Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in unclesky5910 (PyPI) MAL-2025-191664 | Malicious | Not scored | 19 Oct, 2025 | PyPI unclesky5910 |
Malicious release: Malicious code in humunculous591014 (PyPI) MAL-2025-191636 | Malicious | Not scored | 19 Oct, 2025 | PyPI humunculous591014 |
Malicious release: Malicious code in humunculous5910145 (PyPI) MAL-2025-191637 | Malicious | Not scored | 19 Oct, 2025 | PyPI humunculous5910145 |
Malicious release: Malicious code in kirux189894 (PyPI) MAL-2025-191642 | Malicious | Not scored | 19 Oct, 2025 | PyPI kirux189894 |
Malicious release: Malicious code in klsosdoids2 (PyPI) MAL-2025-191776 | Malicious | Not scored | 19 Oct, 2025 | PyPI klsosdoids2 |
Malicious release: Malicious code in huzzleup (PyPI) MAL-2025-191762 | Malicious | Not scored | 19 Oct, 2025 | PyPI huzzleup |
Malicious release: Malicious code in klsosdoids5 (PyPI) MAL-2025-191777 | Malicious | Not scored | 19 Oct, 2025 | PyPI klsosdoids5 |
Malicious release: Malicious code in abhamzufu (PyPI) MAL-2025-191670 | Malicious | Not scored | 19 Oct, 2025 | PyPI abhamzufu |
Malicious release: Malicious code in ga3fario (PyPI) MAL-2025-191627 | Malicious | Not scored | 19 Oct, 2025 | PyPI ga3fario |
Malicious release: Malicious code in ga3farifo (PyPI) MAL-2025-191626 | Malicious | Not scored | 19 Oct, 2025 | PyPI ga3farifo |
Malicious release: Malicious code in hamubika (PyPI) MAL-2025-191747 | Malicious | Not scored | 19 Oct, 2025 | PyPI hamubika |
Malicious release: Malicious code in hamurico (PyPI) MAL-2025-191628 | Malicious | Not scored | 19 Oct, 2025 | PyPI hamurico |
Malicious release: Malicious code in rizco09 (PyPI) MAL-2025-191659 | Malicious | Not scored | 19 Oct, 2025 | PyPI rizco09 |
pyquokka is Vulnerable to Remote Code Execution by Pickle Deserialization via FlightServer CVE-2025-62515, GHSA-f74j-gffq-vm9p, PYSEC-2026-503 | Critical | 0.9% | 17 Oct, 2025 | PyPI pyquokka |
Keras framework vulnerable to deserialization of untrusted data CVE-2025-49655, GHSA-cvhh-q5g5-qprp, PYSEC-2026-368 | Critical | 0.8% | 17 Oct, 2025 | PyPI keras |
Malicious release: Malicious code in ptxcompiler (PyPI) MAL-2025-191653 | Malicious | Not scored | 17 Oct, 2025 | PyPI ptxcompiler |
Malicious release: Malicious code in poc-suppentest (PyPI) MAL-2025-191652 | Malicious | Not scored | 17 Oct, 2025 | PyPI poc-suppentest |
Malicious release: Malicious code in egarcia-poc (PyPI) MAL-2025-191623 | Malicious | Not scored | 17 Oct, 2025 | PyPI egarcia-poc |
Mammoth is vulnerable to Directory Traversal CVE-2025-11849, GHSA-rmjr-87wv-gf87, PYSEC-2026-1603 | Medium | 1.1% | 17 Oct, 2025 | Maven org.zwobble.mammoth:mammoth NuGet Mammoth PyPI mammoth npm mammoth |
Malicious release: Malicious code in makronlox (PyPI) MAL-2025-191646 | Malicious | Not scored | 16 Oct, 2025 | PyPI makronlox |
Malicious release: Malicious code in musl-dev (PyPI) MAL-2025-191650 | Malicious | Not scored | 16 Oct, 2025 | PyPI musl-dev |
Malicious release: Malicious code in saintone (PyPI) MAL-2025-191862 | Malicious | Not scored | 15 Oct, 2025 | PyPI saintone |
Malicious release: Malicious code in md5-en (PyPI) MAL-2025-191649 | Malicious | Not scored | 15 Oct, 2025 | PyPI md5-en |
reflex-dev/reflex has an Open Redirect vulnerability CVE-2025-62379, GHSA-rfh5-c9h5-q8jm, PYSEC-2026-1868 | Low | 0.3% | 15 Oct, 2025 | PyPI reflex |
Apache Spark has Inadequate Encryption Strength CVE-2025-55039, GHSA-6p6v-m64v-jx8q, PYSEC-2025-184 | Medium | 0.2% | 15 Oct, 2025 | Maven org.apache.spark:spark-network-common_2.12 Maven org.apache.spark:spark-network-common_2.13 PyPI pyspark |
Home Assistant has Stored XSS vulnerability in Energy dashboard from Energy Entity Name CVE-2025-62172, GHSA-mq77-rv97-285m, PYSEC-2026-1453 | High | 0.4% | 14 Oct, 2025 | PyPI homeassistant |
