Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Synapse denial of service through media disk space consumption CVE-2024-37302, GHSA-4mhg-xv73-xq2x, PYSEC-2024-286 | High | 0.6% | 03 Dec, 2024 | PyPI matrix-synapse |
Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality CVE-2024-53999, GHSA-5jc6-h9w7-jm3p, PYSEC-2026-1666 | Medium | 0.5% | 03 Dec, 2024 | PyPI mobsf |
MobSF vulnerability allows SSRF due to the allow_redirects=True parameter CVE-2024-54000, GHSA-m435-9v6r-v5f6, PYSEC-2024-256 | High | 0.4% | 03 Dec, 2024 | PyPI mobsf |
Denial of service (DoS) via deformation `multipart/form-data` boundary CVE-2024-53981, GHSA-59g5-xgcq-4qw3, PYSEC-2026-1851 | High | 0.6% | 02 Dec, 2024 | PyPI python-multipart |
Malicious release: Malicious code in my-main-manager (PyPI) MAL-2024-12308 | Malicious | Not scored | 01 Dec, 2024 | PyPI my-main-manager |
Malicious release: Malicious code in my-service-manager (PyPI) MAL-2024-12309 | Malicious | Not scored | 01 Dec, 2024 | PyPI my-service-manager |
Malicious release: Malicious code in omigo-data-analytics (PyPI) MAL-2024-12318 | Malicious | Not scored | 01 Dec, 2024 | PyPI omigo-data-analytics |
Malicious release: Malicious code in apache-airflow-providers-edge (PyPI) MAL-2025-900 | Malicious | Not scored | 01 Dec, 2024 | PyPI apache-airflow-providers-edge |
Malicious release: Malicious code in auth0-open-source-template (PyPI) MAL-2025-901 | Malicious | Not scored | 01 Dec, 2024 | PyPI auth0-open-source-template |
Malicious release: Malicious code in bancor-simulation (PyPI) MAL-2025-902 | Malicious | Not scored | 01 Dec, 2024 | PyPI bancor-simulation |
Malicious release: Malicious code in crowdstrike-foundry (PyPI) MAL-2025-912 | Malicious | Not scored | 01 Dec, 2024 | PyPI crowdstrike-foundry |
Malicious release: Malicious code in datagov-harvester (PyPI) MAL-2025-913 | Malicious | Not scored | 01 Dec, 2024 | PyPI datagov-harvester |
Malicious release: Malicious code in foop (PyPI) MAL-2025-927 | Malicious | Not scored | 01 Dec, 2024 | PyPI foop |
Malicious release: Malicious code in pipcolorpkgv2 (PyPI) MAL-2024-12324 | Malicious | Not scored | 30 Nov, 2024 | PyPI pipcolorpkgv2 |
Malicious release: Malicious code in pycryptographylibv3 (PyPI) MAL-2024-12330 | Malicious | Not scored | 30 Nov, 2024 | PyPI pycryptographylibv3 |
Malicious release: Malicious code in bestcolorsever (PyPI) MAL-2024-12215 | Malicious | Not scored | 30 Nov, 2024 | PyPI bestcolorsever |
Malicious release: Malicious code in bestcolorsever2 (PyPI) MAL-2024-12216 | Malicious | Not scored | 30 Nov, 2024 | PyPI bestcolorsever2 |
Malicious release: Malicious code in bestcolorsever3 (PyPI) MAL-2024-12217 | Malicious | Not scored | 30 Nov, 2024 | PyPI bestcolorsever3 |
Malicious release: Malicious code in bettercolorstesting (PyPI) MAL-2024-12218 | Malicious | Not scored | 30 Nov, 2024 | PyPI bettercolorstesting |
Malicious release: Malicious code in calc123lorc (PyPI) MAL-2024-12225 | Malicious | Not scored | 30 Nov, 2024 | PyPI calc123lorc |
Malicious release: Malicious code in calccc (PyPI) MAL-2024-12226 | Malicious | Not scored | 30 Nov, 2024 | PyPI calccc |
Malicious release: Malicious code in calcnotepad (PyPI) MAL-2024-12227 | Malicious | Not scored | 30 Nov, 2024 | PyPI calcnotepad |
Malicious release: Malicious code in calctestchristmas (PyPI) MAL-2024-12228 | Malicious | Not scored | 30 Nov, 2024 | PyPI calctestchristmas |
Malicious release: Malicious code in christmasmiraclemaker (PyPI) MAL-2024-12234 | Malicious | Not scored | 30 Nov, 2024 | PyPI christmasmiraclemaker |
Malicious release: Malicious code in newpackagetest2024 (PyPI) MAL-2024-12312 | Malicious | Not scored | 30 Nov, 2024 | PyPI newpackagetest2024 |
