Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) BIT-virtualenv-2026-115586, CVE-2026-115586, GHSA-cx6f-vjhg-g3cc | High | 0.2% | 6 days ago | PyPI virtualenv |
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) CVE-2026-115585, GHSA-jr96-gvgh-j3r4 | High | 0.4% | 6 days ago | PyPI pypdf |
pypdf: Possible long runtimes for large xref table header limits CVE-2026-115580, GHSA-gmh7-3g9r-mjh5 | High | 0.4% | 6 days ago | PyPI pypdf |
pypdf: Possible long runtimes for repeated references to the same missing object CVE-2026-115572, GHSA-6c7f-9265-g8fw | High | 0.4% | 6 days ago | PyPI pypdf |
Electron: Mitigation for compromised eMudhra intermediate certificates CVE-2026-115570, GHSA-jr5w-w6x2-84p9 | High | 0.4% | 6 days ago | npm electron |
@justice8096/sagemath-mcp-server: executes arbitrary code via the escapeShellString and sanitizeCode functions CVE-2026-106763, GHSA-2vq3-mpmf-9xgr | High | Not scored | 6 days ago | npm @justice8096/sagemath-mcp-server |
@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function CVE-2026-106764, GHSA-jwc4-922r-f2rw | High | Not scored | 6 days ago | npm @rog0x/mcp-git-tools |
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes CVE-2026-115478, GHSA-r3g7-r4hr-m258 | High | 0.3% | 6 days ago | npm obsidian-tc |
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP CVE-2026-115477, GHSA-737x-cwfr-5vvc | High | 0.4% | 6 days ago | npm obsidian-tc |
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) CVE-2026-114616, GHSA-8m4g-j4wp-wgcg | High | 0.2% | 6 days ago | PyPI Authlib PyPI authlib |
Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys CVE-2026-114615, GHSA-7vr2-2fgp-9w7p | High | 0.1% | 6 days ago | PyPI authlib |