Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-53512Sensitive log retrieval in JujuGo · github.com/juju/juju · fixed in 0.0.0-20250619024904-402ff008dcc2
- CVE-2025-6224Key leakage in juju/utils certificatesGo · github.com/juju/utils, github.com/juju/utils/v2 +3 · fixed in 4.0.4
- CVE-2025-52997File Browser Insecurely Handles PasswordsGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.34.1
- CVE-2025-52996File Browser's Password Protection of Links Vulnerable to BypassGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2
- CVE-2025-52995File Browser vulnerable to command execution allowlist bypassGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.33.10
- CVE-2025-52901File Browser allows sensitive data to be transferred in URLGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.33.9
- CVE-2025-47871Mattermost Playbooks exposes private channel metadata to unauthorized users via run metadata APIGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 0.0.0-20250513065225-4ae5d647fb88, 9.11.16+incompatible, 10.5.6+incompatible and more
- CVE-2025-46702Mattermost Playbooks allows privilege escalation through improper access control in playbook run participant managementGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 0.0.0-20250513065225-4ae5d647fb88, 9.11.16+incompatible, 10.5.6+incompatible and more
- CVE-2025-52904File Browser: Command Execution not Limited to ScopeGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.33.8
- CVE-2025-52903File Browser Allows Execution of Shell Commands That Can Spawn Other CommandsGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.33.10
- CVE-2025-52477Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC FlowGo · github.com/octo-sts/app · fixed in 0.5.3
- CVE-2025-52902File Browser has Stored Cross-Site Scripting vulnerabilityGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.33.7
- CVE-2025-52900File Browser has Insecure File PermissionsGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2 · fixed in 2.33.7
- CVE-2025-6624Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debugGo · github.com/snyk/go-application-framework
- CVE-2025-52894OpenBao Vulnerable to Unauthenticated Rekey Operation CancellationGo · github.com/openbao/openbao · fixed in 0.0.0-20250625150133-fe75468822a2
- CVE-2025-52893OpenBao May Leak Sensitive Information in Logs When Processing Malformed DataGo · github.com/openbao/openbao/sdk, github.com/openbao/openbao/sdk/v2 · fixed in 2.3.0
- CVE-2025-52890Incus vulnerable to antispoofing nftables firewall rule bypass on bridge networks with ACLsGo · github.com/lxc/incus, github.com/lxc/incus/v6 · fixed in 6.14.0
- CVE-2025-52889Incus vulnerable to DoS through antispoofing nftables firewall rule bypass on bridge networks with ACLsGo · github.com/lxc/incus, github.com/lxc/incus/v6 · fixed in 6.14.0
- CVE-2025-4656Vault Vulnerable to Recovery Key Cancellation Denial of ServiceGo · github.com/hashicorp/vault · fixed in 1.20.0
- CVE-2025-6032Podman: podman missing tls verificationGo · github.com/containers/podman, github.com/containers/podman/v2 +3 · fixed in 5.5.2
- CVE-2025-47943Gogs stored XSS in PDF rendererGo · github.com/gogs/gogs, gogs.io/gogs · fixed in 0.13.3-0.20250608224432-110117b2e5e5
- CVE-2024-56731Gogs deletion of internal files allows remote command executionGo · gogs.io/gogs · fixed in 0.13.3
- CVE-2025-4563Nodes can bypass dynamic resource allocation authorization checksGo · k8s.io/kubernetes · fixed in 1.32.6, 1.33.2
- CVE-2025-3228Unauthorized Guest user access to PlaybookGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 0.0.0-20250520060012-d0380305ef7a, 9.11.16+incompatible, 10.5.6+incompatible and more
- CVE-2025-3227Unauthorized channel member management through playbook runsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 0.0.0-20250520060012-d0380305ef7a, 9.11.16+incompatible, 10.5.6+incompatible and more
- CVE-2025-4981Path Traversal Leading to RCE by Any Authenticated Mattermost UserGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 0.0.0-20250519205859-65aec10162f6, 9.11.16+incompatible, 10.5.6+incompatible and more
- CVE-2025-6264Velociraptor priviledge escalation via UpdateConfig artifactGo · www.velocidex.com/golang/velociraptor · fixed in 0.74.3
- CVE-2025-1088Very long unicode dashboard title or panel name can hang the frontendGo · github.com/grafana/grafana · fixed in 0.0.0-20250521211231-e0ba4b480954, 11.6.2
- CVE-2025-5981Arbitrary File write in OSV-SCALIBRGo · github.com/google/osv-scalibr · fixed in 0.2.1
- CVE-2025-49825Teleport allows remote authentication bypassGo · github.com/gravitational/teleport · fixed in 17.5.2, 16.5.12, 15.5.3 and more