Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in pokemon-app-sdk (PyPI) MAL-2025-191815 | Malicious | Not scored | 13 Sep, 2025 | PyPI pokemon-app-sdk |
Malicious release: Malicious code in datetime-zones (PyPI) MAL-2025-47756 | Malicious | Not scored | 13 Sep, 2025 | PyPI datetime-zones |
Malicious release: Malicious code in tronkeypy (PyPI) MAL-2025-47807 | Malicious | Not scored | 12 Sep, 2025 | PyPI tronkeypy |
Malicious release: Malicious code in consolecolornew (PyPI) MAL-2025-47754 | Malicious | Not scored | 12 Sep, 2025 | PyPI consolecolornew |
Malicious release: Malicious code in tronkeyspy (PyPI) MAL-2025-47808 | Malicious | Not scored | 12 Sep, 2025 | PyPI tronkeyspy |
Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer CVE-2025-6638, GHSA-59p9-h35m-wg4g, PYSEC-2026-1981 | High | 0.6% | 12 Sep, 2025 | PyPI transformers |
Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods CVE-2025-58065, GHSA-765j-9r45-w2q2, PYSEC-2026-1378 | Medium | 0.4% | 11 Sep, 2025 | PyPI flask-appbuilder |
Neo4j Cypher MCP server is vulnerable to DNS rebinding CVE-2025-10193, GHSA-vcqx-v2mg-7chx, PYSEC-2026-1620 | High | 0.2% | 11 Sep, 2025 | PyPI mcp-neo4j-cypher |
xml2rfc is vulnerable to arbitrary file reads through prepped files CVE-2025-11059, GHSA-9mv7-3c64-mmqw, PYSEC-2026-2057 | High | Not scored | 10 Sep, 2025 | PyPI xml2rfc |
Picklescan Bypass is Possible via File Extension Mismatch CVE-2025-10155, GHSA-jgw4-cr84-mqxg, PYSEC-2025-151 | Critical | 0.8% | 10 Sep, 2025 | PyPI picklescan |
Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check CVE-2025-10156, GHSA-mjqp-26hc-grxg, PYSEC-2025-152 | Critical | 1.5% | 10 Sep, 2025 | PyPI picklescan |
Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports CVE-2025-10157, GHSA-f7qq-56ww-84cr, PYSEC-2025-153 | Critical | 0.8% | 10 Sep, 2025 | PyPI picklescan |
Indico vulnerable to Cross-Site Scripting via LaTeX math code CVE-2025-59035, GHSA-7cf7-9wrr-vrf4, PYSEC-2026-1461 | Medium | 0.2% | 10 Sep, 2025 | PyPI indico |
Indico may disclose unauthorized user details access via legacy API CVE-2025-59034, GHSA-4269-mcfh-cp7q, PYSEC-2026-1460 | Medium | 0.3% | 10 Sep, 2025 | PyPI indico |
PyInstaller has local privilege escalation vulnerability CVE-2025-59042, GHSA-p2xp-xx3r-mffc, PYSEC-2026-1813 | High | 0.1% | 09 Sep, 2025 | PyPI pyinstaller |
Infrahub: Deleted and expired API tokens can still authenticate CVE-2025-59036, GHSA-v2p7-4pv4-3wwh, PYSEC-2026-1463 | Medium | 0.2% | 09 Sep, 2025 | PyPI infrahub-server |
Malicious release: Malicious code in venomenallib (PyPI) MAL-2025-191920 | Malicious | Not scored | 09 Sep, 2025 | PyPI venomenallib |
Malicious release: Malicious code in zenomenallib (PyPI) MAL-2025-47814 | Malicious | Not scored | 09 Sep, 2025 | PyPI zenomenallib |
Malicious release: Malicious code in denomenallib (PyPI) MAL-2025-191716 | Malicious | Not scored | 09 Sep, 2025 | PyPI denomenallib |
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload CVE-2025-58180, GHSA-49mj-x8jp-qvfc, PYSEC-2026-1712 | High | 22.1% | 09 Sep, 2025 | PyPI octoprint |
Malicious release: Malicious code in fenomenallib (PyPI) MAL-2025-191727 | Malicious | Not scored | 09 Sep, 2025 | PyPI fenomenallib |
SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor CVE-2025-10164, GHSA-9w53-xr52-mwgj, PYSEC-2026-1919 | Medium | 0.4% | 09 Sep, 2025 | PyPI sglang |
Malicious release: Malicious code in cti-ctf-challenges (PyPI) MAL-2025-191709 | Malicious | Not scored | 09 Sep, 2025 | PyPI cti-ctf-challenges |
copyparty: Sharing a single file does not fully restrict access to other files in source folder CVE-2025-58753, GHSA-pxvw-4w88-6x95, PYSEC-2026-1279 | Medium | 0.4% | 09 Sep, 2025 | PyPI copyparty |
Monai: Unsafe use of Pickle deserialization may lead to RCE CVE-2025-58757, GHSA-p8cm-mm2v-gwjm, PYSEC-2025-142 | High | 0.6% | 09 Sep, 2025 | PyPI monai |
