Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Nezha's private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data CVE-2026-49397, GHSA-vrmh-5mmx-hjwx, GO-2026-5672 | Medium | Not scored | 10 Jun, 2026 | Go github.com/nezhahq/nezha |
Apache Answer has an Improper Neutralization of Alternate XSS Syntax vulnerability CVE-2026-25688, GHSA-hmr2-99jm-8x45, GO-2026-6147 | Medium | Not scored | 09 Jun, 2026 | Go github.com/apache/answer Go github.com/apache/incubator-answer |
Apache Answer has an Exposure of Private Personal Information to an Unauthorized Actor vulnerability CVE-2026-25699, GHSA-w754-5646-xq9j, GO-2026-6148 | Medium | Not scored | 09 Jun, 2026 | Go github.com/apache/answer Go github.com/apache/incubator-answer |
Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability CVE-2026-33582, GHSA-v553-g2w6-295p, GO-2026-6153 | Medium | Not scored | 09 Jun, 2026 | Go github.com/apache/answer Go github.com/apache/incubator-answer |
Apache Answer has an Unrestricted Upload of File with Dangerous Type vulnerability CVE-2026-34031, GHSA-x4f6-mqg6-28xx, GO-2026-6154 | Medium | Not scored | 09 Jun, 2026 | Go github.com/apache/answer Go github.com/apache/incubator-answer |
Apache Answer vulnerable to Cross-site Scripting CVE-2026-34033, GHSA-6qwm-5fm9-cvjx, GO-2026-6151 | Medium | Not scored | 09 Jun, 2026 | Go github.com/apache/answer Go github.com/apache/incubator-answer |
Apache Answer has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability CVE-2026-34905, GHSA-85r2-pvg8-89r9, GO-2026-6152 | Medium | Not scored | 09 Jun, 2026 | Go github.com/apache/answer Go github.com/apache/incubator-answer |
Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS CVE-2026-49343, GHSA-fw38-pc54-jvx9, GO-2026-5379 | Medium | Not scored | 05 Jun, 2026 | Go github.com/klever-io/klever-go |
Source controller: Improper path handling allows traversal CVE-2026-47680, GHSA-jjrm-hr5f-673x, GO-2026-5472 | Medium | Not scored | 05 Jun, 2026 | Go github.com/fluxcd/source-controller |
AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle CVE-2026-47703, GHSA-xgx4-4h9w-53pv, GO-2026-5756 | Medium | Not scored | 04 Jun, 2026 | Go github.com/AdguardTeam/AdGuardHome Go github.com/AdguardTeam/dnsproxy |
OpenMeter: SQL injection through meter creation CVE-2026-8462, GHSA-wc3v-3457-c8cm, GO-2026-5703 | Medium | Not scored | 04 Jun, 2026 | Go github.com/openmeterio/openmeter |
Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets CVE-2026-47671, GHSA-64cj-qvx5-m4f3, GO-2026-5166 | Medium | Not scored | 04 Jun, 2026 | Go github.com/nhost/nhost |
Singluarity: Incorrect path matching for 'limit container paths' directive CVE-2026-47215, GHSA-wqcr-7rf3-f64m, GO-2026-5715 | Medium | Not scored | 04 Jun, 2026 | Go github.com/sylabs/singularity Go github.com/sylabs/singularity/v4 |
quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion CVE-2026-40898, GHSA-vvgj-x9jq-8cj9, GO-2026-5676 | Medium | Not scored | 03 Jun, 2026 | Go github.com/quic-go/quic-go |
Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints CVE-2026-10517, GHSA-698x-9w2p-7vvp, GO-2026-5939 | Medium | Not scored | 01 Jun, 2026 | Go github.com/quay/claircore |
GoClaw has a Command Injection issue CVE-2026-10219, GHSA-6jm8-4fhr-5w64, GO-2026-5951 | Medium | Not scored | 01 Jun, 2026 | Go github.com/nextlevelbuilder/goclaw |
