Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-14987Cross Namespace Commands Authorization BypassGo · go.temporal.io/server · fixed in 1.27.4, 1.28.2, 1.29.2 and more
- CVE-2025-68120Unexpected untrusted code execution in github.com/golang/vscode-goGo · github.com/golang/vscode-go · fixed in 0.52.1
- CVE-2025-15107actiontech sqle JWT Secret jwt.go hard-coded keyGo · github.com/actiontech/sqle
- CVE-2025-68927Improper Neutralization of HTML Tags in a Web Page in libredeskGo · github.com/abhinavxd/libredesk · fixed in 0.8.6-beta
- CVE-2025-68946In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.Go · code.gitea.io/gitea · fixed in 1.20.1
- CVE-2025-68945In Gitea before 1.21.2, an anonymous user can visit a private user's project.Go · code.gitea.io/gitea · fixed in 1.21.2
- CVE-2025-68944Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.Go · code.gitea.io/gitea · fixed in 1.22.2
- CVE-2025-68943Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.Go · code.gitea.io/gitea · fixed in 1.21.8
- CVE-2025-68942Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.Go · code.gitea.io/gitea · fixed in 1.22.2
- CVE-2025-68941Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.Go · code.gitea.io/gitea · fixed in 1.22.3
- CVE-2025-68940In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.Go · code.gitea.io/gitea · fixed in 1.22.5
- CVE-2025-68939Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.Go · code.gitea.io/gitea · fixed in 1.23.0-rc0
- CVE-2025-68938Gitea before 1.25.2 mishandles authorization for deletion of releases.Go · code.gitea.io/gitea · fixed in 1.25.2
- CVE-2025-64641Mattermost Jira plugin crafted action leaks Jira issue detailsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.8+incompatible, 10.12.4+incompatible, 11.0.6+incompatible and more
- CVE-2025-13767Unauthorized Read Access to Private Channel Posts via Mattermost Jira PluginGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.8+incompatible, 10.12.4+incompatible, 11.0.6+incompatible and more
- CVE-2025-68476KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account CredentialGo · github.com/kedacore/keda, github.com/kedacore/keda/v2 · fixed in 2.17.3, 2.18.3
- CVE-2025-14273Mattermost Jira plugin user spoofing enables Jira request forgery.Go · github.com/mattermost/mattermost-plugin-jira, github.com/mattermost/mattermost-server +3 · fixed in 4.4.1, 8.0.0-20251121122154-b57c297c6d7a
- CVE-2025-68383Filebeat Improper Validation of Specified Index, Position, or Offset in InputGo · github.com/elastic/beats, github.com/elastic/beats/v7 · fixed in 7.0.0-alpha2.0.20251204214633-dd3af18220bf, 8.19.9, 9.1.9 and more
- CVE-2025-68388Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEGo · github.com/elastic/beats, github.com/elastic/beats/v7 · fixed in 8.19.9, 9.1.9, 9.2.3 and more
- CVE-2025-63389A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3.Go · github.com/ollama/ollama
- CVE-2025-14764Missing cryptographic key commitment in the Amazon S3 Encryption Client for Go may allow a user with write access to the S3 bucket to introdGo · github.com/aws/amazon-s3-encryption-client-go, github.com/aws/amazon-s3-encryption-client-go/v3 +1 · fixed in 4.0.0
- CVE-2025-13324Lack of Invalidation of Legacy Remote Cluster Invite Tokens After ConfirmationGo · github.com/mattermost/mattermost, github.com/mattermost/mattermost-server +3 · fixed in 10.12.2, 10.11.5, 11.0.4 and more
- CVE-2025-12689DoS in Calls plugin via malformed UTF-8 in WebSocket requestGo · github.com/mattermost/mattermost-plugin-calls · fixed in 1.11.0
- CVE-2025-44005An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain pGo · github.com/smallstep/certificates · fixed in 0.29.0
- CVE-2025-62690Open redirect in error page when link opened in new tabGo · github.com/mattermost/mattermost, github.com/mattermost/mattermost-server +3 · fixed in 10.11.5-0.20251016131338-dad6bd7a1509, 11.1.0, 11.1.0+incompatible and more
- CVE-2025-13352Mattermost GitHub Plugin allows unauthorized GitHub reactions via reaction forwarding hijackingGo · github.com/mattermost/mattermost, github.com/mattermost/mattermost-plugin-github +4 · fixed in 11.1.0+incompatible, 10.11.7-0.20251106103514-3b05384dd014, 11.1.0 and more
- CVE-2025-62190CSRF Allows Call Initiation and Message DeliveryGo · github.com/mattermost/mattermost-plugin-calls · fixed in 1.10.0
- CVE-2025-68274SIPGO library has response DoS vulnerability via nil pointer dereferenceGo · github.com/emiago/sipgo · fixed in 1.0.0-alpha-1
- CVE-2025-68156Expr has Denial of Service via Unbounded Recursion in Builtin FunctionsGo · github.com/expr-lang/expr · fixed in 1.17.7
- CVE-2025-14443Ose-openshift-apiserver: openshift api server: server-side request forgery (ssrf) vulnerability in imagestreamimport mechanismGo · github.com/openshift/openshift-apiserver