Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in pipelinepoision-test (PyPI) MAL-2026-759 | Malicious | Not scored | 05 Feb, 2026 | PyPI pipelinepoision-test |
web2py has an Open Redirect Vulnerability CVE-2026-25198, GHSA-rf8c-3f5p-xv45, PYSEC-2026-3413 | Medium | 0.3% | 05 Feb, 2026 | PyPI web2py |
EPyT-Flow vulnerable to unsafe JSON deserialization (__type__) CVE-2026-25632, GHSA-74vm-8frp-7w68, PYSEC-2026-330 | Critical | 0.8% | 04 Feb, 2026 | PyPI epyt-flow |
Malicious release: Malicious code in statssol (PyPI) MAL-2026-745 | Malicious | Not scored | 04 Feb, 2026 | PyPI statssol |
Malicious release: Malicious code in test-for-ppe (PyPI) MAL-2026-739 | Malicious | Not scored | 04 Feb, 2026 | PyPI test-for-ppe |
Malicious release: Malicious code in tablescene (PyPI) MAL-2026-738 | Malicious | Not scored | 04 Feb, 2026 | PyPI tablescene |
Malicious release: Malicious code in cicd-ppe-test (PyPI) MAL-2026-731 | Malicious | Not scored | 04 Feb, 2026 | PyPI cicd-ppe-test |
Malicious release: Malicious code in gridifys (PyPI) MAL-2026-732 | Malicious | Not scored | 04 Feb, 2026 | PyPI gridifys |
Wagtail has improper permission handling on admin preview endpoints CVE-2026-25517, GHSA-4qvv-g3vr-m348, PYSEC-2026-2030 | Medium | 0.4% | 03 Feb, 2026 | PyPI wagtail |
Boltz contains an insecure deserialization vulnerability in its molecule loading functionality CVE-2025-70560, GHSA-fjm6-8xp2-4fwc, PYSEC-2026-1224 | High | 0.2% | 03 Feb, 2026 | PyPI boltz |
Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write CVE-2025-64712, GHSA-gm8q-m8mv-jj5m, PYSEC-2026-558 | Critical | 0.7% | 03 Feb, 2026 | PyPI unstructured |
Django has an SQL Injection issue BIT-django-2026-1312, CVE-2026-1312, GHSA-6426-9fv3-65x8, PYSEC-2026-47 | Medium | 0.9% | 03 Feb, 2026 | PyPI Django PyPI django |
Django has an SQL Injection issue BIT-django-2026-1287, CVE-2026-1287, GHSA-gvg8-93h5-g6qq, PYSEC-2026-46 | High | 0.8% | 03 Feb, 2026 | PyPI Django PyPI django |
Django has Inefficient Algorithmic Complexity BIT-django-2026-1285, CVE-2026-1285, GHSA-4rrr-2h4v-f3j9, PYSEC-2026-45 | High | 1.1% | 03 Feb, 2026 | PyPI Django PyPI django |
Django has an SQL Injection issue BIT-django-2026-1207, CVE-2026-1207, GHSA-mwm9-4648-f68q, PYSEC-2026-44 | High | 12.8% | 03 Feb, 2026 | PyPI Django PyPI django |
Django has Inefficient Algorithmic Complexity BIT-django-2025-14550, CVE-2025-14550, GHSA-33mw-q7rj-mjwj, PYSEC-2026-43 | High | 1.1% | 03 Feb, 2026 | PyPI Django PyPI django |
Django has Observable Timing Discrepancy BIT-django-2025-13473, CVE-2025-13473, GHSA-2mcm-79hx-8fxw, PYSEC-2026-42 | Medium | 0.8% | 03 Feb, 2026 | PyPI Django PyPI django |
Malicious release: Malicious code in serpapi-python (PyPI) MAL-2026-702 | Malicious | Not scored | 03 Feb, 2026 | PyPI serpapi-python |
Malicious release: Malicious code in filespath (PyPI) MAL-2026-701 | Malicious | Not scored | 03 Feb, 2026 | PyPI filespath |
Malicious release: Malicious code in tabulapys (PyPI) MAL-2026-700 | Malicious | Not scored | 03 Feb, 2026 | PyPI tabulapys |
Malicious release: Malicious code in tokyo-ppe-test (PyPI) MAL-2026-699 | Malicious | Not scored | 03 Feb, 2026 | PyPI tokyo-ppe-test |
Malicious release: Malicious code in tableshow (PyPI) MAL-2026-698 | Malicious | Not scored | 03 Feb, 2026 | PyPI tableshow |
Malicious release: Malicious code in pathlib-v2-utility (PyPI) MAL-2026-697 | Malicious | Not scored | 03 Feb, 2026 | PyPI pathlib-v2-utility |
Malicious release: Malicious code in pathfiles (PyPI) MAL-2026-696 | Malicious | Not scored | 03 Feb, 2026 | PyPI pathfiles |
Malicious release: Malicious code in tableapys (PyPI) MAL-2026-686 | Malicious | Not scored | 03 Feb, 2026 | PyPI tableapys |
SageMaker Python SDK has Insecure TLS Configuration CVE-2026-1778, GHSA-62rc-f4v9-h543, PYSEC-2026-1886 | High | 0.3% | 02 Feb, 2026 | PyPI sagemaker |
