Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2025-49653, GHSA-hxvr-gg2w-j48x, PYSEC-2026-1211 | High | 0.3% | 09 Jun, 2025 | PyPI backend-ai PyPI backend.ai |
BackendAI Missing Authentication for Critical Function CVE-2025-49652, GHSA-ww28-4m4v-cq4j, PYSEC-2026-290 | Critical | 0.4% | 09 Jun, 2025 | PyPI backend-ai PyPI backend.ai |
Backend.AI Missing Authorization vulnerability CVE-2025-49651, GHSA-h889-475r-wfmm, PYSEC-2026-1210 | High | 0.3% | 09 Jun, 2025 | PyPI backend-ai PyPI backend.ai |
Requests vulnerable to .netrc credentials leak via malicious URLs CVE-2024-47081, GHSA-9hjg-9r4m-mvj7, PYSEC-2026-1872 | Medium | 1.0% | 09 Jun, 2025 | PyPI requests |
Malicious release: Malicious code in my-fun-tools (PyPI) MAL-2025-6552 | Malicious | Not scored | 09 Jun, 2025 | PyPI my-fun-tools |
Malicious release: Malicious code in robloxextra (PyPI) MAL-2025-6578 | Malicious | Not scored | 09 Jun, 2025 | PyPI robloxextra |
Malicious release: Malicious code in chimera-sandbox-extensions (PyPI) MAL-2025-191701 | Malicious | Not scored | 09 Jun, 2025 | PyPI chimera-sandbox-extensions |
Malicious release: Malicious code in feature-gen-dt (PyPI) MAL-2025-191726 | Malicious | Not scored | 07 Jun, 2025 | PyPI feature-gen-dt |
Malicious release: Malicious code in pyximport (PyPI) MAL-2025-191848 | Malicious | Not scored | 07 Jun, 2025 | PyPI pyximport |
Malicious release: Malicious code in spyderlib (PyPI) MAL-2025-191877 | Malicious | Not scored | 07 Jun, 2025 | PyPI spyderlib |
Malicious release: Malicious code in stubsout (PyPI) MAL-2025-191879 | Malicious | Not scored | 07 Jun, 2025 | PyPI stubsout |
Malicious release: Malicious code in stubsoutagn (PyPI) MAL-2025-191880 | Malicious | Not scored | 07 Jun, 2025 | PyPI stubsoutagn |
Malicious release: Malicious code in tableausdk (PyPI) MAL-2025-191884 | Malicious | Not scored | 07 Jun, 2025 | PyPI tableausdk |
Malicious release: Malicious code in win32con (PyPI) MAL-2025-191932 | Malicious | Not scored | 07 Jun, 2025 | PyPI win32con |
Skyvern has a Jinja runtime leak CVE-2025-49619, GHSA-h92g-3xc3-ww2r, PYSEC-2026-1929 | High | 21.8% | 07 Jun, 2025 | PyPI skyvern |
Malicious release: Malicious code in atlasctf-21-prod-00 (PyPI) MAL-2025-6437 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-00 |
Malicious release: Malicious code in atlasctf-21-prod-01 (PyPI) MAL-2025-6438 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-01 |
Malicious release: Malicious code in atlasctf-21-prod-02 (PyPI) MAL-2025-6439 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-02 |
Malicious release: Malicious code in atlasctf-21-prod-03 (PyPI) MAL-2025-6440 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-03 |
Malicious release: Malicious code in atlasctf-21-prod-04 (PyPI) MAL-2025-6441 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-04 |
Malicious release: Malicious code in atlasctf-21-prod-05 (PyPI) MAL-2025-6442 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-05 |
Malicious release: Malicious code in atlasctf-21-prod-06 (PyPI) MAL-2025-6443 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-06 |
Malicious release: Malicious code in atlasctf-21-prod-07 (PyPI) MAL-2025-6444 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-07 |
Malicious release: Malicious code in atlasctf-21-prod-08 (PyPI) MAL-2025-6445 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-08 |
Malicious release: Malicious code in atlasctf-21-prod-09 (PyPI) MAL-2025-6446 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-09 |
Malicious release: Malicious code in atlasctf-21-prod-10 (PyPI) MAL-2025-6447 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-10 |
