Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Arc has unauthenticated application log disclosure via `/api/v1/logs` GHSA-m3qr-fvp4-78xj | Low | Not scored | 14 hours ago | Go github.com/basekick-labs/arc |
Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through CVE-2026-55458, GHSA-8qx7-j2v2-x6q5 | Low | Not scored | 6 days ago | Go github.com/caddyserver/caddy/v2 |
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin CVE-2026-62994, GHSA-74w3-63xv-x9mv, GO-2026-6805 | Low | Not scored | 18 days ago | Go github.com/coredns/coredns |
Talos Linux: Support bundle does not redact registry credentials CVE-2026-77564, GHSA-7cxh-94cf-mfp6 | Low | Not scored | 19 days ago | Go github.com/siderolabs/talos |
GitHub CLI allows attestation verification bypass through unescaped regex metacharacters CVE-2026-64655, GHSA-mm27-mwq9-fr5g, GO-2026-6767 | Low | Not scored | 19 days ago | Go github.com/cli/cli Go github.com/cli/cli/v2 |
GitHub CLI allows path traversal through unescaped request URL components CVE-2026-64653, GHSA-4fjg-2h4q-fwg3, GO-2026-6765 | Low | Not scored | 19 days ago | Go github.com/cli/cli Go github.com/cli/cli/v2 |
GitHub CLI partially discloses authentication tokens in `gh auth status` output CVE-2026-64652, GHSA-cg6r-mpgc-h9mm, GO-2026-6766 | Low | Not scored | 19 days ago | Go github.com/cli/cli Go github.com/cli/cli/v2 |
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal GHSA-w2ch-4xgr-22ww, GO-2026-6754 | Low | Not scored | 25 days ago | Go code.vikunja.io/api |
SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass CVE-2026-74802, GHSA-3cc2-h3v6-rqpq, GO-2026-6650 | Low | Not scored | 02 Oct, 2026 | Go github.com/siyuan-note/siyuan/kernel |
Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher CVE-2026-84298, GHSA-9q4h-f4x5-ffq8, GO-2026-6561 | Low | Not scored | 22 Sep, 2026 | Go github.com/hatchet-dev/hatchet |
Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope CVE-2026-77637, GHSA-w89x-c962-c44g, GO-2026-6576 | Low | Not scored | 22 Sep, 2026 | Go github.com/cloudreve/Cloudreve Go github.com/cloudreve/Cloudreve/v3 Go github.com/cloudreve/Cloudreve/v4 |
OpenBao Agent Writes Secrets to Stdout BIT-openbao-2026-77285, CVE-2026-77285, GHSA-444v-8vxr-p36h, GO-2026-6554 | Low | Not scored | 22 Sep, 2026 | Go github.com/openbao/openbao |
OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs CVE-2026-81870, GHSA-8wmf-6v46-5gfg, GO-2026-6505 | Low | Not scored | 17 Sep, 2026 | Go go.opentelemetry.io/otel/exporters/otlp/otlptrace Go go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc Go go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp Go go.opentelemetry.io/otel/exporters/zipkin +1 more |
Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty CVE-2026-101090, GHSA-rf68-8gjr-36q7, GO-2026-6486 | Low | Not scored | 15 Sep, 2026 | Go github.com/nezhahq/nezha |
rclone: http backend forwards custom/auth headers to a different host on redirect BIT-rclone-2026-88013, CVE-2026-88013, GHSA-486v-q2wf-fp2r, GO-2026-6463 | Low | Not scored | 10 Sep, 2026 | Go github.com/rclone/rclone |
LF Edge eKuiper: Self-XSS in External Service Creation CVE-2025-24978, GHSA-g8rh-fjm6-h2h9, GO-2026-6446 | Low | Not scored | 09 Sep, 2026 | Go github.com/lf-edge/ekuiper Go github.com/lf-edge/ekuiper/v2 |
Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher CVE-2026-73087, GHSA-p2w3-6x73-2f6x, GO-2026-6440 | Low | Not scored | 08 Sep, 2026 | Go github.com/amir20/dozzle |
free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA CVE-2026-55785, GHSA-fp46-6vfw-gc9c, GO-2026-6328 | Low | Not scored | 28 Aug, 2026 | Go github.com/free5gc/ausf |
ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption CVE-2026-55588, GHSA-298f-872v-2rcx, GO-2026-6317 | Low | Not scored | 28 Aug, 2026 | Go oras.land/oras |
Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter CVE-2026-42350, GHSA-g7gw-m874-7rmf, GO-2026-6301 | Low | Not scored | 27 Aug, 2026 | Go github.com/akuity/kargo |
netfoil vulnerable to improper handling of untrusted DoH response data GHSA-4ph6-mjv7-3fq6, GO-2026-6277 | Low | Not scored | 24 Aug, 2026 | Go github.com/tinfoil-factory/netfoil |
Fleet: ORDER BY column injection on activity list endpoints CVE-2026-101046, GHSA-rxhg-vcww-2mpw, GO-2026-6269 | Low | Not scored | 20 Aug, 2026 | Go github.com/fleetdm/fleet/v4 |
OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers GHSA-22w5-2fxg-vrwx, GO-2026-6262 | Low | Not scored | 20 Aug, 2026 | Go github.com/opentofu/opentofu |
Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings CVE-2026-111932, GHSA-h58c-xccx-75m3, GO-2026-6267 | Low | Not scored | 20 Aug, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison CVE-2026-111933, GHSA-8fxq-53rx-ph5f, GO-2026-6265 | Low | Not scored | 20 Aug, 2026 | Go github.com/coder/coder Go github.com/coder/coder/v2 |
