Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in httppack (PyPI) MAL-2025-6522 | Malicious | Not scored | 14 Jul, 2025 | PyPI httppack |
Roundup is vulnerable to XSS through interactions between URLs and issue tracker templates CVE-2025-53865, GHSA-qxh9-qmf2-rhwc, PYSEC-2025-69 | Medium | 0.2% | 13 Jul, 2025 | PyPI roundup |
Malicious release: Malicious code in package-346234294 (PyPI) MAL-2025-191807 | Malicious | Not scored | 13 Jul, 2025 | PyPI package-346234294 |
Malicious release: Malicious code in crpt1 (PyPI) MAL-2025-6486 | Malicious | Not scored | 13 Jul, 2025 | PyPI crpt1 |
Malicious release: Malicious code in crpt (PyPI) MAL-2025-191707 | Malicious | Not scored | 12 Jul, 2025 | PyPI crpt |
Malicious release: Malicious code in test-package-avinav (PyPI) MAL-2025-5837 | Malicious | Not scored | 12 Jul, 2025 | PyPI test-package-avinav |
Malicious release: Malicious code in gramapi (PyPI) MAL-2025-6513 | Malicious | Not scored | 11 Jul, 2025 | PyPI gramapi |
Malicious release: Malicious code in puregram (PyPI) MAL-2025-6569 | Malicious | Not scored | 11 Jul, 2025 | PyPI puregram |
ExecuTorch vulnerable to Heap-based Buffer Overflow attack CVE-2025-30402, GHSA-h952-963h-rv99, PYSEC-2026-1352 | High | 0.4% | 11 Jul, 2025 | Maven org.pytorch:executorch-android PyPI executorch SwiftURL github.com/pytorch/executorch |
Malicious release: Malicious code in tronpyapi (PyPI) MAL-2025-6610 | Malicious | Not scored | 11 Jul, 2025 | PyPI tronpyapi |
Malicious release: Malicious code in seclab-research-depconf-test (PyPI) MAL-2025-191863 | Malicious | Not scored | 11 Jul, 2025 | PyPI seclab-research-depconf-test |
Transformers is vulnerable to ReDoS attack through its DonutProcessor class CVE-2025-3933, GHSA-37mw-44qp-f5jm, PYSEC-2026-1977 | Medium | 0.5% | 11 Jul, 2025 | PyPI transformers |
Malicious release: Malicious code in dbindicator (PyPI) MAL-2025-6491 | Malicious | Not scored | 11 Jul, 2025 | PyPI dbindicator |
Malicious release: Malicious code in node-db-indicator (PyPI) MAL-2025-6558 | Malicious | Not scored | 11 Jul, 2025 | PyPI node-db-indicator |
Malicious release: Malicious code in gpu-free-ai (PyPI) MAL-2025-191743 | Malicious | Not scored | 10 Jul, 2025 | PyPI gpu-free-ai |
Malicious release: Malicious code in web3toolkit-base (PyPI) MAL-2025-6621 | Malicious | Not scored | 10 Jul, 2025 | PyPI web3toolkit-base |
LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class CVE-2025-6211, GHSA-5hq9-5r78-2gjh, PYSEC-2026-1566, PYSEC-2026-2606 | Medium | 0.4% | 10 Jul, 2025 | PyPI llama-index PyPI llama-index-readers-docugami |
Malicious release: Malicious code in graphdict (PyPI) MAL-2025-6515 | Malicious | Not scored | 09 Jul, 2025 | PyPI graphdict |
Malicious release: Malicious code in cryptob (PyPI) MAL-2025-6488 | Malicious | Not scored | 09 Jul, 2025 | PyPI cryptob |
Malicious release: Malicious code in cryptoo (PyPI) MAL-2025-6489 | Malicious | Not scored | 09 Jul, 2025 | PyPI cryptoo |
pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages CVE-2025-7346, GHSA-x698-5hjm-w2m5, PYSEC-2026-1822 | High | 0.4% | 08 Jul, 2025 | PyPI pyload-ng |
fastapi-guard is vulnerable to ReDoS through inefficient regex CVE-2025-53539, GHSA-j47q-rc62-w448, PYSEC-2026-1359 | Medium | 0.5% | 07 Jul, 2025 | PyPI fastapi-guard |
Malicious release: Malicious code in tq95 (PyPI) MAL-2025-6604 | Malicious | Not scored | 07 Jul, 2025 | PyPI tq95 |
Dagster vulnerable to Path Traversal attack through its /logs endpoint CVE-2023-51232, GHSA-q93c-p2mw-p23f, PYSEC-2026-1287 | High | 0.9% | 07 Jul, 2025 | PyPI dagster |
LlamaIndex vulnerable to Path Traversal attack through its encode_image function CVE-2025-6209, GHSA-2rhq-96q8-4vjq, PYSEC-2025-65, PYSEC-2026-1558 | High | 0.6% | 07 Jul, 2025 | PyPI llama-index PyPI llama-index-core |
Lord of Large Language Models vulnerable to Observable Discrepancy attack via authenticate_user function CVE-2025-6386, GHSA-j5pr-vrjj-9v4h, PYSEC-2026-1590 | High | 0.4% | 07 Jul, 2025 | PyPI lollms |
