Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in modelworks (PyPI) MAL-2026-18162 | Malicious | Not scored | 8 days ago | PyPI modelworks |
Malicious release: Malicious code in vocabblend (PyPI) MAL-2026-18174 | Malicious | Not scored | 8 days ago | PyPI vocabblend |
Malicious release: Malicious code in voicekit (PyPI) MAL-2026-18175 | Malicious | Not scored | 8 days ago | PyPI voicekit |
Malicious release: Malicious code in ttsweaver (PyPI) MAL-2026-18172 | Malicious | Not scored | 8 days ago | PyPI ttsweaver |
Malicious release: Malicious code in ttsprobe (PyPI) MAL-2026-18171 | Malicious | Not scored | 8 days ago | PyPI ttsprobe |
Malicious release: Malicious code in ttsdock (PyPI) MAL-2026-18169 | Malicious | Not scored | 8 days ago | PyPI ttsdock |
Malicious release: Malicious code in voxweaver (PyPI) MAL-2026-18176 | Malicious | Not scored | 8 days ago | PyPI voxweaver |
Malicious release: Malicious code in speaksocket (PyPI) MAL-2026-18167 | Malicious | Not scored | 8 days ago | PyPI speaksocket |
Malicious release: Malicious code in asrdock (PyPI) MAL-2026-18156 | Malicious | Not scored | 8 days ago | PyPI asrdock |
Malicious release: Malicious code in pipegrip (PyPI) MAL-2026-18154 | Malicious | Not scored | 8 days ago | PyPI pipegrip |
Malicious release: Malicious code in hookgantry (PyPI) MAL-2026-18153 | Malicious | Not scored | 8 days ago | PyPI hookgantry |
Malicious release: Malicious code in acousticpack (PyPI) MAL-2026-18152 | Malicious | Not scored | 8 days ago | PyPI acousticpack |
Malicious release: Malicious code in dictanovaasr (PyPI) MAL-2026-18139 | Malicious | Not scored | 8 days ago | PyPI dictanovaasr |
Malicious release: Malicious code in orchestril (PyPI) MAL-2026-18142 | Malicious | Not scored | 8 days ago | PyPI orchestril |
Malicious release: Malicious code in prosodinetts (PyPI) MAL-2026-18144 | Malicious | Not scored | 8 days ago | PyPI prosodinetts |
Malicious release: Malicious code in codecraze (PyPI) MAL-2026-18137 | Malicious | Not scored | 8 days ago | PyPI codecraze |
Malicious release: Malicious code in solivoxtts (PyPI) MAL-2026-18147 | Malicious | Not scored | 8 days ago | PyPI solivoxtts |
Malicious release: Malicious code in tessivatts (PyPI) MAL-2026-18148 | Malicious | Not scored | 8 days ago | PyPI tessivatts |
Malicious release: Malicious code in vellutts (PyPI) MAL-2026-18149 | Malicious | Not scored | 8 days ago | PyPI vellutts |
Malicious release: Malicious code in grommatts (PyPI) MAL-2026-18140 | Malicious | Not scored | 8 days ago | PyPI grommatts |
Malicious release: Malicious code in zennittts (PyPI) MAL-2026-18151 | Malicious | Not scored | 8 days ago | PyPI zennittts |
Malicious release: Malicious code in aurenatts (PyPI) MAL-2026-18134 | Malicious | Not scored | 8 days ago | PyPI aurenatts |
Malicious release: Malicious code in phonoviatts (PyPI) MAL-2026-18143 | Malicious | Not scored | 8 days ago | PyPI phonoviatts |
Malicious release: Malicious code in voxilaratts (PyPI) MAL-2026-18150 | Malicious | Not scored | 8 days ago | PyPI voxilaratts |
Malicious release: Malicious code in brummatts (PyPI) MAL-2026-18136 | Malicious | Not scored | 8 days ago | PyPI brummatts |
Malicious release: Malicious code in melcuratts (PyPI) MAL-2026-18141 | Malicious | Not scored | 8 days ago | PyPI melcuratts |
Malicious release: Malicious code in quillonatts (PyPI) MAL-2026-18145 | Malicious | Not scored | 8 days ago | PyPI quillonatts |
Malicious release: Malicious code in shellgrip (PyPI) MAL-2026-18146 | Malicious | Not scored | 8 days ago | PyPI shellgrip |
Malicious release: Malicious code in batchspar (PyPI) MAL-2026-18135 | Malicious | Not scored | 8 days ago | PyPI batchspar |
