Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-46816goshs route not protected, allows command executionGo · github.com/patrickhener/goshs · fixed in 1.0.5
- CVE-2025-46815ZITADEL Allows IdP Intent Token ReuseGo · github.com/zitadel/zitadel · fixed in 3.0.0, 2.70.10, 2.71.9
- CVE-2025-46735Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`Go · github.com/nrkno/terraform-provider-windns
- CVE-2025-43915In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.Go · github.com/linkerd/linkerd2 · fixed in 0.0.0-20250212165942-faa3f617eef5
- CVE-2025-3879Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on LoginGo · github.com/hashicorp/vault · fixed in 1.19.1
- CVE-2025-4210Casdoor SCIM User Creation Endpoint scim.go HandleScim authorizationGo · github.com/casdoor/casdoor · fixed in 1.812.0
- CVE-2025-4166Vault May Include Sensitive Data in Error Logs When Using the KV v2 PluginGo · github.com/hashicorp/vault · fixed in 1.19.3
- CVE-2025-46569OPA server Data API HTTP path injection of RegoGo · github.com/open-policy-agent/opa, github.com/open-policy-agent/opa/server +1 · fixed in 1.4.0
- CVE-2025-32777Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender PluginGo · volcano.sh/volcano · fixed in 1.9.1, 1.10.2, 1.11.0-network-topology-preview.3 and more
- CVE-2025-46331OpenFGA Authorization BypassGo · github.com/openfga/openfga · fixed in 1.8.11
- CVE-2025-46342Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statementsGo · github.com/kyverno/kyverno · fixed in 1.13.5, 1.14.0
- CVE-2025-46327Go Snowflake Driver has race condition when checking access to Easy Logging configuration fileGo · github.com/snowflakedb/gosnowflake · fixed in 1.13.3
- CVE-2025-46599CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations,Go · github.com/k3s-io/k3s · fixed in 1.32.4-rc1
- CVE-2025-41423Unauthorized Playbooks Post Deletion in Mattermost Playbooks PluginGo · github.com/mattermost/mattermost-plugin-playbooks, github.com/mattermost/mattermost-server +3 · fixed in 1.41.0, 8.0.0-20250218121836-2b5275d87136
- CVE-2025-35965DoS in Mattermost Playbooks via Excessive Task ActionsGo · github.com/mattermost/mattermost-plugin-playbooks, github.com/mattermost/mattermost-server +3 · fixed in 1.41.0, 8.0.0-20250218121836-2b5275d87136
- CVE-2025-41395Webapp DoS via malicious retrospective post in PlaybooksGo · github.com/mattermost/mattermost-plugin-playbooks, github.com/mattermost/mattermost-server +3 · fixed in 1.41.0, 8.0.0-20250218121836-2b5275d87136
- CVE-2025-32963Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STSGo · github.com/minio/operator · fixed in 7.1.0
- CVE-2025-32793Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clustersGo · github.com/cilium/cilium · fixed in 1.15.16, 1.16.9, 1.17.3
- CVE-2025-32431Traefik has a possible vulnerability with the path matchersGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.23, 3.3.6, 3.4.0-rc2
- CVE-2025-43970An issue was discovered in GoBGP before 3.35.0.Go · github.com/osrg/gobgp, github.com/osrg/gobgp/v3 · fixed in 3.35.0
- CVE-2025-43971An issue was discovered in GoBGP before 3.35.0.Go · github.com/osrg/gobgp, github.com/osrg/gobgp/v3 · fixed in 3.35.0
- CVE-2025-43972An issue was discovered in GoBGP before 3.35.0.Go · github.com/osrg/gobgp, github.com/osrg/gobgp/v3 · fixed in 3.35.0
- CVE-2025-43973An issue was discovered in GoBGP before 3.35.0.Go · github.com/osrg/gobgp, github.com/osrg/gobgp/v3 · fixed in 3.35.0
- CVE-2025-3801songquanpeng one-api System Setting cross site scriptingGo · github.com/songquanpeng/one-api
- CVE-2025-22872Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/netGo · golang.org/x/net · fixed in 0.38.0
- CVE-2025-2564Unauthorized View Access to Archived Channel Member InfoGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.10+incompatible, 10.4.4+incompatible, 10.5.2+incompatible and more
- CVE-2025-27936Webhook Secret Exposure via Timing attack in MSteams pluginGo · github.com/mattermost/mattermost-plugin-msteams, github.com/mattermost/mattermost-server +3 · fixed in 2.1.0, 10.5.2+incompatible, 10.5.2 and more
- CVE-2025-31363Data exfiltration via AI plugin Jira toolGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.10+incompatible, 10.4.3+incompatible, 10.5.1+incompatible and more
- CVE-2023-32197Rancher's External RoleTemplates can lead to privilege escalationGo · github.com/rancher/rancher · fixed in 2.7.14, 2.8.5, 2.8.9 and more
- CVE-2024-22036Rancher Remote Code Execution via Cluster/Node DriversGo · github.com/rancher/rancher · fixed in 2.7.16, 2.8.9, 2.9.3