Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
vLLM Denial of Service via the best_of parameter CVE-2024-8939, GHSA-wc36-9694-f9rf, PYSEC-2026-2025 | Medium | 0.2% | 17 Sep, 2024 | PyPI vllm |
Composio Path Traversal vulnerability CVE-2024-8865, GHSA-66r2-xm28-74w9, PYSEC-2026-1265 | Medium | 0.9% | 15 Sep, 2024 | PyPI composio-core |
Composio Code Injection Vulnerability CVE-2024-8864, GHSA-mrmh-3hqh-pfw7, PYSEC-2026-1266 | Medium | 0.8% | 15 Sep, 2024 | PyPI composio-core |
Aim Stored XSS through TEXT EXPLORER CVE-2024-8863, GHSA-pmhg-f7wc-c97m, PYSEC-2026-1093 | Medium | 0.5% | 14 Sep, 2024 | PyPI aim |
D-Tale Command Execution Vulnerability CVE-2024-8862, GHSA-fg5m-m723-7mv6, PYSEC-2026-1321 | Medium | 1.3% | 14 Sep, 2024 | PyPI dtale |
MindsDB Cross-site Scripting vulnerability CVE-2024-45856, GHSA-32fj-r8qw-r8w8, PYSEC-2026-1628 | Medium | 0.5% | 12 Sep, 2024 | PyPI mindsdb |
Sensitive Information Exposure Through Insecure Logging For Secrets Like Metadata.DockerBuildArgs GHSA-rjc6-vm4h-85cg | Medium | Not scored | 11 Sep, 2024 | PyPI aws-sam-cli |
AWS SageMaker Training Toolkit logs CodeArtifact Authorization token GHSA-635v-pc42-fr74 | Medium | Not scored | 11 Sep, 2024 | PyPI sagemaker-training |
HTML injection in JupyterLite leading to DOM Clobbering GHSA-gj55-2xf9-67rq | Medium | Not scored | 06 Sep, 2024 | PyPI jupyterlite-core |
Indico has a Cross-Site-Scripting during account creation CVE-2024-45399, GHSA-rrqf-w74j-24ff, PYSEC-2024-90 | Medium | 0.4% | 04 Sep, 2024 | PyPI indico |
Flask-AppBuilder's login form allows browser to cache sensitive fields CVE-2024-45314, GHSA-fw5r-6m3x-rh7p, PYSEC-2026-1382 | Medium | 0.3% | 04 Sep, 2024 | PyPI flask-appbuilder |
Timing-Based Username Enumeration Vulnerability in Fides Webserver Authentication CVE-2024-45052, GHSA-2h46-8gf5-fmxv, PYSEC-2026-1331 | Medium | 0.6% | 04 Sep, 2024 | PyPI ethyca-fides |
pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels GHSA-h4gh-qq45-vh27 | Medium | Not scored | 03 Sep, 2024 | PyPI cryptography |
Adyen APIs Library for Python timing attack vulnerability GHSA-f3q4-ggfp-jv34 | Medium | Not scored | 30 Aug, 2024 | PyPI Adyen PyPI adyen |
Taipy has a Session Cookie without Secure and HTTPOnly flags CVE-2024-47833, GHSA-r3jq-4r5c-j9hp, PYSEC-2024-168 | Medium | 0.3% | 27 Aug, 2024 | PyPI taipy |
FastAPI Admin Cross-site Scripting vulnerability in the Config-Create function CVE-2024-42818, GHSA-grqx-r2q2-j425, PYSEC-2026-1357 | Medium | 0.3% | 26 Aug, 2024 | PyPI fastapi-admin |
FastAPI Admin cross-site scripting (XSS) vulnerability in the Create Product function CVE-2024-42816, GHSA-22xm-w7r2-834q, PYSEC-2026-1356 | Medium | 0.3% | 26 Aug, 2024 | PyPI fastapi-admin |
