Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Rasa Allows Remote Code Execution via Remote Model Loading CVE-2024-49375, GHSA-cpv4-ggrr-7j9v, PYSEC-2026-513, PYSEC-2026-514 | Critical | 0.9% | 14 Jan, 2025 | PyPI rasa PyPI rasa-pro |
Malicious release: Malicious code in utf-cleaner (PyPI) MAL-2025-73 | Malicious | Not scored | 10 Jan, 2025 | PyPI utf-cleaner |
Malicious release: Malicious code in javascan (PyPI) MAL-2025-1978 | Malicious | Not scored | 10 Jan, 2025 | PyPI javascan |
Malicious release: Malicious code in djangoframework-test (PyPI) MAL-2025-191720 | Malicious | Not scored | 10 Jan, 2025 | PyPI djangoframework-test |
Malicious release: Malicious code in just-framework (PyPI) MAL-2025-191770 | Malicious | Not scored | 10 Jan, 2025 | PyPI just-framework |
Malicious release: Malicious code in just-test-framework (PyPI) MAL-2025-938 | Malicious | Not scored | 10 Jan, 2025 | PyPI just-test-framework |
Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution CVE-2025-22151, GHSA-5xh2-23cc-5jc6, PYSEC-2026-1946 | Low | 0.4% | 09 Jan, 2025 | PyPI strawberry-graphql |
pgAdmin has Incorrect Default Permissions CVE-2023-1907, GHSA-7w6r-748w-mh52, PYSEC-2026-1770 | High | 0.4% | 09 Jan, 2025 | PyPI pgadmin4 |
GHSL-2024-288: SickChill open redirect in login CVE-2024-53995, GHSA-6gf2-ffq8-gcww, PYSEC-2026-1920 | Low | 1.0% | 08 Jan, 2025 | PyPI sickchill |
Composio Command Execution vulnerability CVE-2024-53526, GHSA-8h93-28hg-fj84, PYSEC-2026-1268, PYSEC-2026-2428, PYSEC-2026-2429 | Medium | 0.6% | 08 Jan, 2025 | PyPI composio-claude PyPI composio-julep PyPI composio-openai |
keras Path Traversal vulnerability CVE-2024-55459, GHSA-cjgq-5qmw-rcj6, PYSEC-2025-121 | Medium | 0.2% | 08 Jan, 2025 | PyPI keras |
Apache Airflow Fab Provider Insufficient Session Expiration vulnerability CVE-2024-45033, GHSA-8863-4qmg-fr45, PYSEC-2026-1147 | High | 1.0% | 08 Jan, 2025 | PyPI apache-airflow-providers-fab |
Malicious release: Malicious code in wdwq (PyPI) MAL-2025-1005 | Malicious | Not scored | 07 Jan, 2025 | PyPI wdwq |
NiceGUI On Air authentication issue CVE-2025-21618, GHSA-v6jv-p6r8-j78w, PYSEC-2026-1705 | High | 0.4% | 06 Jan, 2025 | PyPI nicegui |
Malicious release: Malicious code in ilovenyxx (PyPI) MAL-2025-48 | Malicious | Not scored | 02 Jan, 2025 | PyPI ilovenyxx |
Malicious release: Malicious code in ilovenyxxbait (PyPI) MAL-2025-49 | Malicious | Not scored | 02 Jan, 2025 | PyPI ilovenyxxbait |
Malicious release: Malicious code in requetses (PyPI) MAL-2025-974 | Malicious | Not scored | 31 Dec, 2024 | PyPI requetses |
khoj has an IDOR in subscription management allows unauthorized subscription modifications CVE-2024-52294, GHSA-hq4h-w933-jm6c, PYSEC-2026-1493 | Medium | 0.4% | 30 Dec, 2024 | PyPI khoj |
Malicious release: Malicious code in hugginglega (PyPI) MAL-2025-935 | Malicious | Not scored | 29 Dec, 2024 | PyPI hugginglega |
Malicious release: Malicious code in dscss (PyPI) MAL-2024-12185 | Malicious | Not scored | 29 Dec, 2024 | PyPI dscss |
Malicious release: Malicious code in selenium-plugin (PyPI) MAL-2025-982 | Malicious | Not scored | 28 Dec, 2024 | PyPI selenium-plugin |
Letta (previously MemGPT) incorrect access control vulnerability CVE-2024-39025, GHSA-7p2g-2vxc-5g55, PYSEC-2026-1533 | High | 0.4% | 27 Dec, 2024 | PyPI letta |
changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal CVE-2024-56509, GHSA-j5vv-6wjg-cfr8, PYSEC-2026-1242 | High | 0.7% | 27 Dec, 2024 | PyPI changedetection-io PyPI changedetection.io |
python-sql SQL injection vulnerability CVE-2024-9774, GHSA-pq9p-pc3p-9hm4, PYSEC-2026-1855 | Medium | 0.7% | 27 Dec, 2024 | PyPI python-sql |
OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access privileges to admin and support information (SETTINGS_SUPPORT). This is due to inadequate access control for support information (http://<op CVE-2024-45805, GHSA-42mm-c8x3-g5q6, PYSEC-2024-298 | Medium | 0.3% | 26 Dec, 2024 | PyPI pycti |
Malicious release: Malicious code in opshub (PyPI) MAL-2025-948 | Malicious | Not scored | 26 Dec, 2024 | PyPI opshub |
Malicious release: Malicious code in oscontrol (PyPI) MAL-2025-949 | Malicious | Not scored | 26 Dec, 2024 | PyPI oscontrol |
Malicious release: Malicious code in subsys-client (PyPI) MAL-2025-988 | Malicious | Not scored | 26 Dec, 2024 | PyPI subsys-client |
Malicious release: Malicious code in syscontrol (PyPI) MAL-2025-990 | Malicious | Not scored | 26 Dec, 2024 | PyPI syscontrol |
Malicious release: Malicious code in sysfunc (PyPI) MAL-2025-991 | Malicious | Not scored | 26 Dec, 2024 | PyPI sysfunc |
Malicious release: Malicious code in fflask (PyPI) GHSA-mpw9-j6mm-f9gc, MAL-2025-923 | Malicious | Not scored | 24 Dec, 2024 | PyPI fflask |
Malicious release: Malicious code in requesr (PyPI) MAL-2024-12338 | Malicious | Not scored | 24 Dec, 2024 | PyPI requesr |
Malicious release: Malicious code in falask (PyPI) MAL-2025-922 | Malicious | Not scored | 24 Dec, 2024 | PyPI falask |
Malicious release: Malicious code in fkask (PyPI) MAL-2025-925 | Malicious | Not scored | 24 Dec, 2024 | PyPI fkask |
Malicious release: Malicious code in flasl (PyPI) MAL-2025-926 | Malicious | Not scored | 24 Dec, 2024 | PyPI flasl |
Malicious release: Malicious code in reqesst (PyPI) MAL-2025-965 | Malicious | Not scored | 24 Dec, 2024 | PyPI reqesst |
Malicious release: Malicious code in reqest (PyPI) MAL-2025-966 | Malicious | Not scored | 24 Dec, 2024 | PyPI reqest |
Malicious release: Malicious code in reqeuts (PyPI) MAL-2025-968 | Malicious | Not scored | 24 Dec, 2024 | PyPI reqeuts |
Malicious release: Malicious code in reqiest (PyPI) MAL-2025-969 | Malicious | Not scored | 24 Dec, 2024 | PyPI reqiest |
Malicious release: Malicious code in requeszs (PyPI) MAL-2025-973 | Malicious | Not scored | 24 Dec, 2024 | PyPI requeszs |
Malicious release: Malicious code in reqzest (PyPI) MAL-2025-975 | Malicious | Not scored | 24 Dec, 2024 | PyPI reqzest |
Malicious release: Malicious code in rreqest (PyPI) MAL-2025-976 | Malicious | Not scored | 24 Dec, 2024 | PyPI rreqest |
Malicious release: Malicious code in filecraft (PyPI) MAL-2024-12272 | Malicious | Not scored | 24 Dec, 2024 | PyPI filecraft |
Malicious release: Malicious code in handyfiles (PyPI) MAL-2024-12282 | Malicious | Not scored | 24 Dec, 2024 | PyPI handyfiles |
Amazon Redshift Python Connector vulnerable to SQL Injection CVE-2024-12745, GHSA-8gc2-vq6m-rwjw, PYSEC-2026-1866 | High | 0.5% | 24 Dec, 2024 | PyPI redshift-connector PyPI redshift_connector |
Koji Cross-site Scripting CVE-2024-9427, GHSA-g2vg-8hfg-79vj, PYSEC-2026-1501 | Medium | 0.3% | 24 Dec, 2024 | PyPI koji |
Jinja has a sandbox breakout through indirect reference to format method CVE-2024-56326, GHSA-q2x7-8rv6-6q7h, PYSEC-2026-1475 | Medium | 0.5% | 23 Dec, 2024 | PyPI jinja2 |
Jinja has a sandbox breakout through malicious filenames CVE-2024-56201, GHSA-gmj6-6f8f-6699, PYSEC-2026-1472 | Medium | 0.3% | 23 Dec, 2024 | PyPI jinja2 |
Malicious release: Malicious code in piepunk (PyPI) MAL-2024-12322 | Malicious | Not scored | 19 Dec, 2024 | PyPI piepunk |
pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution CVE-2024-56327, GHSA-47h8-jmp3-9f28, PYSEC-2026-1839 | High | 0.5% | 19 Dec, 2024 | PyPI pyrage |