{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:35.521Z","products":["berriai"],"actNowTotal":1,"results":[{"query":"berriai","matched":2,"actNow":1,"events":[{"id":"kev-2026-09-02-berriai-litellm","url":"https://securitythreatpulse.com/events/kev-2026-09-02-berriai-litellm","title":"BerriAI LiteLLM: attackers can get in without a password","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 116 days old, so current versions are being attacked.","tier":null,"rankScore":null,"rankWhy":null,"rulesVersion":"v2","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-59822"],"vendor":"BerriAI","product":"LiteLLM","affectedProducts":[{"vendorKey":"berriai","productKey":"litellm","vendor":"BerriAI","product":"LiteLLM","slug":"berriai/litellm","kind":"direct","evidence":["kev"]}],"category":{"id":"ai","label":"AI tools","why":"It connects to AI models and often holds the keys to paid services and data.","doThis":"Update it and change any API keys stored in it."},"summary":"BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.","cvss":8.8,"epss":0.00836,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-09-02","kevDueDate":"2026-09-16","firstSeenAt":"2026-09-02T00:00:00.000Z","updatedAt":"2026-11-01T19:37:40.189Z","newestEvidenceAt":"2026-10-26T12:41:05.000Z"},{"id":"early-cve-2026-40217","url":"https://securitythreatpulse.com/events/early-cve-2026-40217","title":"BerriAI LiteLLM: attackers can run their own code","verdict":"watch","verdictReason":"Attacks are reported but not confirmed by an authoritative source, and the vulnerability is more than 90 days old.","tier":null,"rankScore":4,"rankWhy":["Exploitation is reported.","Ready-made attack tools are public.","The first report is 5 days old."],"rulesVersion":"v3","ladder":{"talk":"none","damage":"none","attempts":"reported","exposure":"none","exploited":"reported"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-40217"],"vendor":"BerriAI","product":"LiteLLM","affectedProducts":[{"kind":"direct","slug":"berriai/litellm","vendor":"BerriAI","product":"LiteLLM","evidence":["cna","cpe"],"vendorKey":"berriai","productKey":"litellm"}],"category":{"id":"ai","label":"AI tools","why":"It connects to AI models and often holds the keys to paid services and data.","doThis":"Update it and change any API keys stored in it."},"summary":"LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.","cvss":8.8,"epss":0.1702,"exploitMaturity":"weaponized","kevListed":false,"kevDateAdded":null,"kevDueDate":null,"firstSeenAt":"2026-11-06T05:13:29.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-11-08T05:30:58.032Z"}]}]}