Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in timestamp-py (PyPI) MAL-2026-3136 | Malicious | Not scored | 28 Apr, 2026 | PyPI timestamp-py |
Malicious release: Malicious code in timemcp-py (PyPI) MAL-2026-3134 | Malicious | Not scored | 28 Apr, 2026 | PyPI timemcp-py |
NVIDIA NVFlare Dashboard: Authorization bypass through user-controlled key via user management and authentication system CVE-2026-24178, GHSA-jqp3-qrgh-4846, PYSEC-2026-100 | Critical | 0.6% | 28 Apr, 2026 | PyPI nvflare |
Malicious release: Malicious code in fetchapi-syncdata-pypi (PyPI) MAL-2026-3133 | Malicious | Not scored | 28 Apr, 2026 | PyPI fetchapi-syncdata-pypi |
Malicious release: Malicious code in timemcp (PyPI) MAL-2026-3132 | Malicious | Not scored | 28 Apr, 2026 | PyPI timemcp |
Malicious release: Malicious code in kcvlib (PyPI) MAL-2026-3131 | Malicious | Not scored | 28 Apr, 2026 | PyPI kcvlib |
Malicious release: Malicious code in genmedia-izumi-agent (PyPI) MAL-2026-3130 | Malicious | Not scored | 28 Apr, 2026 | PyPI genmedia-izumi-agent |
Malicious release: Malicious code in coloreasyprint (PyPI) MAL-2026-3127 | Malicious | Not scored | 28 Apr, 2026 | PyPI coloreasyprint |
OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere CVE-2026-42510, GHSA-wqpv-c3pp-3m58, PYSEC-2026-2525 | High | 0.6% | 28 Apr, 2026 | PyPI ironic |
notes-mcp has a Path Traversal issue CVE-2026-7212, GHSA-vc5j-42hh-j3mr, PYSEC-2026-2684 | Medium | 0.4% | 28 Apr, 2026 | PyPI notes-mcp |
sqlite-mcp has an Injection issue CVE-2026-7206, GHSA-4j28-22qp-rjcf, PYSEC-2026-3074 | Medium | 0.3% | 28 Apr, 2026 | PyPI sqlite-mcp |
mkdocs-mcp-plugin has a Path Traversal issue CVE-2026-7159, GHSA-wfr3-hf93-qgg3, PYSEC-2026-2653 | Medium | 0.4% | 27 Apr, 2026 | PyPI mkdocs-mcp-plugin |
Malicious release: Malicious code in mypypipkg (PyPI) MAL-2026-3105 | Malicious | Not scored | 27 Apr, 2026 | PyPI mypypipkg |
mcp-url-downloader has a Server-Side Request Forgery issue CVE-2026-7158, GHSA-h7xc-4mv8-59fj, PYSEC-2026-2631 | Medium | 0.3% | 27 Apr, 2026 | PyPI mcp-url-downloader |
auto-favicon has a Server-Side Request Forgery issue CVE-2026-7150, GHSA-vmh7-9c7h-2pgg, PYSEC-2026-2386 | Low | 0.2% | 27 Apr, 2026 | PyPI auto-favicon |
kaggle-mcp has a Path Traversal issue CVE-2026-7149, GHSA-q882-jc55-6343, PYSEC-2026-2542 | Medium | 0.4% | 27 Apr, 2026 | PyPI kaggle-mcp |
Malicious release: Malicious code in robase-ui (PyPI) MAL-2026-3104 | Malicious | Not scored | 27 Apr, 2026 | PyPI robase-ui |
Wooey has an Incorrect Privilege Assignment issue CVE-2026-7142, GHSA-w65c-cmxj-qrhm, PYSEC-2026-3427 | Low | 0.2% | 27 Apr, 2026 | PyPI wooey |
vLLM makes Use of Uninitialized Resource CVE-2026-7141, GHSA-x368-4g9h-fvv4, PYSEC-2026-2306 | Low | 0.3% | 27 Apr, 2026 | PyPI vllm |
Malicious release: Malicious code in fetch-data-api-syncapi (PyPI) MAL-2026-3100 | Malicious | Not scored | 27 Apr, 2026 | PyPI fetch-data-api-syncapi |
pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere CVE-2026-6357, GHSA-jp4c-xjxw-mgf9, PYSEC-2026-2876 | Medium | 0.1% | 27 Apr, 2026 | PyPI pip |
Malicious release: Malicious code in bytedaaa (PyPI) MAL-2026-3085 | Malicious | Not scored | 27 Apr, 2026 | PyPI bytedaaa |
Malicious release: Malicious code in bytedecs (PyPI) MAL-2026-3090 | Malicious | Not scored | 27 Apr, 2026 | PyPI bytedecs |
Malicious release: Malicious code in bytedvke (PyPI) MAL-2026-3098 | Malicious | Not scored | 27 Apr, 2026 | PyPI bytedvke |
Malicious release: Malicious code in bytedark (PyPI) MAL-2026-3087 | Malicious | Not scored | 27 Apr, 2026 | PyPI bytedark |
