Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in 0requests (PyPI) MAL-2026-15859 | Malicious | Not scored | 03 Sep, 2026 | PyPI 0requests |
Malicious release: Malicious code in uvhttp-custom (PyPI) MAL-2026-15863 | Malicious | Not scored | 03 Sep, 2026 | PyPI uvhttp-custom |
Malicious release: Malicious code in trongridi (PyPI) MAL-2026-15858 | Malicious | Not scored | 03 Sep, 2026 | PyPI trongridi |
Malicious release: Malicious code in company-sdk (PyPI) MAL-2026-15827 | Malicious | Not scored | 03 Sep, 2026 | PyPI company-sdk |
Malicious release: Malicious code in env-validator-tool (PyPI) MAL-2026-15828 | Malicious | Not scored | 03 Sep, 2026 | PyPI env-validator-tool |
Malicious release: Malicious code in telemetry-helper (PyPI) MAL-2026-15829 | Malicious | Not scored | 03 Sep, 2026 | PyPI telemetry-helper |
Windows ML CLI: CORS misconfig enables localhost RCE CVE-2026-84452, GHSA-96p9-rh4f-92cf, PYSEC-2026-3944 | High | 1.6% | 02 Sep, 2026 | PyPI winml-cli |
HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification) CVE-2026-84382, GHSA-8xx6-hgc6-gc2m, PYSEC-2026-3846 | High | 0.6% | 02 Sep, 2026 | PyPI httpx2 |
HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies CVE-2026-84381, GHSA-7mj9-2mp8-4m2p, PYSEC-2026-3844, PYSEC-2026-3845 | High | 0.1% | 02 Sep, 2026 | PyPI httpcore2 PyPI httpx2 |
HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated CVE-2026-84380, GHSA-pf96-p4fj-6566, PYSEC-2026-3849 | Medium | 0.2% | 02 Sep, 2026 | PyPI httpx2 |
HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers CVE-2026-84379, GHSA-h4x7-gw46-3wm6, PYSEC-2026-3848 | Medium | 0.3% | 02 Sep, 2026 | PyPI httpx2 |
HTTPX2: Quadratic SSE line buffering can cause CPU denial of service CVE-2026-84378, GHSA-f2fp-rgf2-35cp, PYSEC-2026-3847 | Medium | 0.3% | 02 Sep, 2026 | PyPI httpx2 |
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters CVE-2026-84377, GHSA-3cv6-jpf6-8222, PYSEC-2026-4066 | Medium | 0.5% | 02 Sep, 2026 | PyPI litellm |
NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars CVE-2026-12876, GHSA-ff5c-cp5c-9wjf, PYSEC-2026-3869 | Medium | Not scored | 02 Sep, 2026 | PyPI nltk |
Apache Spark History Server allows stored cross-site scripting through unescaped application names BIT-spark-2026-32773, CVE-2026-32773, GHSA-9437-39hj-3c93, PYSEC-2026-3966 | Medium | 0.4% | 02 Sep, 2026 | Maven org.apache.spark:spark-core_2.12 Maven org.apache.spark:spark-core_2.13 PyPI pyspark |
Malicious release: Malicious code in syswatch (PyPI) MAL-2026-15811 | Malicious | Not scored | 01 Sep, 2026 | PyPI syswatch |
Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default CVE-2026-84366, GHSA-76g3-c3x4-crvx, PYSEC-2026-3918 | High | 0.3% | 01 Sep, 2026 | PyPI scrapy |
pypdf: Possible long runtimes/large memory usage when extracting XForm objects CVE-2026-84311, GHSA-763m-79hh-57f2, PYSEC-2026-3911 | Medium | 0.1% | 01 Sep, 2026 | PyPI pypdf |
pypdf: Possible long runtimes/large memory usage when retrieving outlines CVE-2026-84310, GHSA-23w6-3w8w-8484, PYSEC-2026-3910 | Medium | 0.1% | 01 Sep, 2026 | PyPI pypdf |
tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34) CVE-2026-91990, GHSA-8423-8fgw-73vq | High | 0.4% | 01 Sep, 2026 | PyPI tornado |
pypdf: Possible infinite loop for TreeObject.insert_child CVE-2026-84309, GHSA-jp53-mhqp-8xcg, PYSEC-2026-3913 | Medium | 0.2% | 01 Sep, 2026 | PyPI pypdf |
Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie` CVE-2026-91991, GHSA-wwv5-g3v4-889x | Medium | 0.2% | 01 Sep, 2026 | PyPI tornado |
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption CVE-2026-84305, GHSA-cfqr-cjx5-5jcm, PYSEC-2026-3923 | Medium | 0.2% | 01 Sep, 2026 | PyPI sqlparse |
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact GHSA-gqvg-gmmx-x4hm | High | Not scored | 01 Sep, 2026 | PyPI mlflow |
Malicious release: Malicious code in gcphelpit (PyPI) MAL-2026-15810 | Malicious | Not scored | 01 Sep, 2026 | PyPI gcphelpit |
