Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in bittensor-burn-watch (PyPI) MAL-2026-5292 | Malicious | Not scored | 07 Jun, 2026 | PyPI bittensor-burn-watch |
Malicious release: Malicious code in clip-logger (PyPI) MAL-2026-5293 | Malicious | Not scored | 07 Jun, 2026 | PyPI clip-logger |
Malicious release: Malicious code in dynamo-release (PyPI) MAL-2026-5274, PYSEC-2026-581 | Malicious | Not scored | 06 Jun, 2026 | PyPI dynamo-release |
Malicious release: Malicious code in napari-ufish (PyPI) MAL-2026-5275, PYSEC-2026-604 | Malicious | Not scored | 06 Jun, 2026 | PyPI napari-ufish |
Malicious release: Malicious code in nucbox (PyPI) MAL-2026-5276, PYSEC-2026-605 | Malicious | Not scored | 06 Jun, 2026 | PyPI nucbox |
Malicious release: Malicious code in pantheon-toolsets (PyPI) MAL-2026-5277, PYSEC-2026-608 | Malicious | Not scored | 06 Jun, 2026 | PyPI pantheon-toolsets |
Malicious release: Malicious code in spateo-release (PyPI) MAL-2026-5278, PYSEC-2026-585 | Malicious | Not scored | 06 Jun, 2026 | PyPI spateo-release |
Malicious release: Malicious code in uprobe (PyPI) MAL-2026-5279, PYSEC-2026-611 | Malicious | Not scored | 06 Jun, 2026 | PyPI uprobe |
Malicious release: Malicious code in bramin (PyPI) MAL-2026-5280, PYSEC-2026-578 | Malicious | Not scored | 06 Jun, 2026 | PyPI bramin |
Malicious release: Malicious code in executor-http (PyPI) MAL-2026-5281, PYSEC-2026-590 | Malicious | Not scored | 06 Jun, 2026 | PyPI executor-http |
Malicious release: Malicious code in mrbios (PyPI) MAL-2026-5282, PYSEC-2026-594 | Malicious | Not scored | 06 Jun, 2026 | PyPI mrbios |
Malicious release: Malicious code in okite (PyPI) MAL-2026-5283, PYSEC-2026-606 | Malicious | Not scored | 06 Jun, 2026 | PyPI okite |
Malicious release: Malicious code in synago (PyPI) MAL-2026-5284, PYSEC-2026-609 | Malicious | Not scored | 06 Jun, 2026 | PyPI synago |
Malicious release: Malicious code in ufish (PyPI) MAL-2026-5285, PYSEC-2026-610 | Malicious | Not scored | 06 Jun, 2026 | PyPI ufish |
Malicious release: Malicious code in cmd2func (PyPI) MAL-2026-5290, PYSEC-2026-579 | Malicious | Not scored | 06 Jun, 2026 | PyPI cmd2func |
Malicious release: Malicious code in magique-ai (PyPI) MAL-2026-5294, PYSEC-2026-593 | Malicious | Not scored | 06 Jun, 2026 | PyPI magique-ai |
Malicious release: Malicious code in coolbox (PyPI) MAL-2026-5295, PYSEC-2026-580 | Malicious | Not scored | 06 Jun, 2026 | PyPI coolbox |
Malicious release: Malicious code in magique (PyPI) MAL-2026-5296, PYSEC-2026-592 | Malicious | Not scored | 06 Jun, 2026 | PyPI magique |
Malicious release: Malicious code in executor-engine (PyPI) MAL-2026-5298, PYSEC-2026-589 | Malicious | Not scored | 06 Jun, 2026 | PyPI executor-engine |
Malicious release: Malicious code in pantheon-agents (PyPI) MAL-2026-5299, PYSEC-2026-607 | Malicious | Not scored | 06 Jun, 2026 | PyPI pantheon-agents |
Malicious release: Malicious code in funcdesc (PyPI) MAL-2026-5300, PYSEC-2026-591 | Malicious | Not scored | 06 Jun, 2026 | PyPI funcdesc |
Malicious release: Malicious code in mflux-streamlit (PyPI) MAL-2026-5301, PYSEC-2026-582 | Malicious | Not scored | 06 Jun, 2026 | PyPI mflux-streamlit |
Malicious release: Malicious code in dreamgen (PyPI) MAL-2026-5313, PYSEC-2026-1068 | Malicious | Not scored | 06 Jun, 2026 | PyPI dreamgen |
Malicious release: Malicious code in embiggen (PyPI) MAL-2026-5314, PYSEC-2026-231 | Malicious | Not scored | 06 Jun, 2026 | PyPI embiggen |
Malicious release: Malicious code in ensmallen (PyPI) MAL-2026-5315, PYSEC-2026-232 | Malicious | Not scored | 06 Jun, 2026 | PyPI ensmallen |
Malicious release: Malicious code in gpsea (PyPI) MAL-2026-5316, PYSEC-2026-233 | Malicious | Not scored | 06 Jun, 2026 | PyPI gpsea |
