Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in aliyun-python-sdk-v2 (PyPI) MAL-2026-917 | Malicious | Not scored | 16 Feb, 2026 | PyPI aliyun-python-sdk-v2 |
Malicious release: Malicious code in alibabacloude (PyPI) MAL-2026-916 | Malicious | Not scored | 16 Feb, 2026 | PyPI alibabacloude |
Malicious release: Malicious code in alibabacloud-code-tool (PyPI) MAL-2026-915 | Malicious | Not scored | 16 Feb, 2026 | PyPI alibabacloud-code-tool |
pretix unsafely evaluates variables in emails CVE-2026-2415, GHSA-r8p8-qw9w-j9qv, PYSEC-2026-110 | High | 0.3% | 16 Feb, 2026 | PyPI pretix |
Malicious release: Malicious code in groq-ppe-pkg (PyPI) MAL-2026-913 | Malicious | Not scored | 16 Feb, 2026 | PyPI groq-ppe-pkg |
Malicious release: Malicious code in http-request-toolkit (PyPI) MAL-2026-912 | Malicious | Not scored | 16 Feb, 2026 | PyPI http-request-toolkit |
MindsDB affected by a SSRF vulnerability CVE-2026-2531, GHSA-6xw9-2p64-7622, PYSEC-2026-91 | Low | 0.3% | 16 Feb, 2026 | PyPI MindsDB PyPI mindsdb |
Malicious release: Malicious code in malpkgv2-0 (PyPI) MAL-2026-911 | Malicious | Not scored | 16 Feb, 2026 | PyPI malpkgv2-0 |
Malicious release: Malicious code in dns-execution-test (PyPI) MAL-2026-910 | Malicious | Not scored | 15 Feb, 2026 | PyPI dns-execution-test |
Malicious release: Malicious code in clawdist (PyPI) MAL-2026-909 | Malicious | Not scored | 15 Feb, 2026 | PyPI clawdist |
Malicious release: Malicious code in tronpad (PyPI) MAL-2026-907 | Malicious | Not scored | 15 Feb, 2026 | PyPI tronpad |
Malicious release: Malicious code in marshmellows (PyPI) MAL-2026-905 | Malicious | Not scored | 15 Feb, 2026 | PyPI marshmellows |
Malicious release: Malicious code in strands-agents-anthropic (PyPI) MAL-2026-904 | Malicious | Not scored | 15 Feb, 2026 | PyPI strands-agents-anthropic |
Malicious release: Malicious code in requests-toolkit (PyPI) MAL-2026-903 | Malicious | Not scored | 15 Feb, 2026 | PyPI requests-toolkit |
Malicious release: Malicious code in crc32fast (PyPI) MAL-2026-902 | Malicious | Not scored | 14 Feb, 2026 | PyPI crc32fast |
Malicious release: Malicious code in cubaflixdownload (PyPI) MAL-2026-900 | Malicious | Not scored | 14 Feb, 2026 | PyPI cubaflixdownload |
Malicious release: Malicious code in platforms (PyPI) MAL-2026-901 | Malicious | Not scored | 14 Feb, 2026 | PyPI platforms |
Malicious release: Malicious code in dzuseragents (PyPI) MAL-2026-899 | Malicious | Not scored | 14 Feb, 2026 | PyPI dzuseragents |
Malicious release: Malicious code in langraph (PyPI) MAL-2024-12375 | Malicious | Not scored | 14 Feb, 2026 | PyPI langraph |
Malicious release: Malicious code in magicwolf (PyPI) MAL-2026-898 | Malicious | Not scored | 14 Feb, 2026 | PyPI magicwolf |
Malicious release: Malicious code in clawdest (PyPI) MAL-2026-897 | Malicious | Not scored | 13 Feb, 2026 | PyPI clawdest |
Malicious release: Malicious code in troncloud (PyPI) MAL-2026-894 | Malicious | Not scored | 13 Feb, 2026 | PyPI troncloud |
sqlparse: formatting list of tuples leads to denial of service GHSA-27jp-wm6q-gp25 | Medium | Not scored | 13 Feb, 2026 | PyPI sqlparse |
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.
This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.