Mage AI Path Traversal vulnerability CVE-2024-45190, GHSA-4mrc-w7jh-hx4j, PYSEC-2026-1597 | Medium | 0.9% | 23 Aug, 2024 | PyPI mage-ai |
Mage AI Path Traversal vulnerability CVE-2024-45189, GHSA-cgxv-795x-3vqr, PYSEC-2026-1599 | Medium | 0.9% | 23 Aug, 2024 | PyPI mage-ai |
Mage AI Path Traversal vulnerability CVE-2024-45188, GHSA-v9wr-8wrm-h6p7, PYSEC-2026-1601 | Medium | 0.9% | 23 Aug, 2024 | PyPI mage-ai |
Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users CVE-2024-8072, GHSA-cgrq-wvfj-v28j, PYSEC-2026-1598 | Medium | 0.6% | 22 Aug, 2024 | PyPI mage-ai |
Apache Airflow Cross-site Scripting Vulnerability BIT-airflow-2024-41937, CVE-2024-41937, GHSA-w7cp-g8v7-r54m, PYSEC-2024-181 | Medium | 1.7% | 21 Aug, 2024 | PyPI apache-airflow |
Potential access to sensitive URLs via CKAN extensions (SSRF) CVE-2024-43371, GHSA-g9ph-j5vj-f8wm, PYSEC-2026-1252 | Medium | 0.4% | 21 Aug, 2024 | PyPI ckan |
CKAN has Cross-site Scripting vector in the Datatables view plugin CVE-2024-41675, GHSA-r3jc-vhf4-6v32, PYSEC-2026-1253 | Medium | 0.4% | 21 Aug, 2024 | PyPI ckan |
CKAN may leak Solr credentials via error message in package_search action CVE-2024-41674, GHSA-2rqw-cfhc-35fh, PYSEC-2026-1248 | Medium | 0.4% | 21 Aug, 2024 | PyPI ckan |
Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature) CVE-2024-43396, GHSA-cf72-vg59-4j4h, PYSEC-2026-1492 | Medium | 0.5% | 20 Aug, 2024 | PyPI khoj |
WebOb's location header normalization during redirect leads to open redirect CVE-2024-42353, GHSA-mg3v-6m49-jhp3, PYSEC-2024-188 | Medium | 0.6% | 14 Aug, 2024 | PyPI webob |
Path traveral in Streamlit on windows CVE-2024-42474, GHSA-rxff-vr5r-8cj5, PYSEC-2024-153 | Medium | 0.6% | 12 Aug, 2024 | PyPI streamlit |
In aiohttp, compressed files as symlinks are not protected from path traversal CVE-2024-42367, GHSA-jwhx-xcg6-8xhj, PYSEC-2026-1108 | Medium | 0.7% | 09 Aug, 2024 | PyPI aiohttp |
Open WebUI Stored Cross-Site Scripting Vulnerability CVE-2024-6706, GHSA-5jp3-wp5v-5363, PYSEC-2026-1722 | Medium | 0.7% | 07 Aug, 2024 | PyPI open-webui |
openstack-heat may disclose sensitive information CVE-2024-7319, GHSA-2fqr-cx7q-3ph8, PYSEC-2026-1750 | Medium | 0.4% | 02 Aug, 2024 | PyPI openstack-heat |
MobSF vulnerable to Open Redirect in Login Redirect CVE-2024-41955, GHSA-8m9j-2f32-2vx4, PYSEC-2026-1669 | Medium | 1.0% | 31 Jul, 2024 | PyPI mobsf |
PheonixAppAPI has visible Encoding Maps CVE-2024-41951, GHSA-258h-f687-4226, PYSEC-2026-1779 | Medium | 0.2% | 31 Jul, 2024 | PyPI PheonixAppAPI PyPI pheonixappapi |
Aim Stored Cross-site Scripting Vulnerability CVE-2024-6578, GHSA-p9f2-jg9w-cx69, PYSEC-2026-1092 | Medium | 0.3% | 29 Jul, 2024 | PyPI aim |
