Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-59163vet MCP Server SSE Transport DNS Rebinding VulnerabilityGo · github.com/safedep/vet · fixed in 1.12.5
- CVE-2025-10954Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of InputGo · github.com/nyaruka/phonenumbers · fixed in 1.2.2
- CVE-2025-59823Gardener providers vulnerable to code injection when Terraformer is used for infrastructure provisioningGo · github.com/gardener/gardener-extension-provider-aws, github.com/gardener/gardener-extension-provider-azure +2 · fixed in 1.64.0, 1.55.0, 1.46.0 and more
- CVE-2025-59824Omni Wireguard SideroLink potential escapeGo · github.com/siderolabs/omni · fixed in 0.48.0
- CVE-2025-47910CrossOriginProtection insecure bypass patterns not limited to exact matches in net/httpGo · stdlib · fixed in 1.25.1
- CVE-2025-9081IDOR in board file download allows any user to download any file by UUIDGo · github.com/mattermost/mattermost-plugin-boards, github.com/mattermost/mattermost-server +3 · fixed in 0.0.0-20250716054606-3f3e3becfe1d, 9.11.18+incompatible, 10.5.9+incompatible and more
- CVE-2025-9079Admin RCE via prepackaged plugins by way of misconfigured imports directoryGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.8.4, 10.5.9, 9.11.18 and more
- CVE-2025-10630Regex DoS in Grafana Zabbix PluginGo · github.com/alexanderzobnin/grafana-zabbix · fixed in 6.0.0
- CVE-2025-47906Unexpected paths returned from LookPath in os/execGo · stdlib · fixed in 1.23.12, 1.24.6
- CVE-2025-59410Dragonfly tiny file download uses hard coded HTTP protocolGo · d7y.io/dragonfly/v2, github.com/dragonflyoss/dragonfly · fixed in 2.1.0
- CVE-2025-59354Dragonfly has weak integrity checks for downloaded filesGo · d7y.io/dragonfly/v2, github.com/dragonflyoss/dragonfly · fixed in 2.1.0
- CVE-2025-59353Manager generates mTLS certificates for arbitrary IP addressesGo · d7y.io/dragonfly/v2, github.com/dragonflyoss/dragonfly · fixed in 2.1.0
- CVE-2025-59352Dragonfly allows arbitrary file read and write on a peer machineGo · d7y.io/dragonfly/v2, github.com/dragonflyoss/dragonfly · fixed in 2.1.0
- CVE-2025-59351Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an errorGo · d7y.io/dragonfly/v2, github.com/dragonflyoss/dragonfly · fixed in 2.1.0
- CVE-2025-59350Timing attacks against Proxy’s basic authentication are possibleGo · d7y.io/dragonfly/v2, github.com/dragonflyoss/dragonfly · fixed in 2.1.0
- CVE-2025-59349Directories created via os.MkdirAll are not checked for permissionsGo · d7y.io/dragonfly/v2, github.com/dragonflyoss/dragonfly · fixed in 2.1.0
- CVE-2025-59348Dragonfly incorrectly handles a task structure’s usedTraffic fieldGo · d7y.io/dragonfly/v2, github.com/dragonflyoss/dragonfly · fixed in 2.1.0
- CVE-2025-59347Dragonfly Manager makes requests to external endpoints with disabled TLS authenticationGo · d7y.io/dragonfly/v2, github.com/dragonflyoss/dragonfly · fixed in 2.1.0
- CVE-2025-59346Dragonfly server-side request forgery vulnerabilityGo · d7y.io/dragonfly/v2, github.com/dragonflyoss/dragonfly · fixed in 2.1.0
- CVE-2025-59345Dragonfly did not enable authentication for some Manager’s endpointsGo · d7y.io/dragonfly/v2, github.com/dragonflyoss/dragonfly · fixed in 2.1.0
- CVE-2025-59342esm.sh writes arbitrary files via path traversal in `X-Zone-Id` headerGo · github.com/esm-dev/esm.sh · fixed in 136.1
- CVE-2025-59341Local File Inclusion in esm.shGo · github.com/esm-dev/esm.sh
- CVE-2025-8077NeuVector admin account has insecure default passwordGo · github.com/neuvector/neuvector · fixed in 0.0.0-20250825191744-da1a462074c3
- CVE-2025-54467NeuVector process with sensitive arguments lead to leakageGo · github.com/neuvector/neuvector · fixed in 0.0.0-20250902144615-f9ddbdf42031
- CVE-2025-53884NeuVector has an insecure password storage vulnerable to rainbow attackGo · github.com/neuvector/neuvector · fixed in 0.0.0-20250825191744-da1a462074c3
- CVE-2025-4953Podman: build context bind mountGo · github.com/containers/podman, github.com/containers/podman/v2 +3
- CVE-2025-8396Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due Go · go.temporal.io/server · fixed in 1.26.3, 1.27.3, 1.28.1
- CVE-2025-59361OS command injection in Chaos Mesh via the cleanIptables mutationGo · github.com/chaos-mesh/chaos-mesh · fixed in 2.7.3
- CVE-2025-59360OS command injection in Chaos Mesh via the killProcesses mutationGo · github.com/chaos-mesh/chaos-mesh · fixed in 2.7.3
- CVE-2025-59359OS command injection in Chaos Mesh via the cleanTcs mutationGo · github.com/chaos-mesh/chaos-mesh · fixed in 2.7.3