Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in python-dev-toolkit (PyPI) MAL-2025-191839 | Malicious | Not scored | 03 Sep, 2025 | PyPI python-dev-toolkit |
Malicious release: Malicious code in data-processing-utils (PyPI) MAL-2025-47755 | Malicious | Not scored | 03 Sep, 2025 | PyPI data-processing-utils |
Malicious release: Malicious code in awesome-tools-collection (PyPI) MAL-2025-47746 | Malicious | Not scored | 03 Sep, 2025 | PyPI awesome-tools-collection |
Malicious release: Malicious code in learning-pypi-demo-nisimi (PyPI) MAL-2025-47782 | Malicious | Not scored | 03 Sep, 2025 | PyPI learning-pypi-demo-nisimi |
Malicious release: Malicious code in nayzakishere (PyPI) MAL-2025-191800 | Malicious | Not scored | 03 Sep, 2025 | PyPI nayzakishere |
Malicious release: Malicious code in fromwherebitch (PyPI) MAL-2025-191735 | Malicious | Not scored | 03 Sep, 2025 | PyPI fromwherebitch |
Malicious release: Malicious code in xwormclient (PyPI) MAL-2025-191938 | Malicious | Not scored | 03 Sep, 2025 | PyPI xwormclient |
Local Deep Research's API keys are stored in plain text CVE-2025-57806, GHSA-4h8c-qrcq-cv5c | Medium | 0.1% | 02 Sep, 2025 | PyPI local-deep-research |
Malicious release: Malicious code in trongithpy (PyPI) MAL-2025-47805 | Malicious | Not scored | 02 Sep, 2025 | PyPI trongithpy |
Malicious release: Malicious code in doxer (PyPI) MAL-2025-47759 | Malicious | Not scored | 02 Sep, 2025 | PyPI doxer |
MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction CVE-2025-58162, GHSA-9gh8-9r95-3fc3, PYSEC-2026-1670 | Medium | 0.6% | 02 Sep, 2025 | PyPI mobsf |
MobSF Path Traversal in GET /download/<filename> using absolute filenames CVE-2025-58161, GHSA-ccc3-fvfx-mw3v, PYSEC-2026-1672 | Low | 0.8% | 02 Sep, 2025 | PyPI mobsf |
ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header CVE-2025-57808, GHSA-mxh2-ccgj-8635, PYSEC-2026-1330 | High | 1.5% | 02 Sep, 2025 | PyPI esphome |
Malicious release: Malicious code in testt-abc (PyPI) MAL-2025-191896 | Malicious | Not scored | 30 Aug, 2025 | PyPI testt-abc |
Malicious release: Malicious code in testt-test (PyPI) MAL-2025-47802 | Malicious | Not scored | 30 Aug, 2025 | PyPI testt-test |
Malicious release: Malicious code in fuckyoubitchbro (PyPI) MAL-2025-191736 | Malicious | Not scored | 30 Aug, 2025 | PyPI fuckyoubitchbro |
Eventlet affected by HTTP request smuggling in unparsed trailers CVE-2025-58068, GHSA-hw6f-rjfj-j7j7, PYSEC-2026-1350 | Medium | 0.4% | 29 Aug, 2025 | PyPI eventlet |
Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors who already have write access to the server, and they can more CVE-2023-41471, PYSEC-2025-240 | High | 0.3% | 29 Aug, 2025 | PyPI copyparty |
Malicious release: Malicious code in trongitpy (PyPI) MAL-2025-47806 | Malicious | Not scored | 29 Aug, 2025 | PyPI trongitpy |
Malicious release: Malicious code in license-checker (PyPI) MAL-2025-47784 | Malicious | Not scored | 29 Aug, 2025 | PyPI license-checker |
Malicious release: Malicious code in osanlizer (PyPI) MAL-2025-47792 | Malicious | Not scored | 29 Aug, 2025 | PyPI osanlizer |
Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata CVE-2025-55304, GHSA-m54q-mm9w-fp6g, PYSEC-2026-1355 | Low | 0.3% | 29 Aug, 2025 | PyPI Exiv2 PyPI exiv2 |
Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file CVE-2025-54080, GHSA-496f-x7cq-cq39, PYSEC-2026-1354 | Low | 0.1% | 29 Aug, 2025 | PyPI Exiv2 PyPI exiv2 |
Malicious release: Malicious code in kraken123 (PyPI) MAL-2025-191778 | Malicious | Not scored | 29 Aug, 2025 | PyPI kraken123 |
