Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OpenChatBI has a Path Traversal Vulnerability in save_report Tool CVE-2026-28795, GHSA-vmwq-8g8c-jm79, PYSEC-2026-2794 | High | 0.5% | 02 Mar, 2026 | PyPI openchatbi |
MS-Agent vulnerable to Command Injection CVE-2026-2256, GHSA-4gc2-344q-r2rw, PYSEC-2026-2668 | Medium | 1.7% | 02 Mar, 2026 | PyPI ms-agent |
CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements CVE-2026-28438, GHSA-59g6-v3vg-f7wc, PYSEC-2026-2133 | High | 0.3% | 02 Mar, 2026 | PyPI cocoindex |
Products.isurlinportal has possible open redirect when using more than 2 forward slashes CVE-2026-28413, GHSA-43gx-6gv6-3jcp, PYSEC-2026-112 | Medium | 0.3% | 02 Mar, 2026 | PyPI Products.isurlinportal PyPI products-isurlinportal |
lxml-html-clean has <base> tag injection through default Cleaner configuration CVE-2026-28350, GHSA-xvp8-3mhv-424c, PYSEC-2026-2202 | Medium | 0.3% | 02 Mar, 2026 | PyPI lxml-html-clean |
lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes CVE-2026-28348, GHSA-hw26-mmpg-fqfg, PYSEC-2026-2201 | Medium | 0.3% | 02 Mar, 2026 | PyPI lxml-html-clean |
Malicious release: Malicious code in amigapythonupdater (PyPI) MAL-2026-1136 | Malicious | Not scored | 02 Mar, 2026 | PyPI amigapythonupdater |
Malicious release: Malicious code in wisecloudcyberark (PyPI) MAL-2026-1142 | Malicious | Not scored | 02 Mar, 2026 | PyPI wisecloudcyberark |
Malicious release: Malicious code in heimdal-credentials (PyPI) MAL-2026-1140 | Malicious | Not scored | 02 Mar, 2026 | PyPI heimdal-credentials |
Malicious release: Malicious code in wisecloudsecrets (PyPI) MAL-2026-1143 | Malicious | Not scored | 02 Mar, 2026 | PyPI wisecloudsecrets |
Malicious release: Malicious code in fwk-amigapython (PyPI) MAL-2026-1137 | Malicious | Not scored | 02 Mar, 2026 | PyPI fwk-amigapython |
Malicious release: Malicious code in fwk-amigapython-amigamlserver (PyPI) MAL-2026-1138 | Malicious | Not scored | 02 Mar, 2026 | PyPI fwk-amigapython-amigamlserver |
Malicious release: Malicious code in fwk-amigapython-rest-server (PyPI) MAL-2026-1139 | Malicious | Not scored | 02 Mar, 2026 | PyPI fwk-amigapython-rest-server |
joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS) CVE-2026-27932, GHSA-w5r5-m38g-f9f9, PYSEC-2026-2529 | High | 0.5% | 02 Mar, 2026 | PyPI joserfc |
Malicious release: Malicious code in identityapi (PyPI) MAL-2026-1141 | Malicious | Not scored | 02 Mar, 2026 | PyPI identityapi |
OpenEXR's CompositeDeepScanLine integer-overflow leads to heap OOB write CVE-2026-27622, GHSA-cr4v-6jm6-4963, PYSEC-2026-2846 | High | 0.2% | 02 Mar, 2026 | PyPI OpenEXR PyPI openexr |
Open Babel has a NULL pointer dereference in CDXML OBAtom::GetExplicitValence CVE-2026-3408, GHSA-rxpr-wq63-jr7p, PYSEC-2026-2791 | Low | 0.6% | 02 Mar, 2026 | PyPI openbabel |
Malicious release: Malicious code in pyclogger (PyPI) MAL-2026-1099 | Malicious | Not scored | 01 Mar, 2026 | PyPI pyclogger |
Malicious release: Malicious code in noteasonfnsource (PyPI) MAL-2026-1098 | Malicious | Not scored | 01 Mar, 2026 | PyPI noteasonfnsource |
Malicious release: Malicious code in botbooster (PyPI) MAL-2026-1097 | Malicious | Not scored | 01 Mar, 2026 | PyPI botbooster |
Malicious release: Malicious code in jwrincident (PyPI) MAL-2026-1092 | Malicious | Not scored | 28 Feb, 2026 | PyPI jwrincident |
Malicious release: Malicious code in myproject-bola (PyPI) MAL-2026-1091 | Malicious | Not scored | 28 Feb, 2026 | PyPI myproject-bola |
Malicious release: Malicious code in isb (PyPI) MAL-2026-1090 | Malicious | Not scored | 28 Feb, 2026 | PyPI isb |
Malicious release: Malicious code in randomstringgen (PyPI) MAL-2026-1089 | Malicious | Not scored | 28 Feb, 2026 | PyPI randomstringgen |
Malicious release: Malicious code in bladebit (PyPI) MAL-2026-1088 | Malicious | Not scored | 28 Feb, 2026 | PyPI bladebit |
