Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Picklescan has a missing detection when calling built-in python idlelib.debugobj.ObjectTreeItem CVE-2025-71354, GHSA-3vg9-h568-4w9m, PYSEC-2026-1781 | High | 0.4% | 26 Aug, 2025 | PyPI picklescan |
Picklescan has a missing detection when calling built-in python lib2to3.pgen2.grammar.Grammar.loads CVE-2025-71359, GHSA-f54q-57x4-jg88 | High | 0.6% | 26 Aug, 2025 | PyPI picklescan |
Picklescan has a missing detection when calling built-in python profile.Profile.runctx CVE-2025-71341, GHSA-6vqj-c2q5-j97w, PYSEC-2026-4132 | High | 0.6% | 26 Aug, 2025 | PyPI picklescan |
Picklescan has a missing detection when calling built-in python profile.Profile.run CVE-2025-71374, GHSA-x696-vm39-cp64 | High | 0.7% | 26 Aug, 2025 | PyPI picklescan |
Picklescan has a missing detection when calling built-in python trace.Trace.runctx CVE-2025-71352, GHSA-g344-hcph-8vgg | High | 0.7% | 26 Aug, 2025 | PyPI picklescan |
Picklescan has a missing detection when calling built-in python trace.Trace.run CVE-2025-71349, GHSA-5qwp-399c-mjwf | High | 0.6% | 26 Aug, 2025 | PyPI picklescan |
xml2rfc has an arbitrary file read vulnerability CVE-2025-11058, GHSA-cfmv-h8fx-85m7, PYSEC-2026-2058 | High | Not scored | 26 Aug, 2025 | PyPI xml2rfc |
Malicious release: Malicious code in import-license-checker (PyPI) MAL-2025-191765 | Malicious | Not scored | 26 Aug, 2025 | PyPI import-license-checker |
mitmproxy binaries embed a vulnerable python-hyper/h2 dependency GHSA-63cx-g855-hvv4 | Medium | Not scored | 25 Aug, 2025 | PyPI mitmproxy |
h2 allows HTTP Request Smuggling due to illegal characters in headers CVE-2025-57804, GHSA-847f-9342-265h, PYSEC-2026-1435 | Medium | 1.9% | 25 Aug, 2025 | PyPI h2 |
XGrammar affected by Denial of Service by infinite recursion grammars CVE-2025-57809, GHSA-5cmr-4px5-23pc, PYSEC-2026-2054 | High | 0.5% | 25 Aug, 2025 | PyPI xgrammar |
Malicious release: Malicious code in xx-ent-wiki-sm (PyPI) MAL-2025-191939 | Malicious | Not scored | 25 Aug, 2025 | PyPI xx-ent-wiki-sm |
Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE) CVE-2025-57760, GHSA-4gv9-mp8m-592r, PYSEC-2025-243, PYSEC-2026-1526 | High | 0.5% | 25 Aug, 2025 | PyPI langflow PyPI langflow-base |
LlamaIndex affected by a Denial of Service (DOS) in JSONReader CVE-2025-5302, GHSA-7753-xrfw-ch36, PYSEC-2026-1561 | High | 0.3% | 25 Aug, 2025 | PyPI llama-index-core |
Malicious release: Malicious code in selenium-stealth-utils (PyPI) MAL-2025-191866 | Malicious | Not scored | 25 Aug, 2025 | PyPI selenium-stealth-utils |
Malicious release: Malicious code in enumeratiam (PyPI) MAL-2025-47763 | Malicious | Not scored | 25 Aug, 2025 | PyPI enumeratiam |
Malicious release: Malicious code in hydenmj (PyPI) MAL-2025-47772 | Malicious | Not scored | 24 Aug, 2025 | PyPI hydenmj |
Malicious release: Malicious code in comedrivewithmeman (PyPI) MAL-2025-47753 | Malicious | Not scored | 24 Aug, 2025 | PyPI comedrivewithmeman |
Malicious release: Malicious code in fifam5tl (PyPI) MAL-2025-47765 | Malicious | Not scored | 24 Aug, 2025 | PyPI fifam5tl |
Malicious release: Malicious code in fucknuker (PyPI) MAL-2025-47768 | Malicious | Not scored | 24 Aug, 2025 | PyPI fucknuker |
Malicious release: Malicious code in fucknukeer (PyPI) MAL-2025-47767 | Malicious | Not scored | 24 Aug, 2025 | PyPI fucknukeer |
Malicious release: Malicious code in fuckingnuker (PyPI) MAL-2025-47766 | Malicious | Not scored | 24 Aug, 2025 | PyPI fuckingnuker |
Malicious release: Malicious code in fuckyoubitch (PyPI) MAL-2025-47770 | Malicious | Not scored | 24 Aug, 2025 | PyPI fuckyoubitch |
Malicious release: Malicious code in fucknukerbro (PyPI) MAL-2025-47769 | Malicious | Not scored | 24 Aug, 2025 | PyPI fucknukerbro |
Malicious release: Malicious code in editidle (PyPI) MAL-2025-47760 | Malicious | Not scored | 24 Aug, 2025 | PyPI editidle |
