Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in adv2099m2 (PyPI) MAL-2024-4735 | Malicious | Not scored | 25 Jun, 2024 | PyPI adv2099m2 |
Malicious release: Malicious code in adv2099m3 (PyPI) MAL-2024-4736 | Malicious | Not scored | 25 Jun, 2024 | PyPI adv2099m3 |
Malicious release: Malicious code in admcheck2 (PyPI) MAL-2024-4733 | Malicious | Not scored | 25 Jun, 2024 | PyPI admcheck2 |
Malicious release: Malicious code in adv2099m (PyPI) MAL-2024-4734 | Malicious | Not scored | 25 Jun, 2024 | PyPI adv2099m |
Malicious release: Malicious code in adm3 (PyPI) MAL-2024-4730 | Malicious | Not scored | 25 Jun, 2024 | PyPI adm3 |
Malicious release: Malicious code in adm4 (PyPI) MAL-2024-4731 | Malicious | Not scored | 25 Jun, 2024 | PyPI adm4 |
Malicious release: Malicious code in admcheck (PyPI) MAL-2024-4732 | Malicious | Not scored | 25 Jun, 2024 | PyPI admcheck |
Malicious release: Malicious code in 90456984689490856 (PyPI) MAL-2024-4728 | Malicious | Not scored | 25 Jun, 2024 | PyPI 90456984689490856 |
Malicious release: Malicious code in a1rn (PyPI) MAL-2024-4729 | Malicious | Not scored | 25 Jun, 2024 | PyPI a1rn |
Malicious release: Malicious code in 3m-promo-link-gen (PyPI) MAL-2024-4726 | Malicious | Not scored | 25 Jun, 2024 | PyPI 3m-promo-link-gen |
Malicious release: Malicious code in 4123 (PyPI) MAL-2024-4727 | Malicious | Not scored | 25 Jun, 2024 | PyPI 4123 |
Malicious release: Malicious code in 233-misc (PyPI) MAL-2024-4724 | Malicious | Not scored | 25 Jun, 2024 | PyPI 233-misc |
Malicious release: Malicious code in 3m-promo-gen-api (PyPI) MAL-2024-4725 | Malicious | Not scored | 25 Jun, 2024 | PyPI 3m-promo-gen-api |
Malicious release: Malicious code in 191239aa (PyPI) MAL-2024-4722 | Malicious | Not scored | 25 Jun, 2024 | PyPI 191239aa |
Malicious release: Malicious code in 1923tsl1 (PyPI) MAL-2024-4723 | Malicious | Not scored | 25 Jun, 2024 | PyPI 1923tsl1 |
Malicious release: Malicious code in 1337test (PyPI) MAL-2024-4720 | Malicious | Not scored | 25 Jun, 2024 | PyPI 1337test |
Malicious release: Malicious code in 18923aa (PyPI) MAL-2024-4721 | Malicious | Not scored | 25 Jun, 2024 | PyPI 18923aa |
Malicious release: Malicious code in wessycord (npm) MAL-2024-3948, MAL-2024-6210 | Malicious | Not scored | 25 Jun, 2024 | PyPI wessycord npm wessycord |
CodeChecker has a Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store` CVE-2023-49793, GHSA-h26w-r4m5-8rrf, PYSEC-2024-54 | Medium | 0.7% | 24 Jun, 2024 | PyPI codechecker |
Improper line feed handling in zenml CVE-2024-4460, GHSA-7gjr-hcc3-xfr4, PYSEC-2026-2068 | Medium | Not scored | 24 Jun, 2024 | PyPI zenml |
Remote Code Execution in create_conda_env function in lollms CVE-2024-3121, GHSA-79h8-gxhq-q3jg, PYSEC-2026-1584 | Medium | 0.4% | 24 Jun, 2024 | PyPI lollms |
Remote Code Execution via path traversal bypass in lollms CVE-2024-5443, GHSA-mvrm-fh8q-6wr2, PYSEC-2026-402 | Critical | 1.2% | 22 Jun, 2024 | PyPI lollms |
Open redirect in gradio CVE-2024-4940, GHSA-g6c9-f4xm-9j4x, PYSEC-2026-1414 | Medium | 1.0% | 22 Jun, 2024 | PyPI gradio |
js2py allows remote code execution CVE-2024-28397, GHSA-h95x-26f3-88hr, PYSEC-2026-1476 | High | 4.8% | 20 Jun, 2024 | PyPI js2py |
Malicious release: Malicious code in webquickauth (PyPI) MAL-2024-1651 | Malicious | Not scored | 20 Jun, 2024 | PyPI webquickauth |
Apache Superset server arbitrary file read BIT-superset-2024-34693, CVE-2024-34693, GHSA-hcr7-cqwc-q5gq, PYSEC-2026-1183 | Medium | 1.6% | 20 Jun, 2024 | PyPI apache-superset |
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option CVE-2024-38356, GHSA-9hcv-j9pv-qmph, PYSEC-2026-1301 | Medium | 0.5% | 19 Jun, 2024 | NuGet TinyMCE Packagist tinymce/tinymce PyPI django-tinymce npm tinymce |
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements CVE-2024-38357, GHSA-w9jx-4g6g-rp7x, PYSEC-2026-1302 | Medium | 0.5% | 19 Jun, 2024 | NuGet TinyMCE Packagist tinymce/tinymce PyPI django-tinymce npm tinymce |
