Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in aphisherman (PyPI) MAL-2025-6435 | Malicious | Not scored | 31 Jul, 2025 | PyPI aphisherman |
Malicious release: Malicious code in aphisher (PyPI) MAL-2025-6434 | Malicious | Not scored | 31 Jul, 2025 | PyPI aphisher |
Malicious release: Malicious code in aistac-foundation (PyPI) MAL-2025-6429 | Malicious | Not scored | 31 Jul, 2025 | PyPI aistac-foundation |
OpenEXR Heap-Based Buffer Overflow in Deep Scanline Parsing via Forged Unpacked Size CVE-2025-48071, GHSA-h45x-qhg2-q375, PYSEC-2026-1747 | High | 0.4% | 31 Jul, 2025 | PyPI OpenEXR PyPI openexr |
MaterialX Null Pointer Dereference in MaterialXCore Shader Generation due to Unchecked implGraphOutput CVE-2025-53011, GHSA-7qw8-3vmf-gj32, PYSEC-2026-1607 | Low | 0.6% | 31 Jul, 2025 | PyPI MaterialX PyPI materialx |
MaterialX Null Pointer Dereference in getShaderNodes due to Unchecked nodeGraph->getOutput return CVE-2025-53010, GHSA-3jhf-gxhr-q4cx, PYSEC-2026-1606 | Low | 0.5% | 31 Jul, 2025 | PyPI MaterialX PyPI materialx |
Malicious release: num2words subjected to phishing attack, two versions published containing malware GHSA-jxr6-qrxx-2ph2, MAL-2025-6794, PYSEC-2025-72 | MaliciousCritical | Not scored | 31 Jul, 2025 | PyPI num2words |
MS SWIFT Deserialization RCE Vulnerability GHSA-r54c-2xmf-2cf3 | Medium | Not scored | 31 Jul, 2025 | PyPI ms-swift |
MS SWIFT WEB-UI RCE Vulnerability CVE-2025-41419, GHSA-7c78-rm87-5673, PYSEC-2026-1682 | Medium | Not scored | 31 Jul, 2025 | PyPI ms-swift |
MS SWIFT Remote Code Execution via unsafe PyYAML deserialization CVE-2025-50460, GHSA-fm6c-f59h-7mmg, PYSEC-2026-1683 | Critical | 2.9% | 31 Jul, 2025 | PyPI ms-swift |
copyparty Reflected XSS via Filter Parameter CVE-2025-54589, GHSA-8mx2-rjh8-q3jq, PYSEC-2026-1276 | Medium | 2.4% | 31 Jul, 2025 | PyPI copyparty |
Malicious release: Malicious code in prof-tg-to-qu (PyPI) MAL-2025-191828 | Malicious | Not scored | 31 Jul, 2025 | PyPI prof-tg-to-qu |
Malicious release: Malicious code in prof-tg-go-qu (PyPI) MAL-2025-191827 | Malicious | Not scored | 31 Jul, 2025 | PyPI prof-tg-go-qu |
Malicious release: Malicious code in prof-tg-gjho-qu (PyPI) MAL-2025-191826 | Malicious | Not scored | 31 Jul, 2025 | PyPI prof-tg-gjho-qu |
Malicious release: Malicious code in prof-tg-gdghho-qu (PyPI) MAL-2025-191825 | Malicious | Not scored | 31 Jul, 2025 | PyPI prof-tg-gdghho-qu |
Malicious release: Malicious code in prof-tg-dggrto-qu (PyPI) MAL-2025-191823 | Malicious | Not scored | 31 Jul, 2025 | PyPI prof-tg-dggrto-qu |
Malicious release: Malicious code in backtradingbot (PyPI) MAL-2025-191689 | Malicious | Not scored | 31 Jul, 2025 | PyPI backtradingbot |
Malicious release: Malicious code in trongridperm (PyPI) MAL-2025-41789 | Malicious | Not scored | 30 Jul, 2025 | PyPI trongridperm |
Pyload log Injection via API /json/add_package in add_name parameter GHSA-3wwm-hjv7-23r3 | Medium | Not scored | 30 Jul, 2025 | PyPI pyload-ng |
Malicious release: Malicious code in flatfox-api (PyPI) MAL-2025-6787 | Malicious | Not scored | 30 Jul, 2025 | PyPI flatfox-api |
Malicious release: Malicious code in maxload (PyPI) MAL-2025-41701 | Malicious | Not scored | 30 Jul, 2025 | PyPI maxload |
Couchbase Sync Gateway shows cleartext passwords in redacted and unredacted output CVE-2025-52490, GHSA-pqhp-4xfc-hjgq, GO-2026-5550, PYSEC-2025-101 | High | 0.2% | 29 Jul, 2025 | Go github.com/couchbase/sync_gateway PyPI couchbase |
Bugsink path traversal via event_id in ingestion CVE-2025-54433, GHSA-q78p-g86f-jg6q, PYSEC-2026-1226 | High | 0.7% | 29 Jul, 2025 | PyPI bugsink |
BentoML SSRF Vulnerability in File Upload Processing CVE-2025-54381, GHSA-mrmq-3q62-6cc8, PYSEC-2026-297 | Critical | 13.2% | 29 Jul, 2025 | PyPI bentoml |
Malicious release: Malicious code in someeebbb (PyPI) MAL-2025-41764 | Malicious | Not scored | 29 Jul, 2025 | PyPI someeebbb |
