Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-53363Dpanel has an arbitrary file read vulnerabilityGo · github.com/donknap/dpanel
- CVE-2025-8402Nil pointer dereference in bulk import crashes serverGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.18+incompatible, 10.5.9+incompatible, 10.8.4+incompatible and more
- CVE-2025-6465Path traversal in image upload with preview overwriteGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.5.9+incompatible, 10.8.4+incompatible, 10.9.4+incompatible and more
- CVE-2025-47870Team invite ID leaked to team admin with no member invite privilegesGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.8.4, 10.5.9, 9.11.18 and more
- CVE-2025-49222Mattermost Shared Channel Upload Type Validation BypassGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.8.4, 10.5.9, 9.11.18 and more
- CVE-2025-8023Path Traversal in Template Upload Allows Uploading Files Outside Target DirectoryGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.8.4, 10.5.9, 9.11.18 and more
- CVE-2025-53971Channel and Team Membership APIs inadvertently allow loss of Member privileges.Go · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.18+incompatible, 10.5.9+incompatible, 10.5.9 and more
- CVE-2025-47700AI plugin APIs can be triggered using post actionsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.5.10, 10.5.10+incompatible, 8.0.0-20250814075248-83a37a861d3c
- CVE-2025-49810Thread summarization allows persistent access to channelGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.5.9+incompatible, 10.5.9, 8.0.0-20250721095846-c602a4a78e1f
- CVE-2025-36530Import Path Traversal Enables Unauthorized Unsigned Plugin InstallationGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.18+incompatible, 10.5.9+incompatible, 10.8.4+incompatible and more
- CVE-2025-4437Cri-o: large /etc/passwd file may lead to denial of serviceGo · github.com/cri-o/cri-o
- CVE-2025-55740Default Credentials in nginx-defender Configuration FilesGo · github.com/anipaleja/nginx-defender · fixed in 1.5.0
- CVE-2025-55213OpenFGA Authorization Bypass (Check)Go · github.com/openfga/openfga · fixed in 1.9.5
- CVE-2025-55300Komari Allows Cross-site WebSocket HijackingGo · github.com/komari-monitor/komari · fixed in 0.0.0-20250809073044-53171affcaf0
- CVE-2025-55205Capsule tenant owners with "patch namespace" permission can hijack system namespaces labelGo · github.com/projectcapsule/capsule · fixed in 0.10.4
- CVE-2025-8959HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink AttackGo · github.com/hashicorp/go-getter · fixed in 1.7.9
- CVE-2025-9039Information Disclosure in Amazon ECS Container AgentGo · github.com/aws/amazon-ecs-agent · fixed in 1.97.1
- CVE-2025-55198Helm May Panic Due To Incorrect YAML ContentGo · helm.sh/helm, helm.sh/helm/v3 · fixed in 3.18.5
- CVE-2025-55199Helm Charts with Specific JSON Schema Values Can Cause Memory ExhaustionGo · helm.sh/helm, helm.sh/helm/v3 · fixed in 3.18.5
- CVE-2025-55196External Secrets Operator Missing Namespace Restriction in PushSecret and SecretStore List() Calls Allows Unauthorized Secret AccessGo · github.com/external-secrets/external-secrets · fixed in 0.19.2
- CVE-2025-50946OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.Go · github.com/olivetin/olivetin
- CVE-2025-8285Unauthorized Channel Subscription Creation in Mattermost Confluence PluginGo · github.com/mattermost/mattermost-plugin-confluence · fixed in 1.5.0
- CVE-2025-54525Unexpected input to Create Channel Subscription endpoint causes DoS in Mattermost Confluence PluginGo · github.com/mattermost/mattermost-plugin-confluence · fixed in 1.5.0
- CVE-2025-54478Unauthenticated Channel Subscription Edit in Mattermost Confluence PluginGo · github.com/mattermost/mattermost-plugin-confluence · fixed in 1.5.0
- CVE-2025-54463Unexpected Input to Cloud Webhook endpoint Causes DoS in Mattermost Confluence PluginGo · github.com/mattermost/mattermost-plugin-confluence · fixed in 1.5.0
- CVE-2025-54458Unauthorized Subscription Creation to Confluence Space in Mattermost Confluence PluginGo · github.com/mattermost/mattermost-plugin-confluence · fixed in 1.5.0
- CVE-2025-53910Unauthorized Channel Subscription Edit in Mattermost Confluence PluginGo · github.com/mattermost/mattermost-plugin-confluence · fixed in 1.5.0
- CVE-2025-53857Lack of Authorization on Get Channel Subscriptions for Autocomplete in Mattermost Confluence PluginGo · github.com/mattermost/mattermost-plugin-confluence · fixed in 1.5.0
- CVE-2025-53514Unexpected Input to Server Webhook endpoint Causes DoS in Mattermost Confluence PluginGo · github.com/mattermost/mattermost-plugin-confluence · fixed in 1.5.0
- CVE-2025-52931Unexpected input to Update Channel Subscription endpoint causes DoS in Mattermost Confluence PluginGo · github.com/mattermost/mattermost-plugin-confluence · fixed in 1.5.0