Nezha's authenticated DDNS webhook configuration allows blind SSRF from the dashboard host CVE-2026-47268, GHSA-6x26-5727-rrm9, GO-2026-5194 | Medium | Not scored | 29 May, 2026 | Go github.com/naiba/nezha Go github.com/nezhahq/nezha |
go-git: Malformed Git object data may cause panics or resource exhaustion GHSA-w5pp-99ch-qj29, GO-2026-5693 | Medium | Not scored | 29 May, 2026 | Go github.com/go-git/go-git/v5 Go github.com/go-git/go-git/v6 |
CAPM3 vulnerable to Cross-Namespace resource access GHSA-rf84-wr5g-m3rp, GO-2026-5615 | Medium | Not scored | 29 May, 2026 | Go github.com/metal3-io/cluster-api-provider-metal3 |
IPAM controller service account granted unnecessary full access to Secrets CVE-2026-47190, GHSA-49pm-43hf-6xfq, GO-2026-5117 | Medium | Not scored | 29 May, 2026 | Go github.com/metal3-io/ip-address-manager |
Ironic Standalone Operator's controller modifies user-owned resources without consent GHSA-hfc8-w5f4-3x6m, GO-2026-5425 | Medium | Not scored | 29 May, 2026 | Go github.com/metal3-io/ironic-standalone-operator |
Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces GHSA-7cwm-fpfh-rrch, GO-2026-5215 | Medium | Not scored | 29 May, 2026 | Go github.com/metal3-io/ironic-standalone-operator |
OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens BIT-openbao-2026-46405, CVE-2026-46405, GHSA-7j6w-vvw2-5f9c, GO-2026-5225 | Medium | Not scored | 28 May, 2026 | Go github.com/openbao/openbao |
Calico Inserts Sensitive Information into Log File CVE-2026-41184, GHSA-9p7w-w5q6-mxj3, GO-2026-5888 | Medium | Not scored | 28 May, 2026 | Go github.com/projectcalico/calico Go github.com/projectcalico/calico/v3 |
Casdoor allows users to bypass configured MFA requirements CVE-2026-9091, GHSA-gv4m-v8c8-hr3g, GO-2026-5896 | Medium | Not scored | 28 May, 2026 | Go github.com/casdoor/casdoor |
Calico Inserts Sensitive Information into Log File CVE-2026-41185, GHSA-m67g-87rx-v42c, GO-2026-5891 | Medium | Not scored | 28 May, 2026 | Go github.com/projectcalico/calico Go github.com/projectcalico/calico/v3 |
OpenBao's Inline Auth Incorrectly Redacted Headers BIT-openbao-2026-46358, CVE-2026-46358, GHSA-q8cj-789h-vg24, GO-2026-5574 | Medium | Not scored | 28 May, 2026 | Go github.com/openbao/openbao |
opentelemetry-go's baggage parsing no longer caps raw header length CVE-2026-41178, GHSA-5wrp-cwcj-q835, GO-2026-5158 | Medium | Not scored | 28 May, 2026 | Go go.opentelemetry.io/otel Go go.opentelemetry.io/otel/baggage Go go.opentelemetry.io/otel/propagation |
Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability CVE-2026-22872, GHSA-qjjm-7j9w-pw72, GO-2026-5584 | Medium | Not scored | 28 May, 2026 | Go github.com/projectcapsule/capsule |
CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression CVE-2026-44981, GHSA-273h-gvwr-c3qj, GO-2026-5041 | Medium | Not scored | 27 May, 2026 | Go github.com/crowdsecurity/crowdsec |
Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations CVE-2026-44210, GHSA-rr59-xxvx-96qr, GO-2026-5638 | Medium | Not scored | 26 May, 2026 | Go github.com/kata-containers/kata-containers |
Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing CVE-2026-4915, GHSA-5gmf-x7hg-97wf, GO-2026-5845 | Medium | Not scored | 26 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost allows authenticated users to gain access to private repositories CVE-2026-28735, GHSA-r5vf-grcx-5vqp, GO-2026-5839 | Medium | Not scored | 26 May, 2026 | Go github.com/mattermost/mattermost-plugin-github Go github.com/mattermost/mattermost-server |
Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions CVE-2026-3636, GHSA-ffpr-pfr4-g354, GO-2026-5818 | Medium | Not scored | 26 May, 2026 | Go github.com/mattermost/mattermost-server |
Mattermost doesn't archive the channel before removing persistent notifications CVE-2026-4635, GHSA-pg7c-462j-grxv, GO-2026-5820 | Medium | Not scored | 26 May, 2026 | Go github.com/mattermost/mattermost-server |
Mattermost doesn't validate user-supplied input in API request handlers CVE-2026-4646, GHSA-rmvv-8v8w-rf7x, GO-2026-5833 | Medium | Not scored | 26 May, 2026 | Go github.com/mattermost/mattermost-plugin-github Go github.com/mattermost/mattermost-server |
Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory CVE-2026-5755, GHSA-37j2-3vv8-cf24, GO-2026-5835 | Medium | Not scored | 26 May, 2026 | Go github.com/mattermost/mattermost-server |
Nezha Monitoring: Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members CVE-2026-47124, GHSA-hvv7-hfrh-7gxj, GO-2026-5439 | Medium | Not scored | 23 May, 2026 | Go github.com/nezhahq/nezha |
Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check) CVE-2026-47120, GHSA-rxf6-wjh4-jfj6, GO-2026-5645 | Medium | Not scored | 23 May, 2026 | Go github.com/nezhahq/nezha |
Go Net HTML parser is vulnerable to denial of service CVE-2026-25680, GHSA-5cv4-jp36-h3mw, GO-2026-5028 | Medium | Not scored | 22 May, 2026 | Go golang.org/x/net |
golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS CVE-2026-39827, GHSA-qpw4-5x99-6vjp, GO-2026-5016 | Medium | Not scored | 22 May, 2026 | Go golang.org/x/crypto |
golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions CVE-2026-39828, GHSA-45gg-vh54-h5m9, GO-2026-5014 | Medium | Not scored | 22 May, 2026 | Go golang.org/x/crypto |
golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow CVE-2026-39835, GHSA-78mq-xcr3-xm33, GO-2026-5015 | Medium | Not scored | 22 May, 2026 | Go golang.org/x/crypto |
golang.org/x/crypto: Invoking pathological inputs can lead to client panic CVE-2026-46598, GHSA-9m57-25v3-79x9, GO-2026-5033 | Medium | Not scored | 22 May, 2026 | Go golang.org/x/crypto |
Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables CVE-2026-46618, GHSA-7pjr-qpvh-m339, GO-2026-5230 | Medium | Not scored | 21 May, 2026 | Go github.com/fission/fission |
Klever-Go KVM read-only execution can commit contract delete and upgrade side effects CVE-2026-46403, GHSA-jc6w-wmfc-fh33, GO-2026-5461 | Medium | Not scored | 21 May, 2026 | Go github.com/klever-io/klever-go |
Mattermost has an Incorrect Authorization issue CVE-2026-4055, GHSA-6cfr-wp44-6qmv, GO-2026-5173 | Medium | Not scored | 21 May, 2026 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: * CVE-2026-46431, GHSA-hw27-4v2q-5qff, GO-2026-5440 | Medium | Not scored | 20 May, 2026 | Go github.com/xyproto/algernon |
Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS CVE-2026-46430, GHSA-gj84-924c-48fx, GO-2026-5401 | Medium | Not scored | 20 May, 2026 | Go github.com/xyproto/algernon |
Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint CVE-2026-45796, GHSA-686c-7vgv-v3fx, GO-2026-5169 | Medium | Not scored | 19 May, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |