Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations CVE-2025-68143, GHSA-5cgr-j3jf-jw3v, PYSEC-2026-1621 | Medium | 8.1% | 17 Dec, 2025 | PyPI mcp-server-git |
Malicious release: Malicious code in trondec (PyPI) MAL-2025-192605 | Malicious | Not scored | 17 Dec, 2025 | PyPI trondec |
Duplicate Advisory: python-jose denial of service via compressed JWE content CVE-2024-29370, GHSA-h4pw-wxh7-4vjj, PYSEC-2025-185 | Medium | 0.2% | 17 Dec, 2025 | PyPI python-jose |
Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context CVE-2025-67895, GHSA-66h8-3g48-6hx8, PYSEC-2025-87, PYSEC-2026-276 | Critical | 1.2% | 17 Dec, 2025 | PyPI apache-airflow PyPI apache-airflow-providers-edge3 |
filelock has a TOCTOU race condition which allows symlink attacks during lock file creation CVE-2025-68146, GHSA-w853-jp5j-5j7f, PYSEC-2026-1375 | Medium | 0.2% | 16 Dec, 2025 | PyPI filelock |
PyMdown Extensions has a ReDOS bug in its Figure Capture extension CVE-2025-68142, GHSA-r6h4-mm7h-8pmq, PYSEC-2026-1825 | Low | 0.5% | 16 Dec, 2025 | PyPI pymdown-extensions |
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay CVE-2025-68113, GHSA-6gvq-jcmp-8959, GO-2025-4239, PYSEC-2026-1115 | Medium | 0.5% | 16 Dec, 2025 | Go github.com/altcha-org/altcha-lib-go Hex altcha Maven org.altcha:altcha Packagist altcha-org/altcha +3 more |
Weblate has a Server-Side Request Forgery issue CVE-2025-66407, GHSA-hfpv-mc5v-p9mm, PYSEC-2025-231 | Medium | 0.2% | 16 Dec, 2025 | PyPI Weblate PyPI weblate |
Fickling has Code Injection vulnerability via pty.spawn() CVE-2025-67748, GHSA-r7v6-mfhq-g3m2, PYSEC-2025-113 | High | 0.3% | 15 Dec, 2025 | PyPI fickling |
Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list CVE-2025-67747, GHSA-565g-hwwr-4pp3, PYSEC-2026-1368 | High | 0.3% | 15 Dec, 2025 | PyPI fickling |
Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR) CVE-2025-67715, GHSA-3pmh-24wp-xpf4, PYSEC-2025-233 | Medium | 0.3% | 15 Dec, 2025 | PyPI Weblate PyPI weblate |
Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration CVE-2025-67492, GHSA-pj86-258h-qrvf, PYSEC-2025-232 | Medium | 0.3% | 15 Dec, 2025 | PyPI Weblate PyPI weblate |
Weblate has improper validation upon invitation acceptance CVE-2025-64725, GHSA-m6hq-f4w9-qrjj, PYSEC-2026-2042 | Low | 0.3% | 15 Dec, 2025 | PyPI Weblate PyPI weblate |
Malicious release: Malicious code in smtblib (PyPI) MAL-2025-192579 | Malicious | Not scored | 15 Dec, 2025 | PyPI smtblib |
django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions CVE-2025-65431, GHSA-8m3c-c723-h4p4, PYSEC-2025-111 | Medium | 0.2% | 15 Dec, 2025 | PyPI django-allauth |
django-allauth does not reject access tokens for inactive users CVE-2025-65430, GHSA-qhmc-3mvr-f2j4, PYSEC-2025-110 | Medium | 0.2% | 15 Dec, 2025 | PyPI django-allauth |
Apache Airflow exposes secret values to authenticated UI users via rendered templates BIT-airflow-2025-66388, CVE-2025-66388, GHSA-fv47-pqh6-wxgq, PYSEC-2025-86 | Medium | 0.5% | 15 Dec, 2025 | PyPI apache-airflow |
Mayan EDMS has an Open Redirect through the /authentication/ file CVE-2025-14692, GHSA-x37w-7p52-8f49, PYSEC-2025-135 | Low | 0.5% | 15 Dec, 2025 | PyPI mayan-edms |
Mayan EDMS is vulnerable to XSS through the /authentication/ file CVE-2025-14691, GHSA-774q-r975-vqwp, PYSEC-2025-134 | Low | 0.5% | 14 Dec, 2025 | PyPI mayan-edms |
Universal Tool Calling Protocol (UTCP) client library for Python vulnerable to Trust Boundary Violation through Manual JSON specification CVE-2025-14542, GHSA-75mj-4g74-9rg2, PYSEC-2026-2000 | High | 0.3% | 13 Dec, 2025 | PyPI utcp |
Tornado: Quadratic DoS via Crafted Multipart Parameters CVE-2025-67726, GHSA-jhmp-mqwm-3gq8, PYSEC-2025-267 | High | 0.5% | 12 Dec, 2025 | PyPI tornado |
Tornado: Quadratic DoS via Repeated Header Coalescing CVE-2025-67725, GHSA-c98p-7wgm-6p64, PYSEC-2025-266 | High | 0.6% | 12 Dec, 2025 | PyPI tornado |
Tornado vulnerable to Header Injection and XSS via reason argument CVE-2025-67724, GHSA-pr2v-jx2c-wg9f, PYSEC-2025-265 | Medium | 0.2% | 12 Dec, 2025 | PyPI tornado |
