Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in tcloud-python-test (PyPI) MAL-2025-3006, SNYK-PYTHON-TCLOUDPYTHONTEST-12201353 | Malicious | Not scored | 25 Feb, 2025 | PyPI tcloud-python-test |
Malicious release: Malicious code in timekeeper-verifier (PyPI) MAL-2025-3475 | Malicious | Not scored | 25 Feb, 2025 | PyPI timekeeper-verifier |
Malicious release: Malicious code in serverkeeper-verifier (PyPI) MAL-2025-6583 | Malicious | Not scored | 25 Feb, 2025 | PyPI serverkeeper-verifier |
LTI JupyterHub Authenticator does not properly validate JWT Signature CVE-2023-25574, GHSA-mcgx-2gcr-p3hp, PYSEC-2025-120 | Critical | 0.4% | 25 Feb, 2025 | PyPI jupyterhub-ltiauthenticator |
copyparty renders unsanitized filenames as HTML when user uploads empty files CVE-2025-27145, GHSA-m2jw-cj8v-937r, PYSEC-2026-1278 | Medium | 0.5% | 25 Feb, 2025 | PyPI copyparty |
Malicious release: Malicious code in coinanalysis (PyPI) MAL-2025-2946 | Malicious | Not scored | 24 Feb, 2025 | PyPI coinanalysis |
Malicious release: Malicious code in coinanalyze (PyPI) MAL-2025-2947 | Malicious | Not scored | 24 Feb, 2025 | PyPI coinanalyze |
Malicious release: Malicious code in coingenerator (PyPI) MAL-2025-2948 | Malicious | Not scored | 24 Feb, 2025 | PyPI coingenerator |
Malicious release: Malicious code in transaction-analysis (PyPI) MAL-2025-3010 | Malicious | Not scored | 24 Feb, 2025 | PyPI transaction-analysis |
Malicious release: Malicious code in transaction-analyze (PyPI) MAL-2025-3011 | Malicious | Not scored | 24 Feb, 2025 | PyPI transaction-analyze |
Vyper's sqrt doesn't define rounding behavior CVE-2025-26622, GHSA-2p94-8669-xg86, PYSEC-2025-29 | Low | 0.3% | 21 Feb, 2025 | PyPI vyper |
Vyper has a double eval in For List Iter CVE-2025-27104, GHSA-h33q-mhmp-8p67, PYSEC-2025-30 | Low | 0.4% | 21 Feb, 2025 | PyPI vyper |
AugAssign evaluation order causing OOB write within the object in Vyper CVE-2025-27105, GHSA-4w26-8p97-f4jp, PYSEC-2025-31 | Low | 0.6% | 21 Feb, 2025 | PyPI vyper |
Malicious release: Malicious code in transaction-utils (PyPI) MAL-2025-191909 | Malicious | Not scored | 21 Feb, 2025 | PyPI transaction-utils |
Malicious release: Malicious code in solana-utils (PyPI) MAL-2025-2999 | Malicious | Not scored | 21 Feb, 2025 | PyPI solana-utils |
Malicious release: Malicious code in solders-utils (PyPI) MAL-2025-3000 | Malicious | Not scored | 21 Feb, 2025 | PyPI solders-utils |
Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit CVE-2025-1403, GHSA-fpmr-m242-xm7x, PYSEC-2026-1859, PYSEC-2026-3045 | High | 0.7% | 21 Feb, 2025 | PyPI qiskit PyPI qiskit-terra |
Malicious release: Malicious code in mstplotlib (PyPI) MAL-2025-2345 | Malicious | Not scored | 20 Feb, 2025 | PyPI mstplotlib |
Malicious release: Malicious code in singtok (PyPI) MAL-2025-191868 | Malicious | Not scored | 18 Feb, 2025 | PyPI singtok |
Malicious release: Malicious code in sintok (PyPI) MAL-2025-191869 | Malicious | Not scored | 18 Feb, 2025 | PyPI sintok |
Malicious release: Malicious code in tiksing (PyPI) MAL-2025-191899 | Malicious | Not scored | 18 Feb, 2025 | PyPI tiksing |
Exiv2 allows Use After Free CVE-2025-26623, GHSA-38h4-fx85-qcx7, PYSEC-2026-1353 | Medium | 0.9% | 18 Feb, 2025 | PyPI Exiv2 PyPI exiv2 |
Home Assistant does not correctly validate SSL for outgoing requests in core and used libs CVE-2025-25305, GHSA-m3pm-rpgg-5wj6, PYSEC-2026-1452 | High | 0.3% | 18 Feb, 2025 | PyPI homeassistant |
Malicious release: Malicious code in w3socket (PyPI) MAL-2025-3014 | Malicious | Not scored | 17 Feb, 2025 | PyPI w3socket |
Malicious release: Malicious code in web3node (PyPI) MAL-2025-3016 | Malicious | Not scored | 17 Feb, 2025 | PyPI web3node |
