Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in malicus (PyPI) MAL-2025-5654 | Malicious | Not scored | 04 Jul, 2025 | PyPI malicus |
Malicious release: Malicious code in maliinn (PyPI) MAL-2025-5655 | Malicious | Not scored | 04 Jul, 2025 | PyPI maliinn |
Malicious release: Malicious code in fonafx (PyPI) MAL-2025-191733 | Malicious | Not scored | 04 Jul, 2025 | PyPI fonafx |
Malicious release: Malicious code in confighum (PyPI) MAL-2025-6482 | Malicious | Not scored | 04 Jul, 2025 | PyPI confighum |
Malicious release: Malicious code in hellotesthim (PyPI) MAL-2025-6521 | Malicious | Not scored | 04 Jul, 2025 | PyPI hellotesthim |
Malicious release: Malicious code in malipkghehe (PyPI) MAL-2025-6544 | Malicious | Not scored | 04 Jul, 2025 | PyPI malipkghehe |
Malicious release: Malicious code in pypiion (PyPI) MAL-2025-6571 | Malicious | Not scored | 04 Jul, 2025 | PyPI pypiion |
Malicious release: Malicious code in simple-mali-pkg (PyPI) MAL-2025-6585 | Malicious | Not scored | 04 Jul, 2025 | PyPI simple-mali-pkg |
Malicious release: Malicious code in sinontop-utils (PyPI) MAL-2025-6586 | Malicious | Not scored | 04 Jul, 2025 | PyPI sinontop-utils |
Malicious release: Malicious code in solana-sdkpy (PyPI) MAL-2025-6588 | Malicious | Not scored | 04 Jul, 2025 | PyPI solana-sdkpy |
Malicious release: Malicious code in hellodista (PyPI) MAL-2025-5653 | Malicious | Not scored | 04 Jul, 2025 | PyPI hellodista |
Malicious release: Malicious code in jirawrapped (PyPI) MAL-2025-6529 | Malicious | Not scored | 02 Jul, 2025 | PyPI jirawrapped |
Pillow vulnerability can cause write buffer overflow on BCn encoding BIT-pillow-2025-48379, CVE-2025-48379, GHSA-xg8h-j46f-w952, PYSEC-2025-61 | High | 0.3% | 01 Jul, 2025 | PyPI pillow |
Malicious release: Malicious code in rehttps (PyPI) MAL-2025-6575 | Malicious | Not scored | 01 Jul, 2025 | PyPI rehttps |
Malicious release: Malicious code in utilswallet (PyPI) MAL-2025-6613 | Malicious | Not scored | 01 Jul, 2025 | PyPI utilswallet |
Malicious release: Malicious code in wallet-utils (PyPI) MAL-2025-6615 | Malicious | Not scored | 01 Jul, 2025 | PyPI wallet-utils |
Malicious release: Malicious code in walletsdk (PyPI) MAL-2025-6617 | Malicious | Not scored | 01 Jul, 2025 | PyPI walletsdk |
Malicious release: Malicious code in walletsutils (PyPI) MAL-2025-6618 | Malicious | Not scored | 01 Jul, 2025 | PyPI walletsutils |
Malicious release: Malicious code in walletutility (PyPI) MAL-2025-6620 | Malicious | Not scored | 01 Jul, 2025 | PyPI walletutility |
Malicious release: Malicious code in hancsv (PyPI) MAL-2025-191748 | Malicious | Not scored | 29 Jun, 2025 | PyPI hancsv |
Langchain-Chatchat vulnerable to path traversal CVE-2025-6855, GHSA-f823-phmg-x5fr, PYSEC-2026-1512 | Low | 0.6% | 29 Jun, 2025 | PyPI langchain-chatchat |
Langchain-Chatchat vulnerable to path traversal CVE-2025-6854, GHSA-8v8h-4pjx-rg73, PYSEC-2026-1511 | Low | 0.6% | 29 Jun, 2025 | PyPI langchain-chatchat |
Langchain-Chatchat has a Path Traversal vulnerability CVE-2025-6853, GHSA-qmgv-j263-qr33, PYSEC-2026-1513 | Low | 0.6% | 29 Jun, 2025 | PyPI langchain-chatchat |
Malicious release: Malicious code in typing-extensions-plus (PyPI) MAL-2025-191914 | Malicious | Not scored | 28 Jun, 2025 | PyPI typing-extensions-plus |
Malicious release: Malicious code in cpan (PyPI) MAL-2025-6483 | Malicious | Not scored | 28 Jun, 2025 | PyPI cpan |
Malicious release: Malicious code in managment (PyPI) MAL-2025-6545 | Malicious | Not scored | 28 Jun, 2025 | PyPI managment |
