Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in devilcore (PyPI) MAL-2025-916 | Malicious | Not scored | 03 Feb, 2025 | PyPI devilcore |
Malicious release: Malicious code in bytedance-chat (PyPI) MAL-2025-906 | Malicious | Not scored | 03 Feb, 2025 | PyPI bytedance-chat |
Malicious release: Malicious code in breqest (PyPI) MAL-2025-903 | Malicious | Not scored | 03 Feb, 2025 | PyPI breqest |
Malicious release: Malicious code in bugscanx (PyPI) MAL-2025-904 | Malicious | Not scored | 03 Feb, 2025 | PyPI bugscanx |
Malicious release: Malicious code in alrsnlaseast (PyPI) MAL-2025-899 | Malicious | Not scored | 03 Feb, 2025 | PyPI alrsnlaseast |
Malicious release: Malicious code in account-eth (PyPI) MAL-2025-898 | Malicious | Not scored | 03 Feb, 2025 | PyPI account-eth |
Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass CVE-2025-24370, GHSA-g9wf-5777-gq43, PYSEC-2026-329 | Critical | 0.5% | 03 Feb, 2025 | PyPI django-unicorn |
Malicious release: Malicious code in novatwo (PyPI) MAL-2025-1985 | Malicious | Not scored | 02 Feb, 2025 | PyPI novatwo |
Malicious release: Malicious code in asynchelpers (PyPI) MAL-2025-1965 | Malicious | Not scored | 01 Feb, 2025 | PyPI asynchelpers |
Malicious release: Malicious code in web3imports (PyPI) MAL-2025-2012 | Malicious | Not scored | 01 Feb, 2025 | PyPI web3imports |
snowflake-connector-python vulnerable to SQL Injection in write_pandas CVE-2025-24793, GHSA-2vpq-fh52-j3wv, PYSEC-2025-26 | High | 0.3% | 29 Jan, 2025 | PyPI snowflake-connector-python |
snowflake-connector-python vulnerable to insecure deserialization of the OCSP response cache CVE-2025-24794, GHSA-m4f6-vcj4-w5mx, PYSEC-2025-27 | High | 0.3% | 29 Jan, 2025 | PyPI snowflake-connector-python |
snowflake-connector-python vulnerable to insecure cache files permissions CVE-2025-24795, GHSA-r2x6-cjg7-8r43, PYSEC-2025-28 | Medium | 0.1% | 29 Jan, 2025 | PyPI snowflake-connector-python |
vllm: Malicious model to RCE by torch.load in hf_model_weights_iterator CVE-2025-24357, GHSA-rh4j-5rhw-hr54, PYSEC-2025-58 | High | 0.9% | 27 Jan, 2025 | PyPI vllm |
uniapi version 1.0.7 contained an information harvesting script. GHSA-gvvw-rr8m-fj76 | High | Not scored | 27 Jan, 2025 | PyPI uniapi |
Malicious release: Malicious code in getpublicip (PyPI) MAL-2025-191738 | Malicious | Not scored | 26 Jan, 2025 | PyPI getpublicip |
Malicious release: Malicious code in markitanalysis (PyPI) MAL-2025-2974 | Malicious | Not scored | 26 Jan, 2025 | PyPI markitanalysis |
Malicious release: Malicious code in reque (PyPI) MAL-2025-1989 | Malicious | Not scored | 25 Jan, 2025 | PyPI reque |
Malicious release: Malicious code in reques (PyPI) MAL-2025-1990 | Malicious | Not scored | 25 Jan, 2025 | PyPI reques |
Malicious release: Malicious code in requesra (PyPI) MAL-2025-1991 | Malicious | Not scored | 25 Jan, 2025 | PyPI requesra |
Malicious release: Malicious code in requestsa (PyPI) MAL-2025-1993 | Malicious | Not scored | 25 Jan, 2025 | PyPI requestsa |
Malicious release: Malicious code in requesttss (PyPI) MAL-2025-1994 | Malicious | Not scored | 25 Jan, 2025 | PyPI requesttss |
Malicious release: Malicious code in rqsts (PyPI) MAL-2025-1995 | Malicious | Not scored | 25 Jan, 2025 | PyPI rqsts |
Malicious release: Malicious code in superline (PyPI) MAL-2025-1996 | Malicious | Not scored | 25 Jan, 2025 | PyPI superline |
uniapi version 1.0.7 contained an information harvesting script. PYSEC-2025-2 | Not scored | 24 Jan, 2025 | PyPI uniapi | |
ASTEVAL Allows Maliciously Crafted Format Strings to Lead to Sandbox Escape CVE-2025-24359, GHSA-3wwr-3g9f-9gc7, PYSEC-2026-1195 | High | 0.3% | 24 Jan, 2025 | PyPI asteval |
