Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-68113ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and ReplayGo · github.com/altcha-org/altcha-lib-go · fixed in 1.0.0
- CVE-2025-11393Insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator: improper proxy configuration allows unauthorized administrative commandsGo · github.com/redhatinsights/runtimes-inventory-operator
- CVE-2025-13888Openshift-gitops-operator: openshift gitops: namespace admin cluster takeover via privileged jobsGo · github.com/redhat-developer/gitops-operator · fixed in 1.16.2
- CVE-2025-13281Portworx Half-Blind SSRF in kube-controller-managerGo · k8s.io/kubernetes · fixed in 1.32.10, 1.33.6, 1.34.2
- CVE-2025-67508gardenctl is vulnerable to Command Injection when used with non‑POSIX shellsGo · github.com/gardener/gardenctl-v2 · fixed in 0.0.0-20251107111549-0bdc484cb5fb
- CVE-2025-67818An issue was discovered in Weaviate OSS before 1.33.4.Go · github.com/weaviate/weaviate · fixed in 1.30.20, 1.31.19, 1.32.16 and more
- CVE-2025-67819An issue was discovered in Weaviate OSS before 1.33.4.Go · github.com/weaviate/weaviate · fixed in 1.30.20, 1.31.19, 1.32.16 and more
- CVE-2025-64702quic-go HTTP/3 QPACK Header Expansion DoSGo · github.com/quic-go/quic-go · fixed in 0.57.0
- CVE-2025-67717Zitadel Discloses the Total Number of Instance UsersGo · github.com/zitadel/zitadel · fixed in 1.80.0-v2.20.0.20251210121356-826039c6208f, 4.7.2, 3.4.5
- CVE-2025-67713Miniflux 2 has an Open Redirect via protocol-relative `redirect_url`Go · miniflux.app, miniflux.app/v2 · fixed in 2.2.15
- CVE-2025-344291Panel CSRF Web Port Configuration ChangeGo · github.com/1panel-dev/1panel
- CVE-2025-344301Panel CSRF Panel Name ModificationGo · github.com/1panel-dev/1panel
- CVE-2025-344101Panel CSRF in Change Username Functionality Allows Account LockoutGo · github.com/1panel-dev/1panel
- CVE-2025-8110File overwrite in file update API in GogsGo · gogs.io/gogs
- CVE-2025-65754Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a filGo · github.com/xyproto/algernon · fixed in 1.17.5
- CVE-2025-67499CNI Plugins Portmap nftables backend intercepts non-local trafficGo · github.com/containernetworking/plugins · fixed in 1.9.0
- CVE-2025-67495ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 LoginGo · github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2 · fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e, 4.7.1
- CVE-2025-67494ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 LoginGo · github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2 · fixed in 1.80.0-v2.20.0.20251208091519-4c879b47334e, 4.7.1
- CVE-2025-67488SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCEGo · github.com/siyuan-note/siyuan/kernel
- CVE-2025-66626argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic linksGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +1 · fixed in 3.6.14, 3.7.5
- CVE-2025-66565Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable ValuesGo · github.com/gofiber/utils, github.com/gofiber/utils/v2 · fixed in 1.2.0, 2.0.0-rc.4
- CVE-2025-665081Panel IP Access Control Bypass via Untrusted X-Forwarded-For HeadersGo · github.com/1panel-dev/1panel, github.com/1panel-dev/1panel/agent · fixed in 2.0.14+incompatible, 2.0.14, 0.0.0-20251201063338-94f7d78cc976
- CVE-2025-665071Panel – CAPTCHA Bypass via Client-Controlled FlagGo · github.com/1panel-dev/1panel, github.com/1panel-dev/1panel/core · fixed in 2.0.14, 2.0.14+incompatible, 0.0.0-20251128030527-ac43f00273be
- CVE-2025-66491Traefik has Inverted TLS Verification Logic in its ingress-nginx ProviderGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 3.6.3
- CVE-2025-66490Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware RulesGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.32, 3.6.3
- CVE-2025-65795Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts vGo · github.com/usememos/memos · fixed in 0.25.3
- CVE-2025-65796Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other Go · github.com/usememos/memos · fixed in 0.25.3
- CVE-2025-65797Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarilGo · github.com/usememos/memos · fixed in 0.25.3
- CVE-2025-65798Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments maGo · github.com/usememos/memos · fixed in 0.25.3
- CVE-2025-65799A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traverGo · github.com/usememos/memos · fixed in 0.25.3