Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset GHSA-vpp8-g58w-m8mp | High | Not scored | 4 hours ago | PyPI Twisted PyPI twisted |
PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox CVE-2026-61438, GHSA-26mh-57q7-jfvr | High | Not scored | 4 hours ago | PyPI praisonai |
LangGraph JavaScript custom authentication may permit cross-user Store access CVE-2026-118668, GHSA-4hm6-w6qq-w73v | High | Not scored | 1 day ago | PyPI langgraph-api |
rucio has an Authorization Bypass on REST API endpoint for signing URLs CVE-2026-58273, GHSA-5j9r-fx4x-rpvg | High | Not scored | 1 day ago | PyPI rucio |
MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source CVE-2026-116690, GHSA-m65p-9j7q-6w33 | High | 0.6% | 2 days ago | PyPI mlflow |
Hydra legacy target blacklist permits unsafe PyYAML loading GHSA-wf6j-7hvr-gr93 | High | Not scored | 2 days ago | PyPI hydra-core |
Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage GHSA-3w55-933p-8pv5 | High | Not scored | 2 days ago | PyPI strands-agents |
LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials` GHSA-g5ff-637f-6q2m | High | Not scored | 2 days ago | PyPI litellm |
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow CVE-2026-49272, GHSA-3jp2-3mrg-2vxc | High | Not scored | 2 days ago | PyPI oauthlib |
Datadog dd-trace-py: IAST instrumentation can lead to application DOS CVE-2026-116589, GHSA-p3m5-h5v9-vqj6 | High | 0.3% | 2 days ago | PyPI ddtrace |
Datadog dd-trace-py: ReDoS in URL query string obfuscation CVE-2026-116588, GHSA-3633-r77q-h3v3 | High | 0.5% | 2 days ago | PyPI ddtrace |
Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs CVE-2026-115924, GHSA-qr6x-7v33-6qmg | High | 0.4% | 3 days ago | PyPI rembg |
vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled CVE-2026-115912, GHSA-6757-hggm-hp2w, PYSEC-2026-4345 | High | 0.5% | 3 days ago | PyPI vllm |
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer CVE-2026-115776, GHSA-53xc-49m8-p798 | High | 0.5% | 6 days ago | PyPI Twisted PyPI twisted |
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer CVE-2026-115778, GHSA-cwm5-jh59-mwxr | High | 0.5% | 6 days ago | PyPI Twisted PyPI twisted |
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree CVE-2026-115775, GHSA-3476-c5c2-fr73 | High | 0.4% | 6 days ago | PyPI Twisted PyPI twisted |
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) BIT-virtualenv-2026-115586, CVE-2026-115586, GHSA-cx6f-vjhg-g3cc | High | 0.2% | 6 days ago | PyPI virtualenv |
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) CVE-2026-115585, GHSA-jr96-gvgh-j3r4 | High | 0.4% | 6 days ago | PyPI pypdf |
pypdf: Possible long runtimes for large xref table header limits CVE-2026-115580, GHSA-gmh7-3g9r-mjh5 | High | 0.4% | 6 days ago | PyPI pypdf |
pypdf: Possible long runtimes for repeated references to the same missing object CVE-2026-115572, GHSA-6c7f-9265-g8fw | High | 0.4% | 6 days ago | PyPI pypdf |
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) CVE-2026-114616, GHSA-8m4g-j4wp-wgcg | High | 0.2% | 6 days ago | PyPI Authlib PyPI authlib |
Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys CVE-2026-114615, GHSA-7vr2-2fgp-9w7p | High | 0.1% | 6 days ago | PyPI authlib |