Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in aoohttp (PyPI) MAL-2026-37 | Malicious | Not scored | 04 Jan, 2026 | PyPI aoohttp |
Malicious release: Malicious code in auohttp (PyPI) MAL-2026-38 | Malicious | Not scored | 04 Jan, 2026 | PyPI auohttp |
Malicious release: Malicious code in aiohtto (PyPI) MAL-2026-36 | Malicious | Not scored | 04 Jan, 2026 | PyPI aiohtto |
Malicious release: Malicious code in blobhunter-depconf-poc (PyPI) MAL-2026-33 | Malicious | Not scored | 04 Jan, 2026 | PyPI blobhunter-depconf-poc |
Malicious release: Malicious code in telstra (PyPI) MAL-2026-31 | Malicious | Not scored | 03 Jan, 2026 | PyPI telstra |
Malicious release: Malicious code in chrome-stealth (PyPI) MAL-2026-28 | Malicious | Not scored | 03 Jan, 2026 | PyPI chrome-stealth |
Malicious release: Malicious code in qdatainstaller (PyPI) MAL-2026-27 | Malicious | Not scored | 03 Jan, 2026 | PyPI qdatainstaller |
Langflow Missing Authentication on Critical API Endpoints CVE-2026-21445, GHSA-c5cp-vx83-jhqx, PYSEC-2026-1524, PYSEC-2026-2571 | High | 33.3% | 02 Jan, 2026 | PyPI langflow PyPI langflow-base |
Malicious release: Malicious code in pdatainstaller (PyPI) MAL-2026-26 | Malicious | Not scored | 02 Jan, 2026 | PyPI pdatainstaller |
Malicious release: Malicious code in gatr (PyPI) MAL-2026-7 | Malicious | Not scored | 02 Jan, 2026 | PyPI gatr |
Malicious release: Malicious code in ziphash (PyPI) MAL-2026-6 | Malicious | Not scored | 01 Jan, 2026 | PyPI ziphash |
Malicious release: Malicious code in queryservice-client (PyPI) MAL-2026-5 | Malicious | Not scored | 01 Jan, 2026 | PyPI queryservice-client |
Malicious release: Malicious code in sfnt2woff-zopfli (PyPI) MAL-2026-1 | Malicious | Not scored | 01 Jan, 2026 | PyPI sfnt2woff-zopfli |
Feast vulnerable to Deserialization of Untrusted Data CVE-2025-11157, GHSA-34wm-4hw7-qfjv, PYSEC-2026-1366 | High | 0.3% | 01 Jan, 2026 | PyPI feast |
Malicious release: Malicious code in requeses (PyPI) MAL-2025-193011 | Malicious | Not scored | 31 Dec, 2025 | PyPI requeses |
Malicious release: Malicious code in pyrogrqm (PyPI) MAL-2025-193010 | Malicious | Not scored | 31 Dec, 2025 | PyPI pyrogrqm |
Malicious release: Malicious code in telegreph (PyPI) MAL-2025-193008 | Malicious | Not scored | 31 Dec, 2025 | PyPI telegreph |
Malicious release: Malicious code in aiogrem (PyPI) MAL-2025-193007 | Malicious | Not scored | 31 Dec, 2025 | PyPI aiogrem |
Malicious release: Malicious code in accesspdp (PyPI) MAL-2025-193006 | Malicious | Not scored | 31 Dec, 2025 | PyPI accesspdp |
Malicious release: Malicious code in brolool4141412 (PyPI) MAL-2025-192989 | Malicious | Not scored | 31 Dec, 2025 | PyPI brolool4141412 |
Malicious release: Malicious code in broooxddd1414 (PyPI) MAL-2025-192990 | Malicious | Not scored | 31 Dec, 2025 | PyPI broooxddd1414 |
Malicious release: Malicious code in weorewfoi2393 (PyPI) MAL-2025-192993 | Malicious | Not scored | 31 Dec, 2025 | PyPI weorewfoi2393 |
Malicious release: Malicious code in pyrogrem (PyPI) MAL-2025-192991 | Malicious | Not scored | 31 Dec, 2025 | PyPI pyrogrem |
Malicious release: Malicious code in umap (PyPI) MAL-2025-192992 | Malicious | Not scored | 31 Dec, 2025 | PyPI umap |
libsodium has Incomplete List of Disallowed Inputs CVE-2025-69277, GHSA-mrfv-m5wm-5w6w, PYSEC-2026-1448, PYSEC-2026-3002 | Medium | 0.2% | 31 Dec, 2025 | Packagist paragonie/sodium_compat PyPI PyNaCl PyPI hdwallet PyPI pynacl |
