Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in robloxapi-test (PyPI) MAL-2026-1497 | Malicious | Not scored | 17 Mar, 2026 | PyPI robloxapi-test |
Malicious release: Malicious code in robloxapi-testy (PyPI) MAL-2026-1496 | Malicious | Not scored | 17 Mar, 2026 | PyPI robloxapi-testy |
Malicious release: Malicious code in chacha-lite-encrypt (PyPI) MAL-2026-1482 | Malicious | Not scored | 16 Mar, 2026 | PyPI chacha-lite-encrypt |
Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit CVE-2026-4269, GHSA-xfhr-q72q-jcrj, PYSEC-2026-2396 | Medium | 0.3% | 16 Mar, 2026 | PyPI bedrock-agentcore-starter-toolkit |
Malicious release: Malicious code in pretty-tabulate (PyPI) MAL-2026-1480 | Malicious | Not scored | 16 Mar, 2026 | PyPI pretty-tabulate |
Malicious release: Malicious code in color-list (PyPI) MAL-2026-1479 | Malicious | Not scored | 16 Mar, 2026 | PyPI color-list |
Malicious release: Malicious code in codeshouhu (PyPI) MAL-2026-1488 | Malicious | Not scored | 16 Mar, 2026 | PyPI codeshouhu |
AWS API MCP File Access Restriction Bypass CVE-2026-4270, GHSA-2cpp-j2fc-qhp7, PYSEC-2026-162 | Medium | 0.1% | 16 Mar, 2026 | PyPI awslabs-aws-api-mcp-server PyPI awslabs.aws-api-mcp-server |
Stored XSS in Memray-generated HTML reports via unescaped command-line metadata CVE-2026-32722, GHSA-r5pr-887v-m2w9, PYSEC-2026-2203 | Medium | 0.3% | 16 Mar, 2026 | PyPI memray |
Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers CVE-2026-32634, GHSA-vx5f-957p-qpvm, PYSEC-2026-2172 | High | 0.3% | 16 Mar, 2026 | PyPI Glances PyPI glances |
Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist` CVE-2026-32633, GHSA-r297-p3v4-wp8m, PYSEC-2026-343 | Critical | 0.5% | 16 Mar, 2026 | PyPI Glances PyPI glances |
Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding CVE-2026-32632, GHSA-hhcg-r27j-fhv9, PYSEC-2026-2171 | Medium | 0.2% | 16 Mar, 2026 | PyPI Glances PyPI glances |
Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements CVE-2026-32611, GHSA-49g7-2ww7-3vf5, PYSEC-2026-2170 | Critical | 0.3% | 16 Mar, 2026 | PyPI Glances PyPI glances |
Glances's Default CORS Configuration Allows Cross-Origin Credential Theft CVE-2026-32610, GHSA-9jfm-9rc6-2hfq, PYSEC-2026-2169 | High | 0.3% | 16 Mar, 2026 | PyPI Glances PyPI glances |
Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials CVE-2026-32609, GHSA-cvwp-r2g2-j824, PYSEC-2026-2168 | High | 0.5% | 16 Mar, 2026 | PyPI Glances PyPI glances |
Glances has a Command Injection via Process Names in Action Command Templates CVE-2026-32608, GHSA-vcv2-q258-wrg7, PYSEC-2026-2167 | High | 0.2% | 16 Mar, 2026 | PyPI Glances PyPI glances |
Glances exposes the REST API without authentication CVE-2026-32596, GHSA-wvxv-4j8q-4wjq, PYSEC-2026-2166 | High | 1.6% | 16 Mar, 2026 | PyPI Glances PyPI glances |
ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack CVE-2026-28500, GHSA-hqmj-h5c6-369m, PYSEC-2026-103 | Critical | 0.3% | 16 Mar, 2026 | PyPI onnx |
pyOpenSSL DTLS cookie callback buffer overflow CVE-2026-27459, GHSA-5pwr-322w-8jr4, PYSEC-2026-2269 | High | 0.7% | 16 Mar, 2026 | PyPI pyopenssl |
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding CVE-2026-28498, GHSA-m344-f55w-2m6j, PYSEC-2026-2117 | High | 0.2% | 16 Mar, 2026 | PyPI authlib |
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle CVE-2026-28490, GHSA-7432-952r-cw78, PYSEC-2026-2116 | High | 0.1% | 16 Mar, 2026 | PyPI authlib |
Authlib JWS JWK Header Injection: Signature Verification Bypass CVE-2026-27962, GHSA-wvwj-cvrp-7pv5, PYSEC-2026-287 | Critical | 0.6% | 16 Mar, 2026 | PyPI authlib |
pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback CVE-2026-27448, GHSA-vp96-hxj8-p424, PYSEC-2026-2268 | Low | 0.3% | 16 Mar, 2026 | PyPI pyopenssl |
FastMCP OAuth Proxy token reuse across MCP servers CVE-2025-69196, GHSA-5h2m-4q8j-pqpj, PYSEC-2026-2474 | High | 0.4% | 16 Mar, 2026 | PyPI fastmcp |