Malicious release: Malicious code in instructor-mcp (PyPI) MAL-2026-5317, PYSEC-2026-1069 | Malicious | Not scored | 06 Jun, 2026 | PyPI instructor-mcp |
Malicious release: Malicious code in langchain-core-mcp (PyPI) MAL-2026-5318, PYSEC-2026-1070 | Malicious | Not scored | 06 Jun, 2026 | PyPI langchain-core-mcp |
Malicious release: Malicious code in mem8 (PyPI) MAL-2026-5319, PYSEC-2026-1071 | Malicious | Not scored | 06 Jun, 2026 | PyPI mem8 |
Malicious release: Malicious code in orchestr8-platform (PyPI) MAL-2026-5321, PYSEC-2026-1073 | Malicious | Not scored | 06 Jun, 2026 | PyPI orchestr8-platform |
Malicious release: Malicious code in phenopacket-store-toolkit (PyPI) MAL-2026-5322, PYSEC-2026-234 | Malicious | Not scored | 06 Jun, 2026 | PyPI phenopacket-store-toolkit |
Malicious release: Malicious code in ppkt2synergy (PyPI) MAL-2026-5323, PYSEC-2026-235 | Malicious | Not scored | 06 Jun, 2026 | PyPI ppkt2synergy |
Malicious release: Malicious code in pyphetools (PyPI) MAL-2026-5324, PYSEC-2026-236 | Malicious | Not scored | 06 Jun, 2026 | PyPI pyphetools |
Malicious release: Malicious code in ray-mcp-server (PyPI) MAL-2026-5325, PYSEC-2026-1074 | Malicious | Not scored | 06 Jun, 2026 | PyPI ray-mcp-server |
Malicious release: Malicious code in anthropy (PyPI) MAL-2026-5273 | Malicious | Not scored | 05 Jun, 2026 | PyPI anthropy |
Bugsink: DOS using large numbers of event tags CVE-2026-53954, GHSA-5x67-j5xg-c5gj, PYSEC-2026-2403 | Medium | 0.6% | 05 Jun, 2026 | PyPI bugsink |
Malicious release: Malicious code in goodoltoulas (PyPI) MAL-2026-5272 | Malicious | Not scored | 05 Jun, 2026 | PyPI goodoltoulas |
NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker) CVE-2026-47731, GHSA-p462-prxw-mjx4, PYSEC-2026-265 | Critical | 0.9% | 05 Jun, 2026 | PyPI ait-core |
Malicious release: Malicious code in goodoldtoulas (PyPI) MAL-2026-5271 | Malicious | Not scored | 05 Jun, 2026 | PyPI goodoldtoulas |
vantage6 node has an Improper Access Control issue CVE-2026-54533, GHSA-x9f6-9rvm-mmrg, PYSEC-2026-3401 | Medium | 0.3% | 05 Jun, 2026 | PyPI vantage6 |
Vantage6: Set admin user and password from environment or configuration CVE-2026-54445, GHSA-fgmc-2hqj-86v4, PYSEC-2026-3400 | Medium | 0.3% | 05 Jun, 2026 | PyPI vantage6 |
praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR CVE-2026-47419, GHSA-7p8g-6c6g-h9w7, PYSEC-2026-2931 | High | 0.3% | 05 Jun, 2026 | PyPI praisonai-platform |
Vantage6: 2FA can be circumvented with hacked email access CVE-2024-27928, GHSA-4c5c-2vc3-x5w2, PYSEC-2026-3398 | Medium | 0.3% | 05 Jun, 2026 | PyPI vantage6 |
Vantage6: No limit on emails sent for password/MFA reset CVE-2024-24769, GHSA-5549-c5q7-fj65, PYSEC-2026-3399 | Low | 0.3% | 05 Jun, 2026 | PyPI vantage6 |
sanic-cors contains an improper regular expression in the try_match() function CVE-2026-37737, GHSA-94jw-hqvj-vw74, PYSEC-2026-3539 | Medium | 0.2% | 05 Jun, 2026 | PyPI sanic-cors |
ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution CVE-2026-11332, GHSA-w8p5-mx5w-cpqj, PYSEC-2026-3458 | High | 0.2% | 05 Jun, 2026 | PyPI ansible-core |
bytedance InfiniStore: Denial of Service via Non-Cryptographic Hashing in InfiniStore KV Map CVE-2026-11312, GHSA-2vrg-7rqv-prf9, PYSEC-2026-3469 | Low | 0.1% | 05 Jun, 2026 | PyPI infinistore |
OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash CVE-2026-50589, GHSA-q3g8-rjrx-59ph, PYSEC-2026-216 | High | 0.4% | 05 Jun, 2026 | PyPI ironic |
MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper CVE-2026-47708, GHSA-4p62-hqp5-g644, PYSEC-2026-544 | Critical | 0.4% | 04 Jun, 2026 | PyPI stata-mcp |
kas's late signature validation may allow unnoticed repository manipulations CVE-2026-47192, GHSA-4vqc-wpwg-vh7j, PYSEC-2026-2543 | Low | 0.3% | 04 Jun, 2026 | PyPI kas |