ASTEVAL Allows Malicious Tampering of Exposed AST Nodes Leads to Sandbox Escape GHSA-vp47-9734-prjw | High | Not scored | 23 Jan, 2025 | PyPI asteval |
try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter CVE-2025-22153, GHSA-gmj9-h825-chq2, PYSEC-2026-1874 | High | 0.4% | 23 Jan, 2025 | PyPI RestrictedPython PyPI restrictedpython |
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell. CVE-2024-57724, PYSEC-2025-133 | Medium | 0.4% | 23 Jan, 2025 | PyPI lunasvg |
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over. CVE-2024-57723, PYSEC-2025-132 | Medium | 0.4% | 23 Jan, 2025 | PyPI lunasvg |
lunasvg v3.0.0 was discovered to contain a allocation-size-too-big bug via the component plutovg_surface_create. CVE-2024-57722, PYSEC-2025-131 | High | 0.5% | 23 Jan, 2025 | PyPI lunasvg |
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path. CVE-2024-57721, PYSEC-2025-130 | Medium | 0.4% | 23 Jan, 2025 | PyPI lunasvg |
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend. CVE-2024-57720, PYSEC-2025-129 | Medium | 0.4% | 23 Jan, 2025 | PyPI lunasvg |
lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend_transformed_tiled_argb.isra.0. CVE-2024-57719, PYSEC-2025-128 | Medium | 0.4% | 23 Jan, 2025 | PyPI lunasvg |
Malicious release: Malicious code in mlc-ai-nightly (PyPI) MAL-2025-1980 | Malicious | Not scored | 21 Jan, 2025 | PyPI mlc-ai-nightly |
Malicious release: Malicious code in mlc-ai-nightly-cu123 (PyPI) MAL-2025-1981 | Malicious | Not scored | 21 Jan, 2025 | PyPI mlc-ai-nightly-cu123 |
Malicious release: Malicious code in mlc-ai-nightly-rocm62 (PyPI) MAL-2025-1982 | Malicious | Not scored | 21 Jan, 2025 | PyPI mlc-ai-nightly-rocm62 |
Malicious release: Malicious code in mlc-llm-nightly-cu123 (PyPI) MAL-2025-1983 | Malicious | Not scored | 21 Jan, 2025 | PyPI mlc-llm-nightly-cu123 |
Cross-Site Request Forgery in CodeChecker API CVE-2024-53829, GHSA-f8c8-4pm7-w885, PYSEC-2025-12 | High | 0.3% | 21 Jan, 2025 | PyPI codechecker |
nbgrader's `frame-ancestors: self` grants all users access to formgrader CVE-2025-23205, GHSA-fcr8-4r9f-r66m, PYSEC-2026-1692 | High | 0.5% | 17 Jan, 2025 | PyPI nbgrader |
Indico Insecure Access CVE-2024-50633, GHSA-3wg7-r7q5-r2jf, PYSEC-2026-1459 | High | 0.6% | 16 Jan, 2025 | PyPI indico |
Sentry's improper authentication on SAML SSO process allows user impersonation CVE-2025-22146, GHSA-7pq6-v88g-wf3w, PYSEC-2026-532 | Critical | 0.6% | 15 Jan, 2025 | PyPI sentry |
Django has a potential denial-of-service vulnerability in IPv6 validation BIT-django-2024-56374, CVE-2024-56374, GHSA-qcgg-j2x8-h9g8, PYSEC-2025-1 | High | 1.3% | 14 Jan, 2025 | PyPI Django PyPI django |
Malicious release: Malicious code in amzn-aws-glue-ml-libs-python (PyPI) MAL-2025-2935 | Malicious | Not scored | 14 Jan, 2025 | PyPI amzn-aws-glue-ml-libs-python |
Malicious release: Malicious code in amzn-awsglue (PyPI) MAL-2025-2936 | Malicious | Not scored | 14 Jan, 2025 | PyPI amzn-awsglue |
Malicious release: Malicious code in aws-glue (PyPI) MAL-2025-2940 | Malicious | Not scored | 14 Jan, 2025 | PyPI aws-glue |
Malicious release: Malicious code in awsgluedq (PyPI) MAL-2025-2941 | Malicious | Not scored | 14 Jan, 2025 | PyPI awsgluedq |
Malicious release: Malicious code in awsglueml (PyPI) MAL-2025-2942 | Malicious | Not scored | 14 Jan, 2025 | PyPI awsglueml |
Vyper Does Not Check the Success of Certain Precompile Calls CVE-2025-21607, GHSA-vgf2-gvx8-xwc3, PYSEC-2025-33 | Low | 0.7% | 14 Jan, 2025 | PyPI vyper |
Gradio Blocked Path ACL Bypass Vulnerability CVE-2025-23042, GHSA-j2jg-fq62-7c3h, PYSEC-2025-118 | Critical | 1.0% | 14 Jan, 2025 | PyPI gradio |