Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Nebari prints temporary Keycloak root password CVE-2024-34529, GHSA-vjc4-3vgx-pq9h, PYSEC-2024-185 | Medium | 0.4% | 06 May, 2024 | PyPI nebari |
Gradio's Component Server does not properly consider` _is_server_fn` for functions CVE-2024-34511, GHSA-34rf-p3r3-58x2, PYSEC-2026-1407 | Medium | Not scored | 05 May, 2024 | PyPI gradio |
Gradio allows credential leakage on Windows CVE-2024-34510, GHSA-rvfh-h6c7-fc3c, PYSEC-2024-255 | High | 0.7% | 05 May, 2024 | PyPI gradio |
Malicious release: Malicious code in threadxpools (PyPI) MAL-2024-1333 | Malicious | Not scored | 05 May, 2024 | PyPI threadxpools |
Ryu Infinite Loop vulnerability CVE-2024-34489, GHSA-59p2-v62x-gxj8, PYSEC-2026-1877 | High | 0.7% | 05 May, 2024 | PyPI ryu |
Ryu Infinite Loop vulnerability CVE-2024-34488, GHSA-ffp9-pfq9-g2ww, PYSEC-2026-1881 | High | 0.7% | 05 May, 2024 | PyPI ryu |
Ryu Infinite Loop vulnerability CVE-2024-34487, GHSA-m9vm-8mv9-v5v3, PYSEC-2026-1883 | High | 0.7% | 05 May, 2024 | PyPI ryu |
Ryu Infinite Loop vulnerability CVE-2024-34486, GHSA-fgpw-cx3v-wj95, PYSEC-2026-1882 | High | 0.6% | 05 May, 2024 | PyPI ryu |
Ryu Infinite Loop vulnerability CVE-2024-34484, GHSA-c7w6-33j3-j3mx, PYSEC-2026-1880 | Medium | 0.5% | 05 May, 2024 | PyPI ryu |
Ryu Infinite Loop vulnerability CVE-2024-34483, GHSA-7hmm-wg23-2w7m, PYSEC-2026-1879 | High | 0.7% | 05 May, 2024 | PyPI ryu |
LIEF obtain sensitive information via the name parameter CVE-2024-31636, GHSA-377p-g8gr-5wpg, PYSEC-2024-280 | Low | 0.2% | 03 May, 2024 | PyPI lief |
sagemaker-python-sdk Command Injection vulnerability CVE-2024-34073, GHSA-7pc3-pr3q-58vg, PYSEC-2026-1887 | High | 1.2% | 03 May, 2024 | PyPI sagemaker |
sagemaker-python-sdk vulnerable to Deserialization of Untrusted Data CVE-2024-34072, GHSA-wjvx-jhpj-r54r, PYSEC-2026-1889 | High | 0.4% | 03 May, 2024 | PyPI sagemaker |
tqdm CLI arguments injection attack CVE-2024-34062, GHSA-g7vv-2v7x-gj9p, PYSEC-2026-1976 | Medium | 0.4% | 03 May, 2024 | PyPI tqdm |
pgAdmin Cross-site Scripting vulnerability in /settings/store API response json payload CVE-2024-4216, GHSA-xv64-8p4r-94gq, PYSEC-2026-1777 | High | 0.5% | 02 May, 2024 | PyPI pgAdmin4 PyPI pgadmin4 |
pgAdmin is affected by a multi-factor authentication bypass vulnerability CVE-2024-4215, GHSA-2mvc-557g-5638, PYSEC-2026-1768 | High | 0.6% | 02 May, 2024 | PyPI pgadmin4 |
changedetection.io Cross-site Scripting vulnerability CVE-2024-34061, GHSA-pwgc-w4x9-gw67, PYSEC-2026-1243 | Medium | 1.3% | 02 May, 2024 | PyPI changedetection-io PyPI changedetection.io |
aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests CVE-2024-30251, GHSA-5m98-qgg9-wh84, PYSEC-2026-1098 | High | 1.1% | 02 May, 2024 | PyPI aiohttp |
CraftBeerPi 4 allows arbitrary code execution CVE-2024-3955, GHSA-4f92-w438-f484, PYSEC-2026-308 | Critical | 1.1% | 02 May, 2024 | PyPI cbpi4 |
Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet` CVE-2024-32882, GHSA-w2v8-php4-p8hc, PYSEC-2026-2031 | Low | 0.5% | 01 May, 2024 | PyPI wagtail |
nautobot has reflected Cross-site Scripting potential in all object list views CVE-2024-32979, GHSA-jxgr-gcj5-cqqg, PYSEC-2026-1686 | High | 0.5% | 01 May, 2024 | PyPI nautobot |
lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_over. CVE-2024-33768, PYSEC-2024-285 | Critical | 0.8% | 01 May, 2024 | PyPI lunasvg |
lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source. CVE-2024-33767, PYSEC-2024-284 | Medium | 0.3% | 01 May, 2024 | PyPI lunasvg |
lunasvg v2.3.9 was discovered to contain an FPE (Floating Point Exception) at blend_transformed_tiled_argb.isra.0. CVE-2024-33766, PYSEC-2024-283 | Medium | 0.6% | 01 May, 2024 | PyPI lunasvg |
lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h. CVE-2024-33764, PYSEC-2024-282 | Medium | 0.3% | 01 May, 2024 | PyPI lunasvg |
lunasvg v2.3.9 was discovered to contain a stack-buffer-underflow at lunasvg/source/layoutcontext.cpp. CVE-2024-33763, PYSEC-2024-281 | High | 0.7% | 01 May, 2024 | PyPI lunasvg |
