{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T16:23:59.585Z", "tag": { "id": "python", "label": "Python", "isStack": true, "url": "https://pwn.watch/t/python", "feed": "https://pwn.watch/t/python/feed.xml" }, "counts": { "incidents": 16, "live": 2, "notFullyPatched": 1, "patched": 15 }, "incidents": [ { "slug": "litellm-1-107-0-pypi-compromise", "title": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise", "json": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise.json", "status": "live", "severity": "critical", "patchStatus": "patched", "product": "LiteLLM (PyPI + official Docker/GHCR images)", "tags": [ "python", "pypi", "docker", "ai", "litellm", "supply-chain" ], "cveIds": [ "MAL-2026-2144" ], "affectedVersions": [ "litellm==1.107.0; Docker/GHCR tags v1.107.0, latest, main-latest, main-stable during the Oct 21 window" ], "fixedVersions": [ "1.106.2 (pin; last known safe). Malicious 1.107.0 removed from PyPI, Docker Hub and GHCR" ], "startedAt": "2026-10-21", "closedAt": null, "updatedAt": "2026-10-22T16:00:44+02:00", "summary": "On Oct 21 2026 attackers compromised LiteLLM’s release pipeline and published malicious litellm==1.107.0 to PyPI (live ~2 hours) plus compromised Docker Hub/GHCR tags (v1.107.0, latest, main-latest, main-stable). The wheels install cook.pth / cook.py / sitecustomize.py that steal cloud, developer and AI-tool credentials at every Python startup and open a remote-code loader. Second LiteLLM compromise of 2026.", "xPost": null }, { "slug": "http3-qpack-header-accordions", "title": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS", "url": "https://pwn.watch/i/http3-qpack-header-accordions", "json": "https://pwn.watch/i/http3-qpack-header-accordions.json", "status": "live", "severity": "unknown", "patchStatus": "partial", "product": "HTTP/3 / QPACK stacks (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark, …)", "tags": [ "go", "rust", "python", "cloudflare", "http3" ], "cveIds": [ "CVE-2025-64702", "CVE-2026-12523", "CVE-2025-13945" ], "affectedVersions": [ "See FoxIO table; Bun 1.4.3 and aioquic/mitmproxy unpatched as of Oct 20 2026" ], "fixedVersions": [ "quic-go 0.57.0", "Cloudflare quiche 0.29.3", "lsquic 4.9.0", "Wireshark 4.6.2 / 4.4.12" ], "startedAt": "2026-10-20", "closedAt": null, "updatedAt": "2026-10-22T11:19:00+02:00", "summary": "FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.", "xPost": null }, { "slug": "berriai-litellm-cve-2026-59822", "title": "BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability", "url": "https://pwn.watch/i/berriai-litellm-cve-2026-59822", "json": "https://pwn.watch/i/berriai-litellm-cve-2026-59822.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "BerriAI LiteLLM", "tags": [ "python", "ai", "litellm", "mcp", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-59822" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-09-02", "closedAt": "2026-09-02", "updatedAt": "2026-09-02", "summary": "BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. Added to CISA KEV on 2026-09-02.", "xPost": null }, { "slug": "mlflow-mlflow-cve-2026-64849", "title": "MLflow MLflow: MLflow Server-Side Request Forgery Vulnerability", "url": "https://pwn.watch/i/mlflow-mlflow-cve-2026-64849", "json": "https://pwn.watch/i/mlflow-mlflow-cve-2026-64849.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "MLflow MLflow", "tags": [ "python", "ai", "mlflow", "cisa-kev" ], "cveIds": [ "CVE-2026-64849" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-19", "closedAt": "2026-08-19", "updatedAt": "2026-08-19", "summary": "MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body. Added to CISA KEV on 2026-08-19.", "xPost": null }, { "slug": "ray-project-ray-cve-2025-62593", "title": "Ray-Project Ray: Ray-Project Ray Code Injection Vulnerability", "url": "https://pwn.watch/i/ray-project-ray-cve-2025-62593", "json": "https://pwn.watch/i/ray-project-ray-cve-2025-62593.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Ray-Project Ray", "tags": [ "python", "ai", "ray", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-62593" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-17", "closedAt": "2026-08-17", "updatedAt": "2026-08-17", "summary": "Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari. Added to CISA KEV on 2026-08-17.", "xPost": null }, { "slug": "ibm-langflow-cve-2026-9198", "title": "IBM Langflow: IBM Langflow Code Injection Vulnerability", "url": "https://pwn.watch/i/ibm-langflow-cve-2026-9198", "json": "https://pwn.watch/i/ibm-langflow-cve-2026-9198.