Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-61723Quadratic complexity when parsing some invalid inputs in encoding/pemGo · stdlib · fixed in 1.24.8, 1.25.2
- CVE-2025-58189ALPN negotiation error contains attacker controlled information in crypto/tlsGo · stdlib · fixed in 1.24.8, 1.25.2
- CVE-2025-58187Quadratic complexity when checking name constraints in crypto/x509Go · stdlib · fixed in 1.24.9, 1.25.3
- CVE-2025-61725Excessive CPU consumption in ParseAddress in net/mailGo · stdlib · fixed in 1.24.8, 1.25.2
- CVE-2025-64103Zitadel Bypass Second Authentication FactorGo · github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2 · fixed in 1.80.0-v2.20.0.20251029091250-b284f8474eed, 2.71.18
- CVE-2025-64102Zitadel allows brute-forcing authentication factorsGo · github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2 · fixed in 1.80.0-v2.20.0.20251029090735-b8db8cdf9cc8, 2.71.18
- CVE-2025-64101ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header InjectionGo · github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2 · fixed in 2.71.18, 1.80.0-v2.20.0.20251029090537-72a5c33e6ac3
- CVE-2024-58269Rancher exposes sensitive information through audit logsGo · github.com/rancher/rancher · fixed in 0.0.0-20251013203444-50dc516a19ea
- CVE-2023-32199Rancher user retains access to clusters despite Global Role removalGo · github.com/rancher/rancher · fixed in 0.0.0-20251014212116-7faa74a968c2
- CVE-2025-11374Consul's KV endpoint is vulnerable to denial of serviceGo · github.com/hashicorp/consul · fixed in 1.22.0
- CVE-2025-11375Consul's event endpoint is vulnerable to denial of serviceGo · github.com/hashicorp/consul · fixed in 1.22.0
- CVE-2025-27093Sliver does not restricted traffic between Wireguard clients.Go · github.com/bishopfox/sliver · fixed in 1.5.44
- CVE-2025-62725Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer AnnotationsGo · github.com/docker/compose, github.com/docker/compose/v2 · fixed in 2.40.2
- CVE-2025-58356Constellation allows insecure use of LUKS2 persistent storage partitionsGo · github.com/edgelesssys/constellation, github.com/edgelesssys/constellation/v2 · fixed in 2.24.0
- CVE-2025-62714Karmada Dashboard API Unauthorized Access VulnerabilityGo · github.com/karmada-io/dashboard · fixed in 0.2.0
- CVE-2025-12044Vault Vulnerable to Denial of Service Due to Rate Limit RegressionGo · github.com/hashicorp/vault · fixed in 1.21.0
- CVE-2025-11621Vault AWS auth method bypass due to AWS client cacheGo · github.com/hashicorp/vault · fixed in 1.21.0
- CVE-2025-59048OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth MethodGo · github.com/openbao/openbao-plugins · fixed in 0.1.1
- CVE-2025-62820Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.Go · github.com/slackhq/nebula · fixed in 1.9.7
- CVE-2025-62705OpenBao and Vault Leak []byte Fields in Audit LogsGo · github.com/openbao/openbao · fixed in 0.0.0-20251022165510-cc2c476bac66
- CVE-2025-62513OpenBao leaks HTTPRawBody in Audit LogsGo · github.com/openbao/openbao · fixed in 0.0.0-20251022165510-cc2c476bac66
- CVE-2025-10678Admin with default credentials in NetBird VPNGo · github.com/netbirdio/netbird · fixed in 0.57.0
- CVE-2025-59043OpenBao vulnerable to denial of service via malicious JSON request processingGo · github.com/openbao/openbao · fixed in 2.4.1
- CVE-2025-26625Git LFS may write to arbitrary files via crafted symlinksGo · github.com/git-lfs/git-lfs, github.com/git-lfs/git-lfs/v3 · fixed in 3.7.1
- CVE-2025-62506MinIO vulnerable to privilege escalation via session policy bypass in service accounts and STSGo · github.com/minio/minio · fixed in 0.0.0-20251015170045-c1a49490c78e
- CVE-2025-58073Arbitrary Mattermost Team can be joined by manipulating the OAuth stateGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.2, 10.10.3, 10.5.11 and more
- CVE-2025-61581Apache Traffic Control: ReDoS issue in Traffic Router configurationGo · github.com/apache/trafficcontrol, github.com/apache/trafficcontrol/v8
- CVE-2025-41410Slack import bypasses email verification for team access controlsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.5.11+incompatible, 10.10.3+incompatible, 10.11.3+incompatible and more
- CVE-2025-10545Guest user can add unauthorized team users to private channelsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.5.11, 10.11.3, 10.5.11+incompatible and more
- CVE-2025-58075Arbitrary Mattermost Team can be joined by manipulating the SAML RelayStateGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.11.2, 10.10.3, 10.5.11 and more