Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
AgentScope path traversal vulnerability in save-workflow CVE-2024-8551, GHSA-j9rw-qm5f-r8xm, PYSEC-2026-255 | Critical | 1.0% | 20 Mar, 2025 | PyPI agentscope |
AgentScope path traversal vulnerability CVE-2024-8537, GHSA-c4cc-w454-4634, PYSEC-2026-254 | Critical | 1.0% | 20 Mar, 2025 | PyPI agentscope |
AgentScope directory traversal vulnerability in /read-examples CVE-2024-8524, GHSA-6v28-q95m-93qr, PYSEC-2025-83 | High | 1.2% | 20 Mar, 2025 | PyPI agentscope |
AgentScope Deserialization Vulnerability CVE-2024-8502, GHSA-9w5h-67gf-xvv8, PYSEC-2026-253 | Critical | 1.8% | 20 Mar, 2025 | PyPI agentscope |
AgentScope arbitrary file download vulnerability in rpc_agent_client CVE-2024-8501, GHSA-p6h7-hfj2-vmcf, PYSEC-2025-82 | High | 1.0% | 20 Mar, 2025 | PyPI agentscope |
AgentScope Cross-Origin Resource Sharing (CORS) vulnerability CVE-2024-8487, GHSA-75v5-6885-59f9, PYSEC-2025-81 | Critical | 0.3% | 20 Mar, 2025 | PyPI agentscope |
AgentScope Path Traversal in /api/file CVE-2024-8438, GHSA-f4hc-q562-cc5r, PYSEC-2025-80 | High | 0.8% | 20 Mar, 2025 | PyPI agentscope |
Aim Improper Access Control CVE-2024-8238, GHSA-r229-5wgf-f28g, PYSEC-2026-1094 | High | 0.8% | 20 Mar, 2025 | PyPI aim |
Prefect CORS (Cross-Origin Resource Sharing) misconfiguration CVE-2024-8183, GHSA-4v9f-r55g-g6hc, PYSEC-2026-1800 | High | 0.2% | 20 Mar, 2025 | PyPI prefect |
Ollama Divide by Zero Vulnerability CVE-2024-8063, GHSA-2xf2-gjm6-g2c6, GO-2025-3689, PYSEC-2025-144 | High | 0.6% | 20 Mar, 2025 | Go github.com/ollama/ollama PyPI ollama |
H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request CVE-2024-8062, GHSA-5c8j-g96x-cj78, PYSEC-2026-1438 | High | 0.5% | 20 Mar, 2025 | Maven ai.h2o:h2o-core PyPI h2o |
Aim allows denial of service due to no timeouts for some tracking server endpoints CVE-2024-8061, GHSA-6w7p-xrvp-p7xv, PYSEC-2026-1083 | High | 0.5% | 20 Mar, 2025 | PyPI aim |
Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint CVE-2024-8053, GHSA-9vf8-xgwm-97r8, PYSEC-2026-1725 | High | 0.7% | 20 Mar, 2025 | PyPI open-webui |
Gradio Vulnerable to Open Redirect CVE-2024-8021, GHSA-7v2w-h4gh-w5cv, PYSEC-2026-1411 | Medium | 0.8% | 20 Mar, 2025 | PyPI gradio |
PyTorch Lightning denial of service vulnerability CVE-2024-8020, GHSA-98fp-7v67-4v3q, PYSEC-2026-1857, PYSEC-2026-3971 | High | 0.6% | 20 Mar, 2025 | PyPI lightning PyPI pytorch-lightning |
PyTorch Lightning path traversal vulnerability CVE-2024-8019, GHSA-4cv3-v7pv-rfhf, PYSEC-2026-3970, PYSEC-2026-507 | Critical | 1.1% | 20 Mar, 2025 | PyPI lightning PyPI pytorch-lightning |
