Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-59358Denial of Service via Unauthorized Access to Chaos Mesh debugging serverGo · github.com/chaos-mesh/chaos-mesh · fixed in 2.7.3
- CVE-2025-9072One-Click Mattermost Account Takeover via Poisoned RelayState SAML ParameterGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.5.10+incompatible, 10.9.5+incompatible, 10.10.2+incompatible and more
- CVE-2025-9084Open redirect in OAuth loginGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.5.10+incompatible, 10.5.10, 8.0.0-202508080704-39bd251fe4f600
- CVE-2025-9078Weak cache keys lead to post IDOR and link preview poisoningGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.18+incompatible, 10.5.9+incompatible, 10.8.4+incompatible and more
- CVE-2025-9076Mattermost Server exposes sensitive user credentials during shared channel membership synchronizationGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.10.2+incompatible, 10.10.2, 8.0.0-20250729073403-517ae758cd02
- CVE-2025-54376Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled.Go · github.com/spectolabs/hoverfly · fixed in 1.12.0
- CVE-2025-54123Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementationGo · github.com/spectolabs/hoverfly
- CVE-2025-58430listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account TakeoverGo · github.com/knadh/listmonk
- CVE-2025-58063CoreDNS: DNS Cache Pinning via etcd Lease ID ConfusionGo · github.com/coredns/coredns · fixed in 1.12.4
- CVE-2025-58450pREST has Systemic SQL Injection VulnerabilityGo · github.com/prest/prest, github.com/prest/prest/v2
- CVE-2025-58445Atlantis Exposes Service Version Publicly on /status API EndpointGo · github.com/runatlantis/atlantis
- CVE-2025-58437Coder's privilege escalation vulnerability could lead to a cross workspace compromiseGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.24.4, 2.25.2
- CVE-2025-9566Podman: podman kube play command may overwrite host filesGo · github.com/containers/podman, github.com/containers/podman/v2 +3 · fixed in 5.6.1
- CVE-2025-7445Kubernetes secrets-store-sync-controller discloses service account tokens in logsGo · sigs.k8s.io/secrets-store-sync-controller · fixed in 0.0.2
- CVE-2025-55190Argo CD: Project API Token Exposes Repository CredentialsGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 +1 · fixed in 2.13.9, 2.14.16, 3.0.14 and more
- CVE-2025-58355Soft Serve is vulnerable to arbitrary file writing through its SSH APIGo · github.com/charmbracelet/soft-serve · fixed in 0.10.0
- CVE-2025-56760When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path travGo · github.com/usememos/memos
- CVE-2025-56761Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features.Go · github.com/usememos/memos
- CVE-2025-54588Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faultsGo · github.com/envoyproxy/envoy · fixed in 1.35.1, 1.34.5
- CVE-2024-58259Rancher affected by unauthenticated Denial of ServiceGo · github.com/rancher/rancher · fixed in 0.0.0-20250813072957-aee95d4e2a41, 2.12.1, 2.11.5 and more
- CVE-2024-52284Rancher Fleet Helm Values are stored inside BundleDeployment in plain textGo · github.com/rancher/fleet · fixed in 0.13.1-0.20250806151509-088bcbea7edb, 0.12.6, 0.11.10
- CVE-2025-58157gnark affected by denial of service when computing scalar multiplication using fake-GLV algorithmGo · github.com/consensys/gnark · fixed in 0.13.0
- CVE-2025-58158Harness Affected by Arbitrary File Write in Gitness LFS serverGo · github.com/harness/gitness · fixed in 3.3.0, 1.0.4-gitspaces-beta.0.20250808064055-21c5ce42ae13
- CVE-2025-47909Improper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrfGo · github.com/gorilla/csrf
- CVE-2025-58058github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archivesGo · github.com/ulikunitz/xz · fixed in 0.5.15
- CVE-2025-6203Vault unauthenticated denial of service through complex json payloadGo · github.com/hashicorp/vault · fixed in 1.20.3
- CVE-2025-5187Nodes can delete themselves by adding an OwnerReferenceGo · k8s.io/kubernetes · fixed in 1.31.12, 1.32.8, 1.33.4
- CVE-2025-51667An issue was discovered in simple-admin-core v1.2.0 thru v1.6.7.Go · github.com/suyuan32/simple-admin-core · fixed in 1.6.8
- CVE-2025-57813Insertion of Sensitive Information into Log File in github.com/traPtitech/traQGo · github.com/traptitech/traq · fixed in 3.25.0
- CVE-2025-57801gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checksGo · github.com/consensys/gnark · fixed in 0.14.0