Malicious release: Malicious code in triple-equal (PyPI) MAL-2025-41786 | Malicious | Not scored | 29 Jul, 2025 | PyPI triple-equal |
Malicious release: Malicious code in testing123kk (PyPI) MAL-2025-6336 | Malicious | Not scored | 29 Jul, 2025 | PyPI testing123kk |
Malicious release: Malicious code in testpackageroietest3 (PyPI) MAL-2025-41776 | Malicious | Not scored | 28 Jul, 2025 | PyPI testpackageroietest3 |
Malicious release: Malicious code in testpackageroietest2 (PyPI) MAL-2025-41775 | Malicious | Not scored | 28 Jul, 2025 | PyPI testpackageroietest2 |
Malicious release: Malicious code in greater-than (PyPI) MAL-2025-41681 | Malicious | Not scored | 28 Jul, 2025 | PyPI greater-than |
Malicious release: Malicious code in requires-python (PyPI) MAL-2025-41747 | Malicious | Not scored | 28 Jul, 2025 | PyPI requires-python |
Malicious release: Malicious code in supersafecalc (PyPI) MAL-2025-191881 | Malicious | Not scored | 28 Jul, 2025 | PyPI supersafecalc |
copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata CVE-2025-54423, GHSA-9q4r-x2hj-jmvr, PYSEC-2026-1277 | Medium | 0.5% | 28 Jul, 2025 | PyPI copyparty |
Malicious release: Malicious code in treeherder-submitter (PyPI) MAL-2025-191910 | Malicious | Not scored | 28 Jul, 2025 | PyPI treeherder-submitter |
Malicious release: Malicious code in triple-equals (PyPI) MAL-2025-6328 | Malicious | Not scored | 28 Jul, 2025 | PyPI triple-equals |
Malicious release: Malicious code in hello-from-shiphero (PyPI) MAL-2025-191751 | Malicious | Not scored | 27 Jul, 2025 | PyPI hello-from-shiphero |
smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module CVE-2025-5120, GHSA-6v92-r5mx-h5fx, PYSEC-2026-542 | Critical | 31.2% | 27 Jul, 2025 | PyPI smolagents |
Malicious release: Malicious code in prof-qux (PyPI) MAL-2025-191821 | Malicious | Not scored | 26 Jul, 2025 | PyPI prof-qux |
Malicious release: Malicious code in foundry-jupyter-extension (PyPI) MAL-2025-6248 | Malicious | Not scored | 26 Jul, 2025 | PyPI foundry-jupyter-extension |
Malicious release: Malicious code in prof-qx (PyPI) MAL-2025-191822 | Malicious | Not scored | 25 Jul, 2025 | PyPI prof-qx |
Skops may allow MethodNode to access unexpected object fields through dot notation, leading to arbitrary code execution at load time CVE-2025-54413, GHSA-4v6w-xpmh-gfgp, PYSEC-2026-1926 | High | 0.2% | 25 Jul, 2025 | PyPI skops |
Skops has Inconsistent Trusted Type Validation that Enables Hidden `operator` Methods Execution CVE-2025-54412, GHSA-m7f4-hrc6-fwg3, PYSEC-2026-1927 | High | 0.2% | 25 Jul, 2025 | PyPI skops |
Assemblyline 4 service client vulnerable to Arbitrary Write through path traversal in Client code CVE-2025-55013, GHSA-75jv-vfxf-3865, PYSEC-2026-1194 | Medium | 0.6% | 25 Jul, 2025 | PyPI assemblyline-service-client |
Malicious release: Malicious code in prof-qu (PyPI) MAL-2025-191819 | Malicious | Not scored | 25 Jul, 2025 | PyPI prof-qu |
Malicious release: Malicious code in prof-tgqu (PyPI) MAL-2025-191829 | Malicious | Not scored | 25 Jul, 2025 | PyPI prof-tgqu |
Malicious release: Malicious code in prof-quotex (PyPI) MAL-2025-191820 | Malicious | Not scored | 25 Jul, 2025 | PyPI prof-quotex |
NULL Pointer Dereference in µD3TN via non-singleton destination Endpoint Identifier allows remote attacker to reliably cause DoS CVE-2025-8183, PYSEC-2025-182 | High | 0.6% | 25 Jul, 2025 | PyPI pyd3tn |
Malicious release: Malicious code in m5tlprovetomegz (PyPI) MAL-2025-41699 | Malicious | Not scored | 24 Jul, 2025 | PyPI m5tlprovetomegz |
Malicious release: Malicious code in req-ase (PyPI) MAL-2025-191853 | Malicious | Not scored | 24 Jul, 2025 | PyPI req-ase |
Calibre Web and Autocaliweb have OS Command Injection vulnerability CVE-2025-7404, GHSA-qc4j-v7h6-xr5h, PYSEC-2026-1235 | Medium | 2.8% | 24 Jul, 2025 | PyPI calibreweb |