Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-65109Minder does not sandbox http.send in Rego programsGo · github.com/mindersec/minder · fixed in 0.0.84
- CVE-2025-13357Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth MethodGo · github.com/hashicorp/terraform-provider-vault · fixed in 5.5.0
- CVE-2025-41115Incorrect privilege assignmentGo · github.com/grafana/grafana · fixed in 12.0.7, 12.1.4, 12.2.2 and more
- CVE-2025-64751OpenFGA Improper Policy EnforcementGo · github.com/openfga/openfga · fixed in 1.11.1
- CVE-2025-13425Denial of Service in OSV-SCALIBRGo · github.com/google/osv-scalibr · fixed in 0.3.4
- CVE-2025-47914Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agentGo · golang.org/x/crypto · fixed in 0.45.0
- CVE-2025-58181Unbounded memory consumption in golang.org/x/crypto/sshGo · golang.org/x/crypto · fixed in 0.45.0
- CVE-2025-65026esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScriptGo · github.com/esm-dev/esm.sh · fixed in 0.0.0-20251118065157-87d2f6497574
- CVE-2025-65025esm.sh CDN service has arbitrary file write via tarslipGo · github.com/esm-dev/esm.sh · fixed in 0.0.0-20251117232647-9d77b88c3207
- CVE-2025-64708authentik invitation expiry is delayed by at least 5 minutesGo · goauthentik.io · fixed in 0.0.0-20251119135424-6672e6aaa41e
- CVE-2025-64521authentik deactivated service accounts can authenticate to OAuthGo · goauthentik.io · fixed in 0.0.0-20251119140106-9dbdfc3f1be0
- CVE-2025-64324KubeVirt Vulnerable to Arbitrary Host File Read and WriteGo · kubevirt.io/kubevirt · fixed in 1.6.1, 1.7.0-rc.0
- CVE-2025-55074Channel member objects leak read statusGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.5.12+incompatible, 10.11.4+incompatible, 10.11.4 and more
- CVE-2024-21635Memos Access Tokens Stay Valid after User Password ChangeGo · github.com/usememos/memos · fixed in 0.18.2
- CVE-2025-11794Password hash and MFA secret returned in user email verification endpointGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.4, 10.5.12, 10.12.1 and more
- CVE-2025-55073MS Teams plugin OAuth allows editing arbitrary postsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.4, 10.5.12, 10.12.1 and more
- CVE-2025-55070Lack of MFA enforcement in WebSocket connectionsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 11.1.0, 11.1.0+incompatible, 8.0.0-20250912063506-7d8b7b5e4a60
- CVE-2025-41436Unauthorized access to archived channel content via threads interfaceGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 11.0.0-alpha.1+incompatible, 11.0.0-alpha.1, 8.0.0-20250815165020-c8d66301415d
- CVE-2025-11776Guest user can discover archived public channelsGo · github.com/mattermost/mattermost, github.com/mattermost/mattermost-server +4 · fixed in 5.3.2-0.20250815165020-c8d66301415d, 8.0.0-20250815165020-c8d66301415d
- CVE-2025-47913Potential denial of service in golang.org/x/crypto/ssh/agentGo · golang.org/x/crypto, golang.org/x/crypto/ssh/agent · fixed in 0.43.0
- CVE-2025-11777Cross-team channel membership accessGo · github.com/mattermost/mattermost, github.com/mattermost/mattermost-server +4 · fixed in 5.3.2-0.20250905150616-ba86dfc5876b, 10.11.4, 10.5.12 and more
- CVE-2025-64717ZITADEL vulnerable to Account Takeover with deactivated Instance IdPGo · github.com/zitadel/zitadel · fixed in 1.80.0-v2.20.0.20251112124840-33c51deb2040, 4.6.6, 3.4.4 and more
- CVE-2025-64716Anubis vulnerable to possible XSS via redir parameter when using subrequest auth modeGo · github.com/techarohq/anubis · fixed in 1.23.0
- CVE-2025-64523FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion FunctionGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.45.1
- CVE-2025-64186Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted EnclavesGo · github.com/evervault/evervault-go · fixed in 1.3.2
- CVE-2025-2843Observability-operator: observability operator privilege escalationGo · github.com/rhobs/observability-operator · fixed in 1.3.0
- CVE-2025-63811An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON WeGo · github.com/dvsekhvalnov/jose2go · fixed in 1.7.0
- CVE-2025-64529SpiceDB's WriteRelationships fails silently if payload is too bigGo · github.com/authzed/spicedb · fixed in 1.45.2
- CVE-2025-64522Soft Serve is vulnerable to SSRF through its WebhooksGo · github.com/charmbracelet/soft-serve · fixed in 0.11.1
- CVE-2025-64513Milvus Proxy has Critical Authentication Bypass VulnerabilityGo · github.com/milvus-io/milvus · fixed in 2.4.24, 2.5.21, 2.6.5 and more