Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-64507Incus vulnerable to local privilege escalation through custom storage volumesGo · github.com/lxc/incus, github.com/lxc/incus/v6 · fixed in 6.19.0
- CVE-2025-64484OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalationGo · github.com/oauth2-proxy/oauth2-proxy, github.com/oauth2-proxy/oauth2-proxy/v7 · fixed in 7.13.0
- CVE-2025-64494Soft Serve does not sanitize ANSI escape sequences in user inputGo · github.com/charmbracelet/soft-serve · fixed in 0.11.0
- CVE-2025-64433KubeVirt Arbitrary Container File ReadGo · kubevirt.io/kubevirt · fixed in 1.5.3, 1.6.1, 1.6.0-beta.0.0.20250801195231-a81b27d4600c
- CVE-2025-64437KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission ChangesGo · kubevirt.io/kubevirt · fixed in 1.5.3, 1.6.1, 1.6.0-beta.0.0.20250801202148-3ce9f41c54d0
- CVE-2025-64436KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between NodesGo · github.com/kubevirt/kubevirt, kubevirt.io/kubevirt · fixed in 1.7.0
- CVE-2025-64435KubeVirt VMI Denial-of-Service (DoS) Using Pod ImpersonationGo · kubevirt.io/kubevirt · fixed in 1.7.0-beta.0
- CVE-2025-64434KubeVirt Improper TLS Certificate Management Handling Allows API Identity SpoofingGo · kubevirt.io/kubevirt · fixed in 1.5.3, 1.6.0-beta.0.0.20250730135146-231dc69723f3, 1.6.1
- CVE-2025-64432KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation LayerGo · kubevirt.io/kubevirt · fixed in 1.5.3, 1.6.1, 1.7.0-rc.0 and more
- CVE-2025-64431IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data TemperingGo · github.com/zitadel/zitadel · fixed in 4.6.3, 1.80.0-v2.20.0.20251105083648-8dcfff97ed52
- CVE-2025-64346archives: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Go · github.com/jaredallard/archives · fixed in 1.0.1
- CVE-2025-64329containerd CRI server: Host memory exhaustion through Attach goroutine leakGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 1.7.29, 2.0.7, 2.1.5 and more
- CVE-2025-64323kgateway is missing xDS authorizationGo · github.com/kgateway-dev/kgateway, github.com/kgateway-dev/kgateway/v2 · fixed in 2.0.5, 2.1.0
- CVE-2025-64179lakeFS: Unauthenticated access to API usage metricsGo · github.com/treeverse/lakefs · fixed in 1.71.0
- CVE-2025-64178Jellysweep uses uncontrolled data in image cache API endpointGo · github.com/jon4hz/jellysweep · fixed in 0.13.0
- CVE-2025-52881runc: LSM labels can be bypassed with malicious config using dummy procfs filesGo · github.com/opencontainers/runc, github.com/opencontainers/selinux · fixed in 1.2.8, 1.3.3, 1.4.0-rc.3 and more
- CVE-2025-52565container escape due to /dev/console mount and related racesGo · github.com/opencontainers/runc · fixed in 1.2.8, 1.3.3, 1.4.0-rc.3
- CVE-2025-31133runc container escape via "masked path" abuse due to mount race conditionsGo · github.com/opencontainers/runc · fixed in 1.2.8, 1.3.3, 1.4.0-rc.3
- CVE-2024-25621containerd affected by a local privilege escalation via wide permissions on CRI directoryGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 1.7.29, 2.0.7, 2.1.5 and more
- CVE-2025-64171MARIN3R: Cross-Namespace Vulnerability in the OperatorGo · github.com/3scale-sre/marin3r · fixed in 0.13.4
- CVE-2025-54471NeuVector is shipping cryptographic material into its binaryGo · github.com/neuvector/neuvector · fixed in 0.0.0-20251020133207-084a437033b4, 5.4.7
- CVE-2025-54469NeuVector Enforcer is vulnerable to Command Injection and Buffer overflowGo · github.com/neuvector/neuvector · fixed in 5.3.5, 5.4.7, 0.0.0-20251020133207-084a437033b4
- CVE-2025-54470NeuVector telemetry sender is vulnerable to MITM and DoSGo · github.com/neuvector/neuvector · fixed in 0.0.0-20251020133207-084a437033b4
- CVE-2025-61141sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environmeGo · github.com/sqls-server/sqls
- CVE-2025-61724Excessive CPU consumption in Reader.ReadResponse in net/textprotoGo · stdlib · fixed in 1.24.8, 1.25.2
- CVE-2025-58183Unbounded allocation when parsing GNU sparse map in archive/tarGo · stdlib · fixed in 1.24.8, 1.25.2
- CVE-2025-58188Panic when validating certificates with DSA public keys in crypto/x509Go · stdlib · fixed in 1.24.8, 1.25.2
- CVE-2025-58186Lack of limit when parsing cookies can cause memory exhaustion in net/httpGo · stdlib · fixed in 1.24.8, 1.25.2
- CVE-2025-58185Parsing DER payload can cause memory exhaustion in encoding/asn1Go · stdlib · fixed in 1.24.8, 1.25.2
- CVE-2025-47912Insufficient validation of bracketed IPv6 hostnames in net/urlGo · stdlib · fixed in 1.24.8, 1.25.2