CBORDecoder reuse can leak shareable values across decode calls CVE-2025-68131, GHSA-wcj4-jw5j-44wh, PYSEC-2025-90 | Medium | 0.5% | 31 Dec, 2025 | PyPI cbor2 |
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter CVE-2025-71367, GHSA-46h3-79wf-xr6c | High | 0.6% | 30 Dec, 2025 | PyPI picklescan |
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller CVE-2025-71375, GHSA-955r-x9j8-7rhh | High | 0.5% | 30 Dec, 2025 | PyPI picklescan |
Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length CVE-2025-71339, GHSA-6556-fwc2-fg2p, PYSEC-2026-1783 | High | 0.4% | 30 Dec, 2025 | PyPI picklescan |
Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef CVE-2025-71372, GHSA-rrxm-2pvv-m66x | High | 0.5% | 30 Dec, 2025 | PyPI picklescan |
Malicious release: Malicious code in rippling-cli (PyPI) MAL-2025-192962 | Malicious | Not scored | 30 Dec, 2025 | PyPI rippling-cli |
Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.param_eval CVE-2025-71347, GHSA-cffc-mxrf-mhh4 | High | 0.6% | 29 Dec, 2025 | PyPI picklescan |
Malicious release: Malicious code in awsutil (PyPI) MAL-2025-192961 | Malicious | Not scored | 29 Dec, 2025 | PyPI awsutil |
Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval CVE-2025-71365, GHSA-3329-ghmp-jmv5, PYSEC-2026-4131 | High | 0.4% | 29 Dec, 2025 | PyPI picklescan |
Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller CVE-2025-71373, GHSA-x843-g5mx-g377 | High | 0.6% | 29 Dec, 2025 | PyPI picklescan |
Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef CVE-2025-71362, GHSA-r8g5-cgf2-4m4m | High | 0.4% | 29 Dec, 2025 | PyPI picklescan |
Picklescan Bypasses Unsafe Globals Check using pty.spawn CVE-2025-71322, GHSA-hgrh-qx5j-jfwx, PYSEC-2026-1790 | High | 0.4% | 29 Dec, 2025 | PyPI picklescan |
Picklescan missing detection when calling pty.spawn GHSA-vqmv-47xg-9wpr | High | Not scored | 29 Dec, 2025 | PyPI picklescan |
Picklescan has Incomplete List of Disallowed Inputs CVE-2025-71320, GHSA-84r2-jw7c-4r5q, PYSEC-2026-1785 | Critical | 0.8% | 29 Dec, 2025 | PyPI picklescan |
Picklescan does not block ctypes CVE-2025-71323, GHSA-4675-36f9-wf6r, PYSEC-2026-1782 | Critical | 1.0% | 29 Dec, 2025 | PyPI picklescan |
Picklescan vulnerable to Arbitrary File Writing CVE-2025-71321, GHSA-m273-6v24-x4m4, PYSEC-2026-1791 | Critical | 0.8% | 29 Dec, 2025 | PyPI picklescan |
Malicious release: Malicious code in smtmlib (PyPI) MAL-2025-192958 | Malicious | Not scored | 29 Dec, 2025 | PyPI smtmlib |
Malicious release: Malicious code in cryptozip (PyPI) MAL-2025-192956 | Malicious | Not scored | 28 Dec, 2025 | PyPI cryptozip |
Malicious release: Malicious code in aiogram-types-v3 (PyPI) MAL-2025-192953 | Malicious | Not scored | 28 Dec, 2025 | PyPI aiogram-types-v3 |
Malicious release: Malicious code in extrazip (PyPI) MAL-2025-192948 | Malicious | Not scored | 27 Dec, 2025 | PyPI extrazip |
Malicious release: Malicious code in crypo (PyPI) MAL-2025-192947 | Malicious | Not scored | 27 Dec, 2025 | PyPI crypo |
Malicious release: Malicious code in crpto (PyPI) MAL-2025-192946 | Malicious | Not scored | 27 Dec, 2025 | PyPI crpto |
Malicious release: Malicious code in flaask (PyPI) MAL-2025-192945 | Malicious | Not scored | 27 Dec, 2025 | PyPI flaask |
FastMCP updated to MCP 1.23+ due to CVE-2025-66416 GHSA-rcfx-77hg-w2wv | High | Not scored | 26 Dec, 2025 | PyPI fastmcp |
Malicious release: Malicious code in telebot-bot (PyPI) MAL-2025-192942 | Malicious | Not scored | 26 Dec, 2025 | PyPI telebot-bot |