LlamaIndex vulnerability in its ObsidianReader class can lead to Path Traversal exploit CVE-2025-6210, GHSA-3j8r-jf9w-5cmh, PYSEC-2025-252, PYSEC-2026-1567 | Medium | 0.3% | 07 Jul, 2025 | PyPI llama-index PyPI llama-index-readers-obsidian |
LlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsing CVE-2025-5472, GHSA-3wxx-q3gv-pvvv, PYSEC-2025-251, PYSEC-2026-1559 | Medium | 0.4% | 07 Jul, 2025 | PyPI llama-index PyPI llama-index-core |
Transformers's Improper Input Validation vulnerability can be exploited through username injection CVE-2025-3777, GHSA-phhr-52qp-3mj4, PYSEC-2026-1986 | Low | 0.4% | 07 Jul, 2025 | PyPI transformers |
Transformers vulnerable to ReDoS attack through its get_imports() function CVE-2025-3264, GHSA-jjph-296x-mrcr, PYSEC-2026-1985 | Medium | 0.5% | 07 Jul, 2025 | PyPI transformers |
Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking CVE-2025-3263, GHSA-q2wp-rjmx-x6x9, PYSEC-2026-1987 | Medium | 0.5% | 07 Jul, 2025 | PyPI transformers |
Transformers vulnerable to ReDoS attack through its SETTING_RE variable CVE-2025-3262, GHSA-489j-g2vx-39wf, PYSEC-2026-1979 | High | 0.5% | 07 Jul, 2025 | PyPI transformers |
LlamaIndex has an XML Entity Expansion vulnerability in its sitemap parser CVE-2025-3225, GHSA-w42r-mrx7-c633, PYSEC-2025-250, PYSEC-2026-1570 | High | 0.5% | 07 Jul, 2025 | PyPI llama-index PyPI llama-index-readers-papers |
LlamaIndex is vulnerable to Path Traversal attack through its ObsidianReader class CVE-2025-3046, GHSA-fmrf-6jv9-qjc7, PYSEC-2025-248, PYSEC-2026-1568 | High | 0.6% | 07 Jul, 2025 | PyPI llama-index PyPI llama-index-readers-obsidian |
LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions CVE-2025-3044, GHSA-p7j4-jwjf-5x9w, PYSEC-2025-247, PYSEC-2026-1569 | Medium | 0.3% | 07 Jul, 2025 | PyPI llama-index PyPI llama-index-readers-papers |
Malicious release: Malicious code in jython-file (PyPI) MAL-2025-191771 | Malicious | Not scored | 07 Jul, 2025 | PyPI jython-file |
Malicious release: Malicious code in ase-jreq (PyPI) MAL-2025-191684 | Malicious | Not scored | 07 Jul, 2025 | PyPI ase-jreq |
Malicious release: Malicious code in jsonreq-ase (PyPI) MAL-2025-191768 | Malicious | Not scored | 07 Jul, 2025 | PyPI jsonreq-ase |
LlamaIndex has Incomplete Documentation of Program Execution related to JsonPickleSerializer component CVE-2025-3108, GHSA-m84c-4c34-28gf, PYSEC-2025-249, PYSEC-2026-1564 | High | 0.5% | 06 Jul, 2025 | PyPI llama-index PyPI llama-index-core |
Malicious release: Malicious code in cloudscrapersafe (PyPI) MAL-2025-6478 | Malicious | Not scored | 06 Jul, 2025 | PyPI cloudscrapersafe |
Malicious release: Malicious code in imad213tools (PyPI) MAL-2025-191764 | Malicious | Not scored | 05 Jul, 2025 | PyPI imad213tools |
Malicious release: Malicious code in pipmodule823 (PyPI) MAL-2025-6564 | Malicious | Not scored | 05 Jul, 2025 | PyPI pipmodule823 |
Malicious release: Malicious code in pipmodule83 (PyPI) MAL-2025-6565 | Malicious | Not scored | 05 Jul, 2025 | PyPI pipmodule83 |
Malicious release: Malicious code in callistopy (PyPI) MAL-2025-191698 | Malicious | Not scored | 05 Jul, 2025 | PyPI callistopy |
MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS CVE-2025-53366, GHSA-3qhf-m339-9g5v, PYSEC-2026-1616 | High | 9.8% | 04 Jul, 2025 | PyPI mcp |
MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service CVE-2025-53365, GHSA-j975-95f5-7wqh, PYSEC-2026-1618 | High | 0.4% | 04 Jul, 2025 | PyPI mcp |
Malicious release: Malicious code in malimalo (PyPI) MAL-2025-6541 | Malicious | Not scored | 04 Jul, 2025 | PyPI malimalo |
Malicious release: Malicious code in malimaloo (PyPI) MAL-2025-6542 | Malicious | Not scored | 04 Jul, 2025 | PyPI malimaloo |
Malicious release: Malicious code in malimalooo (PyPI) MAL-2025-6543 | Malicious | Not scored | 04 Jul, 2025 | PyPI malimalooo |
Malicious release: Malicious code in malinssx (PyPI) MAL-2025-5656 | Malicious | Not scored | 04 Jul, 2025 | PyPI malinssx |