Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-66564Sigstore Timestamp Authority allocates excessive memory during request parsingGo · github.com/sigstore/timestamp-authority, github.com/sigstore/timestamp-authority/v2 · fixed in 2.0.3
- CVE-2025-66506Fulcio allocates excessive memory during token parsingGo · github.com/sigstore/fulcio · fixed in 1.8.3
- CVE-2025-65637A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64Go · github.com/sirupsen/logrus · fixed in 1.8.3, 1.9.1, 1.9.3
- CVE-2025-61727Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509Go · stdlib · fixed in 1.24.11, 1.25.5
- CVE-2025-66411Coder logged sensitive objects unsanitizedGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.26.5, 2.27.7, 2.28.4
- CVE-2025-66406Improper Authorization Check for SSH Certificate RevocationGo · github.com/smallstep/certificates · fixed in 0.29.0
- CVE-2025-66220Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byteGo · github.com/envoyproxy/envoy · fixed in 1.36.3, 1.35.7, 1.34.11 and more
- CVE-2025-64763Envoy forwards early CONNECT data in TCP proxy modeGo · github.com/envoyproxy/envoy · fixed in 1.36.3, 1.35.7, 1.34.11 and more
- CVE-2025-64527Envoy crashes when JWT authentication is configured with the remote JWKS fetchingGo · github.com/envoyproxy/envoy · fixed in 1.36.3, 1.35.7, 1.34.11 and more
- CVE-2025-64443DNS Rebinding vulnerability present when running MCP Gateway in sse or streaming modeGo · github.com/docker/mcp-gateway · fixed in 0.28.0
- CVE-2025-61729Excessive resource consumption when printing error string for host certificate validation in crypto/x509Go · stdlib · fixed in 1.24.11, 1.25.5
- CVE-2025-65105Apptainer ineffective application of selinux and apparmor --security optionsGo · github.com/apptainer/apptainer · fixed in 1.4.5
- CVE-2025-64750Singluarity ineffectively applies of selinux / apparmor LSM process labelsGo · github.com/sylabs/singularity, github.com/sylabs/singularity/v4 · fixed in 4.3.5, 4.1.11
- CVE-2025-13353gokey allows secret recovery from a seed file without the master passwordGo · github.com/cloudflare/gokey · fixed in 0.2.0
- CVE-2025-13870Unauthorized access and subscription vulnerability in BoardsGo · github.com/mattermost/mattermost, github.com/mattermost/mattermost-server +3 · fixed in 10.5.13+incompatible, 10.11.5+incompatible, 10.11.5 and more
- CVE-2025-10543In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly Go · github.com/eclipse/paho.mqtt.golang · fixed in 1.5.1
- CVE-2025-66410Gin-vue-admin has an arbitrary file deletion vulnerabilityGo · github.com/flipped-aurora/gin-vue-admin · fixed in 0.9.1-0.20251201084432-ee8d8d7e04d9
- CVE-2025-12756Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment DeletionGo · github.com/mattermost/mattermost, github.com/mattermost/mattermost-server +3
- CVE-2025-64715Cilium with misconfigured toGroups in policies can lead to unrestricted egress trafficGo · github.com/cilium/cilium · fixed in 1.16.17, 1.17.10, 1.18.4
- CVE-2025-12421Account Takeover via Code Exchange EndpointGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 11.0.3, 10.12.2, 10.11.5 and more
- CVE-2025-12559Information Disclosure in Common Teams APIGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 11.0.3, 10.12.2, 10.11.5 and more
- CVE-2025-12419Account takeover on OAuth/OpenID-enabled serversGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.12.2, 10.11.5, 10.5.13 and more
- CVE-2025-65942VictoriaMetrics Snappy Decoder DoS Vulnerability is Causing OOMGo · github.com/victoriametrics/victoriametrics · fixed in 1.129.1, 1.122.8, 1.110.23
- CVE-2025-65965Grype has a credential disclosure vulnerability in Grype JSON outputGo · github.com/anchore/grype · fixed in 0.104.1
- CVE-2025-64761OpenBao Privileged Operator Identity Group Root EscalationGo · github.com/openbao/openbao · fixed in 2.4.4
- CVE-2025-62155QuantumNous New API Has SSRF BypassGo · github.com/quantumnous/new-api · fixed in 0.9.6
- CVE-2025-60632An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Npcf_Go · github.com/free5gc/pcf · fixed in 1.4.0
- CVE-2025-60633An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_SubscriberDataManagementGo · github.com/free5gc/openapi, github.com/free5gc/udm · fixed in 1.2.2
- CVE-2025-60638An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the NnssfGo · github.com/free5gc/nssf · fixed in 1.4.0
- CVE-2025-65111SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete ResultsGo · github.com/authzed/spicedb · fixed in 1.47.1