Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker CVE-2026-112939, GHSA-rfpc-qcw5-3pc4 | Medium | 0.1% | 9 days ago | PyPI filelock |
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name CVE-2026-112937, GHSA-jqc4-5cvw-7w85 | Medium | 0.2% | 9 days ago | PyPI filelock |
filelock: ReadWriteLock follows a symlink at the lock path into SQLite CVE-2026-112936, GHSA-j8f7-rjxc-mr56 | Medium | 0.2% | 9 days ago | PyPI filelock |
filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders CVE-2026-112935, GHSA-fq56-3cx3-fjxp | Medium | 0.1% | 9 days ago | PyPI filelock |
filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record CVE-2026-112934, GHSA-fj95-fr6c-h845 | Medium | 0.2% | 9 days ago | PyPI filelock |
filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout CVE-2026-112915, GHSA-cwqr-hh33-gh44 | Medium | 0.2% | 9 days ago | PyPI filelock |
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory CVE-2026-112914, GHSA-crv4-6mhj-j5jh | Medium | 0.2% | 9 days ago | PyPI filelock |
filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker CVE-2026-112912, GHSA-9j6q-wvj5-jgjg | Low | 0.2% | 9 days ago | PyPI filelock |
filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion CVE-2026-112911, GHSA-9c4x-gm8v-wgc4 | Medium | 0.1% | 9 days ago | PyPI filelock |
filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path CVE-2026-112909, GHSA-69hj-f68j-2879 | Medium | 0.2% | 9 days ago | PyPI filelock |
filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse CVE-2026-112906, GHSA-2g95-wg33-c5x2 | Medium | 0.2% | 9 days ago | PyPI filelock |
Malicious release: Malicious code in workalender (PyPI) MAL-2026-18096 | Malicious | Not scored | 9 days ago | PyPI workalender |
Malicious release: Malicious code in pafex (PyPI) MAL-2026-18094 | Malicious | Not scored | 9 days ago | PyPI pafex |
Malicious release: Malicious code in resion (PyPI) MAL-2026-18095 | Malicious | Not scored | 9 days ago | PyPI resion |
Malicious release: Malicious code in workcalender (PyPI) MAL-2026-18093 | Malicious | Not scored | 9 days ago | PyPI workcalender |
Malicious release: Malicious code in test-workalendar-internal (PyPI) MAL-2026-18092 | Malicious | Not scored | 9 days ago | PyPI test-workalendar-internal |
MLflow FileStore trace IDs allow path traversal and arbitrary file writes BIT-mlflow-2026-53995, CVE-2026-53995, GHSA-wqmh-qccw-pqwf | High | 0.6% | 10 days ago | PyPI mlflow |
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes BIT-pillow-2026-112901, CVE-2026-112901, GHSA-xgh8-jp6q-p5x8, PYSEC-2026-4335 | Medium | 0.5% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE BIT-pillow-2026-112900, CVE-2026-112900, GHSA-w889-685w-c8fh | Critical | 1.3% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Image.quantize() with empty palette leaks uninitialized stack memory BIT-pillow-2026-112898, CVE-2026-112898, GHSA-rfgq-q3w2-pmv2 | Medium | 0.3% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips BIT-pillow-2026-112897, CVE-2026-112897, GHSA-q45j-58j2-45rg | High | 0.5% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read BIT-pillow-2026-112896, CVE-2026-112896, GHSA-pchr-8j38-3x4p, PYSEC-2026-4334 | High | 0.5% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310) BIT-pillow-2026-112895, CVE-2026-112895, GHSA-p4wg-p73j-c528 | High | 0.6% | 10 days ago | PyPI pillow |
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) BIT-pillow-2026-112894, CVE-2026-112894, GHSA-jg86-v3jv-hrpm | High | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Invalid free in FreeType glyph rendering when a stroker is active BIT-pillow-2026-112893, CVE-2026-112893, GHSA-j4m9-6w36-pw47 | High | 0.5% | 10 days ago | PyPI pillow |
Pillow: MSP RLE decoder expands a tiny file into unbounded memory BIT-pillow-2026-112892, CVE-2026-112892, GHSA-gg2r-wvfm-q9rx | High | 0.5% | 10 days ago | PyPI pillow |
