Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in chainutils (PyPI) MAL-2026-2820 | Malicious | Not scored | 16 Apr, 2026 | PyPI chainutils |
Malicious release: Malicious code in pynosist (PyPI) MAL-2026-2819 | Malicious | Not scored | 16 Apr, 2026 | PyPI pynosist |
Malicious release: Malicious code in genosys (PyPI) MAL-2026-2818 | Malicious | Not scored | 16 Apr, 2026 | PyPI genosys |
Apache Airflow: JWT token appearing in logs BIT-airflow-2026-31987, CVE-2026-31987, GHSA-phv5-vq5p-qhp7, PYSEC-2026-2352 | High | 0.7% | 16 Apr, 2026 | PyPI apache-airflow |
Malicious release: Malicious code in emergentintegrations (PyPI) MAL-2026-2702 | Malicious | Not scored | 16 Apr, 2026 | PyPI emergentintegrations |
Malicious release: Malicious code in requests-test-test44 (PyPI) MAL-2026-2812 | Malicious | Not scored | 16 Apr, 2026 | PyPI requests-test-test44 |
Malicious release: Malicious code in requests-testik11 (PyPI) MAL-2026-2813 | Malicious | Not scored | 16 Apr, 2026 | PyPI requests-testik11 |
Malicious release: Malicious code in requests-test-test2 (PyPI) MAL-2026-2810 | Malicious | Not scored | 16 Apr, 2026 | PyPI requests-test-test2 |
Malicious release: Malicious code in requests-test-test3 (PyPI) MAL-2026-2811 | Malicious | Not scored | 16 Apr, 2026 | PyPI requests-test-test3 |
Malicious release: Malicious code in bombonsec-test-123 (PyPI) MAL-2026-2809 | Malicious | Not scored | 16 Apr, 2026 | PyPI bombonsec-test-123 |
Malicious release: Malicious code in robase-api (PyPI) MAL-2026-2699 | Malicious | Not scored | 16 Apr, 2026 | PyPI robase-api |
wger has Stored XSS via Unescaped License Attribution Fields CVE-2026-40353, GHSA-6f54-qjvm-wwq3, PYSEC-2026-3419 | Medium | 0.2% | 16 Apr, 2026 | PyPI wger |
wger has Broken Access Control in Global Gym Configuration Update Endpoint CVE-2026-40474, GHSA-xppv-4jrx-qf8m, PYSEC-2026-3424 | High | 0.3% | 16 Apr, 2026 | PyPI wger |
UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen CVE-2026-54334, GHSA-hm2w-vr2p-hq7w, PYSEC-2026-3394 | Critical | 0.8% | 16 Apr, 2026 | PyPI uefi-firmware |
UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable CVE-2026-54333, GHSA-2689-5p89-6j3j, PYSEC-2026-3393 | Critical | 0.8% | 16 Apr, 2026 | PyPI uefi-firmware |
pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition) CVE-2026-40594, GHSA-mp82-fmj6-f22v, PYSEC-2026-125 | Medium | 0.2% | 16 Apr, 2026 | PyPI pyload-ng |
LangSmith SDK: Streaming token events bypass output redaction CVE-2026-41182, GHSA-rr7j-v2q5-chgv, PYSEC-2026-2583 | Medium | 0.2% | 16 Apr, 2026 | PyPI langsmith npm langsmith |
PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code CVE-2026-41206, GHSA-vp22-38m5-r39r, PYSEC-2026-3031 | Medium | 0.2% | 16 Apr, 2026 | PyPI pyspector |
Malicious release: Malicious code in ccxt-telemetry (PyPI) MAL-2026-2697 | Malicious | Not scored | 15 Apr, 2026 | PyPI ccxt-telemetry |
Malicious release: Malicious code in kyleip (PyPI) MAL-2026-2698 | Malicious | Not scored | 15 Apr, 2026 | PyPI kyleip |
python-multipart affected by Denial of Service via large multipart preamble or epilogue data CVE-2026-40347, GHSA-mj87-hwqh-73pj, PYSEC-2026-3038 | Medium | 0.4% | 15 Apr, 2026 | PyPI python-multipart |
pypdf has long runtimes for wrong size values in cross-reference and object streams CVE-2026-41168, GHSA-jj6c-8h6c-hppx, PYSEC-2026-3021 | Medium | 0.3% | 15 Apr, 2026 | PyPI pypdf |
Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision CVE-2026-40256, GHSA-ffgh-3jrf-8wvh, PYSEC-2026-2315 | Medium | 0.3% | 15 Apr, 2026 | PyPI weblate |
Weblate: SSRF via the webhook add-on using unprotected fetch_url() CVE-2026-39845, GHSA-f8hv-g549-hwg2, PYSEC-2026-156 | Medium | 0.3% | 15 Apr, 2026 | PyPI weblate |
Weblate: Privilege escalation in the user API endpoint CVE-2026-34393, GHSA-3382-gw9x-477v, PYSEC-2026-155 | High | 0.4% | 15 Apr, 2026 | PyPI weblate |
