Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-49221Unauthenticated Access to Channel Subscription in Mattermost Confluence PluginGo · github.com/mattermost/mattermost-plugin-confluence · fixed in 1.5.0
- CVE-2025-48731Unauthorized Subscription Edit to Confluence Space in Mattermost Confluence PluginGo · github.com/mattermost/mattermost-plugin-confluence · fixed in 1.5.0
- CVE-2025-44004Unauthenticated Channel Subscription Creation in Mattermost Confluence PluginGo · github.com/mattermost/mattermost-plugin-confluence · fixed in 1.5.0
- CVE-2025-44001Unauthorized Channel Subscription Read in Mattermost Confluence PluginGo · github.com/mattermost/mattermost-plugin-confluence · fixed in 1.5.0
- CVE-2025-55003OpenBao Login MFA Bypasses Rate Limiting and TOTP Token ReuseGo · github.com/openbao/openbao · fixed in 0.0.0-20250807113757-8340a6918f6c, 2.3.2
- CVE-2025-55001OpenBao LDAP MFA Enforcement Bypass When Using Username As AliasGo · github.com/openbao/openbao · fixed in 0.0.0-20250807212521-c52795c1ef74, 2.3.2
- CVE-2025-55000OpenBao TOTP Secrets Engine Enables Code ReuseGo · github.com/openbao/openbao · fixed in 0.0.0-20250806193153-183891f8d535, 2.3.2
- CVE-2025-54999OpenBao: Timing Side-Channel in Userpass Auth MethodGo · github.com/openbao/openbao · fixed in 2.3.2, 0.0.0-20250806193356-4d9b5d3d6486
- CVE-2025-54998OpenBao Userpass and LDAP User Lockout BypassGo · github.com/openbao/openbao · fixed in 0.0.0-20250807212521-c52795c1ef74, 2.3.2
- CVE-2025-54997OpenBao: Privileged Operator May Execute Code on the Underlying HostGo · github.com/openbao/openbao · fixed in 2.3.2, 0.0.0-20250806194004-a14053c9679d
- CVE-2025-54996OpenBao Root Namespace Operator May Elevate Token PrivilegesGo · github.com/openbao/openbao · fixed in 0.0.0-20250806193240-9b0b5d4f345f, 2.3.2
- CVE-2025-7195Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwdGo · github.com/operator-framework/operator-sdk · fixed in 0.15.2
- CVE-2025-47907Incorrect results returned from Rows.Scan in database/sqlGo · stdlib · fixed in 1.23.12, 1.24.6
- CVE-2025-54799Lego does not enforce HTTPSGo · github.com/go-acme/lego, github.com/go-acme/lego/v3 +1 · fixed in 4.25.2
- CVE-2025-44779An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.Go · github.com/ollama/ollama · fixed in 0.1.34
- CVE-2025-47908Denial of service via malicious preflight requests in github.com/rs/corsGo · github.com/rs/cors · fixed in 1.11.0
- CVE-2025-6013Vault LDAP MFA Enforcement Bypass When Using Username As AliasGo · github.com/hashicorp/vault · fixed in 1.20.2
- CVE-2025-8556Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect resultsGo · github.com/cloudflare/circl · fixed in 1.6.1
- CVE-2025-54801Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in DecoderGo · github.com/gofiber/fiber/v2 · fixed in 2.52.9
- CVE-2025-53534RatPanel can perform remote command execution without authorizationGo · github.com/thetnb/panel, github.com/thetnb/panel/v2 +2 · fixed in 0.0.0-20250707071915-4985eb2e1f38, 2.5.6
- CVE-2025-8341SSRF in Infinity Datasource PluginGo · github.com/grafana/grafana-infinity-datasource · fixed in 1.4.2-0.20250731100004-9c736aa21b3a
- CVE-2025-54386Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code ExecutionGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.28, 3.4.5, 3.5.0
- CVE-2025-544241Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command ExecutionGo · github.com/1panel-dev/1panel/core · fixed in 2.0.6, 0.0.0-20250730021757-04b9cbd87a15
- CVE-2025-6015Vault Login MFA Bypass of Rate Limiting and TOTP Code ReuseGo · github.com/hashicorp/vault · fixed in 1.20.1
- CVE-2025-6011Timing Side-Channel in Vault’s Userpass Auth MethodGo · github.com/hashicorp/vault · fixed in 1.20.1
- CVE-2025-6004Vault Userpass and LDAP User Lockout BypassGo · github.com/hashicorp/vault · fixed in 1.20.1
- CVE-2025-6037Vault Certificate Auth Method Did Not Validate Common Name For Non-CA CertificatesGo · github.com/hashicorp/vault · fixed in 1.20.1
- CVE-2025-6014Vault TOTP Secrets Engine Code ReuseGo · github.com/hashicorp/vault · fixed in 1.20.1
- CVE-2025-6000Arbitrary Remote Code Execution via Plugin Catalog AbuseGo · github.com/hashicorp/vault · fixed in 1.20.1
- CVE-2025-5999Vault Root Namespace Operator May Elevate Token PrivilegesGo · github.com/hashicorp/vault · fixed in 1.20.0