Twisted vulnerable to HTML injection in HTTP redirect body CVE-2024-41810, GHSA-cf56-g6w6-pqq2, PYSEC-2024-75 | Medium | 1.2% | 29 Jul, 2024 | PyPI twisted |
OpenStack Nova vulnerable to unauthorized access to potentially sensitive data CVE-2024-40767, GHSA-rm86-h44c-2r2m, PYSEC-2026-1709 | Medium | 0.9% | 24 Jul, 2024 | PyPI Nova PyPI nova |
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command CVE-2024-41129, GHSA-hcmv-jmqh-fjgm, PYSEC-2026-1753 | Medium | 0.2% | 22 Jul, 2024 | PyPI ops |
Ankitects Anki LaTeX Blocklist Bypass vulnerability CVE-2024-32152, GHSA-q47p-v5rw-v574, PYSEC-2026-1117 | Medium | 12.3% | 22 Jul, 2024 | PyPI anki |
Anki Latex Incomplete Blocklist Vulnerability CVE-2024-29073, GHSA-x3r6-ccvq-cf5v, PYSEC-2026-1118 | Medium | 11.8% | 22 Jul, 2024 | PyPI anki |
Calibre-Web Cross Site Scripting (XSS) CVE-2024-39123, GHSA-j22r-3rf3-cv25, PYSEC-2026-1230 | Medium | 23.1% | 19 Jul, 2024 | PyPI calibreweb |
[PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS` CVE-2024-41124, GHSA-rwcj-7jjp-4w38, PYSEC-2026-1809 | Medium | 0.3% | 19 Jul, 2024 | PyPI puncia |
Sentry's Python SDK unintentionally exposes environment variables to subprocesses CVE-2024-40647, GHSA-g92j-qhmh-64v2, PYSEC-2026-1917 | Medium | 0.2% | 18 Jul, 2024 | PyPI sentry-sdk |
Roundup Cross-site Scripting Vulnerability CVE-2024-39124, GHSA-w8vc-cwv9-wx67, PYSEC-2024-63 | Medium | 0.3% | 17 Jul, 2024 | PyPI roundup |
Roundup Cross-site Scripting Vulnerability CVE-2024-39125, GHSA-xjgw-ghrx-wfff, PYSEC-2024-64 | Medium | 0.3% | 17 Jul, 2024 | PyPI roundup |
Roundup Cross-site Scripting Vulnerability CVE-2024-39126, GHSA-x37x-qf4v-f54f, PYSEC-2024-65 | Medium | 0.3% | 17 Jul, 2024 | PyPI roundup |
BlastRADIUS also affects eduMFA GHSA-vhmj-5q9r-mm9g | Medium | Not scored | 17 Jul, 2024 | PyPI edumfa |
Apache StreamPipes potentially allows creation of multiple identical accounts CVE-2024-30471, GHSA-2qph-v9p2-q2gv, PYSEC-2024-172 | Medium | 0.7% | 17 Jul, 2024 | Maven org.apache.streampipes:streampipes-parent PyPI streampipes |
Apache StreamPipes has possibility of SSRF in pipeline element installation process CVE-2024-31979, GHSA-9gr7-gh74-qg9x, PYSEC-2024-174 | Medium | 0.7% | 17 Jul, 2024 | Maven org.apache.streampipes:streampipes-parent PyPI streampipes |
Apache Airflow Potential Cross-site Scripting Vulnerability BIT-airflow-2024-39863, CVE-2024-39863, GHSA-j482-47xf-p25c, PYSEC-2024-189 | Medium | 1.0% | 17 Jul, 2024 | PyPI apache-airflow |
OpaMiddleware does not filter HTTP OPTIONS requests CVE-2024-40627, GHSA-5f5c-8rvc-j8wf, PYSEC-2026-1361 | Medium | 0.6% | 15 Jul, 2024 | PyPI fastapi-opa |