Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-52281Stored Cross-site Scripting vulnerability in Rancher UIGo · github.com/rancher/rancher · fixed in 2.9.4
- CVE-2025-27571Channel metadata visible in archived channels despite configuration settingGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.10+incompatible, 10.4.4+incompatible, 10.5.2+incompatible and more
- CVE-2025-27538MFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other UsersGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.10+incompatible, 10.5.2+incompatible, 8.0.0-20250314142426-c049748b8863 and more
- CVE-2025-24839Unauthorized AI bot activation via Wrangler pluginGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.10+incompatible, 10.4.4+incompatible, 10.5.2+incompatible and more
- CVE-2025-30215NATS-Server Fails to Authorize Certain Jetstream Admin APIsGo · github.com/nats-io/nats-server/v2 · fixed in 2.10.27, 2.11.1
- CVE-2025-32445Users can gain privileged access to the host system and cluster with EventSource and Sensor CRGo · github.com/argoproj/argo-events · fixed in 1.9.6
- CVE-2025-30206Dpanel's hard-coded JWT secret leads to remote code executionGo · github.com/donknap/dpanel · fixed in 1.6.1
- CVE-2025-24358gorilla/csrf CSRF vulnerability due to broken Referer validationGo · github.com/gorilla/csrf · fixed in 1.7.3
- CVE-2025-2475Unauthorized Bot Login Using CredentialsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.10+incompatible, 10.5.2+incompatible, 10.5.2 and more
- CVE-2025-2424Leaked Metadata of Deleted Files via Bookmark CreationGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.10+incompatible, 10.5.2+incompatible, 8.0.0-20250213231113-68c11e9ecb71 and more
- CVE-2025-32093Syatem admin profile modification by delegated granular administration roleGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.10+incompatible, 10.4.4+incompatible, 10.5.2+incompatible and more
- CVE-2025-3445A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go.Go · github.com/mholt/archiver, github.com/mholt/archiver/v3
- CVE-2024-52280Users can issue watch commands for arbitrary resourcesGo · github.com/rancher/steve · fixed in 0.0.0-20241029132712-2175e090fe4b
- CVE-2024-52282Rancher Helm Applications may have sensitive values leakedGo · github.com/rancher/rancher · fixed in 2.8.10, 2.9.4
- CVE-2025-23387Rancher's SAML-based login via CLI can be denied by unauthenticated usersGo · github.com/rancher/rancher · fixed in 2.8.13, 2.9.7, 2.10.3
- CVE-2025-23388Unauthenticated stack overflow in /v3-public/authproviders APIGo · github.com/rancher/rancher · fixed in 2.8.13, 2.9.7, 2.10.3
- CVE-2025-23389Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First LoginGo · github.com/rancher/rancher · fixed in 2.8.13, 2.9.7, 2.10.3
- CVE-2025-23391Rancher: Restricted Administrator can change Administrator's passwordsGo · github.com/rancher/rancher · fixed in 2.8.14, 2.9.8, 2.10.4
- CVE-2025-1386Query smuggling in ch-go libraryGo · github.com/clickhouse/ch-go · fixed in 0.65.0
- CVE-2025-24866Unauthorized Access to User Activity Logs API by delegated granular administration rolesGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.9+incompatible, 9.11.9, 8.0.0-20250204211032-f52e08754c49
- CVE-2025-32386Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory TerminationGo · helm.sh/helm/v3 · fixed in 3.17.3
- CVE-2025-32387Helm Allows A Specially Crafted JSON Schema To Cause A Stack OverflowGo · helm.sh/helm/v3 · fixed in 3.17.3
- CVE-2025-22871Request smuggling due to acceptance of invalid chunked data in net/httpGo · stdlib · fixed in 1.23.8, 1.24.2
- CVE-2025-32025bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsingGo · github.com/bep/imagemeta · fixed in 0.11.0
- CVE-2025-32024bep/imagemeta allows excessively large EXIF data structuresGo · github.com/bep/imagemeta · fixed in 0.10.0
- CVE-2025-31489MinIO performs incomplete signature validation for unsigned-trailer uploadsGo · github.com/minio/minio · fixed in 0.0.0-20250403145552-8c70975283f9
- CVE-2025-31483Stored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configurationGo · miniflux.app, miniflux.app/v2 · fixed in 2.2.7
- CVE-2025-2842Tempo-operator: tempo operator token exposition lead to read sensitive dataGo · github.com/grafana/tempo-operator · fixed in 0.16.0
- CVE-2025-2786Tempo-operator: serviceaccount token exposure leading to token and subject access reviews in openshift tempo operatorGo · github.com/grafana/tempo-operator · fixed in 0.16.0
- CVE-2025-31135Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple timesGo · github.com/phires/go-guerrilla · fixed in 1.6.7