Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-28357NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management accouGo · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 · fixed in 2.7.4
- CVE-2023-32187An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supGo · github.com/k3s-io/k3s · fixed in 1.24.17, 1.25.13, 1.26.8 and more
- CVE-2023-5036Cross-Site Request Forgery (CSRF) in usememos/memosGo · github.com/usememos/memos · fixed in 0.15.1
- CVE-2023-4680Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent EncryptionGo · github.com/hashicorp/vault · fixed in 1.12.11, 1.13.7, 1.14.3
- CVE-2023-4863Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of boGo · github.com/chai2010/webp · fixed in 1.4.0, 0.0.0-20250406010349-76805d5a8860, 1.1.2-0.20250406010349-76805d5a8860
- CVE-2023-41318Unsafe media served inline on download endpoints in matrix-media-repoGo · github.com/turt2live/matrix-media-repo · fixed in 1.3.0
- CVE-2023-41338Vulnerability in Ctx.IsFromLocal() in gofiberGo · github.com/gofiber/fiber, github.com/gofiber/fiber/v2 · fixed in 2.49.2-0.20230906112033-b8c9ede6efa2, 2.49.2
- CVE-2023-4782Terraform Allows Arbitrary File Write During Init OperationGo · github.com/hashicorp/terraform · fixed in 1.5.7
- CVE-2023-39322Memory exhaustion in QUIC connection handling in crypto/tlsGo · stdlib · fixed in 1.21.1
- CVE-2023-39321Panic when processing post-handshake message on QUIC connections in crypto/tlsGo · stdlib · fixed in 1.21.1
- CVE-2023-39319Improper handling of special tags within script contexts in html/templateGo · stdlib · fixed in 1.20.8, 1.21.1
- CVE-2023-39320Arbitrary code execution via go.mod toolchain directive in cmd/goGo · toolchain · fixed in 1.21.1
- CVE-2023-39318Improper handling of HTML-like comments in script contexts in html/templateGo · stdlib · fixed in 1.20.8, 1.21.1
- CVE-2023-40584Denial of Service to Argo CD repo-server Go · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.6.15, 2.7.14, 2.8.3
- CVE-2023-40029Cluster secret might leak in cluster details page in Argo CDGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.6.15, 2.7.14, 2.8.3
- CVE-2023-4815Missing Authentication for Critical Function in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.1.3
- CVE-2023-40591Denial of service via malicious p2p message in go-ethereumGo · github.com/ethereum/go-ethereum · fixed in 1.12.1-stable, 1.12.1
- CVE-2023-36307ZPLGFA 1.1.1 allows attackers to cause a panic (because of an integer index out of range during a ConvertToGraphicField call) via an image oGo · simonwaldherr.de/go/zplgfa
- CVE-2023-36308disintegration Imaging 1.6.2 allows attackers to cause a panic (because of an integer index out of range during a Grayscale call) via a crafGo · github.com/disintegration/imaging
- CVE-2023-4697Improper Privilege Management in usememos/memosGo · github.com/usememos/memos · fixed in 0.13.2
- CVE-2023-4698Improper Input Validation in usememos/memosGo · github.com/usememos/memos
- CVE-2023-4696Improper Access Control in usememos/memosGo · github.com/usememos/memos · fixed in 0.13.2
- CVE-2023-39348Improper log output when using GitHub Status Notifications in spinnakerGo · github.com/spinnaker/spinnaker
- CVE-2023-34758Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack viaGo · github.com/bishopfox/sliver · fixed in 1.5.40
- CVE-2023-39059An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables paramGo · github.com/ansible-semaphore/semaphore
- CVE-2023-40586go package github.com/corazawaf/coraza is vulnerable to denial of serviceGo · github.com/corazawaf/coraza/v2, github.com/corazawaf/coraza/v3 · fixed in 3.0.1
- CVE-2023-40583libp2p nodes vulnerable to OOM attackGo · github.com/libp2p/go-libp2p · fixed in 0.27.4
- CVE-2023-40579OpenFGA Authorization BypassGo · github.com/openfga/openfga · fixed in 1.3.1
- CVE-2023-40577Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpointGo · github.com/prometheus/alertmanager · fixed in 0.25.1
- CVE-2023-37469CasaOS Command Injection vulnerabilityGo · github.com/icewhaletech/casaos · fixed in 0.4.4