Malicious release: Malicious code in atlasctf-21-prod-11 (PyPI) MAL-2025-6448 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-11 |
Malicious release: Malicious code in atlasctf-21-prod-12 (PyPI) MAL-2025-6449 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-12 |
Malicious release: Malicious code in atlasctf-21-prod-13 (PyPI) MAL-2025-6450 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-13 |
Malicious release: Malicious code in atlasctf-21-prod-14 (PyPI) MAL-2025-6451 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-14 |
Malicious release: Malicious code in atlasctf-21-prod-15 (PyPI) MAL-2025-6452 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-15 |
Malicious release: Malicious code in atlasctf-21-prod-16 (PyPI) MAL-2025-6453 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-16 |
Malicious release: Malicious code in atlasctf-21-prod-17 (PyPI) MAL-2025-6454 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-17 |
Malicious release: Malicious code in atlasctf-21-prod-18 (PyPI) MAL-2025-6455 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-18 |
Malicious release: Malicious code in atlasctf-21-prod-19 (PyPI) MAL-2025-6456 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-19 |
Malicious release: Malicious code in atlasctf-21-prod-20 (PyPI) MAL-2025-6457 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-20 |
Malicious release: Malicious code in atlasctf-21-prod-21 (PyPI) MAL-2025-6458 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-21 |
Malicious release: Malicious code in atlasctf-21-prod-29 (PyPI) MAL-2025-6459 | Malicious | Not scored | 07 Jun, 2025 | PyPI atlasctf-21-prod-29 |
llama_index vulnerable to SQL Injection CVE-2025-1793, GHSA-v3c8-3pr6-gr7p, PYSEC-2026-394 | Critical | 0.7% | 05 Jun, 2025 | PyPI llama-index |
Django Improper Output Neutralization for Logs vulnerability BIT-django-2025-48432, CVE-2025-48432, GHSA-7xr5-9hcq-chf9, PYSEC-2025-47 | Medium | 0.8% | 05 Jun, 2025 | PyPI Django PyPI django |
Malicious release: Malicious code in pyobfuscation (PyPI) MAL-2025-6570 | Malicious | Not scored | 03 Jun, 2025 | PyPI pyobfuscation |
Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability CVE-2025-30167, GHSA-33p9-3p43-82vq, PYSEC-2026-1477 | High | 0.2% | 03 Jun, 2025 | PyPI jupyter-core PyPI jupyter_core |
SignXML's signature verification with HMAC is vulnerable to a timing attack CVE-2025-48995, GHSA-gmhf-gg8w-jw42, PYSEC-2026-1922 | Medium | 0.2% | 02 Jun, 2025 | PyPI signxml |
SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack CVE-2025-48994, GHSA-6vx8-pcwv-xhf4, PYSEC-2026-1921 | Medium | 0.2% | 02 Jun, 2025 | PyPI signxml |
AstrBot Has Path Traversal Vulnerability in /api/chat/get_file CVE-2025-48957, GHSA-cq37-g2qp-3c2p, PYSEC-2026-1196 | High | 0.8% | 02 Jun, 2025 | PyPI astrbot |
LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id CVE-2025-1750, GHSA-6mcc-q3mg-3qg6, PYSEC-2025-245, PYSEC-2026-4242 | Critical | 0.9% | 02 Jun, 2025 | PyPI llama-index PyPI llama-index-vector-stores-duckdb |
django-helpdesk Allows Sensitive Data Exposure CVE-2018-25111, GHSA-m4jx-m5hg-qrxx, PYSEC-2025-44 | Medium | 0.2% | 31 May, 2025 | PyPI django-helpdesk |
Apache Superset: Improper authorization bypass on row level security via SQL Injection BIT-superset-2025-48912, CVE-2025-48912, GHSA-8w7f-8pr9-xgwj, PYSEC-2026-1164 | High | 0.8% | 30 May, 2025 | PyPI apache-superset |
Malicious release: Malicious code in alpha-booster (PyPI) MAL-2025-6431 | Malicious | Not scored | 29 May, 2025 | PyPI alpha-booster |
Malicious release: Malicious code in discord-booster (PyPI) MAL-2025-6495 | Malicious | Not scored | 29 May, 2025 | PyPI discord-booster |