Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-29868Apache Answer: Using externally referenced images can leak user privacy.Go · github.com/apache/answer · fixed in 1.4.5
- CVE-2025-30223Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User InputGo · github.com/beego/beego, github.com/beego/beego/v2 · fixed in 2.3.6
- CVE-2025-29072An integer overflow in Nethermind Juno before v.12.05 within the Sierra bytecode decompression logic within the "cairo-lang-starknet-classesGo · github.com/nethermindeth/juno · fixed in 0.12.5
- CVE-2025-24514ingress-nginx controller - configuration injection via unsanitized auth-url annotationGo · k8s.io/ingress-nginx · fixed in 1.11.5, 1.12.1
- CVE-2025-24513ingress-nginx controller - auth secret file path traversal vulnerabilityGo · k8s.io/ingress-nginx · fixed in 1.11.5, 1.12.1
- CVE-2025-1098ingress-nginx controller - configuration injection via unsanitized mirror annotationsGo · k8s.io/ingress-nginx · fixed in 1.11.5, 1.12.1
- CVE-2025-1097ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotationGo · k8s.io/ingress-nginx · fixed in 1.11.5, 1.12.1
- CVE-2025-1974ingress-nginx admission controller RCE escalationGo · k8s.io/ingress-nginx · fixed in 1.11.5, 1.12.1
- CVE-2025-30163Node based network policies may incorrectly allow workload trafficGo · github.com/cilium/cilium · fixed in 1.16.8, 1.17.2
- CVE-2025-30162East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancersGo · github.com/cilium/cilium · fixed in 1.15.15, 1.16.8, 1.17.2
- CVE-2025-29778Kyverno ignores subjectRegExp and IssuerRegExpGo · github.com/kyverno/kyverno · fixed in 1.14.0-alpha.1
- CVE-2025-30204jwt-go allows excessive memory allocation during header parsingGo · github.com/golang-jwt/jwt, github.com/golang-jwt/jwt/v4 +1 · fixed in 4.5.2, 5.2.2
- CVE-2025-30157Envoy crashes when HTTP ext_proc processes local repliesGo · github.com/envoyproxy/envoy · fixed in 1.30.10, 1.31.6, 1.32.4 and more
- CVE-2025-25068Bypassing MFA Enforcement on Plugin EndpointsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.9+incompatible, 10.3.4+incompatible, 10.4.3+incompatible and more
- CVE-2025-24920Unauthorized Bookmark Creation and Modification in Archived ChannelsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.9+incompatible, 10.3.4+incompatible, 10.4.3+incompatible and more
- CVE-2025-30179MFA Enforcement Bypass in Search APIsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.9+incompatible, 10.3.4+incompatible, 10.4.3+incompatible and more
- CVE-2025-25274Unauthorized Command Execution in Archived ChannelsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.9+incompatible, 10.3.4+incompatible, 10.4.3+incompatible and more
- CVE-2025-27933Unauthorized Private-to-Public Channel ConversionGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.9+incompatible, 10.3.4+incompatible, 10.4.3+incompatible and more
- CVE-2025-27715Auto-Enrollment of Team Admins into Private Channels without explicit consentGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.9+incompatible, 9.11.9
- CVE-2024-53348LoxiLB v.0.9.7 and before is vulnerable to Incorrect Access Control which allows attackers to obtain sensitive information and escalate privGo · github.com/loxilb-io/loxilb
- CVE-2024-53351Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.Go · github.com/pipe-cd/pipecd
- CVE-2025-29923go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishmentGo · github.com/redis/go-redis, github.com/redis/go-redis/v7 +2 · fixed in 9.5.5, 9.6.3, 9.7.3
- CVE-2025-29922kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual WorkspaceGo · github.com/kcp-dev/kcp · fixed in 0.26.3
- CVE-2025-29914OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`Go · github.com/corazawaf/coraza, github.com/corazawaf/coraza/v2 +2 · fixed in 3.3.3
- CVE-2024-7598Network restriction bypass via race condition during namespace terminationGo · k8s.io/kubernetes, k8s.io/kubernetes/cmd/kube-apiserver
- CVE-2024-8063Divide by Zero in ollama/ollamaGo · github.com/ollama/ollama
- CVE-2025-0312NULL Pointer Dereference in ollama/ollamaGo · github.com/ollama/ollama
- CVE-2024-12886Out-Of-Memory (OOM) Vulnerability in ollama/ollamaGo · github.com/ollama/ollama · fixed in 0.4.0-ci1
- CVE-2025-0317Divide By Zero in ollama/ollamaGo · github.com/ollama/ollama
- CVE-2025-0315Allocation of Resources Without Limits or Throttling in ollama/ollamaGo · github.com/ollama/ollama