Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
PraisonAI recipe.run_stream skips dangerous-tool policy enforcement CVE-2026-56838, GHSA-v847-hxxw-3pxg, PYSEC-2026-3520 | High | 0.1% | 18 Jun, 2026 | PyPI praisonai |
PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools CVE-2026-56840, GHSA-63v4-w882-g4x2, PYSEC-2026-3503 | High | 0.4% | 18 Jun, 2026 | PyPI praisonai |
PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing CVE-2026-56837, GHSA-fc26-m9pf-v56q, PYSEC-2026-3510 | High | 0.2% | 18 Jun, 2026 | PyPI praisonai |
PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage CVE-2026-56834, GHSA-j7qx-p75m-wp7g, PYSEC-2026-3514 | High | 0.4% | 18 Jun, 2026 | PyPI praisonai |
PraisonAI Slack app_mention bypasses configured user/channel authorization CVE-2026-56835, GHSA-qvpf-j64c-jmhr, PYSEC-2026-3518 | High | 0.2% | 18 Jun, 2026 | PyPI praisonai |
PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard CVE-2026-56836, GHSA-5qw8-f2g9-ff29, PYSEC-2026-3502 | High | 0.2% | 18 Jun, 2026 | PyPI praisonai |
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools CVE-2026-57112, GHSA-vmf9-xx9w-86wx, PYSEC-2026-3521, PYSEC-2026-3534 | High | 0.2% | 18 Jun, 2026 | PyPI praisonai PyPI praisonaiagents |
PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal CVE-2026-56833, GHSA-22cj-m4wf-fv2c, PYSEC-2026-3499 | High | 0.5% | 18 Jun, 2026 | PyPI praisonai |
PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals CVE-2026-56832, GHSA-8579-rgg5-ph2m, PYSEC-2026-3506 | High | 0.1% | 18 Jun, 2026 | PyPI praisonai |
Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages() CVE-2026-12530, GHSA-6rfw-mq36-jm8h, PYSEC-2026-2395 | High | 0.3% | 17 Jun, 2026 | PyPI bedrock-agentcore |
Hermes Agent contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation CVE-2026-53869, GHSA-4pqm-j46f-795x, PYSEC-2026-2510 | High | 0.6% | 17 Jun, 2026 | PyPI hermes-agent |
Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects CVE-2026-54018, GHSA-jrfp-m64g-pcwv, PYSEC-2026-2743 | High | 0.4% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal CVE-2026-54017, GHSA-r2wg-2mcr-66rv, PYSEC-2026-2751 | High | 0.5% | 17 Jun, 2026 | PyPI open-webui |
pdfkit: Path traversal in from_string CVE-2025-26240, GHSA-9g3x-6x24-vf9f, PYSEC-2026-2860 | High | 0.4% | 17 Jun, 2026 | PyPI pdfkit |
Open WebUI: Stored XSS to Account Takeover via Model Profile Images CVE-2026-54013, GHSA-v2qm-5wxj-qhj7, PYSEC-2026-2757 | High | 0.3% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion CVE-2026-54012, GHSA-vjqm-6gcc-62cr, PYSEC-2026-2761 | High | 0.3% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: Stored XSS in Mermaid Markdown Preview CVE-2026-54011, GHSA-v8qj-hxv7-mgvv, PYSEC-2026-2759 | High | 0.3% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: Forged chat-file link allows cross-user file read and deletion CVE-2026-54010, GHSA-vrhc-3fr6-pc3c, PYSEC-2026-2763 | High | 0.4% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401) CVE-2026-54008, GHSA-226f-f24g-524w, PYSEC-2026-2690 | High | 0.3% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: Cross-origin postMessage confirmation bypass via action:submit CVE-2026-54007, GHSA-3vv5-8xxp-4f55, PYSEC-2026-2695 | High | 0.2% | 17 Jun, 2026 | PyPI open-webui |
yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp GHSA-69qj-pvh9-c5wg | High | Not scored | 16 Jun, 2026 | PyPI yt-dlp |
Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check CVE-2026-53755, GHSA-6qhc-x826-342c, PYSEC-2026-588 | High | 1.6% | 16 Jun, 2026 | PyPI crawl4ai |
Crawl4AI: LLM credential exfiltration in Docker server via request base_url and env: token resolution CVE-2026-56259, GHSA-f989-c77f-r2cq, PYSEC-2026-3448 | High | 0.4% | 16 Jun, 2026 | PyPI crawl4ai |
Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped) CVE-2026-53754, GHSA-4qqr-vv2q-cmr5, PYSEC-2026-587 | High | 0.4% | 16 Jun, 2026 | PyPI crawl4ai |
yt-dlp: File Downloader cookie leak with curl CVE-2026-50019, GHSA-f7j3-774f-rfhj, PYSEC-2026-3431 | High | 0.3% | 16 Jun, 2026 | PyPI yt-dlp |
OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints CVE-2026-46448, GHSA-mfg3-p6m3-gjgr, PYSEC-2026-2686 | High | 0.3% | 16 Jun, 2026 | PyPI nova |
vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution CVE-2026-41523, GHSA-q8gq-377p-jq3r, PYSEC-2026-2300 | High | 0.9% | 16 Jun, 2026 | PyPI vllm |
Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints CVE-2026-33760, GHSA-9c59-2mvc-vfr8, PYSEC-2026-242 | High | 0.5% | 16 Jun, 2026 | PyPI langflow |
Galaxy NG: command injection vulnerability CVE-2026-12398, GHSA-6hw7-j4jw-wpff, PYSEC-2026-2486 | High | 0.9% | 16 Jun, 2026 | PyPI galaxy-ng |
Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read CVE-2026-54293, GHSA-p4gq-832x-fm9v, PYSEC-2026-2078 | High | 0.6% | 16 Jun, 2026 | PyPI nltk |
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS CVE-2026-54283, GHSA-82w8-qh3p-5jfq, PYSEC-2026-249 | High | 0.5% | 15 Jun, 2026 | PyPI starlette |
Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse CVE-2026-91992, GHSA-pw6j-qg29-8w7f | High | 0.2% | 15 Jun, 2026 | PyPI tornado |
python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service CVE-2026-53539, GHSA-5rvq-cxj2-64vf, PYSEC-2026-3036 | High | 0.5% | 15 Jun, 2026 | PyPI python-multipart |
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient CVE-2026-49853, GHSA-3x9g-8vmp-wqvf, PYSEC-2026-3387 | High | 0.4% | 15 Jun, 2026 | PyPI tornado |
tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) CVE-2026-49855, GHSA-mgf9-4vpg-hj56, PYSEC-2026-3389 | High | 0.6% | 15 Jun, 2026 | PyPI tornado |
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows CVE-2026-48818, GHSA-wqp7-x3pw-xc5r, PYSEC-2026-2281 | High | 0.4% | 15 Jun, 2026 | PyPI starlette |
Vulnerable OpenSSL included in cryptography wheels GHSA-537c-gmf6-5ccf | High | Not scored | 15 Jun, 2026 | PyPI cryptography |
ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to CVE-2026-45831, GHSA-xph7-9rjv-w5fr, PYSEC-2026-3815 | High | 0.2% | 12 Jun, 2026 | PyPI chromadb |
ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection CVE-2026-45830, GHSA-2wm9-hf6c-p5cr, PYSEC-2026-3813 | High | 0.3% | 12 Jun, 2026 | PyPI chromadb |
WsgiDAV encoded dot segments can escape filesystem share roots CVE-2026-48099, GHSA-wxq4-cc2q-338q, PYSEC-2026-3428 | High | 0.3% | 11 Jun, 2026 | PyPI wsgidav |
Keras archive extraction utilities allow path traversal and arbitrary file writes CVE-2026-11816, GHSA-hqp4-2352-xf5r, PYSEC-2026-2324 | High | 0.6% | 11 Jun, 2026 | PyPI keras |
PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing CVE-2026-47781, GHSA-qq6c-99pv-prvf, PYSEC-2026-2863 | High | 0.2% | 11 Jun, 2026 | PyPI pdm |
vLLM is vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method CVE-2026-5497, GHSA-wcwg-c5fc-9vrc, PYSEC-2026-2302 | High | 0.5% | 11 Jun, 2026 | PyPI vllm |
Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload CVE-2026-52726, GHSA-gfhv-vqv2-4544, PYSEC-2026-2465 | High | 0.4% | 10 Jun, 2026 | PyPI dulwich |
kafka-python vulnerable to denial of service through an unbounded SCRAM iteration count CVE-2026-10143, GHSA-2jcm-hq8r-84wx, PYSEC-2026-2191 | High | 0.5% | 10 Jun, 2026 | PyPI kafka-python |
kafka-python vulnerable to denial of service through an unvalidated protocol frame length CVE-2026-10142, GHSA-m3px-q5gj-j9x7, PYSEC-2026-2190 | High | 0.3% | 10 Jun, 2026 | PyPI kafka-python |
PDM wheel installation leads to Path Traversal via overridden write_to_fs CVE-2026-47764, GHSA-78v8-vpjp-cjqh, PYSEC-2026-2861 | High | 0.2% | 10 Jun, 2026 | PyPI pdm |
Litestar has HTML Injection Through its CSRF Token CVE-2026-48060, GHSA-542p-wvx7-72m4, PYSEC-2026-2604 | High | 0.4% | 10 Jun, 2026 | PyPI litestar |
praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR CVE-2026-47419, GHSA-7p8g-6c6g-h9w7, PYSEC-2026-2931 | High | 0.3% | 05 Jun, 2026 | PyPI praisonai-platform |
ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution CVE-2026-11332, GHSA-w8p5-mx5w-cpqj, PYSEC-2026-3458 | High | 0.2% | 05 Jun, 2026 | PyPI ansible-core |