Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing CVE-2026-57178, GHSA-3c93-f73f-qc9h, PYSEC-2026-4165 | High | 0.2% | 24 Sep, 2026 | PyPI social-auth-core |
social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend CVE-2026-57177, GHSA-x7qq-23vw-7pfg, PYSEC-2026-4169 | Medium | 0.1% | 24 Sep, 2026 | PyPI social-auth-core |
social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend CVE-2026-57176, GHSA-fp7w-m676-w7gc, PYSEC-2026-4166 | Medium | 0.2% | 24 Sep, 2026 | PyPI social-auth-core |
social-auth-core has an Improper Authentication issue CVE-2026-57175, GHSA-vq6g-g6c7-5f2j, PYSEC-2026-4167 | Medium | 0.2% | 24 Sep, 2026 | PyPI social-auth-core |
hpack: Unbounded variable integer decoding can cause run-away computation on malformed input CVE-2026-59980, GHSA-8v8h-hg4w-mvq2, PYSEC-2026-4053 | Medium | 0.3% | 23 Sep, 2026 | PyPI hpack |
plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length GHSA-8pcw-h6w9-h46g | Medium | Not scored | 23 Sep, 2026 | PyPI plone-app-contenttypes PyPI plone.app.contenttypes |
Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint CVE-2026-93421, GHSA-g7f6-rxc4-qhph, PYSEC-2026-4105 | Medium | 0.5% | 23 Sep, 2026 | PyPI mesop |
Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files CVE-2026-92164, GHSA-vf2x-4v53-pm7v, PYSEC-2026-4172 | Medium | 0.3% | 23 Sep, 2026 | PyPI streamlink |
Malicious release: Malicious code in memoryos (PyPI) MAL-2026-16475, PYSEC-2026-3987 | Malicious | Not scored | 23 Sep, 2026 | PyPI memoryos |
Malicious release: Malicious code in kerokwis (PyPI) MAL-2026-16421 | Malicious | Not scored | 22 Sep, 2026 | PyPI kerokwis |
plone.app.dexterity has a Denial of Service due to excessive title or description length CVE-2026-57576, GHSA-5426-92w4-wvhv, PYSEC-2026-4137 | Medium | 0.8% | 22 Sep, 2026 | PyPI plone-app-dexterity PyPI plone.app.dexterity |
Malicious release: Malicious code in auclean (PyPI) MAL-2026-16410 | Malicious | Not scored | 22 Sep, 2026 | PyPI auclean |
wlc may disclose API tokens to project-configured URLs CVE-2026-62364, GHSA-3mqq-hv9c-85hc, PYSEC-2026-4180 | Low | 0.1% | 22 Sep, 2026 | PyPI wlc |
Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs CVE-2026-83805, GHSA-q4c5-2j6f-r476, PYSEC-2026-4111 | Medium | 0.3% | 22 Sep, 2026 | PyPI nautobot |
Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text CVE-2026-83801, GHSA-56v6-2fhr-wxgq, PYSEC-2026-4110 | Medium | 0.3% | 22 Sep, 2026 | PyPI nautobot |
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers CVE-2026-65829, GHSA-7952-gx68-cjqr, PYSEC-2026-4108 | Medium | 0.4% | 22 Sep, 2026 | Maven net.sf.mpxj:mpxj NuGet MPXJ.Net NuGet net.sf.mpxj NuGet net.sf.mpxj-for-csharp +3 more |
MPXJ: XXE Vulnerability in MerlinReader CVE-2026-61570, GHSA-5vvx-3h34-f3gj, PYSEC-2026-4107 | High | 0.5% | 22 Sep, 2026 | Maven net.sf.mpxj:mpxj NuGet MPXJ.Net NuGet net.sf.mpxj NuGet net.sf.mpxj-for-csharp +3 more |
psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometry CVE-2026-59991, GHSA-8q6g-vjhf-jp8m, PYSEC-2026-4139 | High | 0.5% | 22 Sep, 2026 | PyPI psd-tools |
Home Assistant: XSS in Statistics Graph Card CVE-2026-91130, GHSA-wx4m-69m9-gx3m, PYSEC-2026-4052 | Critical | 0.5% | 22 Sep, 2026 | PyPI homeassistant |
Home Assistant: mDNS Server-Side Request Forgery CVE-2026-91129, GHSA-4ghv-53cq-7wp3, PYSEC-2026-4051 | Medium | 0.3% | 22 Sep, 2026 | PyPI homeassistant |
MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler CVE-2026-77272, GHSA-g2r2-3j32-j27x, PYSEC-2026-4093 | Medium | 0.3% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825) CVE-2026-77269, GHSA-h7wj-5v37-59r2, PYSEC-2026-4095 | Medium | 0.4% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Insecure File Permissions on OAuth Token Storage CVE-2026-77268, GHSA-4596-2p6p-28cv, PYSEC-2026-4082 | Medium | 0.2% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call CVE-2026-77266, GHSA-mfv2-4wvm-9pgp, PYSEC-2026-4097 | Medium | 0.5% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4) CVE-2026-77262, GHSA-p6hp-93wp-fh6p, PYSEC-2026-4099 | High | 0.6% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials CVE-2026-77259, GHSA-6cr4-ccf3-x7h4, PYSEC-2026-4086 | High | 0.4% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths CVE-2026-77257, GHSA-mrq8-fv7v-hhjg, PYSEC-2026-4098 | High | 0.4% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue CVE-2026-77255, GHSA-2xj6-xx86-cwwc, PYSEC-2026-4080 | High | 0.5% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files CVE-2026-77253, GHSA-vc25-24vv-fxxm, PYSEC-2026-4101 | High | 0.4% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup CVE-2026-77249, GHSA-v9m3-wfh8-5646, PYSEC-2026-4100 | Medium | 0.3% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport CVE-2026-77248, GHSA-cc5h-2pwp-pvcc, PYSEC-2026-4089 | High | 0.5% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters CVE-2026-77247, GHSA-f6pj-qv47-g96w, PYSEC-2026-4092 | High | 0.4% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path CVE-2026-77246, GHSA-wv8v-v4c5-v75j, PYSEC-2026-4104 | High | 0.5% | 22 Sep, 2026 | PyPI mcp-atlassian |
plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection CVE-2026-57149, GHSA-rr49-f9g6-c9r5, PYSEC-2026-4138 | Critical | 0.6% | 22 Sep, 2026 | PyPI plone-app-portlets PyPI plone.app.portlets |
Malicious release: Malicious code in snap-queue (PyPI) MAL-2026-16408 | Malicious | Not scored | 22 Sep, 2026 | PyPI snap-queue |
Malicious release: Malicious code in poly-check-b (PyPI) MAL-2026-16407 | Malicious | Not scored | 22 Sep, 2026 | PyPI poly-check-b |
Malicious release: Malicious code in crypto-trader-py (PyPI) MAL-2026-16406 | Malicious | Not scored | 22 Sep, 2026 | PyPI crypto-trader-py |
MCP Atlassian: SSRF Protection Bypass CVE-2026-77274, GHSA-hgcf-4mq8-5266, PYSEC-2026-4096 | High | 0.3% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4) CVE-2026-77271, GHSA-6vmq-24h2-pj7j, PYSEC-2026-4087 | High | 0.6% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Arbitrary File Read via Upload Attachment Tools CVE-2026-77270, GHSA-f26r-j276-ggg4, PYSEC-2026-4090 | Medium | 0.5% | 22 Sep, 2026 | PyPI mcp-atlassian |
mcp-atlassian has an incomplete SSRF remediation CVE-2026-77267, GHSA-5wf4-jqxh-8gm3, PYSEC-2026-4084 | High | 0.3% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow CVE-2026-77265, GHSA-49xv-9743-pw8w, PYSEC-2026-4083 | High | 0.3% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches CVE-2026-77261, GHSA-6529-c226-h328, PYSEC-2026-4085 | High | 0.4% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira) CVE-2026-77260, GHSA-f4p7-qx46-wc5j, PYSEC-2026-4091 | High | 0.4% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path() CVE-2026-77258, GHSA-93xw-j965-9mx3, PYSEC-2026-4088 | High | 0.4% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud) CVE-2026-77251, GHSA-w66g-j6c4-hcfc, PYSEC-2026-4102 | High | 0.3% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions CVE-2026-77250, GHSA-g5xv-mhgm-v5f6, PYSEC-2026-4094 | Medium | 0.1% | 22 Sep, 2026 | PyPI mcp-atlassian |
[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token CVE-2026-77244, GHSA-wrhw-j3f9-8vc6, PYSEC-2026-4103 | Critical | 0.3% | 22 Sep, 2026 | PyPI mcp-atlassian |
MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass CVE-2026-77243, GHSA-3r68-hf9h-887v, PYSEC-2026-4081 | High | 0.5% | 22 Sep, 2026 | PyPI mcp-atlassian |
lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content CVE-2026-86062, GHSA-xpjq-3w4w-w5wr, PYSEC-2026-4065 | Medium | 0.3% | 22 Sep, 2026 | PyPI lightrag-hku |