BuildKit has a possible runtime DoS via unbounded group parsing CVE-2026-61712, GHSA-72x6-4j93-7w86, GO-2026-6256 | Low | Not scored | 19 Aug, 2026 | Go github.com/moby/buildkit |
Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing CVE-2026-71326, GHSA-6765-c87h-8mrf, GO-2026-6204 | Low | Not scored | 06 Aug, 2026 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect BIT-rclone-2026-79782, CVE-2026-79782, GHSA-gx4c-2hqx-cw2r, GO-2026-6196 | Low | Not scored | 05 Aug, 2026 | Go github.com/rclone/rclone |
rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote BIT-rclone-2026-79783, CVE-2026-79783, GHSA-945v-v9p3-v5xw, GO-2026-6190 | Low | Not scored | 05 Aug, 2026 | Go github.com/rclone/rclone |
rclone: Verbose Stack Trace Disclosure in RC API Error Responses BIT-rclone-2026-79777, CVE-2026-79777, GHSA-gwfq-86j8-7qhv, GO-2026-6181 | Low | Not scored | 05 Aug, 2026 | Go github.com/rclone/rclone |
sigstore-go fails to check signature timestamps against a signing key's validity period CVE-2026-54787, GHSA-wqqc-jjcq-vfxm, GO-2026-6162 | Low | Not scored | 31 Jul, 2026 | Go github.com/sigstore/sigstore-go |
Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape CVE-2026-50568, GHSA-r5jh-q2mw-gcx4, GO-2026-6130 | Low | Not scored | 28 Jul, 2026 | Go github.com/fission/fission |
AWS CDK CodeBuild S3 Log Encryption Boolean Inversion GHSA-464c-974j-9xm6, GO-2026-6093 | Low | Not scored | 24 Jul, 2026 | Go github.com/aws/aws-cdk-go/awscdk Go github.com/aws/aws-cdk-go/awscdk/v2 Maven software.amazon.awscdk:aws-cdk-lib Maven software.amazon.awscdk:codebuild +7 more |
Gitea: Webhook Authorization Header Returned in Plaintext via API CVE-2026-58511, GHSA-3r5c-2xxx-h872, GO-2026-6040 | Low | Not scored | 21 Jul, 2026 | Go code.gitea.io/gitea Go gitea.dev |
Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service CVE-2026-55984, GHSA-m932-crvm-gcp5, GO-2026-6064 | Low | Not scored | 21 Jul, 2026 | Go code.gitea.io/gitea Go gitea.dev |
Gitea: Private Repository Metadata Remains Accessible After Access Revocation CVE-2026-58434, GHSA-j2w3-9c3r-g83q, GO-2026-6062 | Low | Not scored | 21 Jul, 2026 | Go code.gitea.io/gitea Go gitea.dev |
Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API CVE-2026-58445, GHSA-pgqf-926r-548m, GO-2026-6067 | Low | Not scored | 21 Jul, 2026 | Go code.gitea.io/gitea Go gitea.dev |
Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access CVE-2026-58438, GHSA-xv9x-fj9g-vj6h, GO-2026-6085 | Low | Not scored | 21 Jul, 2026 | Go gitea.dev |
Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim CVE-2026-23603, GHSA-x77v-q46j-393g, GO-2026-6083 | Low | Not scored | 21 Jul, 2026 | Go code.gitea.io/gitea Go gitea.dev |
File Browser: Share API exposes the password hash and bypass token CVE-2026-62684, GHSA-833g-cqhp-h72j, GO-2026-6025 | Low | Not scored | 20 Jul, 2026 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code GHSA-rjwr-m7qx-3fjr, GO-2026-6016 | Low | Not scored | 17 Jul, 2026 | Go github.com/oapi-codegen/oapi-codegen Go github.com/oapi-codegen/oapi-codegen/v2 |
ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) CVE-2026-58196, GHSA-pr64-jmmf-jp54, GO-2026-6002 | Low | Not scored | 15 Jul, 2026 | Go github.com/stacklok/toolhive |
ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway CVE-2026-54450, GHSA-pph6-vfjv-vpjw, GO-2026-5996 | Low | Not scored | 15 Jul, 2026 | Go github.com/stacklok/toolhive |
netfoil: Attacker controlled data written to logs GHSA-7856-g3gv-9wq8, GO-2026-5935 | Low | Not scored | 07 Jul, 2026 | Go github.com/tinfoil-factory/netfoil |
netfoil has a resource leak in LRU cache GHSA-3g4q-2f67-2gvh, GO-2026-5933 | Low | Not scored | 07 Jul, 2026 | Go github.com/tinfoil-factory/netfoil |
Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth CVE-2026-49254, GHSA-4q9j-6299-gxmr, GO-2026-5901 | Low | Not scored | 02 Jul, 2026 | Go d7y.io/dragonfly/v2 |
SFTPGo has stored XSS via inline parameter on public shares and user file download CVE-2026-49245, GHSA-3vcg-pv95-pq54, GO-2026-5900 | Low | Not scored | 02 Jul, 2026 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |
oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens CVE-2026-48978, GHSA-xf85-363p-868w, GO-2026-5885 | Low | Not scored | 01 Jul, 2026 | Go oras.land/oras-go Go oras.land/oras-go/v2 |
Concourse login flow has an open redirect issue BIT-concourse-2026-49826, CVE-2026-49826, GHSA-8w27-c4vc-88q9, GO-2026-5866 | Low | Not scored | 01 Jul, 2026 | Go github.com/concourse/concourse |
Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries CVE-2026-100837, GHSA-6c87-g9pw-78fx, GO-2026-5865 | Low | Not scored | 01 Jul, 2026 | Go github.com/edgelesssys/contrast |