Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
lunasvg v2.3.9 was discovered to contain an FPE (Floating Point Exception) at blend_transformed_tiled_argb.isra.0. CVE-2024-33766, PYSEC-2024-283 | Medium | 0.6% | 01 May, 2024 | PyPI lunasvg |
lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h. CVE-2024-33764, PYSEC-2024-282 | Medium | 0.3% | 01 May, 2024 | PyPI lunasvg |
lunasvg v2.3.9 was discovered to contain a stack-buffer-underflow at lunasvg/source/layoutcontext.cpp. CVE-2024-33763, PYSEC-2024-281 | High | 0.7% | 01 May, 2024 | PyPI lunasvg |
PyPXE Buffer Overflow vulnerability CVE-2023-46960, GHSA-82wx-rxf8-fxch, PYSEC-2026-1838 | High | 0.5% | 29 Apr, 2024 | PyPI PyPXE PyPI pypxe |
dcnnt-py is vulnerable to command injection via Notification Handler CVE-2023-1000, GHSA-8p42-7597-p2f6, PYSEC-2026-1293 | Medium | 1.3% | 27 Apr, 2024 | PyPI dcnnt |
python-jose algorithm confusion guard bypassed by DER-encoded public keys CVE-2024-33663, CVE-2026-85394, GHSA-3qf3-8w2g-rqmx, GHSA-6c5p-j8vq-pqhj, PYSEC-2024-232, PYSEC-2026-4298 | Critical | 0.3% | 26 Apr, 2024 | PyPI python-jose |
python-jose denial of service via compressed JWE content CVE-2024-33664, GHSA-cjwg-qfpm-7377, PYSEC-2024-233 | Medium | 0.8% | 26 Apr, 2024 | PyPI python-jose |
changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution CVE-2024-32651, GHSA-4r7v-whpg-8rx3, PYSEC-2026-310 | Critical | 85.3% | 26 Apr, 2024 | PyPI changedetection-io PyPI changedetection.io |
vyper default functions don't respect nonreentrancy keys CVE-2024-32648, GHSA-m2v9-w374-5hj9, PYSEC-2024-163 | Medium | 0.4% | 25 Apr, 2024 | PyPI vyper |
vyper performs multiple eval of `sqrt()` argument built in CVE-2024-32649, GHSA-5jrj-52x8-m64h, PYSEC-2024-209 | Medium | 0.5% | 25 Apr, 2024 | PyPI vyper |
vyper performs incorrect topic logging in raw_log CVE-2024-32645, GHSA-xchq-w5r3-4wg3, PYSEC-2024-206 | Medium | 0.5% | 25 Apr, 2024 | PyPI vyper |
vyper performs double eval of the slice start/length args in certain cases CVE-2024-32646, GHSA-r56x-j438-vw5m, PYSEC-2024-207 | Medium | 0.5% | 25 Apr, 2024 | PyPI vyper |
vyper performs double eval of raw_args in create_from_blueprint CVE-2024-32647, GHSA-3whq-64q2-qfj6, PYSEC-2024-208 | Medium | 0.5% | 25 Apr, 2024 | PyPI vyper |
vyper's range(start, start + N) reverts for negative numbers CVE-2024-32481, GHSA-ppx5-q359-pvwj, PYSEC-2024-246 | Medium | 0.8% | 25 Apr, 2024 | PyPI vyper |
pyLoad allows upload to arbitrary folder lead to RCE CVE-2024-32880, GHSA-3f7w-p8vr-4v5f, PYSEC-2026-492 | Critical | 1.4% | 24 Apr, 2024 | PyPI pyload-ng |
social-auth-app-django affected by Improper Handling of Case Sensitivity CVE-2024-32879, GHSA-2gr8-3wc7-xhj3, PYSEC-2026-1931 | Medium | 0.6% | 24 Apr, 2024 | PyPI social-auth-app-django |