Malicious release: Malicious code in newpackagetest2025 (PyPI) MAL-2024-12313 | Malicious | Not scored | 30 Nov, 2024 | PyPI newpackagetest2025 |
Malicious release: Malicious code in nirohf-reverse-shell (PyPI) MAL-2024-12314 | Malicious | Not scored | 29 Nov, 2024 | PyPI nirohf-reverse-shell |
Python package "zhmcclient" stores passwords in clear text in its HMC and API logs CVE-2024-53865, GHSA-p57h-3cmc-xpjq, PYSEC-2026-2073 | High | 0.1% | 29 Nov, 2024 | PyPI zhmcclient |
PyJWT Issuer field partial matches allowed CVE-2024-53861, GHSA-75c5-xw7c-p5pm, PYSEC-2026-1814 | High | 0.8% | 29 Nov, 2024 | PyPI PyJWT PyPI pyjwt |
check-jsonschema default caching for remote schemas allows for cache confusion CVE-2024-53848, GHSA-q6mv-284r-mp36, PYSEC-2026-1245 | High | 0.1% | 29 Nov, 2024 | PyPI check-jsonschema |
Malicious release: Malicious code in catme (PyPI) MAL-2024-12230 | Malicious | Not scored | 29 Nov, 2024 | PyPI catme |
Malicious release: Malicious code in driftme (PyPI) MAL-2024-12259 | Malicious | Not scored | 29 Nov, 2024 | PyPI driftme |
Malicious release: Malicious code in byted-df (PyPI) MAL-2025-905 | Malicious | Not scored | 29 Nov, 2024 | PyPI byted-df |
Malicious release: Malicious code in kotlin-stdlib-jdk8 (PyPI) MAL-2025-939 | Malicious | Not scored | 29 Nov, 2024 | PyPI kotlin-stdlib-jdk8 |
Malicious release: Malicious code in pytest-tt-ddriven (PyPI) MAL-2025-960 | Malicious | Not scored | 29 Nov, 2024 | PyPI pytest-tt-ddriven |
Malicious release: Malicious code in shoots-api-test (PyPI) MAL-2025-985 | Malicious | Not scored | 29 Nov, 2024 | PyPI shoots-api-test |
Malicious release: Malicious code in shoots-flutter (PyPI) MAL-2025-987 | Malicious | Not scored | 29 Nov, 2024 | PyPI shoots-flutter |
Malicious release: Malicious code in trove4j (PyPI) MAL-2025-998 | Malicious | Not scored | 29 Nov, 2024 | PyPI trove4j |
pyspider Cross-site Scripting vulnerability CVE-2024-39162, GHSA-x4x5-jx9j-mmv7, PYSEC-2026-1843 | Medium | 0.4% | 29 Nov, 2024 | PyPI pyspider |
Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it
reads Arrow IPC, Feather or Parquet data from untrusted sources (for
example, user-supplied input files). Thi CVE-2024-52338, PYSEC-2024-161 | Critical | 2.3% | 28 Nov, 2024 | PyPI pyarrow |
Malicious release: Malicious code in ccsinstaller (PyPI) MAL-2024-12231 | Malicious | Not scored | 27 Nov, 2024 | PyPI ccsinstaller |
Malicious release: Malicious code in dgsinstaller (PyPI) MAL-2024-12254 | Malicious | Not scored | 27 Nov, 2024 | PyPI dgsinstaller |
Malicious release: Malicious code in dftester-pip (PyPI) MAL-2024-11575 | Malicious | Not scored | 27 Nov, 2024 | PyPI dftester-pip |
Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API CVE-2024-52008, GHSA-v7vm-rhmg-8j2r, PYSEC-2026-1349 | Low | 0.6% | 26 Nov, 2024 | PyPI ethyca-fides |
aiocpa contains credential harvesting code GHSA-486g-47cc-8wxf | High | Not scored | 25 Nov, 2024 | PyPI aiocpa |
aiocpa 0.1.13 contains credential harvesting code PYSEC-2024-152 | Not scored | 25 Nov, 2024 | PyPI aiocpa | |
libre-chat Path Traversal vulnerability CVE-2024-52787, GHSA-3864-rp2m-2qfj, PYSEC-2026-1537 | Critical | 0.8% | 25 Nov, 2024 | PyPI libre-chat |
MLflow's excessive directory permissions allow local privilege escalation BIT-mlflow-2024-27134, CVE-2024-27134, GHSA-qpgc-w4mg-6v92, PYSEC-2024-224 | High | 0.1% | 25 Nov, 2024 | PyPI mlflow |
OpenStack Neutron can use an incorrect ID during policy enforcement CVE-2024-53916, GHSA-f27h-g923-68hw, PYSEC-2026-1693 | High | 0.7% | 25 Nov, 2024 | PyPI neutron |
virtualenv allows command injection through activation scripts for a virtual environment BIT-virtualenv-2024-53899, CVE-2024-53899, GHSA-rqc4-2hc7-8c8v, PYSEC-2024-187 | High | 1.6% | 24 Nov, 2024 | PyPI virtualenv |