Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules CVE-2026-116692, GHSA-26p8-2jq9-3vq9 | Critical | 0.7% | 1 day ago | PyPI mlflow |
Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it CVE-2026-117601, GHSA-6jp4-8v48-cc5v | Critical | 0.2% | 2 days ago | PyPI electrum |
MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) CVE-2026-48705, GHSA-6hp3-vr39-rqw8 | Critical | Not scored | 2 days ago | PyPI monai |
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE CVE-2026-115915, GHSA-h3rc-j82p-2c3h, PYSEC-2026-4346 | Critical | 0.6% | 3 days ago | PyPI vllm |
Arista VeloCloud Orchestrator SQL Injection Vulnerability CVE-2026-114625 | CriticalExploited | 1.0% | 6 days ago |