Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-5689Improper Permission Management in SSH Session HandlingGo · github.com/ubuntu/authd · fixed in 0.5.4
- CVE-2024-44905go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go.Go · github.com/go-pg/pg, github.com/go-pg/pg/v10 +1 · fixed in 10.15.0
- CVE-2024-44906uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go.Go · github.com/uptrace/bun/driver/pgdriver · fixed in 1.2.15
- CVE-2025-0913Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscallGo · stdlib · fixed in 1.23.10, 1.24.4
- CVE-2025-4673Sensitive headers not cleared on cross-origin redirect in net/httpGo · stdlib · fixed in 1.23.10, 1.24.4
- CVE-2025-22874Usage of ExtKeyUsageAny disables policy validation in crypto/x509Go · stdlib · fixed in 1.24.4
- CVE-2025-4922Nomad Vulnerable To Incorrect ACL Policy Lookup Attached To A JobGo · github.com/hashicorp/nomad · fixed in 1.10.2
- CVE-2025-4128Mattermost Guest User Information Disclosure VulnerabilityGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.14+incompatible, 10.5.5+incompatible, 10.5.5 and more
- CVE-2025-4573LDAP Injection in Mattermost Enterprise Edition When Using Active DirectoryGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.14+incompatible, 10.5.5+incompatible, 10.6.4+incompatible and more
- CVE-2025-49140Pion Interceptor's improper RTP padding handling allows remote crash for SFU users (DoS)Go · github.com/pion/interceptor · fixed in 0.1.39
- CVE-2025-49136listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege userGo · github.com/knadh/listmonk · fixed in 5.0.2
- CVE-2025-25208Rhcl: authorino denial of service through authpolicy with sharedsecretref severityGo · github.com/kuadrant/authorino
- CVE-2025-25207Rhcl: authpolicy callbacks result in denial of service in authorino severityGo · github.com/kuadrant/authorino
- CVE-2025-49011SpiceDB checks involving relations with caveats can result in no permission when permission is expectedGo · github.com/authzed/spicedb · fixed in 1.44.2
- CVE-2025-47950CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream AmplificationGo · github.com/coredns/coredns · fixed in 1.12.2
- CVE-2025-48710kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to Go · github.com/kro-run/kro · fixed in 0.2.1
- CVE-2025-48495Gokapi has stored XSS vulnerability in friendly name for API keysGo · github.com/forceu/gokapi · fixed in 0.0.0-20250530185940-65ddbc68fbfd
- CVE-2025-48494Gokapi vulnerable to stored XSS via uploading file with malicious file nameGo · github.com/forceu/gokapi · fixed in 0.0.0-20250530191232-343cc566cfd7
- CVE-2025-29785quic-go Has Panic in Path Probe Loss Recovery HandlingGo · github.com/quic-go/quic-go · fixed in 0.50.1
- CVE-2025-3454This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URGo · github.com/grafana/grafana · fixed in 0.0.0-20250424191517-1f707d16ed5d
- CVE-2025-3260A security vulnerability in the /apis/dashboard.grafana.app/ endpoints allows authenticated users to bypass dashboard and folder…Go · github.com/grafana/grafana · fixed in 0.0.0-20250521183405-c7a690348df7
- CVE-2025-48949Navidrome allows SQL Injection via role parameterGo · github.com/navidrome/navidrome · fixed in 0.56.0
- CVE-2025-48948Navidrome Transcoding Permission Bypass Vulnerability ReportGo · github.com/navidrome/navidrome · fixed in 0.56.0
- CVE-2025-48938Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise ServerGo · github.com/cli/go-gh/v2 · fixed in 2.12.1
- CVE-2025-3611Improper Access Control in Mattermost allows System Managers to view team details despite role restrictionsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.13+incompatible, 10.5.4+incompatible, 10.7.1+incompatible and more
- CVE-2025-3230Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost ServerGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.13+incompatible, 10.5.4+incompatible, 10.6.3+incompatible and more
- CVE-2025-2571Google OAuth Authentication Bypass for Converted Bot AccountsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.13+incompatible, 10.5.4+incompatible, 10.6.3+incompatible and more
- CVE-2025-1792Improper Access Control in Mattermost Channel Member APIGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.13+incompatible, 10.5.4+incompatible, 10.7.1+incompatible and more
- CVE-2025-48936ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header InjectionGo · github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2 · fixed in 0.0.0-20250528081227-c097887bc5f6, 2.70.12, 3.2.2 and more
- CVE-2025-48865Fabio allows HTTP clients to manipulate custom headers it addsGo · github.com/fabiolb/fabio · fixed in 1.6.6