Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in workalender (PyPI) MAL-2026-18096 | Malicious | Not scored | 9 days ago | PyPI workalender |
Malicious release: Malicious code in pafex (PyPI) MAL-2026-18094 | Malicious | Not scored | 9 days ago | PyPI pafex |
Malicious release: Malicious code in resion (PyPI) MAL-2026-18095 | Malicious | Not scored | 9 days ago | PyPI resion |
Malicious release: Malicious code in workcalender (PyPI) MAL-2026-18093 | Malicious | Not scored | 9 days ago | PyPI workcalender |
Malicious release: Malicious code in test-workalendar-internal (PyPI) MAL-2026-18092 | Malicious | Not scored | 9 days ago | PyPI test-workalendar-internal |
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references CVE-2026-110725, GHSA-333x-w4r6-6crp | Low | 0.3% | 10 days ago | npm fast-uri |
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding CVE-2026-110306, GHSA-w74x-v6f9-j3xg | Medium | 0.3% | 10 days ago | npm fast-uri |
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization CVE-2026-110180, GHSA-wjr9-j795-jxcr | Medium | 0.3% | 10 days ago | npm fast-uri |
fast-uri vulnerable to improper path equivalence in relative reference normalization CVE-2026-110095, GHSA-xhq7-xmqj-769h | Low | 0.3% | 10 days ago | npm fast-uri |
Malicious release: Malicious code in @platform-services/hrm-mfe-core (npm) MAL-2026-18091 | Malicious | Not scored | 10 days ago | npm @platform-services/hrm-mfe-core |
Malicious release: Malicious code in sc-announcer (npm) GHSA-fxw2-4j5q-6hwg, MAL-2026-18064 | Malicious | Not scored | 10 days ago | npm sc-announcer |
Malicious release: Malicious code in fanarena-common (npm) MAL-2026-18063 | Malicious | Not scored | 10 days ago | npm fanarena-common |
Malicious release: Malicious code in ccl-global-shopping (npm) GHSA-hh3m-f424-g8v5, MAL-2026-18061 | Malicious | Not scored | 10 days ago | npm ccl-global-shopping |
Malicious release: Malicious code in sc-wizard (npm) MAL-2026-18062 | Malicious | Not scored | 10 days ago | npm sc-wizard |
Malicious release: Malicious code in @an1mshnpmb9c84920/pipe-dns-m19t2 (npm) GHSA-3xpj-mfqg-v52m, MAL-2026-18049 | Malicious | Not scored | 10 days ago | npm @an1mshnpmb9c84920/pipe-dns-m19t2 |
Malicious release: Malicious code in @an1mshnpmb9c84920/stage-repo-m19g7 (npm) GHSA-42h4-pvwr-r87v, MAL-2026-18052 | Malicious | Not scored | 10 days ago | npm @an1mshnpmb9c84920/stage-repo-m19g7 |
Malicious release: Malicious code in @an1mshnpmb9c84920/stage-outer-m19s5 (npm) GHSA-6grm-8w52-497r, MAL-2026-18051 | Malicious | Not scored | 10 days ago | npm @an1mshnpmb9c84920/stage-outer-m19s5 |
Malicious release: Malicious code in @an1mshnpmb9c84920/gat-scope-target-125ec19a (npm) GHSA-87gv-mmww-whrr, MAL-2026-18046 | Malicious | Not scored | 10 days ago | npm @an1mshnpmb9c84920/gat-scope-target-125ec19a |
Malicious release: Malicious code in @an1mshnpmb9c84920/stage-fn-m19p2 (npm) GHSA-h79g-mv9q-7p44, MAL-2026-18050 | Malicious | Not scored | 10 days ago | npm @an1mshnpmb9c84920/stage-fn-m19p2 |
Malicious release: Malicious code in @an1mshnpmb9c84920/pipe-compat-m19r8 (npm) GHSA-hxmq-p768-mjhf, MAL-2026-18048 | Malicious | Not scored | 10 days ago | npm @an1mshnpmb9c84920/pipe-compat-m19r8 |
Malicious release: Malicious code in @an1mshnpmb9c84920/oidc-cross-cafb9d929e (npm) GHSA-mmr7-9m67-9qh5, MAL-2026-18047 | Malicious | Not scored | 10 days ago | npm @an1mshnpmb9c84920/oidc-cross-cafb9d929e |
MLflow FileStore trace IDs allow path traversal and arbitrary file writes BIT-mlflow-2026-53995, CVE-2026-53995, GHSA-wqmh-qccw-pqwf | High | 0.6% | 10 days ago | PyPI mlflow |