Synapse V2 state resolution weakness allows Denial of Service (DoS) CVE-2024-31208, GHSA-3h7q-rfh9-xm4v, PYSEC-2024-50 | Medium | 1.5% | 23 Apr, 2024 | PyPI matrix-synapse |
cg vulnerable to an Open Redirect Vulnerability on Referer Header GHSA-w228-rfpx-fhm4 | Medium | Not scored | 23 Apr, 2024 | PyPI cg |
dbt uses a SQLparse version with a high vulnerability GHSA-p72q-h37j-3hq7 | High | Not scored | 22 Apr, 2024 | PyPI dbt-core |
OpenStack Storlets arbitrary code execution vulnerability CVE-2024-28717, GHSA-rfm2-f94j-qhjp, PYSEC-2026-1945 | High | 0.9% | 22 Apr, 2024 | PyPI storlets |
Improper Certificate Validation vulnerability in Apache Airflow FTP Provider CVE-2024-29733, GHSA-3gg8-mc87-cq3h, PYSEC-2026-1148 | Low | 0.6% | 21 Apr, 2024 | PyPI apache-airflow-providers-ftp |
Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbuffer_loader.cpp. BIT-pytorch-2024-31584, CVE-2024-31584, PYSEC-2024-250 | Medium | 0.4% | 19 Apr, 2024 | PyPI torch |
flask-cors vulnerable to log injection when the log level is set to debug CVE-2024-1681, GHSA-84pr-m4jr-85g5, PYSEC-2024-271 | Medium | 0.6% | 19 Apr, 2024 | PyPI flask-cors |
Sentry vulnerable to leaking superuser cleartext password in logs CVE-2024-32474, GHSA-6cjm-4pxw-7xp9, PYSEC-2026-1911 | High | 0.4% | 18 Apr, 2024 | PyPI sentry |
aiohttp Cross-site Scripting vulnerability on index pages for static file handling CVE-2024-27306, GHSA-7gpw-8wmc-pm8g, PYSEC-2026-1102 | Medium | 0.7% | 18 Apr, 2024 | PyPI aiohttp |
Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used BIT-airflow-2024-31869, CVE-2024-31869, GHSA-2522-mrjc-m688, PYSEC-2026-1128 | Medium | 1.1% | 18 Apr, 2024 | PyPI apache-airflow |
PyTorch heap buffer overflow vulnerability BIT-pytorch-2024-31580, CVE-2024-31580, GHSA-5pcm-hx3q-hm94, PYSEC-2024-252, PYSEC-2024-328 | High | 0.2% | 17 Apr, 2024 | PyPI torch PyPI torch-npu |
Pytorch use-after-free vulnerability BIT-pytorch-2024-31583, CVE-2024-31583, GHSA-pg7h-5qx3-wjr3, PYSEC-2024-251 | High | 0.3% | 17 Apr, 2024 | PyPI torch |
Keras code injection vulnerability CVE-2024-3660, GHSA-x4wf-678h-2pmq, PYSEC-2026-369 | Critical | 1.7% | 16 Apr, 2024 | PyPI keras |
Cross-site Scripting (XSS) in mindsdb/mindsdb CVE-2024-3575, GHSA-93c5-rj2p-w52x, PYSEC-2024-288 | Medium | 0.4% | 16 Apr, 2024 | PyPI mindsdb |
langchain vulnerable to path traversal CVE-2024-3571, GHSA-rgp8-pm28-3759, PYSEC-2026-1510 | High | 1.9% | 16 Apr, 2024 | PyPI langchain |
llama-index-core Command Injection vulnerability CVE-2024-3271, GHSA-r6gp-rff2-p3hf, PYSEC-2026-396 | Critical | 2.9% | 16 Apr, 2024 | PyPI llama-index-core |