Open WebUI denial of service through endpoint for converting markdown CVE-2024-7983, GHSA-5v9m-57mq-qc75, PYSEC-2026-1723 | High | 0.9% | 20 Mar, 2025 | PyPI open-webui |
H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint CVE-2024-7768, GHSA-p2vc-m5fv-9w9m, PYSEC-2026-1443 | High | 0.8% | 20 Mar, 2025 | Maven ai.h2o:h2o-core PyPI h2o |
Open Neural Network Exchange (ONNX) Path Traversal Vulnerability CVE-2024-7776, GHSA-h36j-8vv3-cj52, PYSEC-2025-10 | Critical | 1.5% | 20 Mar, 2025 | PyPI onnx |
H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing CVE-2024-7765, GHSA-6w62-3jvj-mfj6, PYSEC-2026-1439 | High | 0.8% | 20 Mar, 2025 | Maven ai.h2o:h2o-core PyPI h2o |
Aim vulnerable to Cross-Site Request Forgery CVE-2024-7760, GHSA-38r9-3j52-h92v, PYSEC-2026-1082 | Critical | 0.5% | 20 Mar, 2025 | PyPI aim |
Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload CVE-2024-7044, GHSA-j274-m559-cj4j, PYSEC-2026-1736 | High | 0.5% | 20 Mar, 2025 | PyPI open-webui |
Open WebUI Allows Arbitrary File Reading and Deletion CVE-2024-7043, GHSA-jrhc-9qg9-4qfq, PYSEC-2026-1737 | High | 0.6% | 20 Mar, 2025 | PyPI open-webui |
Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) CVE-2024-7035, GHSA-p5vx-9hj8-cf4h, PYSEC-2026-1739 | Medium | 8.7% | 20 Mar, 2025 | PyPI open-webui |
LoLLMS Code Injection vulnerability CVE-2024-6982, GHSA-jccx-m9v4-9hwh, PYSEC-2026-1591 | High | 0.5% | 20 Mar, 2025 | PyPI lollms |
Flask-CORS vulnerable to Improper Handling of Case Sensitivity CVE-2024-6866, GHSA-43qf-4rqw-9q2g, PYSEC-2026-1383 | High | 0.7% | 20 Mar, 2025 | PyPI flask-cors |
H2O Vulnerable to Execution of Arbitrary Files CVE-2024-6863, GHSA-m37h-8r48-2cxj, PYSEC-2026-1442 | Medium | 0.4% | 20 Mar, 2025 | Maven ai.h2o:h2o-core PyPI h2o |
H2O Vulnerable to Arbitrary File Overwrite via File Export CVE-2024-6854, GHSA-47f6-5p7h-5f3h, PYSEC-2026-1436 | High | 0.8% | 20 Mar, 2025 | Maven ai.h2o:h2o-core PyPI h2o |
Aim Path Traversal vulnerability CVE-2024-6851, GHSA-mrvr-7493-pfq3, PYSEC-2026-1090 | High | 1.1% | 20 Mar, 2025 | PyPI aim |
Flask-CORS allows for inconsistent CORS matching CVE-2024-6844, GHSA-8vgw-p6qm-5gr7, PYSEC-2026-1385 | Medium | 0.3% | 20 Mar, 2025 | PyPI flask-cors |
Flask-CORS improper regex path matching vulnerability CVE-2024-6839, GHSA-7rxf-gvfg-47g4, PYSEC-2026-1384 | Medium | 0.7% | 20 Mar, 2025 | PyPI flask-cors |
MLflow Uncontrolled Resource Consumption vulnerability BIT-mlflow-2024-6838, CVE-2024-6838, GHSA-q3gw-8236-5jw4, PYSEC-2026-1658 | Medium | 0.7% | 20 Mar, 2025 | PyPI mlflow |
Aim External Control of File Name or Path vulnerability CVE-2024-6829, GHSA-75px-35p4-qq6h, PYSEC-2026-259 | Critical | 0.9% | 20 Mar, 2025 | PyPI aim |
Gunicorn HTTP Request/Response Smuggling vulnerability CVE-2024-6827, GHSA-hc5x-x2vx-497g, PYSEC-2026-1433 | High | 0.8% | 20 Mar, 2025 | PyPI gunicorn |