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "IBM Langflow", "tags": [ "python", "ai", "langflow", "ibm", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-9198" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-04", "closedAt": "2026-08-04", "updatedAt": "2026-08-04", "summary": "Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. Added to CISA KEV on 2026-08-04.", "xPost": null }, { "slug": "langflow-langflow-cve-2026-0770", "title": "Langflow Langflow: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability", "url": "https://pwn.watch/i/langflow-langflow-cve-2026-0770", "json": "https://pwn.watch/i/langflow-langflow-cve-2026-0770.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Langflow Langflow", "tags": [ "python", "ai", "langflow", "cisa-kev" ], "cveIds": [ "CVE-2026-0770" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-21", "closedAt": "2026-07-21", "updatedAt": "2026-07-21", "summary": "Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. Added to CISA KEV on 2026-07-21.", "xPost": null }, { "slug": "langflow-langflow-cve-2026-55255", "title": "Langflow Langflow: Langflow Authorization Bypass Through User-Controlled Key Vulnerability", "url": "https://pwn.watch/i/langflow-langflow-cve-2026-55255", "json": "https://pwn.watch/i/langflow-langflow-cve-2026-55255.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Langflow Langflow", "tags": [ "python", "ai", "langflow", "cisa-kev" ], "cveIds": [ "CVE-2026-55255" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-07", "closedAt": "2026-07-07", "updatedAt": "2026-07-07", "summary": "Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. Added to CISA KEV on 2026-07-07.", "xPost": null }, { "slug": "berriai-litellm-cve-2026-42271", "title": "BerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerability", "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42271", "json": "https://pwn.watch/i/berriai-litellm-cve-2026-42271.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "BerriAI LiteLLM", "tags": [ "python", "ai", "litellm", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-42271", "CVE-2026-48710" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-06-08", "closedAt": "2026-06-08", "updatedAt": "2026-09-02", "summary": "BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host. CISA added CVE-2026-42271, CVE-2026-48710 to the Known Exploited Vulnerabilities catalog on 2026-06-08 based on evidence of active exploitation.", "xPost": null }, { "slug": "langflow-langflow-cve-2025-34291", "title": "Langflow Langflow: Langflow Origin Validation Error Vulnerability", "url": "https://pwn.watch/i/langflow-langflow-cve-2025-34291", "json": "https://pwn.watch/i/langflow-langflow-cve-2025-34291.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Langflow Langflow", "tags": [ "python", "ai", "langflow", "cisa-kev" ], "cveIds": [ "CVE-2025-34291" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-05-21", "closedAt": "2026-05-21", "updatedAt": "2026-05-21", "summary": "Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints. Added to CISA KEV on 2026-05-21.", "xPost": null }, { "slug": "berriai-litellm-cve-2026-42208", "title": "BerriAI LiteLLM: BerriAI LiteLLM SQL Injection Vulnerability", "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42208", "json": "https://pwn.watch/i/berriai-litellm-cve-2026-42208.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "BerriAI LiteLLM", "tags": [ "python", "ai", "litellm", "cisa-kev", "sql-injection" ], "cveIds": [ "CVE-2026-42208" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-05-08", "closedAt": "2026-05-08", "updatedAt": "2026-05-08", "summary": "BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages. Added to CISA KEV on 2026-05-08.", "xPost": null }, { "slug": "langflow-langflow-cve-2026-33017", "title": "Langflow Langflow: Langflow Code Injection Vulnerability", "url": "https://pwn.watch/i/langflow-langflow-cve-2026-33017", "json": "https://pwn.watch/i/langflow-langflow-cve-2026-33017.