Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-9900Cross-Site Scripting (XSS) in mudler/localaiGo · github.com/mudler/localai · fixed in 2.22.0
- CVE-2024-12055DoS using malicious gguf model file in ollama/ollamaGo · github.com/ollama/ollama
- CVE-2024-7631Openshift-console: openshift console: path traversalGo · github.com/openshift/console
- CVE-2024-25132Openshift-dedicated: hive: hibernation controller denial of serviceGo · github.com/openshift/hive
- CVE-2025-30153Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filterGo · github.com/getkin/kin-openapi · fixed in 0.131.0
- CVE-2025-1472Unauthorized View Access to Site Statistics and Team StatisticsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.9, 9.11.9+incompatible
- CVE-2025-29781Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRDGo · github.com/metal3-io/baremetal-operator/apis · fixed in 0.9.1, 0.8.1
- CVE-2024-40635containerd has an integer overflow in User ID handlingGo · github.com/containerd/containerd, github.com/containerd/containerd/v2 · fixed in 1.6.38, 1.7.27, 2.0.4
- CVE-2025-0495Secrets leakage to telemetry endpoint via cache backend configuration via buildxGo · github.com/docker/buildx · fixed in 0.21.3
- CVE-2025-2241Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acmGo · github.com/openshift/hive
- CVE-2025-29786Memory Exhaustion in Expr Parser with Unrestricted InputGo · github.com/expr-lang/expr · fixed in 1.17.0
- CVE-2025-30077Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of Go · github.com/onosproject/onos-lib-go
- CVE-2025-1767This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same Go · k8s.io/kubernetes
- CVE-2024-9042This CVE affects only Windows worker nodes.Go · k8s.io/kubernetes · fixed in 1.29.13, 1.30.9, 1.31.5 and more
- CVE-2025-22870HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netGo · golang.org/x/net, stdlib · fixed in 0.36.0, 1.23.7, 1.24.1
- CVE-2025-26260Plenti <= 0.7.16 is vulnerable to code execution.Go · github.com/plentico/plenti · fixed in 0.7.17
- CVE-2025-27403Ratify Azure authentication providers can leak authentication tokens to non-Azure container registriesGo · github.com/deislabs/ratify, github.com/ratify-project/ratify · fixed in 1.2.3, 1.3.2
- CVE-2025-27616Vela Server has Insufficient Webhook Payload Data VerificationGo · github.com/go-vela/server · fixed in 0.25.3, 0.26.3
- CVE-2025-1296Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit LogsGo · github.com/hashicorp/nomad · fixed in 1.9.7
- CVE-2024-52812LF Edge eKuiper has Stored XSS in Rules FunctionalityGo · github.com/lf-edge/ekuiper, github.com/lf-edge/ekuiper/v2 · fixed in 2.0.8
- CVE-2025-27509SAML authentication vulnerability due to improper SAML response validationGo · github.com/fleetdm/fleet/v4 · fixed in 4.64.2, 4.63.2, 4.62.4 and more
- CVE-2025-25294Envoy Gateway Log Injection VulnerabilityGo · github.com/envoyproxy/gateway · fixed in 1.2.7, 1.3.1
- CVE-2025-27507IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP ConfigurationsGo · github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2 · fixed in 2.63.8, 2.64.5, 2.65.6 and more
- CVE-2025-27155In-memory stored Cross-site scripting (XSS) vulnerability in pineconesimGo · github.com/matrix-org/pinecone
- CVE-2025-27421Goroutine Leak in Abacus SSE ImplementationGo · github.com/jasonlovesdoggo/abacus · fixed in 0.0.0-20250302043802-898ff1204e11
- CVE-2025-27414MinIO SFTP authentication bypass due to improperly trusted SSH keyGo · github.com/minio/minio · fixed in 0.0.0-20250227184332-4c71f1b4ec0f
- CVE-2025-22952elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can beGo · github.com/usememos/memos
- CVE-2025-22868Unexpected memory consumption during token parsing in golang.org/x/oauth2Go · golang.org/x/oauth2 · fixed in 0.27.0
- CVE-2025-22869Potential denial of service in golang.org/x/cryptoGo · golang.org/x/crypto · fixed in 0.35.0
- CVE-2025-27144Go JOSE's Parsing Vulnerable to Denial of ServiceGo · github.com/go-jose/go-jose, github.com/go-jose/go-jose/v3 +2 · fixed in 3.0.4, 4.0.5