Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback CVE-2026-59822, GHSA-7488-6r32-c95q, PYSEC-2026-3479 | HighExploited | 0.8% | 08 Jul, 2026 | PyPI litellm |
Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow CVE-2026-55255, GHSA-qrpv-q767-xqq2, PYSEC-2026-221 | HighExploited | 0.9% | 19 Jun, 2026 | PyPI langflow |
LiteLLM: Authenticated command execution via MCP stdio test endpoints CVE-2026-42271, GHSA-v4p8-mg3p-g94g, PYSEC-2026-2599 | HighExploited | 91.4% | 25 Apr, 2026 | PyPI litellm |
libwebp: OOB write in BuildHuffmanTable A-299477569, ASB-A-299477569, CVE-2023-4863, CVE-2023-5129, GHSA-j7hp-h8jx-5ppr, PYSEC-2026-1794, RUSTSEC-2023-0060, RUSTSEC-2023-0061 | HighExploited | 100.0% | 12 Sep, 2023 | Go github.com/chai2010/webp NuGet SkiaSharp NuGet magick.net-q16-anycpu NuGet magick.net-q16-hdri-anycpu +10 more |
Apache Spark UI can allow impersonation if ACLs enabled BIT-spark-2022-33891, CVE-2022-33891, GHSA-4x9r-j582-cgr8, PYSEC-2022-236 | HighExploited | 93.2% | 18 Jul, 2022 | Maven org.apache.spark:spark-parent_2.12 PyPI pyspark |
Remote code execution (RCE) in Apache Airflow BIT-airflow-2020-11978, CVE-2020-11978, GHSA-rvmq-4x66-q7j3, PYSEC-2020-14 | HighExploited | 99.2% | 17 Jul, 2020 | PyPI apache-airflow |
SaltStack Salt is vulnerable Arbitrary Directory Access CVE-2020-11652, GHSA-vp49-2g4r-m3x3, PYSEC-2020-103 | HighExploited | 86.2% | 30 Apr, 2020 | PyPI salt |