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Langflow Langflow", "tags": [ "python", "ai", "langflow", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-33017" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-03-25", "closedAt": "2026-03-25", "updatedAt": "2026-03-25", "summary": "Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication. Added to CISA KEV on 2026-03-25.", "xPost": null }, { "slug": "langflow-cve-2025-3248", "title": "Langflow: Missing Authentication Vulnerability", "url": "https://pwn.watch/i/langflow-cve-2025-3248", "json": "https://pwn.watch/i/langflow-cve-2025-3248.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Langflow", "tags": [ "ai", "python", "langflow", "ransomware", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2025-3248" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-05-05", "closedAt": "2025-05-05", "updatedAt": "2025-05-05", "summary": "Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests. Added to CISA KEV on 2025-05-05.", "xPost": null }, { "slug": "ultralytics-pypi-supply-chain-attack", "title": "Ultralytics PyPI releases backdoored with a crypto miner", "url": "https://pwn.watch/i/ultralytics-pypi-supply-chain-attack", "json": "https://pwn.watch/i/ultralytics-pypi-supply-chain-attack.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "ultralytics (PyPI)", "tags": [ "python", "pypi", "github-actions", "ai", "ultralytics", "supply-chain", "cryptominer", "github" ], "cveIds": [], "affectedVersions": [ "8.3.41", "8.3.42", "8.3.45", "8.3.46" ], "fixedVersions": [ "Malicious versions removed from PyPI; see vendor advisory for the clean release" ], "startedAt": "2024-12-04", "closedAt": "2024-12-11", "updatedAt": "2024-12-11", "summary": "Attackers compromised the Ultralytics YOLO project's GitHub Actions workflows (by poisoning the Actions cache) and published ultralytics 8.3.41 and 8.3.42 to PyPI with an XMRig cryptominer. They later pushed 8.3.45 and 8.3.46 using a leftover PyPI API token. All four versions were removed. PyPI's analysis credits Trusted Publishing attestations with making the attack auditable.", "xPost": null }, { "slug": "apache-superset-cve-2023-27524", "title": "Apache Superset Insecure Default Initialization of Resource", "url": "https://pwn.watch/i/apache-superset-cve-2023-27524", "json": "https://pwn.watch/i/apache-superset-cve-2023-27524.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Apache Superset", "tags": [ "python", "apache", "superset", "cisa-kev" ], "cveIds": [ "CVE-2023-27524" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-08", "closedAt": "2024-01-08", "updatedAt": "2024-01-08", "summary": "Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions. Added to the CISA KEV catalog on 2024-01-08. CVE-2023-27524 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "libwebp-heap-overflow-cve-2023-4863", "title": "libwebp heap overflow exploited in the wild (CVE-2023-4863)", "url": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863", "json": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "libwebp (Google Chrome and everything that bundles libwebp)", "tags": [ "node", "python", "libwebp", "google", "chrome", "electron", "zero-day", "cisa-kev" ], "cveIds": [ "CVE-2023-4863" ], "affectedVersions": [ "Google Chrome before 116.0.5845.187; libwebp before 1.3.2 (NVD)" ], "fixedVersions": [ "Chrome 116.0.5845.187", "libwebp 1.3.2", "Bundling apps/libraries: see each vendor's advisory" ], "startedAt": "2023-09-11", "closedAt": "2023-09-13", "updatedAt": "2023-09-13", "summary": "A heap overflow in libwebp's lossless decoder, found by Apple SEAR and Citizen Lab after the BLASTPASS iPhone exploit, was exploited in the wild. Because libwebp is everywhere, browsers, Electron apps and image libraries that bundle it all had to ship updates.", "xPost": null } ], "posts": [ { "authorName": "Help Net Security", "handle": "helpnetsecurity", "avatarUrl": "https://pbs.twimg.com/profile_images/1602979161932455937/3RwfWo0d_bigger.jpg", "text": "LiteLLM hit by second supply chain attack this year, users urged to rotate credentials - https://t.co/7iolIMAKe8 - @GossiTheDog @RockHudsonRock @cloudsek @wiz_io @AikidoSecurity @SocketSecurity - #LiteLLM #SupplyChainAttack #OpenSource #malware #Cybersecurity #CyberSecurityNews https://t.co/ZLPywonXYC", "date": "2026-10-22T13:26:50.000Z", "url": "https://x.com/helpnetsecurity/status/2113260794544796098", "media": [], "incident": "litellm-1-107-0-pypi-compromise" }, { "authorName": "The Daily Tech Feed", "handle": "dailytechonx", "avatarUrl": "https://pbs.twimg.com/profile_images/1889684200258764800/AEZLG4yL_bigger.jpg", "text": "HTTP/3 servers using QPACK are exposed to serious memory-amplification flaws. Attackers can crash servers with tiny compressed headers. Key stacks like quic-go, quiche, lsquic patched—but Bun, h3, aioquic still vulnerable. Mitigations needed now.