Malicious release: Malicious code in quickwebbasicauth (PyPI) MAL-2024-1643 | Malicious | Not scored | 19 Jun, 2024 | PyPI quickwebbasicauth |
urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects CVE-2024-37891, GHSA-34jh-p97f-mpxf, PYSEC-2026-1995 | Medium | 1.1% | 17 Jun, 2024 | PyPI urllib3 |
Malicious release: Malicious code in importlib-metadate (PyPI) MAL-2024-1624 | Malicious | Not scored | 17 Jun, 2024 | PyPI importlib-metadate |
Malicious release: Malicious code in nt4padyp3 (PyPI) MAL-2024-1625 | Malicious | Not scored | 17 Jun, 2024 | PyPI nt4padyp3 |
langchain_experimental Code Execution via Python REPL access CVE-2024-38459, GHSA-wmvm-9vqv-5qpp, PYSEC-2024-53 | High | 0.2% | 16 Jun, 2024 | PyPI langchain-experimental |
LNbits improperly handles potential network and payment failures when using Eclair backend CVE-2024-34694, GHSA-3j4h-h3fp-vwww, PYSEC-2026-1580 | High | 0.6% | 14 Jun, 2024 | PyPI lnbits |
Apache Airflow does not return the "Cache-Control" header for dynamic content BIT-airflow-2024-25142, CVE-2024-25142, GHSA-9xpj-62mm-24h2, PYSEC-2024-195 | Medium | 0.3% | 14 Jun, 2024 | PyPI apache-airflow |
Invenio-Communities has a Cross-Site Scripting (XSS) vulnerability in React components GHSA-hjx6-f647-mvf9 | Medium | Not scored | 12 Jun, 2024 | PyPI invenio-communities |
Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0 CVE-2024-37300, GHSA-gprj-3p75-f996, PYSEC-2026-1711 | High | 0.4% | 12 Jun, 2024 | PyPI oauthenticator |
Apache Submarine Server Core Incorrect Authorization vulnerability CVE-2024-36265, GHSA-6q97-8v3g-rpxw, PYSEC-2024-98 | Critical | 0.7% | 12 Jun, 2024 | Maven org.apache.submarine:submarine-server-core PyPI apache-submarine |
Apache Submarine Commons Utils has a hard-coded secret CVE-2024-36264, GHSA-jwcg-wv5x-vg3g, PYSEC-2024-97 | Critical | 1.0% | 12 Jun, 2024 | Maven org.apache.submarine:submarine-commons-utils PyPI apache-submarine |
parisneo/lollms Local File Inclusion (LFI) attack CVE-2024-4315, GHSA-vqwr-q6cc-c242, PYSEC-2026-403 | Critical | 1.0% | 12 Jun, 2024 | PyPI lollms |
Jupyter Server Proxy has a reflected XSS issue in host parameter CVE-2024-35225, GHSA-fvcq-4x64-hqxr, PYSEC-2024-236 | Critical | 0.4% | 11 Jun, 2024 | PyPI jupyter-server-proxy |
document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection CVE-2024-37301, GHSA-v5gf-r78h-55q6, PYSEC-2026-1314 | High | 1.0% | 11 Jun, 2024 | PyPI document-merge-service |
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-35255, GHSA-m5vv-6r4h-3vj9, GO-2024-2918, PYSEC-2026-1209 | Medium | 0.8% | 11 Jun, 2024 | Go github.com/Azure/azure-sdk-for-go/sdk/azidentity Maven com.azure:azure-identity Maven com.microsoft.azure:msal4j NuGet Azure.Identity +4 more |
Langflow remote code execution vulnerability CVE-2024-37014, GHSA-qg33-x2c5-6p44, PYSEC-2024-177 | Critical | 63.7% | 10 Jun, 2024 | PyPI langflow |
Authlib has algorithm confusion with asymmetric public keys CVE-2024-37568, GHSA-5357-c2jx-v7qh, PYSEC-2024-52 | High | 0.4% | 09 Jun, 2024 | PyPI authlib |
zenml-io/zenml does not expire the session after password reset CVE-2024-4680, GHSA-99hm-86h7-gr3g, PYSEC-2026-2069 | High | 0.4% | 08 Jun, 2024 | PyPI zenml |
ebookmeta XML External Entity vulnerability CVE-2024-37388, GHSA-hx54-pf28-7xch, PYSEC-2026-1324 | Critical | 0.5% | 07 Jun, 2024 | PyPI ebookmeta |
ebookmeta XML External Entity vulnerability CVE-2024-36827, GHSA-whf4-fpj8-pgg8, PYSEC-2024-76 | High | 0.5% | 07 Jun, 2024 | PyPI ebookmeta |
Tornado has a CRLF injection in CurlAsyncHTTPClient headers CVE-2024-58384, GHSA-w235-7p84-xx57 | Medium | 0.2% | 06 Jun, 2024 | PyPI tornado |
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado CVE-2024-14029, GHSA-753j-mpmx-qq6g | Critical | 0.4% | 06 Jun, 2024 | PyPI tornado |