mlflow vulnerable to Path Traversal BIT-mlflow-2024-3573, CVE-2024-3573, GHSA-hq88-wg7q-gp4g, PYSEC-2024-243 | Critical | 0.7% | 16 Apr, 2024 | PyPI mlflow |
Insecure deserialization in BentoML CVE-2024-2912, GHSA-hvj5-mvw9-93j3, PYSEC-2026-296 | Critical | 1.5% | 16 Apr, 2024 | PyPI bentoml |
Directory traversal in zenml CVE-2024-2083, GHSA-6h3f-43vq-53hj, PYSEC-2024-247 | Critical | 37.2% | 16 Apr, 2024 | PyPI zenml |
zenml Session Fixation vulnerability CVE-2024-2260, GHSA-g3r5-72hf-p7p2, PYSEC-2024-254 | Medium | 0.4% | 16 Apr, 2024 | PyPI zenml |
mlflow vulnerable to Path Traversal BIT-mlflow-2024-1594, CVE-2024-1594, GHSA-m49c-5c52-6696, PYSEC-2026-1655 | High | 0.7% | 16 Apr, 2024 | PyPI mlflow |
mlflow vulnerable to Path Traversal BIT-mlflow-2024-1593, CVE-2024-1593, GHSA-f42m-mvfv-cgw5, PYSEC-2026-1649 | High | 0.7% | 16 Apr, 2024 | PyPI mlflow |
gradio vulnerable to Path Traversal CVE-2024-1561, GHSA-g9cj-cfpp-4g2x, PYSEC-2026-1415 | High | 9.3% | 16 Apr, 2024 | PyPI gradio |
mlflow vulnerable to Path Traversal BIT-mlflow-2024-1560, CVE-2024-1560, GHSA-5mvj-wmgj-7q8c, PYSEC-2026-1641 | High | 0.9% | 16 Apr, 2024 | PyPI mlflow |
mlflow vulnerable to Path Traversal BIT-mlflow-2024-1558, CVE-2024-1558, GHSA-j62r-wxqq-f3gf, PYSEC-2026-1653 | High | 0.9% | 16 Apr, 2024 | PyPI mlflow |
mlflow Path Traversal vulnerability BIT-mlflow-2024-1483, CVE-2024-1483, GHSA-f82r-jj5r-6g97, PYSEC-2026-1650 | High | 2.7% | 16 Apr, 2024 | PyPI mlflow |
gradio Server-Side Request Forgery vulnerability CVE-2024-1183, GHSA-qh6x-j82h-vpf9, PYSEC-2026-1419 | Medium | 1.8% | 16 Apr, 2024 | PyPI gradio |
Request smuggling leading to endpoint restriction bypass in Gunicorn CVE-2024-1135, GHSA-w3h3-4rj7-4ph4, PYSEC-2026-1434 | High | 3.0% | 16 Apr, 2024 | PyPI gunicorn |
sqlparse parsing heavily nested list leads to Denial of Service CVE-2024-4340, GHSA-2m57-hf25-phgg, PYSEC-2026-1940 | High | 3.2% | 15 Apr, 2024 | PyPI sqlparse |
Pydantic regular expression denial of service CVE-2024-3772, GHSA-mr82-8j83-vxmv, PYSEC-2026-1812 | High | 1.0% | 15 Apr, 2024 | PyPI pydantic |
NiceGUI allows potential access to local file system CVE-2024-32005, GHSA-mwc7-64wg-pgvj, PYSEC-2026-1704 | High | 0.8% | 12 Apr, 2024 | PyPI nicegui |
OpenStack magnum vulnerable to time-of-check to time-of-use (TOCTOU) attack CVE-2024-28718, GHSA-jx7x-9r98-h5xr, PYSEC-2026-1602 | Critical | 1.1% | 12 Apr, 2024 | PyPI magnum |
Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode CVE-2024-3651, GHSA-jjg7-2v4v-x38h, PYSEC-2024-60 | High | 1.4% | 11 Apr, 2024 | PyPI idna |
Potential DoS via the Tudoor mechanism in eventlet and dnspython CVE-2023-29483, GHSA-3rq5-2g8h-59hc, PYSEC-2026-1307, PYSEC-2026-2472 | High | 1.9% | 11 Apr, 2024 | PyPI dnspython PyPI eventlet |