Malicious release: Malicious code in crenelatts (PyPI) MAL-2026-18138 | Malicious | Not scored | 8 days ago | PyPI crenelatts |
Malicious release: Malicious code in journey-test-hellospy (PyPI) MAL-2026-18133 | Malicious | Not scored | 8 days ago | PyPI journey-test-hellospy |
Malicious release: Malicious code in @sudobility/testomniac_client (npm) GHSA-g7cj-274j-rxqw, MAL-2026-18129 | Malicious | Not scored | 8 days ago | npm @sudobility/testomniac_client |
Malicious release: Malicious code in @sudobility/indexer_client (npm) GHSA-xfvr-39v2-q24q, MAL-2026-18127 | Malicious | Not scored | 8 days ago | npm @sudobility/indexer_client |
Malicious release: Malicious code in @sudobility/wildduck_client (npm) GHSA-5ff7-5w72-hm63, MAL-2026-18130 | Malicious | Not scored | 8 days ago | npm @sudobility/wildduck_client |
Malicious release: Malicious code in @sudobility/shaperouter_client (npm) GHSA-x7g4-jh5c-33xr, MAL-2026-18128 | Malicious | Not scored | 8 days ago | npm @sudobility/shaperouter_client |
Laravel TokenGuard authentication bypass through non-string API credentials CVE-2026-114509, GHSA-f9x3-7vq9-cph6 | Critical | 0.8% | 8 days ago | Packagist laravel/framework |
Laravel relationship inclusion can trigger unauthorized data destruction CVE-2026-114508, GHSA-5wcm-3v2w-8362 | Medium | 0.4% | 8 days ago | Packagist laravel/framework |
Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1 BIT-pillow-2026-114501, CVE-2026-114501, GHSA-654x-cwwv-5j9c, PYSEC-2026-4336 | Medium | 0.4% | 8 days ago | PyPI Pillow PyPI pillow |
Malicious release: Malicious code in libseal (PyPI) MAL-2026-18132 | Malicious | Not scored | 8 days ago | PyPI libseal |
Malicious release: Malicious code in iterquarry (PyPI) MAL-2026-18131 | Malicious | Not scored | 8 days ago | PyPI iterquarry |
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags CVE-2026-112902, GHSA-xvh5-g6gv-559v | High | Not scored | 8 days ago | PyPI Pillow PyPI pillow |
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer BIT-pillow-2026-96778, CVE-2026-96778, GHSA-g7cr-3p24-7wf7 | High | 0.5% | 8 days ago | PyPI Pillow PyPI pillow |
Malicious release: Malicious code in @worrisome/aaaa (npm) GHSA-fxf3-w84v-3v6g, MAL-2026-18125 | Malicious | Not scored | 8 days ago | npm @worrisome/aaaa |
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds) BIT-pillow-2026-96644, CVE-2026-96644, GHSA-9v9v-9qvf-h2hj, PYSEC-2026-4343 | High | 0.4% | 8 days ago | PyPI Pillow PyPI pillow |
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time BIT-pillow-2026-96643, CVE-2026-96643, GHSA-g4qv-2jxx-769h, PYSEC-2026-4342 | High | 0.4% | 8 days ago | PyPI Pillow PyPI pillow |
Pillow: TarIO negative size field causes infinite CPU-spin loop BIT-pillow-2026-96642, CVE-2026-96642, GHSA-3j72-p6qg-6xp7, PYSEC-2026-4341 | High | 0.3% | 8 days ago | PyPI Pillow PyPI pillow |
Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise BIT-pillow-2026-96641, CVE-2026-96641, GHSA-4rm8-3hmm-39fg, PYSEC-2026-4340 | Medium | 0.3% | 8 days ago | PyPI pillow |
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion BIT-pillow-2026-96640, CVE-2026-96640, GHSA-mrfp-p49p-3hf2 | High | 0.6% | 8 days ago | PyPI Pillow PyPI pillow |
Pillow multi-frame loaders can reuse stale native image storage after mode transitions BIT-pillow-2026-96639, CVE-2026-96639, GHSA-v9pv-5gc8-w2m6, PYSEC-2026-4339 | Critical | 0.7% | 8 days ago | PyPI Pillow PyPI pillow |
Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode BIT-pillow-2026-96638, CVE-2026-96638, GHSA-24rc-8hj2-v98c | Medium | 0.3% | 8 days ago | PyPI pillow |