Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Reverb use after free vulnerability CVE-2024-8375, GHSA-w69q-w4h4-2fx8, PYSEC-2026-1306, PYSEC-2026-2452 | Medium | 0.1% | 19 Sep, 2024 | PyPI dm-reverb PyPI dm-reverb-nightly |
LangChain Experimental Eval Injection vulnerability CVE-2024-46946, GHSA-p2qj-r53j-h3xj, PYSEC-2026-374 | Critical | 1.4% | 19 Sep, 2024 | PyPI langchain-experimental |
Mesop has a local file Inclusion via static file serving functionality CVE-2024-45601, GHSA-pmv9-3xqp-8w42, PYSEC-2026-1625 | High | 0.3% | 18 Sep, 2024 | PyPI mesop |
Guardrails has an arbitrary code execution vulnerability CVE-2024-45858, GHSA-w392-75q8-vr67, PYSEC-2026-1432 | High | 0.4% | 18 Sep, 2024 | PyPI guardrails-ai |
sqlitedict insecure deserialization vulnerability CVE-2024-35515, GHSA-g4r7-86gm-pgqc, PYSEC-2026-1939 | Critical | 0.9% | 18 Sep, 2024 | PyPI sqlitedict |
Malicious release: Malicious code in package-lib8127 (PyPI) MAL-2024-11653 | Malicious | Not scored | 17 Sep, 2024 | PyPI package-lib8127 |
Malicious release: Malicious code in sendtowev (PyPI) MAL-2024-11704 | Malicious | Not scored | 17 Sep, 2024 | PyPI sendtowev |
Heap-based Buffer Overflow in MicroPython CVE-2024-8946, GHSA-74qm-4v7r-jw2f, PYSEC-2024-91, PYSEC-2024-93, PYSEC-2024-95, PYSEC-2024-96 | Medium | 1.0% | 17 Sep, 2024 | PyPI micropython-copy PyPI micropython-io PyPI micropython-os-path PyPI micropython-string |
Use After Free in MicroPython CVE-2024-8947, GHSA-pwwp-3q7j-9mx8, PYSEC-2024-92, PYSEC-2024-94 | Medium | 1.0% | 17 Sep, 2024 | PyPI micropython-copy PyPI micropython-io |
heap-buffer-overflow in MicroPython CVE-2024-8948, GHSA-vh3x-525m-jp4r, PYSEC-2024-87, PYSEC-2024-88, PYSEC-2024-89 | Medium | 1.0% | 17 Sep, 2024 | PyPI micropython-copy PyPI micropython-io PyPI micropython-os |
Sentry improperly authorizes muting of alert rules CVE-2024-45606, GHSA-v345-w9f2-mpm5, PYSEC-2026-1916 | High | 0.4% | 17 Sep, 2024 | PyPI sentry |
Sentry improperly authorizes deletion of user issue alert notifications CVE-2024-45605, GHSA-54m3-95j9-v89j, PYSEC-2026-1910 | High | 0.4% | 17 Sep, 2024 | PyPI sentry |
vLLM Denial of Service via the best_of parameter CVE-2024-8939, GHSA-wc36-9694-f9rf, PYSEC-2026-2025 | Medium | 0.2% | 17 Sep, 2024 | PyPI vllm |
vLLM denial of service vulnerability CVE-2024-8768, GHSA-w2r7-9579-27hf, PYSEC-2026-2024 | High | 0.7% | 17 Sep, 2024 | PyPI vllm |
LangChain pickle deserialization of untrusted data CVE-2024-5998, GHSA-f2jm-rw3h-6phg, PYSEC-2024-323, PYSEC-2026-1514 | High | 0.4% | 17 Sep, 2024 | PyPI langchain PyPI langchain-community |
Malicious release: Malicious code in discself (PyPI) MAL-2024-12258 | Malicious | Not scored | 16 Sep, 2024 | PyPI discself |
Malicious release: Malicious code in discord-api (PyPI) MAL-2024-12255 | Malicious | Not scored | 16 Sep, 2024 | PyPI discord-api |
Composio Path Traversal vulnerability CVE-2024-8865, GHSA-66r2-xm28-74w9, PYSEC-2026-1265 | Medium | 0.9% | 15 Sep, 2024 | PyPI composio-core |
Composio Code Injection Vulnerability CVE-2024-8864, GHSA-mrmh-3hqh-pfw7, PYSEC-2026-1266 | Medium | 0.8% | 15 Sep, 2024 | PyPI composio-core |
Aim Stored XSS through TEXT EXPLORER CVE-2024-8863, GHSA-pmhg-f7wc-c97m, PYSEC-2026-1093 | Medium | 0.5% | 14 Sep, 2024 | PyPI aim |
D-Tale Command Execution Vulnerability CVE-2024-8862, GHSA-fg5m-m723-7mv6, PYSEC-2026-1321 | Medium | 1.3% | 14 Sep, 2024 | PyPI dtale |
Ansible vulnerable to Insertion of Sensitive Information into Log File CVE-2024-8775, GHSA-jpxc-vmjf-9fcj, PYSEC-2026-1124 | High | 0.3% | 14 Sep, 2024 | PyPI ansible-core |
LiteLLM Server-Side Request Forgery (SSRF) vulnerability CVE-2024-6587, GHSA-g26j-5385-hhw3, PYSEC-2026-1547 | High | 34.4% | 13 Sep, 2024 | PyPI litellm |
Cleanlab Deserialization of Untrusted Data vulnerability CVE-2024-45857, GHSA-8cm9-rrgc-4pcj, PYSEC-2026-1254 | High | 0.2% | 12 Sep, 2024 | PyPI cleanlab |
