Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in pipspeed (PyPI) MAL-2026-10213 | Malicious | Not scored | 12 Jul, 2026 | PyPI pipspeed |
Malicious release: Malicious code in jupiter-sdk (PyPI) MAL-2026-10196 | Malicious | Not scored | 12 Jul, 2026 | PyPI jupiter-sdk |
Malicious release: Malicious code in eth-agent (PyPI) MAL-2026-10195 | Malicious | Not scored | 12 Jul, 2026 | PyPI eth-agent |
Malicious release: Malicious code in metemask-sdk (PyPI) MAL-2026-10197 | Malicious | Not scored | 12 Jul, 2026 | PyPI metemask-sdk |
Malicious release: Malicious code in solidity-dev (PyPI) MAL-2026-10194 | Malicious | Not scored | 12 Jul, 2026 | PyPI solidity-dev |
Malicious release: Malicious code in defi-tools (PyPI) MAL-2026-10192 | Malicious | Not scored | 12 Jul, 2026 | PyPI defi-tools |
Malicious release: Malicious code in data-harvester (PyPI) MAL-2026-10191 | Malicious | Not scored | 12 Jul, 2026 | PyPI data-harvester |
Malicious release: Malicious code in py-base58 (PyPI) MAL-2026-10193 | Malicious | Not scored | 12 Jul, 2026 | PyPI py-base58 |
PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets CVE-2026-61447, GHSA-2xv2-w8cq-5gxw, PYSEC-2026-4266 | Critical | 15.2% | 11 Jul, 2026 | PyPI praisonaiagents |
PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls CVE-2026-61445, GHSA-9mp3-24cc-77mg, PYSEC-2026-4253 | Critical | 0.6% | 11 Jul, 2026 | PyPI praisonai |
PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass CVE-2026-61442, GHSA-c78w-2q4r-68r7, PYSEC-2026-4262 | High | 0.3% | 11 Jul, 2026 | PyPI praisonai-platform |
PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats CVE-2026-61439, GHSA-fj8f-m44g-c479, PYSEC-2026-4255 | High | 0.3% | 11 Jul, 2026 | PyPI PraisonAI PyPI praisonai |
PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass CVE-2026-61429, GHSA-6g59-gm2v-qhvq, PYSEC-2026-4269 | High | 0.3% | 11 Jul, 2026 | PyPI praisonaiagents |
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing CVE-2026-61428, GHSA-qj9c-59p6-8cgx, PYSEC-2026-4259 | High | 0.3% | 11 Jul, 2026 | PyPI praisonai |
PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL CVE-2026-60090, GHSA-wf65-4jjx-q444, PYSEC-2026-4260 | Critical | 0.7% | 11 Jul, 2026 | PyPI praisonai |
PraisonAI: Project custom command templates can read outside-workspace files into model prompts CVE-2026-60088, GHSA-xpx6-x8c2-mw5w, PYSEC-2026-4261 | Medium | 0.2% | 11 Jul, 2026 | PyPI praisonai |
Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset GHSA-h4g2-xfmw-q2c9 | High | Not scored | 10 Jul, 2026 | PyPI clauster |
mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment CVE-2026-73498, GHSA-g5r6-gv6m-f5jv, PYSEC-2026-3683 | High | 0.5% | 10 Jul, 2026 | PyPI mcp-atlassian |
mcp-atlassian: Arbitrary server-side file read via attachment upload CVE-2026-73496, GHSA-wm45-qh3g-v83f | High | 0.5% | 10 Jul, 2026 | PyPI mcp-atlassian |
BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py CVE-2026-54071, GHSA-m8gf-v64p-gfmg, PYSEC-2026-2389 | High | 0.4% | 10 Jul, 2026 | PyPI BabelDOC PyPI babeldoc |
CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources GHSA-9mqm-qcwf-5qhg | Medium | Not scored | 10 Jul, 2026 | PyPI credsweeper |
mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials CVE-2026-61459, GHSA-wmg3-h8mf-wgvr, PYSEC-2026-3685 | Critical | 2.4% | 10 Jul, 2026 | PyPI mcp-server-kubernetes npm mcp-server-kubernetes |
Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover CVE-2026-100169, CVE-2026-59151, GHSA-h8m9-jgf8-vwvp, PYSEC-2026-3725 | Critical | 0.9% | 10 Jul, 2026 | PyPI prowler-cloud |
MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826) CVE-2026-73497, GHSA-489g-7rxv-6c8q | Medium | 0.4% | 10 Jul, 2026 | PyPI mcp-atlassian |
Apprise forwards configured auth headers across cross-origin HTTP redirects CVE-2026-59180, GHSA-856c-92hv-3vxx, PYSEC-2026-4200 | Low | 0.3% | 10 Jul, 2026 | PyPI apprise |
Malicious release: Malicious code in turbocalc (PyPI) MAL-2026-10139 | Malicious | Not scored | 10 Jul, 2026 | PyPI turbocalc |
PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow CVE-2026-61437, GHSA-4gfv-wg42-7jw5, PYSEC-2026-4267 | High | 0.2% | 10 Jul, 2026 | PyPI praisonaiagents |
PraisonAI: Shell command allowlist bypass via find -exec built-in action CVE-2026-61434, GHSA-cv3g-hj65-pcfh, PYSEC-2026-4254 | High | 0.7% | 10 Jul, 2026 | PyPI praisonai |
PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace CVE-2026-61432, GHSA-4xxv-6wmf-xf45, PYSEC-2026-4268 | Medium | 0.3% | 10 Jul, 2026 | PyPI praisonaiagents |
PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace CVE-2026-61431, GHSA-q7m5-3jmv-vm48, PYSEC-2026-4258 | Medium | 0.4% | 10 Jul, 2026 | PyPI praisonai |
PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF CVE-2026-60091, GHSA-4w49-gwv8-fpjg, PYSEC-2026-4249 | High | 0.3% | 10 Jul, 2026 | PyPI praisonai |
PraisonAI: Project config can auto-save agent output outside the project root CVE-2026-60089, GHSA-qjw5-xwrp-xwpq, PYSEC-2026-4273 | Medium | 0.2% | 10 Jul, 2026 | PyPI praisonaiagents |
PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked CVE-2026-60086, GHSA-4r3p-w3mc-5v34, PYSEC-2026-4248 | Medium | 0.3% | 10 Jul, 2026 | PyPI praisonai |
Malicious release: Malicious code in sankislayer (PyPI) MAL-2026-10119 | Malicious | Not scored | 10 Jul, 2026 | PyPI sankislayer |
psd-tools vulnerable to arbitrary file write via smart-object filename CVE-2026-49836, GHSA-2rmg-vrx8-9j2f, PYSEC-2026-2969 | Medium | 0.2% | 09 Jul, 2026 | PyPI psd-tools |
Rattler vulnerable to package cache path traversal via conda package build string CVE-2026-53956, GHSA-h672-p7h7-97v9, PYSEC-2026-2970 | Medium | 0.3% | 09 Jul, 2026 | PyPI py-rattler PyPI py_rattler crates.io rattler_cache |
Malicious release: Malicious code in proxy-check-i (PyPI) MAL-2026-10100 | Malicious | Not scored | 09 Jul, 2026 | PyPI proxy-check-i |
open-webui terminal proxy path traversal guard bypass via 9x encoded traversal CVE-2026-59221, GHSA-frvj-c5qp-xj4w, PYSEC-2026-3597 | High | 0.5% | 09 Jul, 2026 | PyPI open-webui |
Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave) CVE-2026-59715, GHSA-gmfw-g93r-vg53, PYSEC-2026-3599 | Medium | 0.4% | 09 Jul, 2026 | PyPI open-webui |
Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission CVE-2026-59227, GHSA-rqj7-6wrp-6g2g, PYSEC-2026-3604 | Medium | 0.4% | 09 Jul, 2026 | PyPI open-webui |
Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation CVE-2026-59226, GHSA-mvx4-532p-xfm9, PYSEC-2026-3602 | Medium | 0.5% | 09 Jul, 2026 | PyPI open-webui |
Open WebUI: Arena task endpoints can bypass underlying model access controls CVE-2026-59225, GHSA-m3qf-58wf-w979, PYSEC-2026-3601 | Medium | 0.4% | 09 Jul, 2026 | PyPI open-webui |
Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection) CVE-2026-59224, GHSA-j657-m4c4-24jq, PYSEC-2026-3600 | High | 0.4% | 09 Jul, 2026 | PyPI open-webui |
Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching CVE-2026-59223, GHSA-qg3f-8x3j-ggf2, PYSEC-2026-3603 | Medium | 0.4% | 09 Jul, 2026 | PyPI open-webui |
Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials CVE-2026-59222, GHSA-gh7p-78x6-jw6m, PYSEC-2026-3598 | Medium | 0.5% | 09 Jul, 2026 | PyPI open-webui |
Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config CVE-2026-59220, GHSA-ffpj-xv5c-p3gw, PYSEC-2026-3596 | Medium | 0.6% | 09 Jul, 2026 | PyPI open-webui |
Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout CVE-2026-59219, GHSA-855v-hq7w-jmjw, PYSEC-2026-3595 | High | 0.6% | 09 Jul, 2026 | PyPI open-webui |
Open WebUI: Account enumeration via observable login timing discrepancy CVE-2026-59218, GHSA-7rw5-9f7q-xj36, PYSEC-2026-3594 | Medium | 0.4% | 09 Jul, 2026 | PyPI open-webui |
Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB) CVE-2026-59217, GHSA-7r7x-gjvr-448g, PYSEC-2026-3593 | Medium | 0.4% | 09 Jul, 2026 | PyPI open-webui |
Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id CVE-2026-59216, GHSA-74h3-cxq7-vc5q, PYSEC-2026-3592 | Critical | 0.5% | 09 Jul, 2026 | PyPI open-webui |