Malicious release: Malicious code in bytedai (PyPI) MAL-2026-3086 | Malicious | Not scored | 27 Apr, 2026 | PyPI bytedai |
Malicious release: Malicious code in bytedmlp (PyPI) MAL-2026-3093 | Malicious | Not scored | 27 Apr, 2026 | PyPI bytedmlp |
Malicious release: Malicious code in bytedvefaas (PyPI) MAL-2026-3097 | Malicious | Not scored | 27 Apr, 2026 | PyPI bytedvefaas |
Malicious release: Malicious code in bytedfaas (PyPI) MAL-2026-3091 | Malicious | Not scored | 27 Apr, 2026 | PyPI bytedfaas |
Malicious release: Malicious code in bytedclaw (PyPI) MAL-2026-3089 | Malicious | Not scored | 27 Apr, 2026 | PyPI bytedclaw |
Malicious release: Malicious code in byteclaw (PyPI) MAL-2026-3084 | Malicious | Not scored | 27 Apr, 2026 | PyPI byteclaw |
Malicious release: Malicious code in bytedvod (PyPI) MAL-2026-3099 | Malicious | Not scored | 27 Apr, 2026 | PyPI bytedvod |
Malicious release: Malicious code in bytedpymysql (PyPI) MAL-2026-3095 | Malicious | Not scored | 27 Apr, 2026 | PyPI bytedpymysql |
Malicious release: Malicious code in bytedbackground (PyPI) MAL-2026-3088 | Malicious | Not scored | 27 Apr, 2026 | PyPI bytedbackground |
Malicious release: Malicious code in bytedtccc (PyPI) MAL-2026-3096 | Malicious | Not scored | 27 Apr, 2026 | PyPI bytedtccc |
Malicious release: Malicious code in bytedmem (PyPI) MAL-2026-3092 | Malicious | Not scored | 27 Apr, 2026 | PyPI bytedmem |
Malicious release: Malicious code in bytedpgsql (PyPI) MAL-2026-3094 | Malicious | Not scored | 27 Apr, 2026 | PyPI bytedpgsql |
Malicious release: Malicious code in robase-fast-install (PyPI) MAL-2026-3050 | Malicious | Not scored | 26 Apr, 2026 | PyPI robase-fast-install |
Malicious release: Malicious code in robase-gui-api (PyPI) MAL-2026-3048 | Malicious | Not scored | 26 Apr, 2026 | PyPI robase-gui-api |
Malicious release: Malicious code in robase-gui (PyPI) MAL-2026-3047 | Malicious | Not scored | 26 Apr, 2026 | PyPI robase-gui |
Malicious release: Malicious code in swisscom-ai-research-keyphrase (PyPI) MAL-2026-3046 | Malicious | Not scored | 26 Apr, 2026 | PyPI swisscom-ai-research-keyphrase |
Malicious release: Malicious code in quicktestybesty (PyPI) MAL-2026-3045 | Malicious | Not scored | 26 Apr, 2026 | PyPI quicktestybesty |
GitPython has Command Injection via Git options bypass CVE-2026-42215, GHSA-rpm5-65cw-6hj4, PYSEC-2026-2160 | High | 0.7% | 25 Apr, 2026 | PyPI GitPython PyPI gitpython |
GitPython: Unsafe option check validates multi_options before shlex.split transformation CVE-2026-42284, GHSA-x2qx-6953-8485, PYSEC-2026-2161 | Critical | 0.6% | 25 Apr, 2026 | PyPI GitPython PyPI gitpython |
LiteLLM: Authenticated command execution via MCP stdio test endpoints CVE-2026-42271, GHSA-v4p8-mg3p-g94g, PYSEC-2026-2599 | HighExploited | 91.4% | 25 Apr, 2026 | PyPI litellm |
Malicious release: Malicious code in quicksolving (PyPI) MAL-2026-3044 | Malicious | Not scored | 25 Apr, 2026 | PyPI quicksolving |
Malicious release: Malicious code in rosolver (PyPI) MAL-2026-3043 | Malicious | Not scored | 25 Apr, 2026 | PyPI rosolver |
Malicious release: Malicious code in pycolorlib001 (PyPI) MAL-2026-3042 | Malicious | Not scored | 25 Apr, 2026 | PyPI pycolorlib001 |
Malicious release: Malicious code in robase-library-quick-install (PyPI) MAL-2026-3041 | Malicious | Not scored | 25 Apr, 2026 | PyPI robase-library-quick-install |
AstrBot has Incomplete Filtering of Special Elements CVE-2026-6984, GHSA-h3rr-9wqj-v3c6, PYSEC-2026-2381 | Low | 0.3% | 25 Apr, 2026 | PyPI AstrBot PyPI astrbot |