Malicious release: Malicious code in mulaptested-pakname (PyPI) MAL-2025-191796 | Malicious | Not scored | 28 Aug, 2025 | PyPI mulaptested-pakname |
Malicious release: Malicious code in notary-client (PyPI) MAL-2025-191804 | Malicious | Not scored | 28 Aug, 2025 | PyPI notary-client |
Malicious release: Malicious code in tronwebwpy (PyPI) MAL-2025-47810 | Malicious | Not scored | 28 Aug, 2025 | PyPI tronwebwpy |
Malicious release: Malicious code in kraken-virus (PyPI) MAL-2025-47780 | Malicious | Not scored | 28 Aug, 2025 | PyPI kraken-virus |
Malicious release: Malicious code in krakenvirus (PyPI) MAL-2025-47781 | Malicious | Not scored | 28 Aug, 2025 | PyPI krakenvirus |
Malicious release: Malicious code in iamenumerat (PyPI) MAL-2025-47773 | Malicious | Not scored | 28 Aug, 2025 | PyPI iamenumerat |
Malicious release: Malicious code in zking (PyPI) MAL-2025-41803 | Malicious | Not scored | 28 Aug, 2025 | PyPI zking |
Malicious release: Malicious code in zlib1g-dev (PyPI) MAL-2025-41804 | Malicious | Not scored | 28 Aug, 2025 | PyPI zlib1g-dev |
Malicious release: Malicious code in youtube-new (PyPI) MAL-2025-41801 | Malicious | Not scored | 28 Aug, 2025 | PyPI youtube-new |
Malicious release: Malicious code in xoloowlowpzeke (PyPI) MAL-2025-41798 | Malicious | Not scored | 28 Aug, 2025 | PyPI xoloowlowpzeke |
Malicious release: Malicious code in xoloyuaezcqixu (PyPI) MAL-2025-41799 | Malicious | Not scored | 28 Aug, 2025 | PyPI xoloyuaezcqixu |
Malicious release: Malicious code in xorg-renderproto (PyPI) MAL-2025-41800 | Malicious | Not scored | 28 Aug, 2025 | PyPI xorg-renderproto |
Malicious release: Malicious code in xolofyxkotqwko (PyPI) MAL-2025-41796 | Malicious | Not scored | 28 Aug, 2025 | PyPI xolofyxkotqwko |
Malicious release: Malicious code in xolonavrylpbeb (PyPI) MAL-2025-41797 | Malicious | Not scored | 28 Aug, 2025 | PyPI xolonavrylpbeb |
Malicious release: Malicious code in xoloazfgyobkaw (PyPI) MAL-2025-41795 | Malicious | Not scored | 28 Aug, 2025 | PyPI xoloazfgyobkaw |
Malicious release: Malicious code in web5 (PyPI) MAL-2025-41794 | Malicious | Not scored | 28 Aug, 2025 | PyPI web5 |
Malicious release: Malicious code in virtualebv (PyPI) MAL-2025-41793 | Malicious | Not scored | 28 Aug, 2025 | PyPI virtualebv |
Malicious release: Malicious code in upgrade-requests (PyPI) MAL-2025-41791 | Malicious | Not scored | 28 Aug, 2025 | PyPI upgrade-requests |
Malicious release: Malicious code in uploder-rubika (PyPI) MAL-2025-41792 | Malicious | Not scored | 28 Aug, 2025 | PyPI uploder-rubika |
Malicious release: Malicious code in tkinnter (PyPI) MAL-2025-41782 | Malicious | Not scored | 28 Aug, 2025 | PyPI tkinnter |
Malicious release: Malicious code in tkinnter2 (PyPI) MAL-2025-41783 | Malicious | Not scored | 28 Aug, 2025 | PyPI tkinnter2 |
Malicious release: Malicious code in toolbelt-requests (PyPI) MAL-2025-41784 | Malicious | Not scored | 28 Aug, 2025 | PyPI toolbelt-requests |
Malicious release: Malicious code in tf-nightly-2-0-preview (PyPI) MAL-2025-41778 | Malicious | Not scored | 28 Aug, 2025 | PyPI tf-nightly-2-0-preview |
Malicious release: Malicious code in this-is-vvvv (PyPI) MAL-2025-41779 | Malicious | Not scored | 28 Aug, 2025 | PyPI this-is-vvvv |
Malicious release: Malicious code in testcase100 (PyPI) MAL-2025-41774 | Malicious | Not scored | 28 Aug, 2025 | PyPI testcase100 |
Malicious release: Malicious code in telemaster (PyPI) MAL-2025-41772 | Malicious | Not scored | 28 Aug, 2025 | PyPI telemaster |