Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
pretix has Email Content Injection Through Maliciously Formatted Names CVE-2025-13742, GHSA-2mm6-624x-fqrr, PYSEC-2025-154 | Low | 0.2% | 27 Nov, 2025 | PyPI pretix |
Malicious release: Malicious code in threading-helper (PyPI) MAL-2025-191898 | Malicious | Not scored | 27 Nov, 2025 | PyPI threading-helper |
Malicious release: Malicious code in dev-server-python (PyPI) MAL-2025-191717 | Malicious | Not scored | 27 Nov, 2025 | PyPI dev-server-python |
Malicious release: Malicious code in gptall (PyPI) MAL-2025-191742 | Malicious | Not scored | 27 Nov, 2025 | PyPI gptall |
Ray's New Token Authentication is Disabled By Default CVE-2025-34351, GHSA-gx77-xgc2-4888, PYSEC-2026-518 | Critical | Not scored | 27 Nov, 2025 | PyPI ray |
Spotipy has a XSS vulnerability in its OAuth callback server CVE-2025-66040, GHSA-r77h-rpp9-w2xm, PYSEC-2026-1937 | Low | 0.2% | 27 Nov, 2025 | PyPI spotipy |
Malicious release: Malicious code in discordhelper-ecr (PyPI) MAL-2025-191719 | Malicious | Not scored | 26 Nov, 2025 | PyPI discordhelper-ecr |
Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack CVE-2025-62593, GHSA-q279-jhrf-cc6v, PYSEC-2026-520 | CriticalExploited | 60.2% | 26 Nov, 2025 | PyPI ray |
Overhang Tutor Discloses Sensitive Information due to Improper Cache-Control CVE-2025-65681, GHSA-gq25-78jf-v78c, PYSEC-2025-219 | Low | 0.2% | 26 Nov, 2025 | PyPI tutor |
OpenStack's Mistral Client has a local file inclusion vulnerability CVE-2021-4472, GHSA-75hx-6r6j-hw56, PYSEC-2026-1849 | Medium | 0.5% | 26 Nov, 2025 | PyPI python-mistralclient |
Malicious release: Malicious code in rtcplogin (PyPI) MAL-2025-191858 | Malicious | Not scored | 26 Nov, 2025 | PyPI rtcplogin |
Malicious release: Malicious code in tablates (PyPI) MAL-2025-191534 | Malicious | Not scored | 26 Nov, 2025 | PyPI tablates |
Malicious release: Malicious code in hooktest2 (PyPI) MAL-2025-191483 | Malicious | Not scored | 26 Nov, 2025 | PyPI hooktest2 |
Malicious release: Malicious code in atlassian-praz (PyPI) MAL-2025-191476 | Malicious | Not scored | 26 Nov, 2025 | PyPI atlassian-praz |
Malicious release: Malicious code in atlassian-exp (PyPI) MAL-2025-191475 | Malicious | Not scored | 26 Nov, 2025 | PyPI atlassian-exp |
Malicious release: Malicious code in rtcpstream (PyPI) MAL-2025-191859 | Malicious | Not scored | 25 Nov, 2025 | PyPI rtcpstream |
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer CVE-2025-62703, GHSA-xv5p-fjw5-vrj6, PYSEC-2026-1399 | High | 0.8% | 25 Nov, 2025 | PyPI fugue |
Malicious release: Malicious code in hexcon (PyPI) MAL-2025-191755 | Malicious | Not scored | 25 Nov, 2025 | PyPI hexcon |
Malicious release: Malicious code in tableate (PyPI) MAL-2025-191535 | Malicious | Not scored | 25 Nov, 2025 | PyPI tableate |
OMERO.web uses jquery-form library, which may be vulnerable to XSS attack GHSA-j4gv-6x9v-v23g | Low | Not scored | 24 Nov, 2025 | PyPI omero-web |
Malicious release: Malicious code in pyrtp (PyPI) MAL-2025-191837 | Malicious | Not scored | 24 Nov, 2025 | PyPI pyrtp |
Malicious release: Malicious code in rtcpy (PyPI) MAL-2025-191860 | Malicious | Not scored | 24 Nov, 2025 | PyPI rtcpy |
pypdf's LZWDecode streams be manipulated to exhaust RAM CVE-2025-66019, GHSA-m449-cwjh-6pw7, PYSEC-2026-1832 | Medium | 0.4% | 24 Nov, 2025 | PyPI pypdf |
Malicious release: Malicious code in aounitaounit2 (PyPI) MAL-2025-191682 | Malicious | Not scored | 24 Nov, 2025 | PyPI aounitaounit2 |
