Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
FastMCP vulnerable to reflected XSS in client's callback page CVE-2025-62800, GHSA-mxxr-jv3v-6pgc, PYSEC-2026-1364 | Medium | 0.3% | 28 Oct, 2025 | PyPI fastmcp |
Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse`` CVE-2025-62727, GHSA-7f5h-v6xp-fcq8, PYSEC-2026-1942 | High | 0.8% | 28 Oct, 2025 | PyPI starlette |
Malicious release: Malicious code in speedd-testing-bot (PyPI) MAL-2025-191876 | Malicious | Not scored | 28 Oct, 2025 | PyPI speedd-testing-bot |
pg8000 SQL injection vulnerability via a specially crafted Python list input CVE-2025-61385, GHSA-wq2g-r956-j8cc, PYSEC-2026-1766 | Critical | 0.4% | 27 Oct, 2025 | PyPI pg8000 |
Malicious release: Malicious code in aiohappyeyeball (PyPI) MAL-2025-191616 | Malicious | Not scored | 27 Oct, 2025 | PyPI aiohappyeyeball |
Malicious release: Malicious code in httpserver-cache (PyPI) MAL-2025-191632 | Malicious | Not scored | 27 Oct, 2025 | PyPI httpserver-cache |
Malicious release: Malicious code in donotinstall (PyPI) MAL-2025-191622 | Malicious | Not scored | 26 Oct, 2025 | PyPI donotinstall |
Malicious release: Malicious code in syschecker (PyPI) MAL-2025-191663 | Malicious | Not scored | 26 Oct, 2025 | PyPI syschecker |
Malicious release: Malicious code in windowsrequir (PyPI) MAL-2025-191665 | Malicious | Not scored | 26 Oct, 2025 | PyPI windowsrequir |
LangGraph's SQLite store implementation has a SQL Injection Vulnerability CVE-2025-8709, GHSA-4h97-wpxp-3757, PYSEC-2026-1528 | High | 0.2% | 26 Oct, 2025 | PyPI langgraph-checkpoint-sqlite |
Malicious release: Malicious code in hexdecli (PyPI) MAL-2025-191630 | Malicious | Not scored | 25 Oct, 2025 | PyPI hexdecli |
Malicious release: Malicious code in benign-lib (PyPI) MAL-2025-191620 | Malicious | Not scored | 25 Oct, 2025 | PyPI benign-lib |
Malicious release: Malicious code in python3-autopep8 (PyPI) MAL-2025-191844 | Malicious | Not scored | 25 Oct, 2025 | PyPI python3-autopep8 |
Malicious release: Malicious code in statsapi (PyPI) MAL-2025-191878 | Malicious | Not scored | 25 Oct, 2025 | PyPI statsapi |
Malicious release: Malicious code in ethaddrlib (PyPI) MAL-2025-191624 | Malicious | Not scored | 25 Oct, 2025 | PyPI ethaddrlib |
Malicious release: Malicious code in hexdecpy (PyPI) MAL-2025-191631 | Malicious | Not scored | 24 Oct, 2025 | PyPI hexdecpy |
Malicious release: Malicious code in aiohttp-openssl (PyPI) MAL-2025-191617 | Malicious | Not scored | 24 Oct, 2025 | PyPI aiohttp-openssl |
Malicious release: Malicious code in web3eth (PyPI) MAL-2025-48910 | Malicious | Not scored | 23 Oct, 2025 | PyPI web3eth |
Malicious release: Malicious code in trstk (PyPI) MAL-2025-48909 | Malicious | Not scored | 23 Oct, 2025 | PyPI trstk |
Malicious release: Malicious code in testpackageclaim (PyPI) MAL-2025-48902 | Malicious | Not scored | 23 Oct, 2025 | PyPI testpackageclaim |
Malicious release: Malicious code in test422 (PyPI) MAL-2025-48900 | Malicious | Not scored | 23 Oct, 2025 | PyPI test422 |
Malicious release: Malicious code in testpackage-hello (PyPI) MAL-2025-48901 | Malicious | Not scored | 23 Oct, 2025 | PyPI testpackage-hello |
Malicious release: Malicious code in test421 (PyPI) MAL-2025-48899 | Malicious | Not scored | 23 Oct, 2025 | PyPI test421 |
Malicious release: Malicious code in request-unitest (PyPI) MAL-2025-48897 | Malicious | Not scored | 23 Oct, 2025 | PyPI request-unitest |
Malicious release: Malicious code in my-test-packagexx (PyPI) MAL-2025-48894 | Malicious | Not scored | 23 Oct, 2025 | PyPI my-test-packagexx |
