Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in fairness-bias (PyPI) MAL-2026-2170 | Malicious | Not scored | 25 Mar, 2026 | PyPI fairness-bias |
Malicious release: Malicious code in globally (PyPI) MAL-2026-2171 | Malicious | Not scored | 25 Mar, 2026 | PyPI globally |
Malicious release: Malicious code in v2-8-3 (PyPI) MAL-2026-2172 | Malicious | Not scored | 25 Mar, 2026 | PyPI v2-8-3 |
Malicious release: Malicious code in sonic-config-engine (PyPI) MAL-2026-2180 | Malicious | Not scored | 25 Mar, 2026 | PyPI sonic-config-engine |
Malicious release: Malicious code in sonic-yang-mgmt (PyPI) MAL-2026-2182 | Malicious | Not scored | 25 Mar, 2026 | PyPI sonic-yang-mgmt |
Malicious release: Malicious code in kusto (PyPI) MAL-2026-2176 | Malicious | Not scored | 25 Mar, 2026 | PyPI kusto |
Malicious release: Malicious code in sonic-platform-common (PyPI) MAL-2026-2181 | Malicious | Not scored | 25 Mar, 2026 | PyPI sonic-platform-common |
Malicious release: Malicious code in batch-shipyard (PyPI) MAL-2026-2174 | Malicious | Not scored | 25 Mar, 2026 | PyPI batch-shipyard |
Malicious release: Malicious code in aristanetworks (PyPI) MAL-2026-2173 | Malicious | Not scored | 25 Mar, 2026 | PyPI aristanetworks |
Malicious release: Malicious code in python-glue (PyPI) MAL-2026-2179 | Malicious | Not scored | 25 Mar, 2026 | PyPI python-glue |
Malicious release: Malicious code in lm-sys (PyPI) MAL-2026-2178 | Malicious | Not scored | 25 Mar, 2026 | PyPI lm-sys |
Malicious release: Malicious code in torchunmix (PyPI) MAL-2026-2158 | Malicious | Not scored | 25 Mar, 2026 | PyPI torchunmix |
Malicious release: Malicious code in mattermost-data-warehouse (PyPI) MAL-2026-2148 | Malicious | Not scored | 24 Mar, 2026 | PyPI mattermost-data-warehouse |
Malicious release: Malicious code in snooty (PyPI) MAL-2026-2150 | Malicious | Not scored | 24 Mar, 2026 | PyPI snooty |
Malicious release: Malicious code in sentry-filter-forks (PyPI) MAL-2026-2149 | Malicious | Not scored | 24 Mar, 2026 | PyPI sentry-filter-forks |
Malicious release: Malicious code in mattermost-airflow (PyPI) MAL-2026-2147 | Malicious | Not scored | 24 Mar, 2026 | PyPI mattermost-airflow |
Malicious release: Malicious code in databricks-clean-room-orchestrator (PyPI) MAL-2026-2146 | Malicious | Not scored | 24 Mar, 2026 | PyPI databricks-clean-room-orchestrator |
Malicious release: Malicious code in compose-rl (PyPI) MAL-2026-2145 | Malicious | Not scored | 24 Mar, 2026 | PyPI compose-rl |
Malicious release: Malicious code in target-iceberg (PyPI) MAL-2026-2152 | Malicious | Not scored | 24 Mar, 2026 | PyPI target-iceberg |
Malicious release: Malicious code in tap-wordpress (PyPI) MAL-2026-2151 | Malicious | Not scored | 24 Mar, 2026 | PyPI tap-wordpress |
NVIDIA NeMo Framework contains a vulnerability leading to Remote Code Execution CVE-2026-24159, GHSA-v7v2-m736-cf3c, PYSEC-2026-2675 | Critical | 0.7% | 24 Mar, 2026 | PyPI nemo-toolkit |
NVIDIA NeMo Framework contains an RCE vulnerability in checkpoint loading CVE-2026-24157, GHSA-m4jw-wgmf-889x, PYSEC-2026-2674 | Critical | 0.7% | 24 Mar, 2026 | PyPI nemo-toolkit |
Malicious release: Malicious code in roboat-util (PyPI) MAL-2026-2142 | Malicious | Not scored | 24 Mar, 2026 | PyPI roboat-util |
Malicious release: Malicious code in roboated (PyPI) MAL-2026-2143 | Malicious | Not scored | 24 Mar, 2026 | PyPI roboated |
Malicious release: Malicious code in corexloader (PyPI) MAL-2026-2141 | Malicious | Not scored | 24 Mar, 2026 | PyPI corexloader |