\n\n#HTTP3 #QPACK #Vulnerability https://t.co/ZU7h7ky0XX", "date": "2026-10-22T07:02:21.000Z", "url": "https://x.com/dailytechonx/status/2113164033914175882", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HVN3faQWgAIF_bP.jpg" } ], "incident": "http3-qpack-header-accordions" }, { "authorName": "kokumօtօ", "handle": "__kokumoto", "avatarUrl": "https://pbs.twimg.com/profile_images/1612504196720492544/T_-s-6OP_bigger.jpg", "text": "HTTP/3サーバ向けのDoS攻撃手法、QPACK増幅攻撃\"Header Accordions\"のPoC（攻撃の概念実証コード）と詳細が開示された。quic-go、Cloudflare quiche、Wiresharkは修正済み。Microsoft IIS、Envoy、Google quiche、ngtcp2/nghttp3は元々脆弱ではない。 https://t.co/iIRxIHmhnu", "date": "2026-10-22T03:32:49.000Z", "url": "https://x.com/__kokumoto/status/2113111305393750474", "media": [], "incident": "http3-qpack-header-accordions" }, { "authorName": "azu", "handle": "azu_re", "avatarUrl": "https://pbs.twimg.com/profile_images/1081057521719078912/OqWfdeQ6_bigger.jpg", "text": "QUICの多くの実装でのOOM \"Header Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber Innovation\" https://t.co/qEjI9cftas", "date": "2026-10-21T23:49:44.000Z", "url": "https://x.com/azu_re/status/2113055165100286299", "media": [], "incident": "http3-qpack-header-accordions" }, { "authorName": "The Hacker News", "handle": "TheHackersNews", "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg", "text": "🚨 LiteLLM 1.107.0 compromised in a supply chain attack.\n\nMalicious PyPI packages and Docker images delivered a credential stealer and backdoor.\n\n⚠️ The malware runs at Python startup, targeting cloud credentials, private keys, and AI tool credentials.\n\n🔗 Full story: https://t.co/ANqBuYaGx5", "date": "2026-10-21T18:02:10.000Z", "url": "https://x.com/TheHackersNews/status/2112967698103894257", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HVLE6tcakAATDtC.jpg" } ], "incident": "litellm-1-107-0-pypi-compromise" }, { "authorName": "Moshe Siman Tov Bustan", "handle": "MosheTov", "avatarUrl": "https://pbs.twimg.com/profile_images/1998067906706345984/SwYIhsPZ_bigger.jpg", "text": "❗ If 2 PHP vulns weren't enough for one day (or, 0-day?) - LiteLLM were compromised today by a combined RAT Infostealer malware!\n\nTLDR - LiteLLM PyPI ver 1.107.0 is compromised, if you installed it - revoke keys and change passwords ASAP.\n\nThe malware combines two threats in one https://t.co/WjpMeKcVgg", "date": "2026-10-21T15:46:21.000Z", "url": "https://x.com/MosheTov/status/2112933514962247891", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HVKl1H6XQAAPSJw.jpg" } ], "incident": "litellm-1-107-0-pypi-compromise" }, { "authorName": "Cyber Security News", "handle": "The_Cyber_News", "avatarUrl": "https://pbs.twimg.com/profile_images/1174924326807592960/aJMuU6Ms_bigger.jpg", "text": "‼️ Breaking: LiteLLM Compromised – Infostealer and RAT Injected in 1.107.0 PyPI Release\n\nDetails: https://t.co/8rlH8xijjj\n\nLiteLLM version 1.107.0 was compromised on PyPI on October 21, 2026, spreading a credential stealer and a remote access trojan through all seven distributed https://t.co/caDoffOmFx", "date": "2026-10-21T15:21:29.000Z", "url": "https://x.com/The_Cyber_News/status/2112927256956088756", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HVKf10bawAAfyb6.jpg" } ], "incident": "litellm-1-107-0-pypi-compromise" }, { "authorName": "Socket", "handle": "SocketSecurity", "avatarUrl": "https://pbs.twimg.com/profile_images/2057141188591824896/aKdKFNEE_bigger.jpg", "text": "🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised.\n\nVersion 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools. https://t.co/4Mbt1LbhLu", "date": "2026-10-21T14:03:54.000Z", "url": "https://x.com/SocketSecurity/status/2112907732877775016", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HVKNz_RWYAAoI1O.jpg" } ], "incident": "litellm-1-107-0-pypi-compromise" } ], "changes": [ { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "LiteLLM root cause: attacker held three developer GitHub CLI tokens, likely scraped from logs of an internet-exposed internal LiteLLM deployment (Claude Code can echo a gh OAuth token into logged response bodies), disabled branch protection and ran the release workflow against lookalike repo Berri-AI/litellm.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-22", "title": "StepSecurity full teardown: payload exfiltrates to lookalike www.litellm.dev (registered Oct 13) and an hourly loader polls a GitHub dead drop (letters9813/pythonclient-test, now deleted). Infected hosts keep polling, so anyone re-registering that username could run code on them: kill the process holding /tmp/remote_code_loader.lock, delete cook.pth/cook.py/sitecustomize.py, pin 1.106.2 and rotate everything.", "body": null, "sourceUrl": "https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T11:39Z", "title": "Malicious 1.107.0 wheels appear on PyPI.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T11:39Z", "title": "Malicious litellm==1.107.0 (all seven wheels) live on PyPI 11:39-13:23 UTC; Docker tags v1.107.0/latest/main-latest/main-stable compromised 11:46-14:20 UTC.", "body": null, "sourceUrl": "https://docs.litellm.ai/blog/security-incident-oct-21-2026", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T13:23Z", "title": "PyPI quarantines/pulls the package (~2h window).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T14:20Z", "title": "Docker Hub tags cleaned / retargeted; GHCR images made unavailable earlier.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T16:20Z", "title": "Wiz sees stolen AWS instance-role credentials validated from 168.100.8.57 and 165.227.201.8 (sts:GetCallerIdentity, then Bedrock model listing), consistent with LLMjacking.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-21T20:30Z", "title": "LiteLLM posts containment update; investigation ongoing.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "http3-qpack-header-accordions", "incidentTitle": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS", "severity": "unknown", "status": "live", "patchStatus": "partial", "date": "2026-10-20", "title": "FoxIO blog + PoC published; several stacks still unpatched.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/http3-qpack-header-accordions" }, { "incident": "litellm-1-107-0-pypi-compromise", "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise", "severity": "critical", "status": "live", "patchStatus": "patched", "date": "2026-10-19", "title": "LiteLLM temporarily expands release permissions for two internal engineers (daily bugfix backports).", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html", "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise" }, { "incident": "berriai-litellm-cve-2026-59822", "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-02", "title": "CISA added CVE-2026-59822 to the KEV catalog (due 2026-09-16).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/berriai-litellm-cve-2026-59822" }, { "incident": "mlflow-mlflow-cve-2026-64849", "incidentTitle": "MLflow MLflow: MLflow Server-Side Request Forgery Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-19", "title": "CISA added CVE-2026-64849 to the KEV catalog (due 2026-09-02).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/mlflow-mlflow-cve-2026-64849" }, { "incident": "ray-project-ray-cve-2025-62593", "incidentTitle": "Ray-Project Ray: Ray-Project Ray Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-17", "title": "CISA added CVE-2025-62593 to the KEV catalog (due 2026-08-20).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ray-project-ray-cve-2025-62593" }, { "incident": "ibm-langflow-cve-2026-9198", "incidentTitle": "IBM Langflow: IBM Langflow Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-04", "title": "CISA added CVE-2026-9198 to the KEV catalog (due 2026-08-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/ibm-langflow-cve-2026-9198" }, { "incident": "langflow-langflow-cve-2026-0770", "incidentTitle": "Langflow Langflow: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-21", "title": "CISA added CVE-2026-0770 to the KEV catalog (due 2026-07-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-langflow-cve-2026-0770" }, { "incident": "langflow-langflow-cve-2026-55255", "incidentTitle": "Langflow Langflow: Langflow Authorization Bypass Through User-Controlled Key Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-07", "title": "CISA added CVE-2026-55255 to the KEV catalog (due 2026-07-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-langflow-cve-2026-55255" }, { "incident": "berriai-litellm-cve-2026-42271", "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-06-08", "title": "CISA added CVE-2026-42271, CVE-2026-48710 to the KEV catalog (due 2026-06-22).