Malicious release: Malicious code in image2hex (PyPI) MAL-2025-48893 | Malicious | Not scored | 23 Oct, 2025 | PyPI image2hex |
Malicious release: Malicious code in aiohttp-ssl (PyPI) MAL-2025-191618 | Malicious | Not scored | 23 Oct, 2025 | PyPI aiohttp-ssl |
pypdf can exhaust RAM via manipulated LZWDecode streams CVE-2025-62708, GHSA-jfx9-29x2-rv3j, PYSEC-2026-1831 | Medium | 0.4% | 22 Oct, 2025 | PyPI pypdf |
pypdf possibly loops infinitely when reading DCT inline images without EOF marker CVE-2025-62707, GHSA-vr63-x8vc-m265, PYSEC-2026-1833 | Medium | 0.4% | 22 Oct, 2025 | PyPI pypdf |
Malicious release: Malicious code in smart-scheduler (PyPI) MAL-2025-191661 | Malicious | Not scored | 22 Oct, 2025 | PyPI smart-scheduler |
aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server CVE-2025-62611, GHSA-r397-ff8c-wv2g, PYSEC-2026-1110 | High | 0.4% | 22 Oct, 2025 | PyPI aiomysql |
Scapy Session Loading Vulnerable to Arbitrary Code Execution via Untrusted Pickle Deserialization GHSA-cq46-m9x9-j8w2 | Medium | Not scored | 22 Oct, 2025 | PyPI scapy |
Malicious release: Malicious code in requests-os (PyPI) MAL-2025-191657 | Malicious | Not scored | 22 Oct, 2025 | PyPI requests-os |
Hugging Face Smolagents XPath injection vulnerability in the search_item_ctrl_f function CVE-2025-11844, GHSA-8mf9-rmgw-33qc, PYSEC-2026-1930 | Medium | 0.3% | 22 Oct, 2025 | PyPI smolagents |
Malicious release: Malicious code in lbank-connector-pythons (PyPI) MAL-2025-191644 | Malicious | Not scored | 22 Oct, 2025 | PyPI lbank-connector-pythons |
Malicious release: Malicious code in asynhttp (PyPI) MAL-2025-191619 | Malicious | Not scored | 22 Oct, 2025 | PyPI asynhttp |
Malicious release: Malicious code in libtasnl (PyPI) MAL-2025-191645 | Malicious | Not scored | 22 Oct, 2025 | PyPI libtasnl |
Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL CVE-2025-62607, GHSA-535g-62r7-cx6v, PYSEC-2026-1690 | Medium | 0.3% | 21 Oct, 2025 | PyPI nautobot-ssot |
uv has differential in tar extraction with PAX headers GHSA-w476-p2h3-79g9 | Low | Not scored | 21 Oct, 2025 | PyPI uv |
Malicious release: Malicious code in installyoura (PyPI) MAL-2025-191641 | Malicious | Not scored | 21 Oct, 2025 | PyPI installyoura |
Taguette vulnerable to cross-site scripting via tag name, tag description, document name and document description CVE-2025-62528, GHSA-g9qw-g6rv-3889, PYSEC-2025-188 | Medium | 0.2% | 20 Oct, 2025 | PyPI taguette |
Taguette password reset link poisoning CVE-2025-62527, GHSA-7rc8-5c8q-jr6j, PYSEC-2025-187 | High | 0.3% | 20 Oct, 2025 | PyPI taguette |
Malicious release: Malicious code in pytelegramapi (PyPI) MAL-2025-191838 | Malicious | Not scored | 20 Oct, 2025 | PyPI pytelegramapi |
Malicious release: Malicious code in yelp-pkg (PyPI) MAL-2025-191666 | Malicious | Not scored | 20 Oct, 2025 | PyPI yelp-pkg |
Malicious release: Malicious code in huzzleuo130 (PyPI) MAL-2025-191638 | Malicious | Not scored | 19 Oct, 2025 | PyPI huzzleuo130 |
Malicious release: Malicious code in cheezokdi10 (PyPI) MAL-2025-191621 | Malicious | Not scored | 19 Oct, 2025 | PyPI cheezokdi10 |
Malicious release: Malicious code in humunculous5910 (PyPI) MAL-2025-191634 | Malicious | Not scored | 19 Oct, 2025 | PyPI humunculous5910 |
Malicious release: Malicious code in rando0192490 (PyPI) MAL-2025-191655 | Malicious | Not scored | 19 Oct, 2025 | PyPI rando0192490 |
Malicious release: Malicious code in humunculous59101 (PyPI) MAL-2025-191635 | Malicious | Not scored | 19 Oct, 2025 | PyPI humunculous59101 |
Malicious release: Malicious code in humunaiodio2443 (PyPI) MAL-2025-191633 | Malicious | Not scored | 19 Oct, 2025 | PyPI humunaiodio2443 |