Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass CVE-2025-71325, GHSA-9gvj-pp9x-gcfr, PYSEC-2026-1788 | Critical | 0.6% | 12 Aug, 2025 | PyPI picklescan |
PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter CVE-2025-55156, GHSA-pwh4-6r3m-j2rf, PYSEC-2026-1821 | High | 0.4% | 11 Aug, 2025 | PyPI pyload-ng |
Litestar has potential log injection in exception logging GHSA-674p-xv2x-rf3g | Low | Not scored | 11 Aug, 2025 | PyPI litestar |
Malicious release: Malicious code in flask-tdg-cyber (PyPI) MAL-2025-41675 | Malicious | Not scored | 11 Aug, 2025 | PyPI flask-tdg-cyber |
Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality CVE-2025-8747, GHSA-c9rc-mg46-23w3, PYSEC-2025-75 | High | 0.1% | 11 Aug, 2025 | PyPI keras |
Malicious release: Malicious code in tronapihelper (PyPI) MAL-2025-191911 | Malicious | Not scored | 10 Aug, 2025 | PyPI tronapihelper |
Malicious release: Malicious code in permsupping (PyPI) MAL-2025-41717 | Malicious | Not scored | 09 Aug, 2025 | PyPI permsupping |
TinyScientist has Path Traversal Vulnerability in PDF Review Function (CWE-22) CVE-2025-55149, GHSA-rrgf-hcr9-jq6h, PYSEC-2026-1967 | Medium | 0.7% | 09 Aug, 2025 | PyPI tiny-scientist |
Malicious release: Malicious code in w3shi-h1 (PyPI) MAL-2025-191923 | Malicious | Not scored | 08 Aug, 2025 | PyPI w3shi-h1 |
Malicious release: Malicious code in packed-w3shi (PyPI) MAL-2025-191809 | Malicious | Not scored | 08 Aug, 2025 | PyPI packed-w3shi |
ExecuTorch integer overflow vulnerability leads to code execution CVE-2025-54952, GHSA-33r8-vrx9-rmcv, PYSEC-2026-1351 | Critical | 0.6% | 08 Aug, 2025 | PyPI executorch |
ExecuTorch vulnerable to Heap-based Buffer Overflow CVE-2025-54951, GHSA-xc7w-r669-48pf, PYSEC-2026-336 | Critical | 0.7% | 07 Aug, 2025 | Maven org.pytorch:executorch-android PyPI executorch SwiftURL github.com/pytorch/executorch |
ExecuTorch out-of-bounds access vulnerability CVE-2025-54950, GHSA-f9hx-c6jf-3qxm, PYSEC-2026-334 | Critical | 0.6% | 07 Aug, 2025 | Maven org.pytorch:executorch-android PyPI executorch SwiftURL github.com/pytorch/executorch |
ExecuTorch heap buffer overflow vulnerability CVE-2025-54949, GHSA-9m39-3mf3-xwch, PYSEC-2026-333 | Critical | 0.7% | 07 Aug, 2025 | Maven org.pytorch:executorch-android PyPI executorch SwiftURL github.com/pytorch/executorch |
ExecuTorch integer overflow vulnerability CVE-2025-30405, GHSA-84m3-f99p-cqx5, PYSEC-2026-332 | Critical | 0.6% | 07 Aug, 2025 | Maven org.pytorch:executorch-android PyPI executorch SwiftURL github.com/pytorch/executorch |
ExecuTorch integer overflow vulnerability CVE-2025-30404, GHSA-hj95-mhgf-jxc4, PYSEC-2026-335 | Critical | 0.6% | 07 Aug, 2025 | Maven org.pytorch:executorch-android PyPI executorch SwiftURL github.com/pytorch/executorch |
Malicious release: Malicious code in raknet-testing-package2 (PyPI) MAL-2025-41730 | Malicious | Not scored | 07 Aug, 2025 | PyPI raknet-testing-package2 |
Malicious release: Malicious code in raknet-testing-package (PyPI) MAL-2025-41729 | Malicious | Not scored | 07 Aug, 2025 | PyPI raknet-testing-package |
uv allows ZIP payload obfuscation through parsing differentials CVE-2025-54368, GHSA-8qf3-x8v5-2pj8, PYSEC-2026-2001 | Medium | 0.2% | 07 Aug, 2025 | PyPI uv |
SKOPS Card.get_model happily allows arbitrary code execution CVE-2025-54886, GHSA-378x-6p4f-8jgm, PYSEC-2026-1925 | High | 0.2% | 07 Aug, 2025 | PyPI skops |
An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull. CVE-2025-44779, GHSA-93jv-pvg8-hf3v, GO-2025-3851, PYSEC-2025-146 | Medium | 0.2% | 07 Aug, 2025 | PyPI ollama |
Malicious release: Malicious code in tronapisync (PyPI) MAL-2025-41787 | Malicious | Not scored | 06 Aug, 2025 | PyPI tronapisync |
Malicious release: Malicious code in httpsyncer (PyPI) MAL-2025-41686 | Malicious | Not scored | 06 Aug, 2025 | PyPI httpsyncer |
Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability CVE-2025-5197, GHSA-9356-575x-2w9m, PYSEC-2026-1983 | Medium | 0.4% | 06 Aug, 2025 | PyPI transformers |
Malicious release: Malicious code in flashsimplelogger (PyPI) MAL-2025-191729 | Malicious | Not scored | 05 Aug, 2025 | PyPI flashsimplelogger |
Malicious release: Malicious code in trongridapi (PyPI) MAL-2025-41788 | Malicious | Not scored | 05 Aug, 2025 | PyPI trongridapi |
Malicious release: Malicious code in discordsync (PyPI) MAL-2025-41662 | Malicious | Not scored | 04 Aug, 2025 | PyPI discordsync |
Malicious release: Malicious code in bh-25-req-ase (PyPI) MAL-2025-191690 | Malicious | Not scored | 04 Aug, 2025 | PyPI bh-25-req-ase |
Malicious release: Malicious code in thisisthedaventestz (PyPI) MAL-2025-41781 | Malicious | Not scored | 04 Aug, 2025 | PyPI thisisthedaventestz |
pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE) CVE-2025-54802, GHSA-48rp-jc79-2264, PYSEC-2026-493 | Critical | 1.3% | 04 Aug, 2025 | PyPI pyload-ng |
Malicious release: Malicious code in zhopaorlaaato (PyPI) MAL-2025-41802 | Malicious | Not scored | 04 Aug, 2025 | PyPI zhopaorlaaato |
Malicious release: Malicious code in sisaws (PyPI) MAL-2025-47453 | Malicious | Not scored | 04 Aug, 2025 | PyPI sisaws |
Malicious release: Malicious code in thisisthedaventest (PyPI) MAL-2025-41780 | Malicious | Not scored | 03 Aug, 2025 | PyPI thisisthedaventest |
Malicious release: Malicious code in totallysafe (PyPI) MAL-2025-41785 | Malicious | Not scored | 03 Aug, 2025 | PyPI totallysafe |
Malicious release: Malicious code in dsodelib (PyPI) MAL-2025-41667 | Malicious | Not scored | 03 Aug, 2025 | PyPI dsodelib |
Malicious release: Malicious code in dziplib (PyPI) MAL-2025-41668 | Malicious | Not scored | 03 Aug, 2025 | PyPI dziplib |
Malicious release: Malicious code in dsidelib (PyPI) MAL-2025-41666 | Malicious | Not scored | 03 Aug, 2025 | PyPI dsidelib |
Malicious release: Malicious code in secmeasure (PyPI) MAL-2025-47452 | Malicious | Not scored | 03 Aug, 2025 | PyPI secmeasure |
Malicious release: Malicious code in supersafepackage (PyPI) MAL-2025-41770 | Malicious | Not scored | 02 Aug, 2025 | PyPI supersafepackage |
Malicious release: Malicious code in bh-usa-req-ase (PyPI) MAL-2025-191692 | Malicious | Not scored | 02 Aug, 2025 | PyPI bh-usa-req-ase |
Malicious release: Malicious code in bh-usa-automate-req-ase (PyPI) MAL-2025-191691 | Malicious | Not scored | 02 Aug, 2025 | PyPI bh-usa-automate-req-ase |
Malicious release: Malicious code in tsesyx (PyPI) MAL-2025-41790 | Malicious | Not scored | 02 Aug, 2025 | PyPI tsesyx |
Malicious release: Malicious code in web3dummycti (PyPI) MAL-2025-191928 | Malicious | Not scored | 02 Aug, 2025 | PyPI web3dummycti |
Malicious release: Malicious code in req-ase-automate (PyPI) MAL-2025-191854 | Malicious | Not scored | 02 Aug, 2025 | PyPI req-ase-automate |
Malicious release: Malicious code in req-pre-automate (PyPI) MAL-2025-191855 | Malicious | Not scored | 02 Aug, 2025 | PyPI req-pre-automate |
Malicious release: Malicious code in req-pre-automate1 (PyPI) MAL-2025-191856 | Malicious | Not scored | 02 Aug, 2025 | PyPI req-pre-automate1 |
copyparty allows Regex Denial of Service (ReDoS) in the upload listing CVE-2025-54796, GHSA-5662-2rj7-f2v6, PYSEC-2026-1275 | High | 0.5% | 02 Aug, 2025 | PyPI copyparty |
Malicious release: Malicious code in loggerex (PyPI) MAL-2025-191782 | Malicious | Not scored | 01 Aug, 2025 | PyPI loggerex |
Malicious release: Malicious code in supersafereverse (PyPI) MAL-2025-191882 | Malicious | Not scored | 01 Aug, 2025 | PyPI supersafereverse |
Malicious release: Malicious code in loquru (PyPI) MAL-2025-191784 | Malicious | Not scored | 01 Aug, 2025 | PyPI loquru |