Malicious release: Malicious code in web3socket (PyPI) MAL-2025-3017 | Malicious | Not scored | 17 Feb, 2025 | PyPI web3socket |
Malicious release: Malicious code in dcbot-online (PyPI) MAL-2025-191714 | Malicious | Not scored | 15 Feb, 2025 | PyPI dcbot-online |
Malicious release: Malicious code in dcbotoffline3 (PyPI) MAL-2025-191715 | Malicious | Not scored | 15 Feb, 2025 | PyPI dcbotoffline3 |
Malicious release: Malicious code in network-utils-simple (PyPI) MAL-2025-191803 | Malicious | Not scored | 14 Feb, 2025 | PyPI network-utils-simple |
Keylime registrar is vulnerable to Denial-of-Service attack when updated to version 7.12.0 CVE-2025-1057, GHSA-9jxq-5x44-gx23, PYSEC-2026-1488 | Medium | 0.4% | 14 Feb, 2025 | PyPI keylime |
Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint CVE-2025-25297, GHSA-m238-fmcw-wh58, PYSEC-2026-1503 | High | 0.7% | 14 Feb, 2025 | PyPI label-studio |
Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint CVE-2025-25296, GHSA-wpq5-3366-mqw4, PYSEC-2026-1504 | Medium | 1.9% | 14 Feb, 2025 | PyPI label-studio |
Label Studio has a Path Traversal Vulnerability via image Field CVE-2025-25295, GHSA-rgv9-w7jp-m23g, PYSEC-2026-1506 | High | 0.8% | 14 Feb, 2025 | PyPI label-studio-sdk |
Malicious release: Malicious code in bprinter (PyPI) MAL-2025-191693 | Malicious | Not scored | 13 Feb, 2025 | PyPI bprinter |
Malicious release: Malicious code in bprintoor (PyPI) MAL-2025-191694 | Malicious | Not scored | 13 Feb, 2025 | PyPI bprintoor |
Malicious release: Malicious code in compute-st-speed (PyPI) MAL-2025-191703 | Malicious | Not scored | 13 Feb, 2025 | PyPI compute-st-speed |
Malicious release: Malicious code in computestpspeedcomp (PyPI) MAL-2025-191704 | Malicious | Not scored | 13 Feb, 2025 | PyPI computestpspeedcomp |
Malicious release: Malicious code in computestpspeedcompcomp (PyPI) MAL-2025-191705 | Malicious | Not scored | 13 Feb, 2025 | PyPI computestpspeedcompcomp |
Malicious release: Malicious code in multis (PyPI) MAL-2025-191797 | Malicious | Not scored | 13 Feb, 2025 | PyPI multis |
Malicious release: Malicious code in aiosignalasync (PyPI) MAL-2025-2931 | Malicious | Not scored | 13 Feb, 2025 | PyPI aiosignalasync |
Malicious release: Malicious code in asyncaiosignal (PyPI) MAL-2025-2937 | Malicious | Not scored | 13 Feb, 2025 | PyPI asyncaiosignal |
Malicious release: Malicious code in asyncconfigreader (PyPI) MAL-2025-2938 | Malicious | Not scored | 13 Feb, 2025 | PyPI asyncconfigreader |
Malicious release: Malicious code in asynctestpython (PyPI) MAL-2025-2939 | Malicious | Not scored | 13 Feb, 2025 | PyPI asynctestpython |
Malicious release: Malicious code in moonitoring (PyPI) MAL-2025-2976 | Malicious | Not scored | 13 Feb, 2025 | PyPI moonitoring |
Malicious release: Malicious code in speedtestpython (PyPI) MAL-2025-3002 | Malicious | Not scored | 13 Feb, 2025 | PyPI speedtestpython |
Malicious release: Malicious code in systoring (PyPI) MAL-2025-3004 | Malicious | Not scored | 13 Feb, 2025 | PyPI systoring |
Malicious release: Malicious code in watchitoring (PyPI) MAL-2025-3015 | Malicious | Not scored | 13 Feb, 2025 | PyPI watchitoring |
Vulnerable OpenSSL included in cryptography wheels CVE-2024-12797, GHSA-79v4-65xg-pq4g, PYSEC-2026-1284 | Medium | 2.5% | 11 Feb, 2025 | PyPI cryptography |
PandasAI interactive prompt function Remote Code Execution (RCE) CVE-2024-12366, GHSA-vv2h-2w3q-3fx7, PYSEC-2026-448 | Critical | 1.2% | 11 Feb, 2025 | PyPI pandasai |
A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue arise CVE-2024-8550, PYSEC-2025-84 | High | 0.5% | 10 Feb, 2025 | PyPI agentscope |