MindsDB Cross-site Scripting vulnerability CVE-2024-45856, GHSA-32fj-r8qw-r8w8, PYSEC-2026-1628 | Medium | 0.5% | 12 Sep, 2024 | PyPI mindsdb |
MindsDB Eval Injection vulnerability CVE-2024-45847, GHSA-crmg-rp64-5cm3, PYSEC-2026-1629 | High | 0.9% | 12 Sep, 2024 | PyPI mindsdb |
Refuel Autolab Eval Injection vulnerability CVE-2024-27321, GHSA-4fgp-7vvm-m4jf, PYSEC-2026-1869 | High | 0.3% | 12 Sep, 2024 | PyPI refuel-autolabel |
Refuel Autolab Eval Injection vulnerability CVE-2024-27320, GHSA-g2m8-f3x2-qprw, PYSEC-2026-1870 | High | 0.4% | 12 Sep, 2024 | PyPI refuel-autolabel |
MindsDB Eval Injection vulnerability CVE-2024-45846, GHSA-wcjw-3v6p-4v3r, PYSEC-2024-77 | High | 2.1% | 12 Sep, 2024 | PyPI mindsdb |
MindsDB Eval Injection vulnerability CVE-2024-45848, GHSA-9gq6-6936-885w, PYSEC-2024-78 | High | 0.9% | 12 Sep, 2024 | PyPI mindsdb |
MindsDB Eval Injection vulnerability CVE-2024-45849, GHSA-c85f-pcx6-2ghm, PYSEC-2024-79 | High | 0.9% | 12 Sep, 2024 | PyPI mindsdb |
MindsDB Eval Injection vulnerability CVE-2024-45850, GHSA-v6g6-3cm3-vf6c, PYSEC-2024-80 | High | 0.9% | 12 Sep, 2024 | PyPI mindsdb |
MindsDB Eval Injection vulnerability CVE-2024-45851, GHSA-wf9g-c67g-h4ch, PYSEC-2024-81 | High | 0.9% | 12 Sep, 2024 | PyPI mindsdb |
MindsDB Deserialization of Untrusted Data vulnerability CVE-2024-45852, GHSA-7vhj-pfwv-hx3w, PYSEC-2024-82 | High | 0.7% | 12 Sep, 2024 | PyPI mindsdb |
MindsDB Deserialization of Untrusted Data vulnerability CVE-2024-45853, GHSA-q9r8-89xr-4xv4, PYSEC-2024-83 | High | 0.5% | 12 Sep, 2024 | PyPI mindsdb |
MindsDB Deserialization of Untrusted Data vulnerability CVE-2024-45854, GHSA-7vhh-gfjc-x8rm, PYSEC-2024-84 | High | 0.5% | 12 Sep, 2024 | PyPI mindsdb |
MindsDB Deserialization of Untrusted Data vulnerability CVE-2024-45855, GHSA-fr9q-rgwq-g5r5, PYSEC-2024-85 | High | 0.5% | 12 Sep, 2024 | PyPI mindsdb |
Sensitive Information Exposure Through Insecure Logging For Secrets Like Metadata.DockerBuildArgs GHSA-rjc6-vm4h-85cg | Medium | Not scored | 11 Sep, 2024 | PyPI aws-sam-cli |
AWS SageMaker Training Toolkit logs CodeArtifact Authorization token GHSA-635v-pc42-fr74 | Medium | Not scored | 11 Sep, 2024 | PyPI sagemaker-training |
AutoGPT bypass of the shell commands denylist settings CVE-2024-6091, GHSA-g84q-54hf-36rg, PYSEC-2026-257 | Critical | 0.8% | 11 Sep, 2024 | PyPI agpt |
D-Tale vulnerable to Remote Code Execution through the Query input on Chart Builder CVE-2024-45595, GHSA-pw44-4h99-wqff, PYSEC-2026-1323 | Critical | 0.8% | 10 Sep, 2024 | PyPI dtale |
pyload-ng vulnerable to RCE with js2py sandbox escape CVE-2024-39205, GHSA-r9pp-r4xf-597r, PYSEC-2026-499 | Critical | 16.5% | 09 Sep, 2024 | PyPI pyload-ng |
Malicious release: Malicious code in hyperreq (PyPI) MAL-2024-10035 | Malicious | Not scored | 09 Sep, 2024 | PyPI hyperreq |
Malicious release: Malicious code in request-wizard (PyPI) MAL-2025-3464 | Malicious | Not scored | 09 Sep, 2024 | PyPI request-wizard |
Malicious release: Malicious code in colorbytes (PyPI) MAL-2024-9962 | Malicious | Not scored | 08 Sep, 2024 | PyPI colorbytes |
Malicious release: Malicious code in colourfulls (PyPI) MAL-2024-12246 | Malicious | Not scored | 08 Sep, 2024 | PyPI colourfulls |
Malicious release: Malicious code in coffin-codes-2022 (PyPI) MAL-2024-12240 | Malicious | Not scored | 08 Sep, 2024 | PyPI coffin-codes-2022 |
Malicious release: Malicious code in coffin-codes-net (PyPI) MAL-2024-12241 | Malicious | Not scored | 08 Sep, 2024 | PyPI coffin-codes-net |
Malicious release: Malicious code in coffin-codes-net2 (PyPI) MAL-2024-12242 | Malicious | Not scored | 08 Sep, 2024 | PyPI coffin-codes-net2 |
Malicious release: Malicious code in coffin-codes-pro (PyPI) MAL-2024-12243 | Malicious | Not scored | 08 Sep, 2024 | PyPI coffin-codes-pro |