Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold CVE-2026-112908, GHSA-6627-m3xw-93mp | Medium | Not scored | 1 day ago | PyPI filelock |
filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL CVE-2026-112910, GHSA-8mx5-7m5m-r77g | Medium | Not scored | 1 day ago | PyPI filelock |
filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses CVE-2026-112938, GHSA-m462-7rxw-wvpg | Medium | Not scored | 1 day ago | PyPI filelock |
LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests CVE-2026-118667, GHSA-3fx2-cqw9-xr3c | Medium | Not scored | 1 day ago | PyPI langgraph PyPI langgraph-sdk |
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation CVE-2026-116694, GHSA-f5m9-jfrj-jjj7 | Medium | 0.4% | 2 days ago | PyPI opentelemetry-propagator-jaeger |
MLflow CrewAI autologging records LLM provider API keys in logged trace spans CVE-2026-116691, GHSA-j7qq-vr8c-xvw3 | Medium | 0.2% | 2 days ago | PyPI mlflow |
Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas CVE-2026-116686, GHSA-rwrf-2pqf-9j8j | Medium | 0.3% | 2 days ago | PyPI mcp |
Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies CVE-2026-116685, GHSA-5h93-6whr-6q8j | Medium | 0.4% | 2 days ago | PyPI mcp |
Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server CVE-2026-116684, GHSA-w4fh-qvv9-3v23 | Medium | 0.4% | 2 days ago | PyPI mcp |
Strands Agents: Default FileSessionManager storage is world-readable on shared systems GHSA-763v-5pjm-fx36 | Medium | Not scored | 2 days ago | PyPI strands-agents |
LiteLLM vulnerable to reflected XSS in /sso/debug/callback GHSA-hhww-mrg2-969h | Medium | Not scored | 2 days ago | PyPI litellm |
Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566) CVE-2026-116579, GHSA-pjh6-c8mg-3x7m | Medium | 0.4% | 3 days ago | PyPI autobahn |
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding CVE-2026-116577, GHSA-pcg2-g6cj-q92c | Medium | 0.4% | 3 days ago | PyPI tornado |
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope) CVE-2026-116575, GHSA-5324-3w58-qpp2 | Medium | 0.1% | 3 days ago | PyPI mem0ai npm mem0ai |
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks CVE-2026-115927, GHSA-r4j5-9xpp-3985 | Medium | 0.4% | 3 days ago | PyPI tornado |
ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs CVE-2026-115922, GHSA-q69g-f4f5-v8m7 | Medium | 0.1% | 3 days ago | PyPI onnx |
ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute CVE-2026-115921, GHSA-m4pr-6v3c-6fgr | Medium | 0.1% | 3 days ago | PyPI onnx |
ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank CVE-2026-115920, GHSA-6pwm-x34p-fvj2 | Medium | 0.2% | 3 days ago | PyPI onnx |
ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check) CVE-2026-115919, GHSA-48m4-24cq-37qf | Medium | 0.2% | 3 days ago | PyPI onnx |
vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs CVE-2026-115918, GHSA-x567-49g5-p4cf, PYSEC-2026-4349 | Medium | 0.3% | 3 days ago | PyPI vllm |
vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server CVE-2026-115917, GHSA-vvpg-rrww-wpmh, PYSEC-2026-4348 | Medium | 0.2% | 3 days ago | PyPI vllm |
vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) CVE-2026-115916, GHSA-q97c-p368-75c4, PYSEC-2026-4347 | Medium | 0.3% | 3 days ago | PyPI vllm |
vLLM DeepSeek-OCR image processing vulnerable to denial of service CVE-2026-115914, GHSA-gq5q-89c7-vhvx | Medium | 0.4% | 3 days ago | PyPI vllm |
vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine CVE-2026-115913, GHSA-8397-8qf6-f2gm | Medium | 0.3% | 3 days ago | PyPI vllm |
vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool CVE-2026-115911, GHSA-542m-9234-8gvf, PYSEC-2026-4344 | Medium | 0.3% | 3 days ago | PyPI vllm |
Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim CVE-2026-115910, GHSA-h2r5-x5m7-3935 | Medium | 0.2% | 3 days ago | PyPI social-auth-core |
LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output CVE-2026-115885, GHSA-8prr-f582-jqq3 | Medium | 0.1% | 5 days ago | PyPI langgraph-cli |
MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints BIT-mlflow-2026-115886, CVE-2026-115886, GHSA-2wqp-q3c6-ccj5 | Medium | 0.3% | 5 days ago | PyPI mlflow |
LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores CVE-2026-115883, GHSA-6hmw-9432-67qq | Medium | 0.3% | 5 days ago | PyPI langgraph-checkpoint-postgres PyPI langgraph-checkpoint-sqlite |
FastMCP: Post-transform component authorization is skipped on direct calls GHSA-7xgj-8392-5q4r | Medium | Not scored | 6 days ago | PyPI fastmcp PyPI fastmcp-slim |
FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server GHSA-vqqp-x5qm-5qp4 | Medium | Not scored | 6 days ago | PyPI fastmcp PyPI fastmcp-slim |
Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH CVE-2026-115774, GHSA-2qrf-pqgx-qh9v | Medium | 0.4% | 6 days ago | PyPI Twisted PyPI twisted |
Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value CVE-2026-115877, GHSA-q7qq-6mhp-9rc4 | Medium | 0.3% | 6 days ago | PyPI Twisted PyPI twisted |
Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF CVE-2026-114620, GHSA-x4rv-c3wx-4cr8 | Medium | 0.3% | 6 days ago | PyPI authlib |
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens CVE-2026-114619, GHSA-q686-2qmg-hqc7 | Medium | 0.2% | 6 days ago | PyPI authlib |
Authlib: Default JWT bearer grant accepts assertions for the wrong audience CVE-2026-114618, GHSA-fch4-3c6x-j4gc | Medium | 0.2% | 6 days ago | PyPI authlib |
Authlib: ID token can disable its own nonce validation via the nonce_supported claim CVE-2026-114617, GHSA-c5mf-xmp2-59rc | Medium | 0.2% | 6 days ago | PyPI authlib |