Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in cometlogger (PyPI) MAL-2024-11562, SNYK-PYTHON-COMETLOGGER-8549369 | Malicious | Not scored | 24 Nov, 2024 | PyPI cometlogger |
Deserialization of Untrusted Data in Hugging Face Transformers CVE-2024-11393, GHSA-wrfc-pvp9-mr9g, PYSEC-2024-228 | High | 3.3% | 22 Nov, 2024 | PyPI transformers |
Deserialization of Untrusted Data in Hugging Face Transformers CVE-2024-11394, GHSA-hxxf-235m-72v3, PYSEC-2024-229 | High | 2.7% | 22 Nov, 2024 | PyPI transformers |
Deserialization of Untrusted Data in Hugging Face Transformers CVE-2024-11392, GHSA-qxrp-vhvm-j765, PYSEC-2024-227 | High | 7.7% | 22 Nov, 2024 | PyPI transformers |
Sentry improper error handling leaks Application Integration Client Secret CVE-2024-53253, GHSA-v5h2-q2w4-gpcx, PYSEC-2024-310 | Medium | 0.6% | 22 Nov, 2024 | PyPI sentry |
Tornado has an HTTP cookie parsing DoS vulnerability CVE-2024-52804, GHSA-8w49-h785-mj3c, PYSEC-2026-1975 | High | 1.0% | 22 Nov, 2024 | PyPI tornado |
Malicious release: Malicious code in newpipv3 (PyPI) MAL-2024-10877 | Malicious | Not scored | 22 Nov, 2024 | PyPI newpipv3 |
Malicious release: Malicious code in blackamerxs (PyPI) MAL-2024-11537 | Malicious | Not scored | 22 Nov, 2024 | PyPI blackamerxs |
LLama Factory Remote OS Command Injection Vulnerability CVE-2024-52803, GHSA-hj3w-wrh4-44vp, PYSEC-2026-1575 | Critical | 2.3% | 21 Nov, 2024 | PyPI llamafactory |
A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue occurs when processing certain malformed MD5 model files, leading to an out-of-bounds read and potential application crash. CVE-2024-53425, PYSEC-2024-295 | Medium | 0.3% | 21 Nov, 2024 | PyPI pyassimp |
Litestar allows unbounded resource consumption (DoS vulnerability) CVE-2024-52581, GHSA-gjcc-jvgw-wvwj, PYSEC-2024-178, PYSEC-2026-1944 | High | 0.8% | 20 Nov, 2024 | PyPI litestar PyPI starlite |
django CMS Attributes Field Cross-site Scripting CVE-2024-11406, GHSA-vxcv-4xvf-pc22, PYSEC-2026-1303 | Medium | 0.5% | 20 Nov, 2024 | PyPI djangocms-attributes-field |
Django Filer Unrestricted Upload of File with Dangerous Type CVE-2024-11404, GHSA-j4v3-wwwx-5gqv, PYSEC-2026-1298 | Medium | 0.4% | 20 Nov, 2024 | PyPI django-filer |
HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through CVE-2024-52595, GHSA-5jfw-gq64-q45f, PYSEC-2024-160 | High | 0.5% | 19 Nov, 2024 | PyPI lxml-html-clean |
aiohttp allows request smuggling due to incorrect parsing of chunk extensions CVE-2024-52304, GHSA-8495-4g3g-x7pr, PYSEC-2026-1103 | Medium | 0.6% | 18 Nov, 2024 | PyPI aiohttp |
aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method CVE-2024-52303, GHSA-27mf-ghqm-j3j8, PYSEC-2026-1096 | High | 0.6% | 18 Nov, 2024 | PyPI aiohttp |
cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes CVE-2024-47533, GHSA-m26c-fcgh-cp6h, PYSEC-2026-316 | Critical | 4.0% | 18 Nov, 2024 | PyPI cobbler |
OpenCTI May Bypass Introspection Restriction CVE-2024-37155, GHSA-4mvw-j8r9-xcgc, PYSEC-2024-313 | High | 0.5% | 18 Nov, 2024 | PyPI pycti |
django CMS Cross-Site Scripting (XSS) CVE-2024-11319, GHSA-gv5h-5655-h4mv, PYSEC-2024-124 | Medium | 0.5% | 18 Nov, 2024 | PyPI django-cms |
Malicious release: Malicious code in instacart-roulette-daemon-client (PyPI) MAL-2024-12291 | Malicious | Not scored | 17 Nov, 2024 | PyPI instacart-roulette-daemon-client |
Malicious release: Malicious code in random-security-test-pkg (PyPI) MAL-2024-12335 | Malicious | Not scored | 17 Nov, 2024 | PyPI random-security-test-pkg |
OpenStack improperly deletes access rules CVE-2023-6110, GHSA-2ppf-2m6f-6v6f, PYSEC-2026-1853 | Medium | 0.5% | 17 Nov, 2024 | PyPI python-openstackclient |
Malicious release: Malicious code in zebo (PyPI) MAL-2024-11751, SNYK-PYTHON-ZEBO-8549368 | Malicious | Not scored | 16 Nov, 2024 | PyPI zebo |
Malicious release: Malicious code in discconnect (PyPI) MAL-2024-11576 | Malicious | Not scored | 16 Nov, 2024 | PyPI discconnect |
Malicious release: Malicious code in pycalculater (PyPI) MAL-2024-11668 | Malicious | Not scored | 16 Nov, 2024 | PyPI pycalculater |