Malicious release: Malicious code in coreloader (PyPI) MAL-2026-2140 | Malicious | Not scored | 24 Mar, 2026 | PyPI coreloader |
Malicious release: Malicious code in stats-helpers (PyPI) MAL-2026-2139 | Malicious | Not scored | 24 Mar, 2026 | PyPI stats-helpers |
Malicious release: Malicious code in open-vp-cal (PyPI) MAL-2026-2138 | Malicious | Not scored | 24 Mar, 2026 | PyPI open-vp-cal |
MobSF has SQL Injection in its SQLite Database Viewer Utils CVE-2026-33545, GHSA-hqjr-43r5-9q58, PYSEC-2026-2662 | Medium | 0.3% | 24 Mar, 2026 | PyPI mobsf |
JustHTML is vulnerable to XSS via code fence breakout in <pre> content CVE-2026-5389, GHSA-5vp3-3cg6-2rq3 | High | 0.2% | 24 Mar, 2026 | PyPI justhtml |
Malicious release: Malicious code in rocketpill (PyPI) MAL-2026-2401 | Malicious | Not scored | 24 Mar, 2026 | PyPI rocketpill |
Malicious release: Malicious code in flycalc (PyPI) MAL-2026-2399 | Malicious | Not scored | 24 Mar, 2026 | PyPI flycalc |
Malicious release: Malicious code in privaton-beacon-img-8f3603448690bdde-png (PyPI) MAL-2026-2201 | Malicious | Not scored | 24 Mar, 2026 | PyPI privaton-beacon-img-8f3603448690bdde-png |
Malicious release: Malicious code in litellm (PyPI) MAL-2026-2144, PYSEC-2026-2 | Malicious | Not scored | 24 Mar, 2026 | PyPI litellm |
Malicious release: Malicious code in mgrcfg (PyPI) MAL-2026-2124 | Malicious | Not scored | 24 Mar, 2026 | PyPI mgrcfg |
Malicious release: Malicious code in rowrapee (PyPI) MAL-2026-2122 | Malicious | Not scored | 23 Mar, 2026 | PyPI rowrapee |
Malicious release: Malicious code in roboat (PyPI) MAL-2026-2121 | Malicious | Not scored | 23 Mar, 2026 | PyPI roboat |
Malicious release: Malicious code in logutilkit (PyPI) MAL-2026-2120 | Malicious | Not scored | 23 Mar, 2026 | PyPI logutilkit |
Briefcase: Windows MSI Installer Privilege Escalation via Insecure Directory Permissions CVE-2026-33430, GHSA-r3r2-35v9-v238, PYSEC-2026-27 | High | 0.1% | 23 Mar, 2026 | PyPI briefcase |
Indico discloses local files resulting in Remote Code Execution through LaTeX injection CVE-2026-33046, GHSA-rm2q-f7jv-3cfp, PYSEC-2026-2184 | High | 0.8% | 23 Mar, 2026 | PyPI indico |
Malicious release: Malicious code in apachelicense (PyPI) MAL-2026-2119 | Malicious | Not scored | 23 Mar, 2026 | PyPI apachelicense |
cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads CVE-2026-26209, GHSA-3c37-wwvx-h642, PYSEC-2026-2123 | High | 0.4% | 23 Mar, 2026 | PyPI cbor2 |
Malicious release: Malicious code in hash-utils-py (PyPI) MAL-2026-2118 | Malicious | Not scored | 23 Mar, 2026 | PyPI hash-utils-py |
Malicious release: Malicious code in apply-hive-table (PyPI) MAL-2026-2112 | Malicious | Not scored | 23 Mar, 2026 | PyPI apply-hive-table |
Malicious release: Malicious code in pyregions-snowflake (PyPI) MAL-2026-2109 | Malicious | Not scored | 23 Mar, 2026 | PyPI pyregions-snowflake |
Malicious release: Malicious code in dmclc (PyPI) MAL-2026-2106 | Malicious | Not scored | 23 Mar, 2026 | PyPI dmclc |
Malicious release: Malicious code in modelconftranslator (PyPI) MAL-2026-2108 | Malicious | Not scored | 23 Mar, 2026 | PyPI modelconftranslator |
Malicious release: Malicious code in financial-crimes-general-utils (PyPI) MAL-2026-2107 | Malicious | Not scored | 23 Mar, 2026 | PyPI financial-crimes-general-utils |
Malicious release: Malicious code in license-utils-kit (PyPI) MAL-2026-2084 | Malicious | Not scored | 23 Mar, 2026 | PyPI license-utils-kit |
Malicious release: Malicious code in anduril-sdk (PyPI) MAL-2026-2083 | Malicious | Not scored | 23 Mar, 2026 | PyPI anduril-sdk |