PyPXE Buffer Overflow vulnerability CVE-2023-46960, GHSA-82wx-rxf8-fxch, PYSEC-2026-1838 | High | 0.5% | 29 Apr, 2024 | PyPI PyPXE PyPI pypxe |
dcnnt-py is vulnerable to command injection via Notification Handler CVE-2023-1000, GHSA-8p42-7597-p2f6, PYSEC-2026-1293 | Medium | 1.3% | 27 Apr, 2024 | PyPI dcnnt |
python-jose algorithm confusion guard bypassed by DER-encoded public keys CVE-2024-33663, CVE-2026-85394, GHSA-3qf3-8w2g-rqmx, GHSA-6c5p-j8vq-pqhj, PYSEC-2024-232, PYSEC-2026-4298 | Critical | 0.3% | 26 Apr, 2024 | PyPI python-jose |
python-jose denial of service via compressed JWE content CVE-2024-33664, GHSA-cjwg-qfpm-7377, PYSEC-2024-233 | Medium | 0.8% | 26 Apr, 2024 | PyPI python-jose |
changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution CVE-2024-32651, GHSA-4r7v-whpg-8rx3, PYSEC-2026-310 | Critical | 85.3% | 26 Apr, 2024 | PyPI changedetection-io PyPI changedetection.io |
vyper default functions don't respect nonreentrancy keys CVE-2024-32648, GHSA-m2v9-w374-5hj9, PYSEC-2024-163 | Medium | 0.4% | 25 Apr, 2024 | PyPI vyper |
vyper performs multiple eval of `sqrt()` argument built in CVE-2024-32649, GHSA-5jrj-52x8-m64h, PYSEC-2024-209 | Medium | 0.5% | 25 Apr, 2024 | PyPI vyper |
vyper performs incorrect topic logging in raw_log CVE-2024-32645, GHSA-xchq-w5r3-4wg3, PYSEC-2024-206 | Medium | 0.5% | 25 Apr, 2024 | PyPI vyper |
vyper performs double eval of the slice start/length args in certain cases CVE-2024-32646, GHSA-r56x-j438-vw5m, PYSEC-2024-207 | Medium | 0.5% | 25 Apr, 2024 | PyPI vyper |
vyper performs double eval of raw_args in create_from_blueprint CVE-2024-32647, GHSA-3whq-64q2-qfj6, PYSEC-2024-208 | Medium | 0.5% | 25 Apr, 2024 | PyPI vyper |
vyper's range(start, start + N) reverts for negative numbers CVE-2024-32481, GHSA-ppx5-q359-pvwj, PYSEC-2024-246 | Medium | 0.8% | 25 Apr, 2024 | PyPI vyper |
pyLoad allows upload to arbitrary folder lead to RCE CVE-2024-32880, GHSA-3f7w-p8vr-4v5f, PYSEC-2026-492 | Critical | 1.4% | 24 Apr, 2024 | PyPI pyload-ng |
social-auth-app-django affected by Improper Handling of Case Sensitivity CVE-2024-32879, GHSA-2gr8-3wc7-xhj3, PYSEC-2026-1931 | Medium | 0.6% | 24 Apr, 2024 | PyPI social-auth-app-django |
Synapse V2 state resolution weakness allows Denial of Service (DoS) CVE-2024-31208, GHSA-3h7q-rfh9-xm4v, PYSEC-2024-50 | Medium | 1.5% | 23 Apr, 2024 | PyPI matrix-synapse |
cg vulnerable to an Open Redirect Vulnerability on Referer Header GHSA-w228-rfpx-fhm4 | Medium | Not scored | 23 Apr, 2024 | PyPI cg |
dbt uses a SQLparse version with a high vulnerability GHSA-p72q-h37j-3hq7 | High | Not scored | 22 Apr, 2024 | PyPI dbt-core |
OpenStack Storlets arbitrary code execution vulnerability CVE-2024-28717, GHSA-rfm2-f94j-qhjp, PYSEC-2026-1945 | High | 0.9% | 22 Apr, 2024 | PyPI storlets |
Improper Certificate Validation vulnerability in Apache Airflow FTP Provider CVE-2024-29733, GHSA-3gg8-mc87-cq3h, PYSEC-2026-1148 | Low | 0.6% | 21 Apr, 2024 | PyPI apache-airflow-providers-ftp |
Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbuffer_loader.cpp. BIT-pytorch-2024-31584, CVE-2024-31584, PYSEC-2024-250 | Medium | 0.4% | 19 Apr, 2024 | PyPI torch |
flask-cors vulnerable to log injection when the log level is set to debug CVE-2024-1681, GHSA-84pr-m4jr-85g5, PYSEC-2024-271 | Medium | 0.6% | 19 Apr, 2024 | PyPI flask-cors |
Sentry vulnerable to leaking superuser cleartext password in logs CVE-2024-32474, GHSA-6cjm-4pxw-7xp9, PYSEC-2026-1911 | High | 0.4% | 18 Apr, 2024 | PyPI sentry |
aiohttp Cross-site Scripting vulnerability on index pages for static file handling CVE-2024-27306, GHSA-7gpw-8wmc-pm8g, PYSEC-2026-1102 | Medium | 0.7% | 18 Apr, 2024 | PyPI aiohttp |
Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used BIT-airflow-2024-31869, CVE-2024-31869, GHSA-2522-mrjc-m688, PYSEC-2026-1128 | Medium | 1.1% | 18 Apr, 2024 | PyPI apache-airflow |
PyTorch heap buffer overflow vulnerability BIT-pytorch-2024-31580, CVE-2024-31580, GHSA-5pcm-hx3q-hm94, PYSEC-2024-252, PYSEC-2024-328 | High | 0.2% | 17 Apr, 2024 | PyPI torch PyPI torch-npu |