Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package BIT-brotli-2026-111497, BIT-dotnet-2026-111497, BIT-dotnet-sdk-2026-111497, BIT-node-2026-111497, BIT-node-min-2026-111497, BIT-powershell-2026-111497, CVE-2026-111497, GHSA-9v8h-qqgm-4m35, PYSEC-2026-4322, PYSEC-2026-4323 | CriticalExploited | 88.0% | 7 days ago | PyPI brotli PyPI brotlicffi |
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) BIT-mlflow-2026-64849, CVE-2026-64849, GHSA-7gwp-5pfp-969j, PYSEC-2026-3687 | CriticalExploited | 10.0% | 17 Aug, 2026 | PyPI mlflow |
LiteLLM has SQL Injection in Proxy API key verification CVE-2026-42208, GHSA-r75f-5x8p-qvmc, PYSEC-2026-391 | CriticalExploited | 89.4% | 24 Apr, 2026 | PyPI litellm |
Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass CVE-2026-39987, GHSA-2679-6mx9-h9xc, PYSEC-2026-407 | CriticalExploited | 99.6% | 08 Apr, 2026 | PyPI marimo |
Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint CVE-2026-33017, GHSA-vwmf-pq79-vjvx, PYSEC-2026-379 | CriticalExploited | 96.2% | 17 Mar, 2026 | PyPI langflow |
Langflow affected by Remote Code Execution via validate_code() exec() CVE-2026-0770, GHSA-g22f-v6f7-2hrh, PYSEC-2026-1525 | CriticalExploited | 62.6% | 23 Jan, 2026 | PyPI langflow |
Langflow CORS misconfiguration enables Account Takeover and RCE CVE-2025-34291, GHSA-577h-p2hh-v4mv, PYSEC-2025-78 | CriticalExploited | 92.8% | 05 Dec, 2025 | PyPI langflow |
Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack CVE-2025-62593, GHSA-q279-jhrf-cc6v, PYSEC-2026-520 | CriticalExploited | 60.2% | 26 Nov, 2025 | PyPI ray |
Langflow Unauth RCE CVE-2025-3248, GHSA-rvqx-wpfh-mfx7, PYSEC-2025-36, PYSEC-2026-380 | CriticalExploited | 100.0% | 07 Apr, 2025 | PyPI langflow PyPI langflow-base |
Apache superset missing check for default SECRET_KEY BIT-superset-2023-27524, CVE-2023-27524, GHSA-5cx2-vq3h-x52c, PYSEC-2026-1161 | CriticalExploited | 98.1% | 24 Apr, 2023 | PyPI apache-superset |
Authentication bypass in Apache Airflow BIT-airflow-2020-13927, CVE-2020-13927, GHSA-hhx9-p69v-cx2j, PYSEC-2020-18 | CriticalExploited | 99.8% | 10 Nov, 2020 | PyPI apache-airflow |
SaltStack Salt Command Injection in netapi ssh client CVE-2020-16846, GHSA-qr38-h96j-2j3w, PYSEC-2020-104 | CriticalExploited | 99.6% | 06 Nov, 2020 | PyPI salt |
SaltStack Salt Unauthenticated Remote Code Execution CVE-2020-11651, GHSA-pjhf-vpx3-33r3, PYSEC-2020-102 | CriticalExploited | 96.6% | 30 Apr, 2020 | PyPI salt |