Malicious release: Malicious code in tallyboxlite (PyPI) MAL-2026-15809 | Malicious | Not scored | 01 Sep, 2026 | PyPI tallyboxlite |
Hugging Face Transformers downloads custom generation code before trust consent CVE-2026-80047, GHSA-x9r9-c232-4q39, PYSEC-2026-4174 | High | 0.1% | 01 Sep, 2026 | PyPI transformers |
pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace CVE-2026-82398, GHSA-fc8x-2rww-xw9m, PYSEC-2026-3912 | Medium | 0.5% | 31 Aug, 2026 | PyPI pypdf |
Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop CVE-2026-82397, GHSA-mpf4-983q-p7j4, PYSEC-2026-3928 | High | 0.3% | 31 Aug, 2026 | PyPI tornado |
Malicious release: Malicious code in pyservercheck (PyPI) MAL-2026-15603 | Malicious | Not scored | 31 Aug, 2026 | PyPI pyservercheck |
Malicious release: Malicious code in tronlinker (PyPI) MAL-2026-15588 | Malicious | Not scored | 30 Aug, 2026 | PyPI tronlinker |
Malicious release: Malicious code in auth-app-streamlit (PyPI) MAL-2026-15577 | Malicious | Not scored | 30 Aug, 2026 | PyPI auth-app-streamlit |
Malicious release: Malicious code in trongridor (PyPI) MAL-2026-15578 | Malicious | Not scored | 30 Aug, 2026 | PyPI trongridor |
Malicious release: Malicious code in flask-header-guard (PyPI) MAL-2026-15566 | Malicious | Not scored | 29 Aug, 2026 | PyPI flask-header-guard |
AIIR verification and policy gates could report success without enforcing the control (fail-open) GHSA-73p9-6hrp-8qhr | Medium | Not scored | 28 Aug, 2026 | PyPI aiir |
plone.app.event vulnerable to denial of service via iCalendar import CVE-2026-55247, GHSA-r82h-mqw3-fc56, PYSEC-2026-3883 | Critical | 0.4% | 28 Aug, 2026 | PyPI plone-app-event PyPI plone.app.event |
Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching CVE-2026-55520, GHSA-wjmf-p669-5m5p, PYSEC-2026-3906 | High | 0.5% | 28 Aug, 2026 | PyPI Protego PyPI protego |
plone.app.portlets vulnerable to denial of service via RSS feed portlet CVE-2026-55248, GHSA-x5g3-w747-2h8q, PYSEC-2026-3884 | Critical | 0.4% | 28 Aug, 2026 | PyPI plone-app-portlets PyPI plone.app.portlets |
piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/. CVE-2026-55485, GHSA-2gh4-jmwq-rr8w, PYSEC-2026-3882 | High | 0.6% | 28 Aug, 2026 | PyPI piccolo-admin |
WsgiDAV MySQL provider has a blind SQL injection CVE-2026-55509, GHSA-p6gw-4frg-j7jw, PYSEC-2026-3945 | High | 0.5% | 28 Aug, 2026 | PyPI WsgiDAV PyPI wsgidav |
Malicious release: Malicious code in calcboxlite (PyPI) MAL-2026-15488 | Malicious | Not scored | 28 Aug, 2026 | PyPI calcboxlite |
Malicious release: Malicious code in yamlformat-tools (PyPI) MAL-2026-14589 | Malicious | Not scored | 28 Aug, 2026 | PyPI yamlformat-tools |
Malicious release: Malicious code in yamlformatter-utils (PyPI) MAL-2026-14590 | Malicious | Not scored | 28 Aug, 2026 | PyPI yamlformatter-utils |
Malicious release: Malicious code in pygame-renderkit (PyPI) MAL-2026-14587 | Malicious | Not scored | 28 Aug, 2026 | PyPI pygame-renderkit |
Malicious release: Malicious code in yaml-report-formatter (PyPI) MAL-2026-14588 | Malicious | Not scored | 28 Aug, 2026 | PyPI yaml-report-formatter |
Malicious release: Malicious code in flyteplugins-redis (PyPI) MAL-2026-14584 | Malicious | Not scored | 27 Aug, 2026 | PyPI flyteplugins-redis |
Malicious release: Malicious code in flyteplugins-nsight (PyPI) MAL-2026-14583 | Malicious | Not scored | 27 Aug, 2026 | PyPI flyteplugins-nsight |
Malicious release: Malicious code in flyteplugins-agento11y (PyPI) MAL-2026-14581 | Malicious | Not scored | 27 Aug, 2026 | PyPI flyteplugins-agento11y |
Malicious release: Malicious code in flyteplugins-echo (PyPI) MAL-2026-14582 | Malicious | Not scored | 27 Aug, 2026 | PyPI flyteplugins-echo |
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint CVE-2026-37004, GHSA-6wvf-77m9-58rm, PYSEC-2026-3861 | Critical | 0.8% | 27 Aug, 2026 | PyPI litellm |