Weblate: SSRF via Project-Level Machinery Configuration CVE-2026-34244, GHSA-xrwr-fcw6-fmq8, PYSEC-2026-2314 | Medium | 0.3% | 15 Apr, 2026 | PyPI weblate |
Weblate: Arbitrary File Read via Symlink CVE-2026-34242, GHSA-hv99-mxm5-q397, PYSEC-2026-2313 | High | 0.5% | 15 Apr, 2026 | PyPI weblate |
Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads CVE-2026-33440, GHSA-5fhx-9jwj-867m, PYSEC-2026-2312 | Medium | 0.2% | 15 Apr, 2026 | PyPI weblate |
Weblate: Remote code execution during backup restoration CVE-2026-33435, GHSA-558g-h753-6m33, PYSEC-2026-154 | High | 0.7% | 15 Apr, 2026 | PyPI weblate |
Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository CVE-2026-33220, GHSA-mqph-7h49-hqfm, PYSEC-2026-153 | Medium | 0.3% | 15 Apr, 2026 | PyPI weblate |
Weblate: Improper access control for the translation memory in API CVE-2026-33214, GHSA-mpf5-3vph-q75r, PYSEC-2026-152 | Medium | 0.2% | 15 Apr, 2026 | PyPI weblate |
Weblate: Improper access control for pending tasks in API CVE-2026-33212, GHSA-vj45-x3pj-f4w4, PYSEC-2026-2311 | Low | 0.2% | 15 Apr, 2026 | PyPI weblate |
Malicious release: Malicious code in cpu-optimizers2-33 (PyPI) MAL-2026-2695 | Malicious | Not scored | 15 Apr, 2026 | PyPI cpu-optimizers2-33 |
Malicious release: Malicious code in cpu-optimizers (PyPI) MAL-2026-2694 | Malicious | Not scored | 15 Apr, 2026 | PyPI cpu-optimizers |
Upsonic: remote code execution vulnerability in its MCP server/task creation functionality CVE-2026-30625, GHSA-cw73-5f7h-m4gv, PYSEC-2026-559 | Critical | 1.0% | 15 Apr, 2026 | PyPI upsonic |
Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access BIT-airflow-2026-25219, CVE-2026-25219, GHSA-4g48-54q2-fg7q, PYSEC-2026-2344 | Medium | 0.6% | 15 Apr, 2026 | PyPI apache-airflow |
Malicious release: Malicious code in neverinstallme (PyPI) MAL-2026-2686 | Malicious | Not scored | 15 Apr, 2026 | PyPI neverinstallme |
Apache Airflow: RCE by race condition in example_xcom dag BIT-airflow-2025-54550, CVE-2025-54550, GHSA-q2hg-643c-gw8h, PYSEC-2026-2353 | High | 0.6% | 15 Apr, 2026 | PyPI apache-airflow |
pyLoad's Session Not Invalidated After Permission Changes GHSA-fj52-5g4h-gmq8 | Low | Not scored | 14 Apr, 2026 | PyPI pyload-ng |
pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass) CVE-2026-41133, GHSA-66hx-chf7-3332, PYSEC-2026-2990 | High | 0.3% | 14 Apr, 2026 | PyPI pyload-ng |
Giskard has Unsandboxed Jinja2 Template Rendering in ConformityCheck CVE-2026-40320, GHSA-7xjm-g8f4-rp26, PYSEC-2026-2488 | Medium | 0.1% | 14 Apr, 2026 | PyPI giskard-checks |
Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check CVE-2026-40319, GHSA-rq2q-4r55-9877, PYSEC-2026-2489 | Low | 0.1% | 14 Apr, 2026 | PyPI giskard-checks |
Malicious release: Malicious code in kryptex-os (PyPI) MAL-2026-2671 | Malicious | Not scored | 14 Apr, 2026 | PyPI kryptex-os |
Malicious release: Malicious code in 7miners (PyPI) MAL-2026-2670 | Malicious | Not scored | 14 Apr, 2026 | PyPI 7miners |
Malicious release: Malicious code in ant-mcp-proxy-for-test (PyPI) MAL-2026-2669 | Malicious | Not scored | 14 Apr, 2026 | PyPI ant-mcp-proxy-for-test |
OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean CVE-2026-40683, GHSA-pfx2-9x9m-7ghx, PYSEC-2026-2550 | High | 0.3% | 14 Apr, 2026 | PyPI keystone |
Multiple security fixes in justhtml CVE-2026-7808, GHSA-4p64-v8f5-r2gx | Critical | 0.6% | 14 Apr, 2026 | PyPI justhtml |
Malicious release: Malicious code in moooo (PyPI) MAL-2026-2666 | Malicious | Not scored | 14 Apr, 2026 | PyPI moooo |
Malicious release: Malicious code in buildenv-telemetry (PyPI) MAL-2026-2664 | Malicious | Not scored | 14 Apr, 2026 | PyPI buildenv-telemetry |
Malicious release: Malicious code in hive-os-settings (PyPI) MAL-2026-2665 | Malicious | Not scored | 14 Apr, 2026 | PyPI hive-os-settings |