Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-54499Insecure string comparison enables timing attacksGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.5.11, 10.11.3, 10.5.11+incompatible and more
- CVE-2025-41443Guest user can discover active public channelsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost/server/v8 · fixed in 10.5.11, 10.11.3, 8.0.0-20250822090405-e8c7e7d0252b
- CVE-2025-62375go-witness Improper Verification of AWS EC2 Identity DocumentsGo · github.com/in-toto/go-witness · fixed in 0.9.1
- CVE-2025-62157Argo Workflows exposes artifact repository credentials in workflow-controller logsGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +1 · fixed in 3.7.3, 3.6.12
- CVE-2025-62156argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwriteGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +1 · fixed in 3.6.12, 3.7.3
- CVE-2025-61688Omni leaks information via the APIGo · github.com/siderolabs/omni · fixed in 1.1.5, 1.0.2
- CVE-2025-59836Omni is Vulnerable to DoS via Empty Create/Update Resource RequestsGo · github.com/siderolabs/omni · fixed in 1.1.5, 1.0.2
- CVE-2025-59530quic-go has Client Crash Due to Premature HANDSHAKE_DONE FrameGo · github.com/quic-go/quic-go · fixed in 0.49.1, 0.54.1
- CVE-2025-11579DoS via Out Of Memory CrashGo · github.com/nwaples/rardecode, github.com/nwaples/rardecode/v2 · fixed in 2.2.0
- CVE-2025-61926Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook SecretGo · github.com/ossf/allstar · fixed in 0.0.0-20250721181116-e004ecb540d6
- CVE-2025-61524An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.Go · github.com/casdoor/casdoor · fixed in 2.63.0
- CVE-2025-61595MANTRA tx gas limit is not enforced in send hooksGo · github.com/mantra-chain/mantrachain, github.com/mantra-chain/mantrachain/v2 +2 · fixed in 4.0.2
- CVE-2024-58260Rancher update on users can deny the service to the adminGo · github.com/rancher/rancher · fixed in 2.12.2, 2.11.6, 2.10.10 and more
- CVE-2024-58267Rancher CLI SAML authentication is vulnerable to phishing attacksGo · github.com/rancher/rancher · fixed in 2.12.2, 2.11.6, 2.10.10 and more
- CVE-2025-54293Path Traversal in LXD Instance Log File RetrievalGo · github.com/canonical/lxd · fixed in 5.21.4, 6.5, 0.0.0-20250224180022-ec09b24179f3
- CVE-2025-54468Rancher sends sensitive information to external services through the `/meta/proxy` endpointGo · github.com/rancher/rancher · fixed in 2.12.2, 2.11.6, 2.10.10 and more
- CVE-2025-54291Project existence disclosure in LXD images APIGo · github.com/canonical/lxd · fixed in 5.21.4, 6.5, 0.0.0-20250827065555-0494f5d47e41
- CVE-2025-54290Project Existence Disclosure via Error Handling in LXD Image ExportGo · github.com/canonical/lxd · fixed in 0.0.0-20250827065555-0494f5d47e41, 5.21.4, 6.5
- CVE-2025-54289Privilege Escalation via WebSocket Connection Hijacking in LXD Operations APIGo · github.com/canonical/lxd · fixed in 5.21.4, 6.5, 0.0.0-20250827065555-0494f5d47e41
- CVE-2025-54288Source Container Identification Vulnerability via cmdline Spoofing in devLXD ServerGo · github.com/canonical/lxd · fixed in 0.0.0-20250827065555-0494f5d47e41, 5.21.4, 6.5
- CVE-2025-54287Arbitrary File Read via Template Injection in Snapshot PatternsGo · github.com/lxc/lxd, github.com/lxc/lxd/v6 · fixed in 5.21.4, 6.5.0, 0.0.0-20250827065555-0494f5d47e41
- CVE-2025-54286CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UIGo · github.com/canonical/lxd · fixed in 5.0.5, 5.21.4, 6.5 and more
- CVE-2025-59538Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhookGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 +1 · fixed in 2.14.20, 3.0.19, 3.1.8 and more
- CVE-2025-59537argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payloadGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 +1 · fixed in 2.14.20, 3.2.0-rc2, 3.1.8 and more
- CVE-2025-59531Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payloadGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 +1 · fixed in 2.14.20, 3.2.0-rc2, 3.1.8 and more
- CVE-2025-55191Repository Credentials Race Condition Crashes Argo CD ServerGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 +1 · fixed in 2.14.20, 3.0.19, 3.1.8 and more
- CVE-2025-59956AgentAPI exposed user chat history via a DNS rebinding attackGo · github.com/coder/agentapi · fixed in 0.4.0
- CVE-2025-59942go-f3 module vulnerable to integer overflow leading to panicGo · github.com/filecoin-project/go-f3 · fixed in 0.8.7
- CVE-2025-59941go-f3 is Vulnerable to Cached Justification Verification BypassGo · github.com/filecoin-project/go-f3 · fixed in 0.8.9
- CVE-2025-59937go-mail has insufficient address encoding when passing mail addresses to the SMTP clientGo · github.com/wneessen/go-mail · fixed in 0.7.1