SageMaker Python SDK has Exposed HMAC CVE-2026-1777, GHSA-rjrp-m2jw-pv9c, PYSEC-2026-1888 | High | 0.5% | 02 Feb, 2026 | PyPI sagemaker |
Tendenci CMS contains a stored Cross-site Scripting (XSS) vulnerability in the Forums module CVE-2025-70960, GHSA-6fvp-wmh6-jg95, PYSEC-2026-138 | Medium | 0.3% | 02 Feb, 2026 | PyPI tendenci |
Tendenci CMS Contains a Cross-site Scripting Vulnerability in its Jobs Module CVE-2025-70959, GHSA-g7hj-29xq-r64w, PYSEC-2026-137 | Medium | 0.3% | 02 Feb, 2026 | PyPI tendenci |
Malicious release: Malicious code in pipeline-poision-test (PyPI) MAL-2026-655 | Malicious | Not scored | 02 Feb, 2026 | PyPI pipeline-poision-test |
Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication CVE-2026-25505, GHSA-gc24-px2r-5qmf | Critical | 0.8% | 02 Feb, 2026 | PyPI bambuddy |
picklescan vulnerable to arbitrary file create using logging.FileHandler CVE-2026-56304, GHSA-m7j5-r2p5-c39r, PYSEC-2026-225 | Medium | 0.4% | 02 Feb, 2026 | PyPI picklescan |
picklescan missing detection by simple obfuscation of a `builtins.eval` call CVE-2026-53874, GHSA-9m3x-qqw2-h32h, PYSEC-2026-1789 | Critical | 0.5% | 02 Feb, 2026 | PyPI picklescan |
Langroid has WAF Bypass Leading to RCE in TableChatAgent CVE-2026-25481, GHSA-x34r-63hx-w57f, PYSEC-2026-383 | Critical | 0.7% | 02 Feb, 2026 | PyPI langroid |
vLLM has RCE In Video Processing CVE-2026-22778, GHSA-4r2x-xpjr-7cvv, PYSEC-2026-565 | Critical | 18.3% | 02 Feb, 2026 | PyPI vllm |
Khoj has an IDOR in Notion OAuth Flow that Enables Index Poisoning CVE-2025-69207, GHSA-6whj-7qmg-86qj, PYSEC-2026-1491 | High | 0.4% | 02 Feb, 2026 | PyPI khoj |
pip Path Traversal vulnerability CVE-2026-1703, GHSA-6vgw-5pg2-w6jp, PYSEC-2026-1796 | Low | 0.4% | 02 Feb, 2026 | PyPI pip |
Malicious release: Malicious code in cat-admin-tool (PyPI) MAL-2026-651 | Malicious | Not scored | 02 Feb, 2026 | PyPI cat-admin-tool |
Malicious release: Malicious code in chia-pool-reference (PyPI) MAL-2026-652 | Malicious | Not scored | 02 Feb, 2026 | PyPI chia-pool-reference |
Malicious release: Malicious code in credit-decision-metrics (PyPI) MAL-2026-653 | Malicious | Not scored | 02 Feb, 2026 | PyPI credit-decision-metrics |
Malicious release: Malicious code in zabitog (PyPI) MAL-2026-654 | Malicious | Not scored | 02 Feb, 2026 | PyPI zabitog |
Malicious release: Malicious code in tableapy (PyPI) MAL-2026-650 | Malicious | Not scored | 02 Feb, 2026 | PyPI tableapy |
Hugging Face Text Generation Inference vulnerable to Uncontrolled Resource Consumption CVE-2026-0599, GHSA-j7x9-7j54-2v3h, PYSEC-2026-1965 | High | 29.5% | 02 Feb, 2026 | PyPI text-generation |
llama-index-core vulnerable to Uncontrolled Resource Consumption CVE-2025-6208, GHSA-488g-hw5f-x29p, PYSEC-2026-1560 | Medium | 0.4% | 02 Feb, 2026 | PyPI llama-index-core |
mlflow Creates of Temporary File in Directory with Insecure Permissions BIT-mlflow-2025-10279, CVE-2025-10279, GHSA-4x5p-f36r-mxxr, PYSEC-2026-1639 | High | 0.2% | 02 Feb, 2026 | PyPI mlflow |
H2O has an External Control of File Name or Path vulnerability CVE-2024-5986, GHSA-wj3h-wx8g-x699, PYSEC-2026-353 | Critical | 0.7% | 02 Feb, 2026 | Maven ai.h2o:h2o-core PyPI h2o |
Lollms has an Improper Access Control vulnerability CVE-2026-1117, GHSA-82fw-ch24-j34w, PYSEC-2026-1586 | High | 0.6% | 02 Feb, 2026 | PyPI lollms |
Malicious release: Malicious code in callapirequests (PyPI) MAL-2026-649 | Malicious | Not scored | 02 Feb, 2026 | PyPI callapirequests |
Malicious release: Malicious code in connections-api-requests (PyPI) MAL-2026-641 | Malicious | Not scored | 02 Feb, 2026 | PyPI connections-api-requests |
Malicious release: Malicious code in connections-api-request (PyPI) MAL-2026-640 | Malicious | Not scored | 02 Feb, 2026 | PyPI connections-api-request |