Malicious release: Malicious code in kimportsetup (PyPI) MAL-2025-47779 | Malicious | Not scored | 24 Aug, 2025 | PyPI kimportsetup |
Malicious release: Malicious code in anrok (PyPI) MAL-2025-47745 | Malicious | Not scored | 23 Aug, 2025 | PyPI anrok |
Malicious release: Malicious code in anrk (PyPI) MAL-2025-47744 | Malicious | Not scored | 23 Aug, 2025 | PyPI anrk |
Malicious release: Malicious code in initialtestingdonotpull1235 (PyPI) MAL-2025-41435 | Malicious | Not scored | 23 Aug, 2025 | PyPI initialtestingdonotpull1235 |
Malicious release: Malicious code in py-sys-utils (PyPI) MAL-2025-47794 | Malicious | Not scored | 23 Aug, 2025 | PyPI py-sys-utils |
Malicious release: Malicious code in selenium-stealth-helper (PyPI) MAL-2025-191865 | Malicious | Not scored | 23 Aug, 2025 | PyPI selenium-stealth-helper |
Malicious release: Malicious code in electrum-bch (PyPI) MAL-2025-47762 | Malicious | Not scored | 23 Aug, 2025 | PyPI electrum-bch |
Malicious release: Malicious code in nukebount (PyPI) MAL-2025-47789 | Malicious | Not scored | 22 Aug, 2025 | PyPI nukebount |
Malicious release: Malicious code in nukeport (PyPI) MAL-2025-47791 | Malicious | Not scored | 22 Aug, 2025 | PyPI nukeport |
Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config CVE-2025-71348, GHSA-vv6j-3g6g-2pvj, PYSEC-2026-245 | High | 0.6% | 22 Aug, 2025 | PyPI picklescan |
Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper CVE-2025-71370, GHSA-vr7h-p6mm-wpmh, PYSEC-2026-4136 | High | 0.5% | 22 Aug, 2025 | PyPI picklescan |
Picklescan missing detection when calling pytorch function torch.utils.data.datapipes.utils.decoder.basichandlers CVE-2025-71369, GHSA-h3qp-7fh3-f8h4 | High | 0.6% | 22 Aug, 2025 | PyPI picklescan |
Picklescan missing detection when calling pytorch function torch.utils.collect_env.run CVE-2025-71350, GHSA-f745-w6jp-hpxx | High | 0.4% | 22 Aug, 2025 | PyPI picklescan |
Picklescan missing detection when calling pytorch function torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression CVE-2025-71356, GHSA-f4x7-rfwp-v3xw | High | 0.4% | 22 Aug, 2025 | PyPI picklescan |
Picklescan missing detection when calling pytorch function torch._dynamo.guards.GuardBuilder.get CVE-2025-71353, GHSA-86cj-95qr-2p4f | High | 0.4% | 22 Aug, 2025 | PyPI picklescan |
Picklescan missing detection when calling pytorch function torch.utils.bottleneck.__main__.run_cprofile CVE-2025-71366, GHSA-4r9r-ch6f-vxmx | High | 0.6% | 22 Aug, 2025 | PyPI picklescan |
Malicious release: Malicious code in seclab-research-depconf-test-2 (PyPI) MAL-2025-191864 | Malicious | Not scored | 22 Aug, 2025 | PyPI seclab-research-depconf-test-2 |
Malicious release: Malicious code in tronpropy (PyPI) MAL-2025-191913 | Malicious | Not scored | 21 Aug, 2025 | PyPI tronpropy |
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs CVE-2025-57751, GHSA-9gjj-6gj7-c4wj, PYSEC-2026-1815 | High | 0.3% | 21 Aug, 2025 | PyPI pyload-ng |
Malicious release: Malicious code in hacktool (PyPI) MAL-2025-47771 | Malicious | Not scored | 21 Aug, 2025 | PyPI hacktool |
Malicious release: Malicious code in vcdiff-py (PyPI) MAL-2025-47811 | Malicious | Not scored | 21 Aug, 2025 | PyPI vcdiff-py |
Malicious release: Malicious code in lolcrazy (PyPI) MAL-2025-47785 | Malicious | Not scored | 21 Aug, 2025 | PyPI lolcrazy |
Malicious release: Malicious code in importsetup (PyPI) MAL-2025-47774 | Malicious | Not scored | 21 Aug, 2025 | PyPI importsetup |
Malicious release: Malicious code in python-ledgercommon (PyPI) MAL-2025-47799 | Malicious | Not scored | 21 Aug, 2025 | PyPI python-ledgercommon |
vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder CVE-2025-9141, GHSA-79j6-g2m3-jgfw, PYSEC-2026-2014 | High | Not scored | 21 Aug, 2025 | PyPI vllm |