Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-47952Traefik allows path traversal using url encodingGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.25, 3.4.1
- CVE-2020-36846IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C libraryGo · github.com/google/brotli
- CVE-2025-47933Argo CD allows cross-site scripting on repositories pageGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 +1 · fixed in 2.13.8, 2.14.13, 3.0.4
- CVE-2025-3913Team Privacy Settings Authorization Bypass in Mattermost ServerGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.13+incompatible, 10.5.4+incompatible, 10.6.3+incompatible and more
- CVE-2025-4057Activemq-artemis-operator: amq broker operator starting credentials reuseGo · github.com/arkmq-org/activemq-artemis-operator
- CVE-2025-48371OpenFGA Authorization BypassGo · github.com/openfga/openfga · fixed in 1.8.13
- CVE-2025-48374zot logs secretsGo · zotregistry.dev/zot · fixed in 1.4.4-0.20250522160828-8a99a3ed231f
- CVE-2025-48075Fiber panics when fiber.Ctx.BodyParser parses invalid range indexGo · github.com/gofiber/fiber, github.com/gofiber/fiber/v2 · fixed in 2.52.7
- CVE-2025-4123A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect.Go · github.com/grafana/grafana · fixed in 0.0.0-20250521183405-c7a690348df7
- CVE-2025-48069ejson2env has insufficient input sanitizationGo · github.com/shopify/ejson2env, github.com/shopify/ejson2env/v2 · fixed in 2.0.8
- CVE-2025-47291containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.Go · github.com/containerd/containerd/v2 · fixed in 2.0.5
- CVE-2025-5031Ackites KillWxapkg wxapkg File Decompression resource consumptionGo · github.com/ackites/killwxapkg
- CVE-2025-5030Ackites KillWxapkg wxapkg File Parser unpack.go processFile os command injectionGo · github.com/ackites/killwxapkg
- CVE-2025-48056Hubble CLI vulnerable to character injectionGo · github.com/cilium/hubble · fixed in 1.17.2
- CVE-2025-47290Containerd vulnerable to host filesystem access during image unpackGo · github.com/containerd/containerd/v2 · fixed in 2.1.1
- CVE-2025-47284Gardener vulnerable to metadata injection for a project secret that can lead to privilege escalationGo · github.com/gardener/gardener · fixed in 1.116.4, 1.117.5, 1.118.2
- CVE-2025-47283Bypassing project secret validation can lead to privilege escalationGo · github.com/gardener/gardener · fixed in 1.116.4, 1.117.5, 1.118.2
- CVE-2025-47282Malicious google credential in DNS secret can lead to privilege escalationGo · github.com/gardener/external-dns-management, github.com/gardener/gardener-extension-shoot-dns-service · fixed in 0.23.6
- CVE-2025-1975Improper Validation of Array Index in ollama/ollamaGo · github.com/ollama/ollama
- CVE-2024-40120seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_store.go.Go · github.com/seaweedfs/seaweedfs · fixed in 0.0.0-20240625155419-9ac102336200
- CVE-2025-2570System Admin Cannot Access Environment settings in System Console While System Manager CanGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.12+incompatible, 10.5.3+incompatible, 8.0.0-20250411064244-844447fbd57c and more
- CVE-2025-2527Improper access control to group informationGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.12+incompatible, 10.5.3+incompatible, 8.0.0-20250411064244-844447fbd57c and more
- CVE-2025-3446Members Without Guest Invite Permissions Can Add Guests to TeamsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.12+incompatible, 10.4.5+incompatible, 10.5.3+incompatible and more
- CVE-2025-31947Repeated LDAP login failures can lock an LDAP accountGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.12+incompatible, 10.4.5+incompatible, 10.5.3+incompatible and more
- CVE-2025-3931Yggdrasil: local privilege escalation in yggdrasilGo · github.com/redhatinsights/yggdrasil
- CVE-2024-52290Stored XSS in Configuration Key FunctionalityGo · github.com/lf-edge/ekuiper, github.com/lf-edge/ekuiper/v2 · fixed in 2.1.0
- CVE-2025-4658Authentication Bypass in OPKSSHGo · github.com/openpubkey/opkssh · fixed in 0.5.0
- CVE-2025-3757Authentication Bypass in OpenPubKeyGo · github.com/openpubkey/openpubkey · fixed in 0.10.0
- CVE-2025-46721nosurf vulnerable to CSRF due to non-functional same-origin request checksGo · github.com/justinas/nosurf · fixed in 1.2.0
- CVE-2025-4432Ring: some aes functions may panic when overflow checking is enabled in ringGo · github.com/briansmith/ring