Cross-site Scripting (XSS) - DOM in janeczku/calibre-web CVE-2021-3988, GHSA-r735-9gc6-2hvq, PYSEC-2026-1236 | Medium | 0.4% | 15 Nov, 2024 | PyPI calibreweb |
Improper Access Control in janeczku/calibre-web CVE-2021-3987, GHSA-fj5v-w2jp-wqvj, PYSEC-2026-1229 | Medium | 0.3% | 15 Nov, 2024 | PyPI calibreweb |
Generation of Error Message Containing Sensitive Information in janeczku/calibre-web CVE-2021-3986, GHSA-m982-h4f8-g4hf, PYSEC-2026-1232 | Medium | 0.4% | 15 Nov, 2024 | PyPI calibreweb |
An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login functionality. An attacker can exploit this vulnerability to redirect users to malicious sites, which can be used for phishing or other maliciou CVE-2024-1240, PYSEC-2024-123 | Medium | 0.3% | 15 Nov, 2024 | PyPI pyload-ng |
Apache Airflow: Sensitive configuration values are not masked in the logs by default BIT-airflow-2024-45784, CVE-2024-45784, GHSA-46c3-5xc5-wwhv, PYSEC-2024-182, PYSEC-2026-1112 | High | 1.3% | 15 Nov, 2024 | PyPI airflow PyPI apache-airflow |
ReDoS in giskard's transformation.py (GHSL-2024-324) CVE-2024-52524, GHSA-pjwm-cr36-mwv3, PYSEC-2026-1403 | Medium | 0.8% | 14 Nov, 2024 | PyPI giskard |
Missing ratelimit on passwrod resets in zenml CVE-2024-4311, GHSA-j3vq-pmp5-r5xj, PYSEC-2026-2070 | Medium | 0.5% | 14 Nov, 2024 | PyPI zenml |
Malicious release: Malicious code in reverse4343 (PyPI) MAL-2024-11693 | Malicious | Not scored | 14 Nov, 2024 | PyPI reverse4343 |
Malicious release: Malicious code in reverse434343 (PyPI) MAL-2024-11694 | Malicious | Not scored | 14 Nov, 2024 | PyPI reverse434343 |
Malicious release: Malicious code in eosio-signer (PyPI) MAL-2024-11582 | Malicious | Not scored | 14 Nov, 2024 | PyPI eosio-signer |
Salt preflight script could be attacker controlled CVE-2023-34049, GHSA-4277-m35q-7c9w, PYSEC-2026-1892 | Medium | 0.2% | 14 Nov, 2024 | PyPI salt |
Malicious release: Malicious code in tingetone (PyPI) MAL-2024-11727 | Malicious | Not scored | 13 Nov, 2024 | PyPI tingetone |
Malicious release: Malicious code in ansishade (PyPI) MAL-2024-12190 | Malicious | Not scored | 13 Nov, 2024 | PyPI ansishade |
TorchGeo Remote Code Execution Vulnerability CVE-2024-49048, GHSA-ghq9-vc6f-8qjf, PYSEC-2024-204 | High | 1.2% | 12 Nov, 2024 | PyPI torchgeo |
LightGBM Remote Code Execution Vulnerability CVE-2024-43598, GHSA-2586-f3p4-hq84, PYSEC-2024-231 | High | 1.4% | 12 Nov, 2024 | PyPI lightgbm |
Malicious release: Malicious code in backwwi (PyPI) MAL-2024-11534 | Malicious | Not scored | 12 Nov, 2024 | PyPI backwwi |
Malicious release: Malicious code in backwwii (PyPI) MAL-2024-12212 | Malicious | Not scored | 12 Nov, 2024 | PyPI backwwii |
Ansible-Core vulnerable to content protections bypass CVE-2024-11079, GHSA-99w6-3xph-cx78, PYSEC-2026-1123 | Medium | 0.5% | 12 Nov, 2024 | PyPI ansible-core |
Malicious release: Malicious code in fabrice (PyPI) MAL-2024-10573 | Malicious | Not scored | 11 Nov, 2024 | PyPI fabrice |
Malicious release: Malicious code in asn1tool (PyPI) MAL-2024-11530 | Malicious | Not scored | 10 Nov, 2024 | PyPI asn1tool |
pywasm3 contains a Use-After-Free in ForEachModule CVE-2024-27530, GHSA-46r6-92jg-22jg, PYSEC-2024-306 | High | 0.2% | 08 Nov, 2024 | PyPI pywasm3 |
wasm3 uncontrolled memory allocation vulnerability CVE-2024-27529, GHSA-fmq6-4w57-2w3v, PYSEC-2024-305 | High | 0.3% | 08 Nov, 2024 | PyPI pywasm3 SwiftURL github.com/shareup/wasm-interpreter-apple crates.io wasm3 |
pywasm3 has an Invalid Memory Read, Leading to DoS and Potential Code Execution CVE-2024-27528, GHSA-mhg9-mm8c-c683, PYSEC-2024-304 | High | 0.2% | 08 Nov, 2024 | PyPI pywasm3 |
wasm3 139076a is vulnerable to Denial of Service (DoS). CVE-2024-27527, PYSEC-2024-303 | High | 0.5% | 08 Nov, 2024 | PyPI pywasm3 |
Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data BIT-airflow-2024-50378, CVE-2024-50378, GHSA-j857-2pwm-jjmm, PYSEC-2026-1134 | Medium | 1.2% | 08 Nov, 2024 | PyPI apache-airflow |