MONAI: Unsafe torch usage may lead to arbitrary code execution CVE-2025-58756, GHSA-6vm5-6jv9-rjpj, PYSEC-2025-141 | High | 0.8% | 09 Sep, 2025 | PyPI monai |
MONAI does not prevent path traversal, potentially leading to arbitrary file writes CVE-2025-58755, GHSA-x6ww-pf9m-m73m, PYSEC-2025-140 | High | 0.6% | 09 Sep, 2025 | PyPI monai |
Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation CVE-2025-57817, GHSA-hjfh-p8f5-24wr, PYSEC-2026-1343 | High | 0.4% | 08 Sep, 2025 | PyPI ethyca-fides |
Fides Webserver API Rate Limiting Vulnerability in Proxied Environments CVE-2025-57816, GHSA-fq34-xw6c-fphf, PYSEC-2026-1341 | Medium | 0.4% | 08 Sep, 2025 | PyPI ethyca-fides |
Fides has a Lack of Brute-Force Protections on Authentication Endpoints CVE-2025-57815, GHSA-7q62-r88r-j5gw, PYSEC-2026-1335 | Low | 0.3% | 08 Sep, 2025 | PyPI ethyca-fides |
Fides' Admin UI User Password Change Does Not Invalidate Current Session CVE-2025-57766, GHSA-rpw8-82v9-3q87, PYSEC-2026-1348 | Low | 0.3% | 08 Sep, 2025 | PyPI ethyca-fides |
Malicious release: Malicious code in kekovayalibka (PyPI) MAL-2025-191773 | Malicious | Not scored | 08 Sep, 2025 | PyPI kekovayalibka |
Malicious release: Malicious code in onnxruntime-winml (PyPI) MAL-2025-191806 | Malicious | Not scored | 07 Sep, 2025 | PyPI onnxruntime-winml |
Malicious release: Malicious code in private-evolution (PyPI) MAL-2025-191817 | Malicious | Not scored | 07 Sep, 2025 | PyPI private-evolution |
Malicious release: Malicious code in unicore (PyPI) MAL-2025-191916 | Malicious | Not scored | 07 Sep, 2025 | PyPI unicore |
Malicious release: Malicious code in brotli-python (PyPI) MAL-2025-47749 | Malicious | Not scored | 07 Sep, 2025 | PyPI brotli-python |
Malicious release: Malicious code in netmanagement (PyPI) MAL-2025-191802 | Malicious | Not scored | 07 Sep, 2025 | PyPI netmanagement |
Malicious release: Malicious code in amzn-sagemaker-studio (PyPI) MAL-2025-191680 | Malicious | Not scored | 07 Sep, 2025 | PyPI amzn-sagemaker-studio |
Malicious release: Malicious code in xenlib (PyPI) MAL-2025-191936 | Malicious | Not scored | 06 Sep, 2025 | PyPI xenlib |
Malicious release: Malicious code in giteegit (PyPI) MAL-2025-191739 | Malicious | Not scored | 06 Sep, 2025 | PyPI giteegit |
xgrammar vulnerable to denial of service by huge enum grammar CVE-2025-58446, GHSA-9q5r-wfvf-rr7f, PYSEC-2026-2055 | Medium | 0.6% | 05 Sep, 2025 | PyPI xgrammar |
internetarchive Vulnerable to Directory Traversal in File.download() CVE-2025-58438, GHSA-wx3r-v6h7-frjp, PYSEC-2026-357 | Critical | 1.6% | 05 Sep, 2025 | PyPI internetarchive |
TkEasyGUI Affected by Uncontrolled Search Path Element Issue CVE-2025-55671, GHSA-ph2w-cx28-vhrq, PYSEC-2026-1968 | High | 0.2% | 05 Sep, 2025 | PyPI TkEasyGUI PyPI tkeasygui |
TkEasyGUI Vulnerable to OS Command Injection CVE-2025-55037, GHSA-hfrj-3w3g-jv32, PYSEC-2026-552 | Critical | 2.3% | 05 Sep, 2025 | PyPI TkEasyGUI PyPI tkeasygui |
Pixar OpenUSD Sdf_PathNode Module Use-After-Free Vulnerability Leading to Potential Remote Code Execution GHSA-58p5-r2f6-g2cj | Critical | Not scored | 04 Sep, 2025 | PyPI usd-core |
pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability CVE-2025-9636, GHSA-6859-2qxq-ffv2, PYSEC-2026-1769 | High | 0.2% | 04 Sep, 2025 | PyPI pgadmin4 |
Weblate has a long session expiry when verifying second factor CVE-2025-58352, GHSA-377j-wj38-4728, PYSEC-2026-2036 | Low | 0.3% | 04 Sep, 2025 | PyPI Weblate PyPI weblate |
Langchain Community Vulnerable to XML External Entity (XXE) Attacks CVE-2025-6984, GHSA-pc6w-59fv-rh23, PYSEC-2026-1515 | High | 1.6% | 04 Sep, 2025 | PyPI langchain-community |
DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more CVE-2025-58367, GHSA-mw26-5g2v-hqw3, PYSEC-2026-327 | Critical | 1.2% | 03 Sep, 2025 | PyPI deepdiff |
Django is subject to SQL injection through its column aliases BIT-django-2025-57833, CVE-2025-57833, GHSA-6w2r-r2m5-xq5w, PYSEC-2025-105 | High | 26.1% | 03 Sep, 2025 | PyPI Django PyPI django |