Malicious release: Malicious code in tosa-serialization-lib (PyPI) MAL-2025-191908 | Malicious | Not scored | 14 Oct, 2025 | PyPI tosa-serialization-lib |
llama-index has Insecure Temporary File CVE-2025-7707, GHSA-rg9h-vx28-xxp5, PYSEC-2026-1556 | High | 0.2% | 13 Oct, 2025 | PyPI llama-index |
Malicious release: Malicious code in mcp-runcmd-server (PyPI) MAL-2025-191788 | Malicious | Not scored | 13 Oct, 2025 | PyPI mcp-runcmd-server |
Authlib : JWE zip=DEF decompression bomb enables DoS CVE-2025-62706, GHSA-g7f3-828f-7h7m, PYSEC-2026-1202 | Medium | 0.5% | 10 Oct, 2025 | PyPI authlib |
python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination CVE-2025-61912, GHSA-p34h-wq7j-h5v6, PYSEC-2026-1846 | Medium | 0.5% | 10 Oct, 2025 | PyPI python-ldap |
python-ldap has sanitization bypass in ldap.filter.escape_filter_chars CVE-2025-61911, GHSA-r7r6-cc7p-4v5m, PYSEC-2026-1847 | Medium | 0.3% | 10 Oct, 2025 | PyPI python-ldap |
Authlib is vulnerable to Denial of Service via Oversized JOSE Segments CVE-2025-61920, GHSA-pq5p-34cr-23v9, PYSEC-2026-1203 | High | 0.6% | 10 Oct, 2025 | PyPI authlib |
Malicious release: Malicious code in hexdec (PyPI) MAL-2025-191629 | Malicious | Not scored | 10 Oct, 2025 | PyPI hexdec |
Malicious release: Malicious code in python3-6 (PyPI) MAL-2025-191843 | Malicious | Not scored | 10 Oct, 2025 | PyPI python3-6 |
Malicious release: Malicious code in mcp-runcommand-server2 (PyPI) MAL-2025-191648 | Malicious | Not scored | 10 Oct, 2025 | PyPI mcp-runcommand-server2 |
Malicious release: Malicious code in mcp-runcommand-server (PyPI) MAL-2025-191647 | Malicious | Not scored | 10 Oct, 2025 | PyPI mcp-runcommand-server |
Python Social Auth - Django has unsafe account association CVE-2025-61783, GHSA-wv4w-6qv2-qqfg, PYSEC-2026-1932 | Medium | 0.5% | 09 Oct, 2025 | PyPI social-auth-app-django |
BBOT's various issues in unarchive.py can cause arbitrary file write and RCE CVE-2025-10284, GHSA-fhw8-8v9p-7jp7, PYSEC-2026-292 | Critical | 0.7% | 09 Oct, 2025 | PyPI bbot |
BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE CVE-2025-10283, GHSA-h6m2-r6h9-4c44, PYSEC-2026-293 | Critical | 0.5% | 09 Oct, 2025 | PyPI bbot |
BBOT's gitlab.py exposes globally configured "gitlab" API key CVE-2025-10282, GHSA-p3v4-c93g-cmhw, PYSEC-2026-1217 | Medium | 0.2% | 09 Oct, 2025 | PyPI bbot |
BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver CVE-2025-10281, GHSA-63wh-p5fx-h4vc, PYSEC-2026-1216 | Medium | 0.2% | 09 Oct, 2025 | PyPI bbot |
pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters CVE-2025-61773, GHSA-cjjf-27cc-pvmv, PYSEC-2026-1816 | High | 0.5% | 09 Oct, 2025 | PyPI pyload-ng |
scio is vunerable to Remote Command Execution through PyTorch GHSA-m9mp-6x32-5rhg | Critical | Not scored | 09 Oct, 2025 | PyPI scio-pypi |
Synapse's invalid device keys degrade federation functionality CVE-2025-61672, GHSA-fh66-fcv5-jjfr, PYSEC-2026-1612 | Medium | 0.5% | 08 Oct, 2025 | PyPI matrix-synapse |
Malicious release: Malicious code in anothertestproject (PyPI) MAL-2025-191681 | Malicious | Not scored | 08 Oct, 2025 | PyPI anothertestproject |
vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server CVE-2025-61620, GHSA-6fvq-23cw-5628, PYSEC-2026-2013 | Medium | Not scored | 07 Oct, 2025 | PyPI vllm |
vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class CVE-2025-6242, GHSA-3f6c-7fw2-ppm4, PYSEC-2026-2011 | High | 0.3% | 07 Oct, 2025 | PyPI vllm |
LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities CVE-2025-61784, GHSA-527m-2xhr-j27g, PYSEC-2026-1573 | High | 0.4% | 07 Oct, 2025 | PyPI llamafactory |
Wasmtime: Memory leak in C API with `externref` and `anyref` types CVE-2025-61670, GHSA-vvp9-h8p2-xwfc, PYSEC-2025-268 | Low | 0.2% | 07 Oct, 2025 | PyPI wasmtime-bin crates.io wasmtime-c-api-impl |