Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization CVE-2026-48990, GHSA-wphv-vfrh-23q5, PYSEC-2026-2530 | Medium | 0.2% | 17 Jun, 2026 | PyPI joserfc |
Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages() CVE-2026-12530, GHSA-6rfw-mq36-jm8h, PYSEC-2026-2395 | High | 0.3% | 17 Jun, 2026 | PyPI bedrock-agentcore |
Malicious release: Malicious code in dotenv-sync (PyPI) MAL-2026-6082 | Malicious | Not scored | 17 Jun, 2026 | PyPI dotenv-sync |
Malicious release: Malicious code in disksweep (PyPI) MAL-2026-6081 | Malicious | Not scored | 17 Jun, 2026 | PyPI disksweep |
Malicious release: Malicious code in syncagents (PyPI) MAL-2026-6083 | Malicious | Not scored | 17 Jun, 2026 | PyPI syncagents |
Malicious release: Malicious code in boardflow (PyPI) MAL-2026-6080 | Malicious | Not scored | 17 Jun, 2026 | PyPI boardflow |
Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644) CVE-2026-53870, GHSA-99f9-j8r3-p853, PYSEC-2026-2511 | Medium | 0.2% | 17 Jun, 2026 | PyPI hermes-agent |
Hermes Agent contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation CVE-2026-53869, GHSA-4pqm-j46f-795x, PYSEC-2026-2510 | High | 0.6% | 17 Jun, 2026 | PyPI hermes-agent |
Malicious release: Malicious code in pystylish (PyPI) MAL-2026-6076 | Malicious | Not scored | 17 Jun, 2026 | PyPI pystylish |
Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak CVE-2026-55450, GHSA-x223-p2gf-v735, PYSEC-2026-224 | Critical | 1.2% | 17 Jun, 2026 | PyPI langflow |
Open WebUI: Any authenticated user can read other users' private notes via Socket.IO CVE-2026-54022, GHSA-8788-j68r-3cgh, PYSEC-2026-2712 | Medium | 0.3% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter CVE-2026-54021, GHSA-9rpj-v7hf-vv2w, PYSEC-2026-2718 | Medium | 0.3% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode CVE-2026-54019, GHSA-p5cp-r7rg-qpxc, PYSEC-2026-2750 | Medium | 0.4% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects CVE-2026-54018, GHSA-jrfp-m64g-pcwv, PYSEC-2026-2743 | High | 0.4% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal CVE-2026-54017, GHSA-r2wg-2mcr-66rv, PYSEC-2026-2751 | High | 0.5% | 17 Jun, 2026 | PyPI open-webui |
pdfkit: Path traversal in from_string CVE-2025-26240, GHSA-9g3x-6x24-vf9f, PYSEC-2026-2860 | High | 0.4% | 17 Jun, 2026 | PyPI pdfkit |
OpenStack Horizon RC file generation does not escape special characters in project names CVE-2026-55748, GHSA-6wrm-x65g-hr4p, PYSEC-2026-2519 | Medium | 0.3% | 17 Jun, 2026 | PyPI horizon |
python-statemachine SCXML <data expr> Eval Injection CVE-2026-47103, GHSA-v4jc-pm6r-3vj8, PYSEC-2026-506 | Critical | 1.4% | 17 Jun, 2026 | PyPI python-statemachine |
Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration CVE-2026-54016, GHSA-cx9v-4qj2-jrw6, PYSEC-2026-2721 | Medium | 0.3% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion CVE-2026-54015, GHSA-4r4w-2wgp-w7cj, PYSEC-2026-2701 | Medium | 0.3% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} CVE-2026-54014, GHSA-j2c8-v969-8r5c, PYSEC-2026-2736 | Medium | 0.4% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: Stored XSS to Account Takeover via Model Profile Images CVE-2026-54013, GHSA-v2qm-5wxj-qhj7, PYSEC-2026-2757 | High | 0.3% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion CVE-2026-54012, GHSA-vjqm-6gcc-62cr, PYSEC-2026-2761 | High | 0.3% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: Stored XSS in Mermaid Markdown Preview CVE-2026-54011, GHSA-v8qj-hxv7-mgvv, PYSEC-2026-2759 | High | 0.3% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: Forged chat-file link allows cross-user file read and deletion CVE-2026-54010, GHSA-vrhc-3fr6-pc3c, PYSEC-2026-2763 | High | 0.4% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field CVE-2026-54009, GHSA-wch8-mhj5-9frg, PYSEC-2026-2766 | Medium | 0.4% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401) CVE-2026-54008, GHSA-226f-f24g-524w, PYSEC-2026-2690 | High | 0.3% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI: Cross-origin postMessage confirmation bypass via action:submit CVE-2026-54007, GHSA-3vv5-8xxp-4f55, PYSEC-2026-2695 | High | 0.2% | 17 Jun, 2026 | PyPI open-webui |
Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar CVE-2026-54006, GHSA-f3g7-59qc-pqg6, PYSEC-2026-2722 | Medium | 0.3% | 17 Jun, 2026 | PyPI open-webui |
vLLM: OOM Denial of Service via Audio Decompression Bomb CVE-2026-54233, GHSA-6pr9-rp53-2pmc, PYSEC-2026-3404 | Medium | 0.4% | 17 Jun, 2026 | PyPI vllm |
vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router CVE-2026-54236, GHSA-hgg8-fqqc-vfmw, PYSEC-2026-3408 | Medium | 0.9% | 17 Jun, 2026 | PyPI vllm |
vLLM: GGUF dequantize kernel int truncation exposes uninitialized GPU memory in multi-tenant serving CVE-2026-53923, GHSA-5jv2-g5wq-cmr4, PYSEC-2026-3403 | Medium | 0.5% | 17 Jun, 2026 | PyPI vllm |
vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels CVE-2026-54235, GHSA-7h4p-rffg-7823, PYSEC-2026-3405 | Medium | 0.4% | 17 Jun, 2026 | PyPI vllm |
Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory CVE-2026-50203, GHSA-qf38-jq28-3ccq, PYSEC-2026-218 | Critical | 0.6% | 17 Jun, 2026 | PyPI apache-airflow-providers-sftp |
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication CVE-2026-48797, GHSA-f65r-h4g3-3h9h, PYSEC-2026-291 | Critical | 0.3% | 17 Jun, 2026 | PyPI backpropagate npm @mcptoolshop/backpropagate |
pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678) CVE-2026-48782, GHSA-cg7w-rg45-pc59, PYSEC-2026-2977, PYSEC-2026-2981 | Medium | 0.4% | 17 Jun, 2026 | PyPI pydantic-ai PyPI pydantic-ai-slim |
vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations CVE-2026-12491, GHSA-8jr5-v98p-w75m, PYSEC-2026-3406 | Medium | 0.2% | 17 Jun, 2026 | PyPI vllm |
LangGraph SDK has unsafe URL path construction CVE-2026-48776, GHSA-w39p-vh2g-g8g5, PYSEC-2026-2194, PYSEC-2026-2575 | Critical | 0.2% | 17 Jun, 2026 | PyPI langgraph PyPI langgraph-sdk |
Malicious release: Malicious code in telegram-lite-grabber (PyPI) MAL-2026-6051 | Malicious | Not scored | 17 Jun, 2026 | PyPI telegram-lite-grabber |
Malicious release: Malicious code in tobihook (PyPI) MAL-2026-5995 | Malicious | Not scored | 17 Jun, 2026 | PyPI tobihook |
LiteLLM: Authentication Bypass via Host Header Injection CVE-2026-49468, GHSA-4xpc-pv4p-pm3w, PYSEC-2026-388 | Critical | 3.0% | 16 Jun, 2026 | PyPI litellm |
yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp GHSA-69qj-pvh9-c5wg | High | Not scored | 16 Jun, 2026 | PyPI yt-dlp |
yt-dlp: Arbitrary code execution via manifest downloads with aria2c CVE-2026-50574, GHSA-vx4q-3cr2-7cg2, PYSEC-2026-3433 | Critical | 0.5% | 16 Jun, 2026 | PyPI yt-dlp |
Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check CVE-2026-53755, GHSA-6qhc-x826-342c, PYSEC-2026-588 | High | 1.6% | 16 Jun, 2026 | PyPI crawl4ai |
Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server CVE-2026-56258, GHSA-7cx2-g3h9-382p, PYSEC-2026-228 | Critical | 0.9% | 16 Jun, 2026 | PyPI crawl4ai |
Crawl4AI: LLM credential exfiltration in Docker server via request base_url and env: token resolution CVE-2026-56259, GHSA-f989-c77f-r2cq, PYSEC-2026-3448 | High | 0.4% | 16 Jun, 2026 | PyPI crawl4ai |
Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped) CVE-2026-53754, GHSA-4qqr-vv2q-cmr5, PYSEC-2026-587 | High | 0.4% | 16 Jun, 2026 | PyPI crawl4ai |
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519) CVE-2026-50023, GHSA-c6mh-fpjc-4pr3, PYSEC-2026-3430 | Critical | 0.7% | 16 Jun, 2026 | PyPI yt-dlp |
yt-dlp: File Downloader cookie leak with curl CVE-2026-50019, GHSA-f7j3-774f-rfhj, PYSEC-2026-3431 | High | 0.3% | 16 Jun, 2026 | PyPI yt-dlp |
OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints CVE-2026-46448, GHSA-mfg3-p6m3-gjgr, PYSEC-2026-2686 | High | 0.3% | 16 Jun, 2026 | PyPI nova |