization in Attachment Download CVE-2026-52799, GHSA-p9f5-h3rx-j5qw, GO-2026-5536 | High | Not scored | 22 Jun, 2026 | Go gogs.io/gogs |
Gogs has Stored XSS in `.ipynb` Preview CVE-2026-52798, GHSA-jq8v-rmf6-65jw, GO-2026-5477 | High | Not scored | 22 Jun, 2026 | Go gogs.io/gogs |
Gogs has SSRF in webhook deliveries CVE-2026-47267, GHSA-c4v7-xg93-qf8g, GO-2026-5312 | High | Not scored | 22 Jun, 2026 | Go gogs.io/gogs |
Gophish contains a denial of service vulnerability CVE-2026-39904, GHSA-42jc-v69j-g38f, GO-2026-6212 | High | Not scored | 22 Jun, 2026 | Go github.com/gophish/gophish |
Grafana: Pre-authentication denial of service in the public dashboard query handler BIT-grafana-2026-42127, CVE-2026-42127, GHSA-3w66-95m3-8jxg, GO-2026-6541 | High | Not scored | 22 Jun, 2026 | Go github.com/grafana/grafana |
Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers CVE-2026-25119, GHSA-w6j9-vw59-27wv, GO-2026-5695 | High | Not scored | 22 Jun, 2026 | Go gogs.io/gogs |
Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug BIT-grafana-2026-9029, CVE-2026-9029, GHSA-9g84-39mm-q4p3, GO-2026-6542 | High | Not scored | 22 Jun, 2026 | Go github.com/grafana/grafana |
Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. CVE-2026-42129, GHSA-f74p-cwhp-x2wx, GO-2026-6544 | High | Not scored | 22 Jun, 2026 | Go github.com/grafana/grafana |
Gogs: XSS in .ipynb files renderer due to outdated notebookjs GHSA-6vxv-wg6j-5qwp, GO-2026-5193 | High | Not scored | 19 Jun, 2026 | Go gogs.io/gogs |
Blocky DNSSEC validation bypass and validation-cache scope pollution GHSA-x845-2f78-7v36, GO-2026-5745 | High | Not scored | 19 Jun, 2026 | Go github.com/0xERR0R/blocky |
containerd CRI checkpoint restore CDI annotation smuggling CVE-2026-53492, GHSA-33vj-92qq-66hc, GO-2026-5064 | High | Not scored | 19 Jun, 2026 | Go github.com/containerd/containerd Go github.com/containerd/containerd/v2 |
Arbitrary host CRI log file read via symlink following in CRI checkpoint restore CVE-2026-53489, GHSA-rgh6-rfwx-v388, GO-2026-5622 | High | Not scored | 19 Jun, 2026 | Go github.com/containerd/containerd Go github.com/containerd/containerd/v2 |
containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull CVE-2026-53488, GHSA-xhf5-7wjv-pqxp, GO-2026-5758 | High | Not scored | 19 Jun, 2026 | Go github.com/containerd/containerd Go github.com/containerd/containerd/v2 |
Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF) CVE-2026-58404, GHSA-r46f-3rpw-hxrv, GO-2026-5606 | High | Not scored | 19 Jun, 2026 | Go github.com/gohugoio/hugo |
OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL GHSA-q7j3-v8qv-22vq, GO-2026-5571 | High | Not scored | 19 Jun, 2026 | Go github.com/opentofu/opentofu |
Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream CVE-2026-55883, GHSA-6m68-r693-78qx, GO-2026-5181 | High | Not scored | 19 Jun, 2026 | Go github.com/tilt-dev/tilt |
Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server CVE-2026-55882, GHSA-p749-9w62-w533, GO-2026-5533 | High | Not scored | 19 Jun, 2026 | Go github.com/tilt-dev/tilt |
MCP Toolbox for Databases: authenticated authorization bypass CVE-2026-11719, GHSA-5gf6-gc35-xjpc, GO-2026-5144 | High | Not scored | 18 Jun, 2026 | Go github.com/googleapis/mcp-toolbox |
Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode CVE-2026-57209, GHSA-4jgr-pg2m-m988, GO-2026-5125 | High | Not scored | 18 Jun, 2026 | Go github.com/dadrus/heimdall |
Heimdall: IP Spoofing via Unvalidated Forwarding Headers CVE-2026-57210, GHSA-38x9-25wx-7fg2, GO-2026-5075 | High | Not scored | 18 Jun, 2026 | Go github.com/dadrus/heimdall Go https://github.com/dadrus/heimdall |