Vanna has a SQL injection in the remove_training_data function CVE-2026-4229, GHSA-6mj8-jmp2-g8q7, PYSEC-2026-3397 | Medium | 0.3% | 16 Mar, 2026 | PyPI vanna |
MLflow has a command injection in mlflow/sagemaker/__init__.py BIT-mlflow-2025-14287, CVE-2025-14287, GHSA-xch3-2f9x-wh9f, PYSEC-2026-2661 | High | 1.5% | 16 Mar, 2026 | PyPI mlflow |
Malicious release: Malicious code in pymnemonic (PyPI) MAL-2026-1438 | Malicious | Not scored | 15 Mar, 2026 | PyPI pymnemonic |
Malicious release: Malicious code in do-not-install-this-package-004 (PyPI) MAL-2026-1436 | Malicious | Not scored | 15 Mar, 2026 | PyPI do-not-install-this-package-004 |
Malicious release: Malicious code in flowpeek (PyPI) MAL-2026-1437 | Malicious | Not scored | 15 Mar, 2026 | PyPI flowpeek |
Malicious release: Malicious code in kvstore-pb2-grpc (PyPI) MAL-2026-1433 | Malicious | Not scored | 15 Mar, 2026 | PyPI kvstore-pb2-grpc |
Malicious release: Malicious code in dgl-cu117 (PyPI) MAL-2026-1432 | Malicious | Not scored | 15 Mar, 2026 | PyPI dgl-cu117 |
Malicious release: Malicious code in python-anchor (PyPI) MAL-2026-1435 | Malicious | Not scored | 15 Mar, 2026 | PyPI python-anchor |
Malicious release: Malicious code in my-super-lib (PyPI) MAL-2026-1434 | Malicious | Not scored | 15 Mar, 2026 | PyPI my-super-lib |
Malicious release: Malicious code in ariadne-federation (PyPI) MAL-2026-1431 | Malicious | Not scored | 15 Mar, 2026 | PyPI ariadne-federation |
fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE` GHSA-5cxw-w2xg-2m8h | Medium | Not scored | 13 Mar, 2026 | PyPI fickling |
fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist GHSA-r48f-3986-4f9c | Medium | Not scored | 13 Mar, 2026 | PyPI fickling |
SimpleEval: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox CVE-2026-32640, GHSA-44vg-5wv2-h2hg, PYSEC-2026-132 | High | 0.5% | 13 Mar, 2026 | PyPI simpleeval |
Malicious release: Malicious code in fastapi-middleware-cors (PyPI) MAL-2026-1422 | Malicious | Not scored | 13 Mar, 2026 | PyPI fastapi-middleware-cors |
Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware CVE-2026-105782, GHSA-cwxj-rr6w-m6w7, PYSEC-2026-4299 | High | 0.4% | 13 Mar, 2026 | PyPI Scrapy PyPI scrapy |
PyJWT accepts unknown `crit` header extensions CVE-2026-32597, GHSA-752w-5fwx-jx9f, PYSEC-2026-120 | High | 0.3% | 13 Mar, 2026 | PyPI PyJWT PyPI pyjwt |
CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification CVE-2026-31899, GHSA-f38f-5xpm-9r7c, PYSEC-2026-2122 | High | 0.5% | 13 Mar, 2026 | PyPI CairoSVG PyPI cairosvg |
Malicious release: Malicious code in project47 (PyPI) MAL-2026-1412 | Malicious | Not scored | 13 Mar, 2026 | PyPI project47 |
Malicious release: Malicious code in darkig (PyPI) MAL-2026-1409 | Malicious | Not scored | 13 Mar, 2026 | PyPI darkig |
Malicious release: Malicious code in ighack (PyPI) MAL-2026-1410 | Malicious | Not scored | 13 Mar, 2026 | PyPI ighack |
Malicious release: Malicious code in nfd (PyPI) MAL-2026-1411 | Malicious | Not scored | 13 Mar, 2026 | PyPI nfd |
Malicious release: Malicious code in nai (PyPI) MAL-2026-1408 | Malicious | Not scored | 13 Mar, 2026 | PyPI nai |
Malicious release: Malicious code in thief-utils (PyPI) MAL-2026-1407 | Malicious | Not scored | 13 Mar, 2026 | PyPI thief-utils |
Malicious release: Malicious code in makenotion-ppetest (PyPI) MAL-2026-1406 | Malicious | Not scored | 13 Mar, 2026 | PyPI makenotion-ppetest |
Black: Arbitrary file writes from unsanitized user input in cache file name CVE-2026-32274, GHSA-3936-cmfr-pm3m, PYSEC-2026-2121 | High | 0.6% | 12 Mar, 2026 | PyPI black |
Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite CVE-2026-32116, GHSA-4g4c-mfqg-pj8r, PYSEC-2026-2615 | High | 0.4% | 12 Mar, 2026 | PyPI magic-wormhole |