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42271" }, { "incident": "langflow-langflow-cve-2025-34291", "incidentTitle": "Langflow Langflow: Langflow Origin Validation Error Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-21", "title": "CISA added CVE-2025-34291 to the KEV catalog (due 2026-06-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-langflow-cve-2025-34291" }, { "incident": "berriai-litellm-cve-2026-42208", "incidentTitle": "BerriAI LiteLLM: BerriAI LiteLLM SQL Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-08", "title": "CISA added CVE-2026-42208 to the KEV catalog (due 2026-05-11).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/berriai-litellm-cve-2026-42208" }, { "incident": "langflow-langflow-cve-2026-33017", "incidentTitle": "Langflow Langflow: Langflow Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-25", "title": "CISA added CVE-2026-33017 to the KEV catalog (due 2026-04-08).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-langflow-cve-2026-33017" }, { "incident": "http3-qpack-header-accordions", "incidentTitle": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS", "severity": "unknown", "status": "live", "patchStatus": "partial", "date": "2025-11 → 2026-07", "title": "Responsible reports to quic-go, quiche, Bun, aioquic, lsquic, h3.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/http3-qpack-header-accordions" }, { "incident": "langflow-cve-2025-3248", "incidentTitle": "Langflow: Missing Authentication Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-05-05", "title": "CISA added CVE-2025-3248 to the KEV catalog (due 2025-05-26).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/langflow-cve-2025-3248" }, { "incident": "ultralytics-pypi-supply-chain-attack", "incidentTitle": "Ultralytics PyPI releases backdoored with a crypto miner", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-12-11", "title": "PyPI publishes its analysis: 8.3.41, 8.3.42, 8.3.45 and 8.3.46 affected and removed", "body": null, "sourceUrl": "https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/", "url": "https://pwn.watch/i/ultralytics-pypi-supply-chain-attack" }, { "incident": "ultralytics-pypi-supply-chain-attack", "incidentTitle": "Ultralytics PyPI releases backdoored with a crypto miner", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-12-05", "title": "Issue #18027: published 8.3.41 wheel differs from GitHub and runs an XMRig miner", "body": null, "sourceUrl": "https://github.com/ultralytics/ultralytics/issues/18027", "url": "https://pwn.watch/i/ultralytics-pypi-supply-chain-attack" }, { "incident": "apache-superset-cve-2023-27524", "incidentTitle": "Apache Superset Insecure Default Initialization of Resource", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-01-08", "title": "CISA added CVE-2023-27524 to the KEV catalog (federal deadline 2024-01-29)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/apache-superset-cve-2023-27524" }, { "incident": "libwebp-heap-overflow-cve-2023-4863", "incidentTitle": "libwebp heap overflow exploited in the wild (CVE-2023-4863)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-09-13", "title": "CISA adds CVE-2023-4863 to the KEV catalog", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863" }, { "incident": "libwebp-heap-overflow-cve-2023-4863", "incidentTitle": "libwebp heap overflow exploited in the wild (CVE-2023-4863)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-09-11", "title": "Chrome stable update fixes CVE-2023-4863; Google says an exploit exists in the wild", "body": null, "sourceUrl": "https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html", "url": "https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863" } ] }