pgadmin4 has a Meta-Command Filter Command Execution CVE-2025-13780, GHSA-fxmw-jcgr-w44v, PYSEC-2026-450 | Critical | 0.9% | 11 Dec, 2025 | PyPI pgadmin4 |
Malicious release: Malicious code in yzip (PyPI) MAL-2025-192468 | Malicious | Not scored | 11 Dec, 2025 | PyPI yzip |
Malicious release: Malicious code in gxzip (PyPI) MAL-2025-192467 | Malicious | Not scored | 10 Dec, 2025 | PyPI gxzip |
Pyrofork has a Path Traversal in download_media Method CVE-2025-67720, GHSA-6h2f-wjhf-4wjx, PYSEC-2026-1841 | Medium | 0.3% | 10 Dec, 2025 | PyPI pyrofork |
Malicious release: Malicious code in netbenchkit (PyPI) MAL-2025-192437 | Malicious | Not scored | 10 Dec, 2025 | PyPI netbenchkit |
Malicious release: Malicious code in synium (PyPI) MAL-2025-192438 | Malicious | Not scored | 10 Dec, 2025 | PyPI synium |
Malicious release: Malicious code in jsonschema-utf8 (PyPI) MAL-2025-192436 | Malicious | Not scored | 10 Dec, 2025 | PyPI jsonschema-utf8 |
Malicious release: Malicious code in loguru-utf8 (PyPI) MAL-2025-192435 | Malicious | Not scored | 10 Dec, 2025 | PyPI loguru-utf8 |
Malicious release: Malicious code in ctosec-appsec-wb-xray-adapters (PyPI) MAL-2025-192431 | Malicious | Not scored | 10 Dec, 2025 | PyPI ctosec-appsec-wb-xray-adapters |
Malicious release: Malicious code in kzip (PyPI) MAL-2025-192432 | Malicious | Not scored | 10 Dec, 2025 | PyPI kzip |
Malicious release: Malicious code in bigpyx (PyPI) MAL-2025-192430 | Malicious | Not scored | 10 Dec, 2025 | PyPI bigpyx |
LangGraph's SQLite is vulnerable to SQL injection via metadata filter key in SQLite checkpointer list method CVE-2025-67644, GHSA-9rwj-6rc7-p77c, PYSEC-2026-1530 | High | 2.3% | 10 Dec, 2025 | PyPI langgraph-checkpoint-sqlite |
Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool CVE-2025-67511, GHSA-4c65-9gqf-4w8h, PYSEC-2026-302 | Critical | 2.0% | 09 Dec, 2025 | PyPI cai-framework |
Malicious release: Malicious code in helloharry123c (PyPI) MAL-2025-192396 | Malicious | Not scored | 09 Dec, 2025 | PyPI helloharry123c |
Malicious release: Malicious code in ctosec-appsec-wb-xray-adapter (PyPI) MAL-2025-192393 | Malicious | Not scored | 09 Dec, 2025 | PyPI ctosec-appsec-wb-xray-adapter |
Malicious release: Malicious code in ajenti-plugin-testing-pyld (PyPI) MAL-2025-192392 | Malicious | Not scored | 09 Dec, 2025 | PyPI ajenti-plugin-testing-pyld |
HTTP/HTTPS Traffic Interception Bypass in mad-proxy CVE-2025-67485, GHSA-wx63-35hw-2482, PYSEC-2026-1596 | Medium | 0.2% | 09 Dec, 2025 | PyPI mad-proxy |
Malicious release: Malicious code in bignum (PyPI) MAL-2025-192391 | Malicious | Not scored | 09 Dec, 2025 | PyPI bignum |
Open Redirect Vulnerability in Taguette CVE-2025-67502, GHSA-5923-r76v-mprm, PYSEC-2026-1948 | Medium | 0.3% | 09 Dec, 2025 | PyPI taguette |
NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read CVE-2025-66645, GHSA-hxp3-63hc-5366, PYSEC-2026-1700 | High | 1.1% | 09 Dec, 2025 | PyPI nicegui |
Malicious release: Malicious code in do-not-install-this-package-001 (PyPI) MAL-2025-192387 | Malicious | Not scored | 09 Dec, 2025 | PyPI do-not-install-this-package-001 |
Malicious release: Malicious code in telcoo (PyPI) MAL-2025-192386 | Malicious | Not scored | 09 Dec, 2025 | PyPI telcoo |
Malicious release: Malicious code in graphsync (PyPI) MAL-2025-192385 | Malicious | Not scored | 09 Dec, 2025 | PyPI graphsync |
Malicious release: Malicious code in raft-dask (PyPI) MAL-2025-192382 | Malicious | Not scored | 09 Dec, 2025 | PyPI raft-dask |
Malicious release: Malicious code in sketchfab-spinner (PyPI) MAL-2025-192380 | Malicious | Not scored | 09 Dec, 2025 | PyPI sketchfab-spinner |
Malicious release: Malicious code in helloharry123p (PyPI) MAL-2025-192379 | Malicious | Not scored | 08 Dec, 2025 | PyPI helloharry123p |
NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content CVE-2025-66470, GHSA-2m4f-cg75-76w2, PYSEC-2026-1696 | Medium | 0.3% | 08 Dec, 2025 | PyPI nicegui |