Pillow: Quadratic GIF comment copying during save BIT-pillow-2026-112891, CVE-2026-112891, GHSA-fc9g-5qg7-mf45 | Medium | 0.5% | 10 days ago | PyPI pillow |
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle BIT-pillow-2026-112406, CVE-2026-112406, GHSA-f2g6-542v-9j58 | High | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0 BIT-pillow-2026-112405, CVE-2026-112405, GHSA-cp9v-662q-vvx9, PYSEC-2026-4333 | High | 0.5% | 10 days ago | PyPI pillow |
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels BIT-pillow-2026-112404, CVE-2026-112404, GHSA-c6hw-5grf-ff96 | High | 0.4% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Heap buffer overflow in ImagingJpegDecode BIT-pillow-2026-112403, CVE-2026-112403, GHSA-8g5g-8vmr-9782, PYSEC-2026-4332 | Critical | 0.9% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform BIT-pillow-2026-112402, CVE-2026-112402, GHSA-7mwm-ghpf-9vrm, PYSEC-2026-4331 | High | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open() BIT-pillow-2026-112401, CVE-2026-112401, GHSA-74r2-7ff9-mjj2 | Medium | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS BIT-pillow-2026-112400, CVE-2026-112400, GHSA-65qm-jvmh-6pqg | High | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: APNG background disposal allocates full canvas before decompression bomb check BIT-pillow-2026-112399, CVE-2026-112399, GHSA-5xm2-6676-qcp9 | High | 0.5% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution BIT-pillow-2026-112398, CVE-2026-112398, GHSA-5x8w-8jj5-q52h, PYSEC-2026-4330 | Critical | 0.7% | 10 days ago | PyPI pillow |
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image BIT-pillow-2026-112397, CVE-2026-112397, GHSA-58r4-6rv3-gfh8, PYSEC-2026-4329 | High | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer BIT-pillow-2026-112396, CVE-2026-112396, GHSA-4rr5-89j8-mwwm, PYSEC-2026-4328 | High | 0.7% | 10 days ago | PyPI pillow |
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images BIT-pillow-2026-112392, CVE-2026-112392, GHSA-27h8-gf7j-v5hc, PYSEC-2026-4326 | High | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Malicious release: Malicious code in asurion (PyPI) MAL-2026-18045 | Malicious | Not scored | 10 days ago | PyPI asurion |
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290) BIT-pillow-2026-112395, CVE-2026-112395, GHSA-462x-pgg6-55fp | High | 0.5% | 10 days ago | PyPI pillow |
Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size BIT-pillow-2026-112394, CVE-2026-112394, GHSA-4558-3h8r-v8xp, PYSEC-2026-4327 | Medium | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO BIT-pillow-2026-112393, CVE-2026-112393, GHSA-332p-7hrc-92wf | Critical | 1.0% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree() BIT-pillow-2026-112391, CVE-2026-112391, GHSA-254f-3936-288h | Medium | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Infinite loop in MIC n_frames when the embedded TIFF BIT-pillow-2026-112390, CVE-2026-112390, GHSA-22hg-r758-rrw9 | High | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
AIOHTTP: Pure-Python parser request smuggling CVE-2026-111750, GHSA-pqxq-w44r-73xw | Medium | 0.4% | 10 days ago | PyPI aiohttp |
AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies CVE-2026-111749, GHSA-gx76-c99x-2c96 | Low | 0.4% | 10 days ago | PyPI aiohttp |
AIOHTTP: Absolute-form request targets can spoof Request.scheme CVE-2026-111748, GHSA-f9xw-jh8m-3mwq | Medium | 0.4% | 10 days ago | PyPI aiohttp |
AIOHTTP: File descriptor exhaustion in multipart requests CVE-2026-111066, GHSA-9xw5-w5jj-pvcg | High | 0.4% | 10 days ago | PyPI aiohttp |
AIOHTTP: Connector pool exhaustion via Max-Age overflow CVE-2026-111065, GHSA-6cjc-53gc-5rqm | Medium | 0.4% | 10 days ago | PyPI aiohttp |