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes BIT-pillow-2026-112901, CVE-2026-112901, GHSA-xgh8-jp6q-p5x8, PYSEC-2026-4335 | Medium | 0.5% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE BIT-pillow-2026-112900, CVE-2026-112900, GHSA-w889-685w-c8fh | Critical | 1.3% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Image.quantize() with empty palette leaks uninitialized stack memory BIT-pillow-2026-112898, CVE-2026-112898, GHSA-rfgq-q3w2-pmv2 | Medium | 0.3% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips BIT-pillow-2026-112897, CVE-2026-112897, GHSA-q45j-58j2-45rg | High | 0.5% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read BIT-pillow-2026-112896, CVE-2026-112896, GHSA-pchr-8j38-3x4p, PYSEC-2026-4334 | High | 0.5% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310) BIT-pillow-2026-112895, CVE-2026-112895, GHSA-p4wg-p73j-c528 | High | 0.6% | 10 days ago | PyPI pillow |
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) BIT-pillow-2026-112894, CVE-2026-112894, GHSA-jg86-v3jv-hrpm | High | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Invalid free in FreeType glyph rendering when a stroker is active BIT-pillow-2026-112893, CVE-2026-112893, GHSA-j4m9-6w36-pw47 | High | 0.5% | 10 days ago | PyPI pillow |
Pillow: MSP RLE decoder expands a tiny file into unbounded memory BIT-pillow-2026-112892, CVE-2026-112892, GHSA-gg2r-wvfm-q9rx | High | 0.5% | 10 days ago | PyPI pillow |
Pillow: Quadratic GIF comment copying during save BIT-pillow-2026-112891, CVE-2026-112891, GHSA-fc9g-5qg7-mf45 | Medium | 0.5% | 10 days ago | PyPI pillow |
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle BIT-pillow-2026-112406, CVE-2026-112406, GHSA-f2g6-542v-9j58 | High | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0 BIT-pillow-2026-112405, CVE-2026-112405, GHSA-cp9v-662q-vvx9, PYSEC-2026-4333 | High | 0.5% | 10 days ago | PyPI pillow |
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels BIT-pillow-2026-112404, CVE-2026-112404, GHSA-c6hw-5grf-ff96 | High | 0.4% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Heap buffer overflow in ImagingJpegDecode BIT-pillow-2026-112403, CVE-2026-112403, GHSA-8g5g-8vmr-9782, PYSEC-2026-4332 | Critical | 0.9% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform BIT-pillow-2026-112402, CVE-2026-112402, GHSA-7mwm-ghpf-9vrm, PYSEC-2026-4331 | High | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open() BIT-pillow-2026-112401, CVE-2026-112401, GHSA-74r2-7ff9-mjj2 | Medium | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS BIT-pillow-2026-112400, CVE-2026-112400, GHSA-65qm-jvmh-6pqg | High | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: APNG background disposal allocates full canvas before decompression bomb check BIT-pillow-2026-112399, CVE-2026-112399, GHSA-5xm2-6676-qcp9 | High | 0.5% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution BIT-pillow-2026-112398, CVE-2026-112398, GHSA-5x8w-8jj5-q52h, PYSEC-2026-4330 | Critical | 0.7% | 10 days ago | PyPI pillow |
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image BIT-pillow-2026-112397, CVE-2026-112397, GHSA-58r4-6rv3-gfh8, PYSEC-2026-4329 | High | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer BIT-pillow-2026-112396, CVE-2026-112396, GHSA-4rr5-89j8-mwwm, PYSEC-2026-4328 | High | 0.7% | 10 days ago | PyPI pillow |
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images BIT-pillow-2026-112392, CVE-2026-112392, GHSA-27h8-gf7j-v5hc, PYSEC-2026-4326 | High | 0.6% | 10 days ago | PyPI Pillow PyPI pillow |
Malicious release: Malicious code in @decoopus/chatgpt-setup (npm) GHSA-4632-2g34-4r9w, MAL-2026-18053 | Malicious | Not scored | 10 days ago | npm @decoopus/chatgpt-setup |
Malicious release: Malicious code in api-anthropic (npm) GHSA-cj9w-7h22-q93g, MAL-2026-18055 | Malicious | Not scored | 10 days ago | npm api-anthropic |
Malicious release: Malicious code in claude-desktop-setup (npm) GHSA-f4mf-vhm8-xxqc, MAL-2026-18059 | Malicious | Not scored | 10 days ago | npm claude-desktop-setup |
Malicious release: Malicious code in codex-setup (npm) GHSA-h8cg-xwfv-9x77, MAL-2026-18060 | Malicious | Not scored | 10 days ago | npm codex-setup |
Malicious release: Malicious code in @decoopus/claude-setup (npm) GHSA-p7p5-jrq5-q47x, MAL-2026-18054 | Malicious | Not scored | 10 days ago | npm @decoopus/claude-setup |
Malicious release: Malicious code in chatgpt-desktop-setup (npm) GHSA-pgq5-xq28-533m, MAL-2026-18056 | Malicious | Not scored | 10 days ago | npm chatgpt-desktop-setup |