Users are recommended to upgrade to version 1.12.1 CVE-2025-33042, GHSA-rp46-r563-jrc7, PYSEC-2026-26 | High | 0.7% | 13 Feb, 2026 | PyPI avro |
Malicious release: Malicious code in magichat (PyPI) MAL-2026-878 | Malicious | Not scored | 13 Feb, 2026 | PyPI magichat |
Malicious release: Malicious code in displaydoc (PyPI) MAL-2026-875 | Malicious | Not scored | 13 Feb, 2026 | PyPI displaydoc |
Malicious release: Malicious code in acpi-tables (PyPI) MAL-2026-876 | Malicious | Not scored | 13 Feb, 2026 | PyPI acpi-tables |
Malicious release: Malicious code in arrayvec (PyPI) MAL-2026-877 | Malicious | Not scored | 13 Feb, 2026 | PyPI arrayvec |
Malicious release: Malicious code in google-search-result (PyPI) MAL-2026-874 | Malicious | Not scored | 12 Feb, 2026 | PyPI google-search-result |
DokuWiki 2018-04-22b contains a username enumeration vulnerability in its password reset functionality that allows attackers to identify valid user accounts. Attackers can submit different usernames to the password reset endpoint and distinguish between existing and non-existing accounts by analyzin CVE-2019-25338, PYSEC-2026-57 | Medium | 0.5% | 12 Feb, 2026 | PyPI dokuwiki |
Malicious release: Malicious code in b10connoisseur (PyPI) MAL-2026-870 | Malicious | Not scored | 12 Feb, 2026 | PyPI b10connoisseur |
Malicious release: Malicious code in ritch (PyPI) MAL-2026-869 | Malicious | Not scored | 12 Feb, 2026 | PyPI ritch |
Malicious release: Malicious code in oraceldb (PyPI) MAL-2026-866 | Malicious | Not scored | 12 Feb, 2026 | PyPI oraceldb |
Malicious release: Malicious code in krbutils (PyPI) MAL-2026-863 | Malicious | Not scored | 12 Feb, 2026 | PyPI krbutils |
Malicious release: Malicious code in pydantics (PyPI) MAL-2026-868 | Malicious | Not scored | 12 Feb, 2026 | PyPI pydantics |
Malicious release: Malicious code in pandaai (PyPI) MAL-2026-867 | Malicious | Not scored | 12 Feb, 2026 | PyPI pandaai |
Malicious release: Malicious code in opentelematry-api (PyPI) MAL-2026-865 | Malicious | Not scored | 12 Feb, 2026 | PyPI opentelematry-api |
Malicious release: Malicious code in marshmellow (PyPI) MAL-2026-864 | Malicious | Not scored | 12 Feb, 2026 | PyPI marshmellow |
Malicious release: Malicious code in lala6992 (PyPI) MAL-2026-946 | Malicious | Not scored | 12 Feb, 2026 | PyPI lala6992 |
Malicious release: Malicious code in get-incorrect-name-bob (PyPI) MAL-2026-862 | Malicious | Not scored | 12 Feb, 2026 | PyPI get-incorrect-name-bob |
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading CVE-2026-1669, GHSA-3m4q-jmj6-r34q, PYSEC-2026-2546 | High | 0.3% | 11 Feb, 2026 | PyPI keras |
DiskCache has unsafe pickle deserialization CVE-2025-69872, GHSA-w8v5-vhqr-4h9v, PYSEC-2026-2447 | Critical | 0.6% | 11 Feb, 2026 | PyPI diskcache |
Malicious release: Malicious code in osopackagepy (PyPI) MAL-2026-860 | Malicious | Not scored | 11 Feb, 2026 | PyPI osopackagepy |
Pillow affected by out-of-bounds write when loading PSD images BIT-pillow-2026-25990, CVE-2026-25990, GHSA-cfh3-3jmp-rvhc, PYSEC-2026-2249 | High | 0.4% | 11 Feb, 2026 | PyPI pillow |
Malicious release: Malicious code in config-toolkit (PyPI) MAL-2026-855 | Malicious | Not scored | 11 Feb, 2026 | PyPI config-toolkit |
Malicious release: Malicious code in python-files-mod (PyPI) MAL-2026-851 | Malicious | Not scored | 11 Feb, 2026 | PyPI python-files-mod |
Malicious release: Malicious code in ci-metadata-python-logging (PyPI) MAL-2024-12374 | Malicious | Not scored | 11 Feb, 2026 | PyPI ci-metadata-python-logging |
Malicious release: Malicious code in tablixs (PyPI) MAL-2025-193013 | Malicious | Not scored | 11 Feb, 2026 | PyPI tablixs |
Malicious release: Malicious code in ntoctfutils (PyPI) MAL-2026-850 | Malicious | Not scored | 11 Feb, 2026 | PyPI ntoctfutils |
Malicious release: Malicious code in jsonconfig-utils (PyPI) MAL-2026-849 | Malicious | Not scored | 11 Feb, 2026 | PyPI jsonconfig-utils |