Malicious release: Malicious code in tchap-bot (PyPI) MAL-2026-1086 | Malicious | Not scored | 28 Feb, 2026 | PyPI tchap-bot |
Malicious release: Malicious code in ctf-toolkit (PyPI) MAL-2026-1085 | Malicious | Not scored | 28 Feb, 2026 | PyPI ctf-toolkit |
Malicious release: Malicious code in socketxio (PyPI) MAL-2026-1084 | Malicious | Not scored | 28 Feb, 2026 | PyPI socketxio |
Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing CVE-2026-28416, GHSA-jmh7-g254-2cq9, PYSEC-2026-66 | High | 7.3% | 27 Feb, 2026 | PyPI gradio |
Gradio has an Open Redirect in its OAuth Flow CVE-2026-28415, GHSA-pfjf-5gxr-995x, PYSEC-2026-65 | Medium | 0.3% | 27 Feb, 2026 | PyPI gradio |
Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+ CVE-2026-28414, GHSA-39mp-8hj3-5c49, PYSEC-2026-64 | High | 3.1% | 27 Feb, 2026 | PyPI gradio |
Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret CVE-2026-27167, GHSA-h3h8-3v2v-rg7m, PYSEC-2026-63 | Medium | 0.5% | 27 Feb, 2026 | PyPI gradio |
Malicious release: Malicious code in cdf-clients (PyPI) MAL-2026-1082 | Malicious | Not scored | 27 Feb, 2026 | PyPI cdf-clients |
Indico has a missing access check in the event series management API CVE-2026-28352, GHSA-rfpp-2hgm-gp5v, PYSEC-2026-2183 | Medium | 0.3% | 27 Feb, 2026 | PyPI indico |
pypdf: Manipulated RunLengthDecode streams can exhaust RAM CVE-2026-28351, GHSA-f2v5-7jq9-h8cg, PYSEC-2026-3017 | Medium | 0.5% | 27 Feb, 2026 | PyPI pypdf |
pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read CVE-2026-28231, GHSA-5gjj-6r7v-ph3x, PYSEC-2026-2248, PYSEC-2026-2258 | Medium | 0.7% | 27 Feb, 2026 | PyPI pi-heif PyPI pillow-heif |
Malicious release: Malicious code in hashtools32 (PyPI) MAL-2026-1080 | Malicious | Not scored | 27 Feb, 2026 | PyPI hashtools32 |
AWS CLI: cli_history database does not restrict file permissions on Unix systems GHSA-747p-wmpv-9c78 | Medium | Not scored | 27 Feb, 2026 | PyPI awscli |
Malicious release: Malicious code in cicd-ppe-redteam-test02 (PyPI) MAL-2026-1064 | Malicious | Not scored | 27 Feb, 2026 | PyPI cicd-ppe-redteam-test02 |
Malicious release: Malicious code in cicd-ppe-redteam-test01 (PyPI) MAL-2026-1063 | Malicious | Not scored | 27 Feb, 2026 | PyPI cicd-ppe-redteam-test01 |
OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection CVE-2026-28370, GHSA-8xwf-cr4r-856r, PYSEC-2026-564 | Critical | 0.8% | 27 Feb, 2026 | PyPI vitrage |
wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup CVE-2026-27839, GHSA-g8gc-6c4h-jg86, PYSEC-2026-3422 | Medium | 0.3% | 26 Feb, 2026 | PyPI wger |
wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data CVE-2026-27838, GHSA-42cr-w2gr-m54q, PYSEC-2026-3418 | Low | 0.3% | 26 Feb, 2026 | PyPI wger |
wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data CVE-2026-27835, GHSA-xf68-8hjw-7mpm, PYSEC-2026-3423 | Medium | 0.3% | 26 Feb, 2026 | PyPI wger |
Weblate: Missing access control for the AddonViewSet API exposes all addon configurations CVE-2026-27457, GHSA-wppc-7cq7-cgfv, PYSEC-2026-2310 | Medium | 0.3% | 26 Feb, 2026 | PyPI weblate |
Malicious release: Malicious code in flycord (PyPI) MAL-2026-1049 | Malicious | Not scored | 26 Feb, 2026 | PyPI flycord |
Malicious release: Malicious code in edx-salesforce (PyPI) MAL-2026-1048 | Malicious | Not scored | 26 Feb, 2026 | PyPI edx-salesforce |
Malicious release: Malicious code in awareness-demo-pkg (PyPI) MAL-2026-1044 | Malicious | Not scored | 26 Feb, 2026 | PyPI awareness-demo-pkg |
Ajenti has potential Remote Code Execution CVE-2026-27975, GHSA-vcw3-r3fx-j444 | High | 0.6% | 26 Feb, 2026 | PyPI aj |
Langflow has Remote Code Execution in CSV Agent CVE-2026-27966, GHSA-3645-fxcv-hqr4, PYSEC-2026-376 | Critical | 35.2% | 26 Feb, 2026 | PyPI langflow |