Malicious release: Malicious code in chicopute (PyPI) MAL-2025-191700 | Malicious | Not scored | 24 Nov, 2025 | PyPI chicopute |
Malicious release: Malicious code in aiostreams (PyPI) MAL-2025-191675 | Malicious | Not scored | 24 Nov, 2025 | PyPI aiostreams |
Malicious release: Malicious code in jsonschemex (PyPI) MAL-2025-191769 | Malicious | Not scored | 24 Nov, 2025 | PyPI jsonschemex |
Keylime allows users to register new agents by recycling existing UUIDs when using different TPM devices CVE-2025-13609, GHSA-xh5w-g8gq-r3v9, PYSEC-2025-77 | High | 0.5% | 24 Nov, 2025 | PyPI keylime |
Malicious release: Malicious code in evil-py-argo-shell (PyPI) MAL-2025-191722 | Malicious | Not scored | 24 Nov, 2025 | PyPI evil-py-argo-shell |
Malicious release: Malicious code in mongland (PyPI) MAL-2025-191794 | Malicious | Not scored | 24 Nov, 2025 | PyPI mongland |
Malicious release: Malicious code in zakuchienne (PyPI) MAL-2025-191940 | Malicious | Not scored | 24 Nov, 2025 | PyPI zakuchienne |
Malicious release: Malicious code in mescouilles (PyPI) MAL-2025-191790 | Malicious | Not scored | 23 Nov, 2025 | PyPI mescouilles |
Malicious release: Malicious code in testingpkgja (PyPI) MAL-2025-191894 | Malicious | Not scored | 23 Nov, 2025 | PyPI testingpkgja |
Malicious release: Malicious code in hooktest1 (PyPI) MAL-2025-191760 | Malicious | Not scored | 23 Nov, 2025 | PyPI hooktest1 |
Malicious release: Malicious code in speed-testing-vps (PyPI) MAL-2025-191875 | Malicious | Not scored | 23 Nov, 2025 | PyPI speed-testing-vps |
Malicious release: Malicious code in minizip (PyPI) MAL-2025-191792 | Malicious | Not scored | 23 Nov, 2025 | PyPI minizip |
Malicious release: Malicious code in hexdecnet (PyPI) MAL-2025-191758 | Malicious | Not scored | 23 Nov, 2025 | PyPI hexdecnet |
Malicious release: Malicious code in uuzip (PyPI) MAL-2025-191918 | Malicious | Not scored | 22 Nov, 2025 | PyPI uuzip |
Malicious release: Malicious code in mzip (PyPI) MAL-2025-191799 | Malicious | Not scored | 22 Nov, 2025 | PyPI mzip |
Malicious release: Malicious code in uzip (PyPI) MAL-2025-191919 | Malicious | Not scored | 22 Nov, 2025 | PyPI uzip |
Malicious release: Malicious code in aiogram-msgeffect (PyPI) MAL-2025-191674 | Malicious | Not scored | 22 Nov, 2025 | PyPI aiogram-msgeffect |
Malicious release: Malicious code in nspacercesolve (PyPI) MAL-2025-191805 | Malicious | Not scored | 22 Nov, 2025 | PyPI nspacercesolve |
Malicious release: Malicious code in tgeffect (PyPI) MAL-2025-191897 | Malicious | Not scored | 22 Nov, 2025 | PyPI tgeffect |
Malicious release: Malicious code in voicemetterr (PyPI) MAL-2025-191921 | Malicious | Not scored | 21 Nov, 2025 | PyPI voicemetterr |
MLX has Wild Pointer Dereference in load_gguf() CVE-2025-62609, GHSA-j842-xgm4-wf88, PYSEC-2025-139 | Medium | 0.4% | 21 Nov, 2025 | PyPI mlx |
MLX has heap-buffer-overflow in load() CVE-2025-62608, GHSA-w6vg-jg77-2qg6, PYSEC-2025-138 | Medium | 0.6% | 21 Nov, 2025 | PyPI mlx |
Malicious release: Malicious code in kdewebhelper (PyPI) MAL-2025-191772 | Malicious | Not scored | 20 Nov, 2025 | PyPI kdewebhelper |
vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs` CVE-2025-62426, GHSA-69j4-grxj-j64p, PYSEC-2026-2012 | Medium | 0.5% | 20 Nov, 2025 | PyPI vllm |
vLLM vulnerable to DoS with incorrect shape of multimodal embedding inputs CVE-2025-62372, GHSA-pmqf-x6x8-p7qw, PYSEC-2026-2019 | High | 0.4% | 20 Nov, 2025 | PyPI vllm |
vLLM deserialization vulnerability leading to DoS and potential RCE CVE-2025-62164, GHSA-mrw7-hf4f-83pf, PYSEC-2026-2018 | High | 1.0% | 20 Nov, 2025 | PyPI vllm |