Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-54576OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusionGo · github.com/oauth2-proxy/oauth2-proxy, github.com/oauth2-proxy/oauth2-proxy/v7 · fixed in 7.11.0
- CVE-2025-54410Moby's Firewalld reload removes bridge network isolationGo · github.com/docker/docker · fixed in 25.0.13, 28.0.0, 25.0.13+incompatible
- CVE-2025-54388Moby's Firewalld reload makes published container ports accessible from remote hostsGo · github.com/docker/docker · fixed in 28.3.3+incompatible, 28.3.3
- CVE-2025-4674Unexpected command execution in untrusted VCS repositories in cmd/goGo · toolchain · fixed in 1.23.11, 1.24.5
- CVE-2025-50738The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs.Go · github.com/usememos/memos · fixed in 0.24.4
- CVE-2025-52490An issue was discovered in Couchbase Sync Gateway before 3.2.6.Go · github.com/couchbase/sync_gateway · fixed in 3.2.6
- CVE-2025-30086CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak presenGo · github.com/goharbor/harbor · fixed in 2.12.4+incompatible, 2.13.1+incompatible, 2.13.1 and more
- CVE-2025-54379eKuiper API endpoints handling SQL queries with user-controlled table names.Go · github.com/lf-edge/ekuiper, github.com/lf-edge/ekuiper/v2 · fixed in 2.2.1
- CVE-2025-32019Harbor's repository description page allows for XSSGo · github.com/goharbor/harbor · fixed in 2.12.4-rc1, 2.13.1-rc1, 2.4.0-rc1.0.20250421072404-a13a16383a41 and more
- CVE-2025-47281Kyverno's Improper JMESPath Variable Evaluation Leads to Denial of ServiceGo · github.com/kyverno/kyverno · fixed in 1.14.2
- CVE-2025-53942authentik has an insufficient check for account active status during OAuth/SAML authenticationGo · goauthentik.io · fixed in 0.0.0-20250722122105-7a4c6b9b50f8
- CVE-2025-51471Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and Go · github.com/ollama/ollama
- CVE-2025-54059melange creates SBOM files in APKs with world-writable permissionsGo · chainguard.dev/melange · fixed in 0.29.5
- CVE-2025-53945apko has incorrect permission (0666) in /etc/ld.so.cache and other filesGo · chainguard.dev/apko · fixed in 0.29.5
- CVE-2025-6227Invite token is used as part of the secure communicationGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.5.8, 9.11.17, 9.11.17+incompatible and more
- CVE-2025-6233Arbitrary file read by system admin via path traversalGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.8.2, 10.7.4, 10.5.8 and more
- CVE-2025-6226IDOR in CreatePost API allows for timeboxed message disclosureGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.5.7, 10.8.2, 10.7.4 and more
- CVE-2025-6023An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks.Go · github.com/grafana/grafana · fixed in 1.9.2-0.20250521205822-0ba0b99665a9
- CVE-2025-23267NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link followiGo · github.com/nvidia/gpu-operator, github.com/nvidia/k8s-device-plugin +2 · fixed in 25.3.2, 0.17.3, 0.12.2 and more
- CVE-2025-23266NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could Go · github.com/nvidia/gpu-operator, github.com/nvidia/k8s-device-plugin +2 · fixed in 25.3.2, 0.17.3, 0.12.2 and more
- CVE-2025-3415Grafana is an open-source platform for monitoring and observability.Go · github.com/grafana/grafana · fixed in 1.9.2-0.20250514160932-04111e9f2afd
- CVE-2025-53826FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after LogoutGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2
- CVE-2025-53893File Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File ProcessingGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2
- CVE-2025-7453saltbo zpan JSON Web Token token.go NewToken hard-coded passwordGo · github.com/saltbo/zpan · fixed in 1.6.6
- CVE-2025-53634Chall-Manager's HTTP Gateway have no header check timeout leading to potential slow loris attacksGo · github.com/ctfer-io/chall-manager · fixed in 0.1.4
- CVE-2025-53633Chall-Manager's scenario decoding process does not check for zip bombsGo · github.com/ctfer-io/chall-manager · fixed in 0.1.4
- CVE-2025-53632Chall-Manager's scenario decoding process does not check for zip slipsGo · github.com/ctfer-io/chall-manager · fixed in 0.1.4
- CVE-2025-53547Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code ExecutionGo · helm.sh/helm/v3 · fixed in 3.18.4, 3.17.4
- CVE-2025-0928Arbitrary executable upload via authenticated endpointGo · github.com/juju/juju · fixed in 0.0.0-20250619215741-4034aa13c7cf
- CVE-2025-53513Zip slip vulnerability in JujuGo · github.com/juju/juju · fixed in 0.0.0-20250619215741-6356e984b82a