LiteLLM Vulnerable to Remote Code Execution (RCE) CVE-2024-6825, GHSA-53gh-p8jc-7rg8, PYSEC-2026-1541 | High | 1.7% | 20 Mar, 2025 | PyPI litellm |
TorchServe script references S3 bucket without ensuring ownership or confirming accessibility CVE-2024-6577, GHSA-xx7c-j7h3-vjcq, PYSEC-2026-1973 | Medium | 0.4% | 20 Mar, 2025 | PyPI torchserve |
Aim Relative Path Traversal vulnerability CVE-2024-6483, GHSA-p6x3-v6g3-7557, PYSEC-2026-1091 | Medium | 0.9% | 20 Mar, 2025 | PyPI aim |
LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions CVE-2024-12911, GHSA-jmgm-gx32-vp4w, PYSEC-2026-1555 | High | 0.5% | 20 Mar, 2025 | PyPI llama-index |
llama-index-packs-finchat SQL Injection vulnerability CVE-2024-12909, GHSA-x48g-hm9c-ww42, PYSEC-2026-398 | Critical | 1.4% | 20 Mar, 2025 | PyPI llama-index-packs-finchat |
LlamaIndex Uncontrolled Resource Consumption vulnerability CVE-2024-12910, GHSA-jvpf-xf32-2w4q, PYSEC-2025-11 | Medium | 0.7% | 20 Mar, 2025 | PyPI llama-index |
Aim Uncontrolled Resource Consumption vulnerability CVE-2024-12778, GHSA-35p3-6j45-prwm, PYSEC-2026-1080 | High | 0.8% | 20 Mar, 2025 | PyPI aim |
Aim vulnerable to Synchronous Access of Remote Resource without Timeout CVE-2024-12777, GHSA-v5pj-jrpv-h6g2, PYSEC-2026-1095 | Medium | 0.5% | 20 Mar, 2025 | PyPI aim |
imaginAIry Denial of Service (DoS) vulnerability CVE-2024-12761, GHSA-x5xw-28w4-53j5, PYSEC-2026-1458 | High | 0.7% | 20 Mar, 2025 | PyPI imaginAIry PyPI imaginairy |
Transformers Regular Expression Denial of Service (ReDoS) vulnerability CVE-2024-12720, GHSA-6rvg-6v2m-4j46, PYSEC-2026-1982 | High | 0.7% | 20 Mar, 2025 | PyPI transformers |
LlamaIndex Improper Handling of Exceptional Conditions vulnerability CVE-2024-12704, GHSA-j3wr-m6xh-64hg, PYSEC-2025-244, PYSEC-2026-1563 | High | 0.8% | 20 Mar, 2025 | PyPI llama-index PyPI llama-index-core |
FastChat Server-Side Request Forgery vulnerability CVE-2024-12376, GHSA-g44m-hpf4-vmrp, PYSEC-2026-1396 | High | 0.8% | 20 Mar, 2025 | PyPI fschat |
Gradio Path Traversal vulnerability CVE-2024-12217, GHSA-prpg-p95c-32fv, PYSEC-2026-1418 | Medium | 0.7% | 20 Mar, 2025 | PyPI gradio |
GluonCV Arbitrary File Write via TarSlip CVE-2024-12216, GHSA-m724-hqmc-ggpx, PYSEC-2026-1406 | High | 0.3% | 20 Mar, 2025 | PyPI gluoncv |
Kedro allows Remote Code Execution by Pulling Micro Packages CVE-2024-12215, GHSA-rm69-wvpv-r2w7, PYSEC-2026-1485 | High | 1.1% | 20 Mar, 2025 | PyPI kedro |
LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection CVE-2024-11958, GHSA-339r-cjv9-x78g, PYSEC-2026-399 | Critical | 1.4% | 20 Mar, 2025 | PyPI llama-index-retrievers-duckdb-retriever |