HKUDS LightRAG allows Path Traversal via function upload_to_input_dir CVE-2025-6773, GHSA-v9w6-9hq9-33ch, PYSEC-2026-1539 | Medium | 0.2% | 27 Jun, 2025 | PyPI lightrag-hku |
Malicious release: Malicious code in sqiul83 (PyPI) MAL-2025-6596 | Malicious | Not scored | 26 Jun, 2025 | PyPI sqiul83 |
LLaMA-Factory allows Code Injection through improper vhead_file safeguards CVE-2025-53002, GHSA-xj56-p8mm-qmxj, PYSEC-2026-1576 | Critical | 1.3% | 26 Jun, 2025 | PyPI llamafactory |
Malicious release: Malicious code in mainx (PyPI) MAL-2025-6540 | Malicious | Not scored | 24 Jun, 2025 | PyPI mainx |
Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator CVE-2025-50213, GHSA-9r64-3wmc-x8m8, PYSEC-2025-51 | Critical | 0.8% | 24 Jun, 2025 | PyPI apache-airflow-providers-snowflake |
ChangeDetection.io XSS in watch overview CVE-2025-52558, GHSA-hwpg-x5hw-vpv9, PYSEC-2026-1241 | High | 0.6% | 23 Jun, 2025 | PyPI changedetection-io PyPI changedetection.io |
LangChain Community SSRF vulnerability exists in RequestsToolkit component CVE-2025-2828, GHSA-h5gc-rm8j-5gpr, PYSEC-2025-70 | Critical | 21.0% | 23 Jun, 2025 | PyPI langchain-community |
pyspur Incomplete Filtering of Special Elements allowed by SingleLLMCallNode function CVE-2025-6518, GHSA-8gff-cf92-72pv, PYSEC-2026-1844 | Low | 0.4% | 23 Jun, 2025 | PyPI pyspur |
Malicious release: Malicious code in chatgpt4 (PyPI) MAL-2025-6477 | Malicious | Not scored | 23 Jun, 2025 | PyPI chatgpt4 |
MLFlow SSRF via gateway_proxy_handler BIT-mlflow-2025-52967, CVE-2025-52967, GHSA-wxj7-3fx5-pp9m, PYSEC-2025-52 | Medium | 0.4% | 23 Jun, 2025 | PyPI mlflow |
Malicious release: Malicious code in hashidf (PyPI) MAL-2025-6520 | Malicious | Not scored | 22 Jun, 2025 | PyPI hashidf |
Malicious release: Malicious code in spokeo (PyPI) MAL-2025-6594 | Malicious | Not scored | 22 Jun, 2025 | PyPI spokeo |
Malicious release: Malicious code in pythondm32 (PyPI) MAL-2025-191846 | Malicious | Not scored | 21 Jun, 2025 | PyPI pythondm32 |
rfc3161-client has insufficient verification for timestamp response signatures CVE-2025-52556, GHSA-6qhv-4h7r-2g9m, PYSEC-2026-525 | Critical | 0.2% | 20 Jun, 2025 | PyPI rfc3161-client |
Upsonic is vulnerable to Path Traversal attack through its os.path.join function CVE-2025-6278, GHSA-8jf4-fcjr-68c2, PYSEC-2025-67 | Low | 0.7% | 19 Jun, 2025 | PyPI upsonic |
Upsonic has vulnerability in Pickle Handler component that can lead to deserialization CVE-2025-6279, GHSA-rpfv-46xj-5984, PYSEC-2025-68 | Low | 0.5% | 19 Jun, 2025 | PyPI upsonic |
pywasm3 has Improper Restriction of Operations within the Bounds of a Memory Buffer CVE-2025-6272, GHSA-rrmw-gv85-w824, PYSEC-2025-186 | Low | 0.2% | 19 Jun, 2025 | PyPI pywasm3 |
urllib3 does not control redirects in browsers and Node.js CVE-2025-50182, GHSA-48p4-8xcf-vxj5, PYSEC-2026-1997 | Medium | 0.6% | 18 Jun, 2025 | PyPI urllib3 |
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation CVE-2025-50181, GHSA-pq67-6m6q-mj2v, PYSEC-2026-1999 | Medium | 0.5% | 18 Jun, 2025 | PyPI urllib3 |
Malicious release: Malicious code in solana-data (PyPI) MAL-2025-5137 | Malicious | Not scored | 18 Jun, 2025 | PyPI solana-data |
Malicious release: Malicious code in solana-chart (PyPI) MAL-2025-5134 | Malicious | Not scored | 18 Jun, 2025 | PyPI solana-chart |
Malicious release: Malicious code in solana-charts (PyPI) MAL-2025-5135 | Malicious | Not scored | 18 Jun, 2025 | PyPI solana-charts |
Malicious release: Malicious code in requestsdev (PyPI) MAL-2025-5129 | Malicious | Not scored | 18 Jun, 2025 | PyPI requestsdev |
Malicious release: Malicious code in requestpacket (PyPI) MAL-2025-5128 | Malicious | Not scored | 18 Jun, 2025 | PyPI requestpacket |