Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-27112Navidrome has authentication bypass in Subsonic API with non-existent usernameGo · github.com/navidrome/navidrome · fixed in 0.54.5
- CVE-2025-20051Arbitrary file read via block duplication in Mattermost BoardsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.8+incompatible, 10.2.3+incompatible, 10.3.3+incompatible and more
- CVE-2025-25279Arbitrary file read in Mattermost Boards via import & export board archiveGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.8+incompatible, 10.2.3+incompatible, 10.3.3+incompatible and more
- CVE-2025-1412Session Persistence After User-to-Bot ConversionGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.7+incompatible, 10.4.2+incompatible, 8.0.0-20241217145510-faa7e4f2ea0c and more
- CVE-2025-24526Channel export permitted on archived channel when viewing archived channels is disabledGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.8+incompatible, 10.2.3+incompatible, 10.3.3+incompatible and more
- CVE-2025-27100An authenticated user can crash lakeFS by exhausting server memoryGo · github.com/treeverse/lakefs · fixed in 1.50.0
- CVE-2025-27088Reflected Cross-site Scripting (XSS) in template implementation in oxyno-zeta/s3-proxyGo · github.com/oxyno-zeta/s3-proxy, github.com/oxyno-zeta/s3-proxy/cmd/s3-proxy · fixed in 0.0.0-20250220214310-c611c741ed48
- CVE-2025-1293HashiCorp Hermes Improperly Validates AWS ALB JWTs, which May Lead to Authentication BypassGo · github.com/hashicorp-forge/hermes · fixed in 0.5.0
- CVE-2025-27090Server-Side Request Forgery (SSRF) in sliver teamserverGo · github.com/bishopfox/sliver · fixed in 1.5.43
- CVE-2025-25196OpenFGA Authorization BypassGo · github.com/openfga/openfga · fixed in 1.8.5
- CVE-2025-24806Regulation applies separately to Username-based logins to Email-based logins in autheliaGo · github.com/authelia/authelia, github.com/authelia/authelia/v4 · fixed in 4.38.19
- CVE-2025-25204`gh attestation verify` returns incorrect exit code during verification if no attestations are presentGo · github.com/cli/cli, github.com/cli/cli/v2 · fixed in 2.67.0
- CVE-2025-0426A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet readGo · k8s.io/kubernetes · fixed in 1.32.2, 1.31.6, 1.30.10 and more
- CVE-2025-25199BCryptGenerateSymmetricKey memory leakGo · github.com/microsoft/go-crypto-winnative · fixed in 0.0.0-20250211154640-f49c8e1379ea
- CVE-2025-1243Field in api-go proxy not transformed before version 1.44.1Go · go.temporal.io/api · fixed in 1.44.1
- CVE-2024-57603An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting.Go · github.com/mayswind/ezbookkeeping
- CVE-2024-57604An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component.Go · github.com/mayswind/ezbookkeeping
- CVE-2025-24976Distribution's token authentication allows attacker to inject an untrusted signing key in a JWTGo · github.com/distribution/distribution
- CVE-2025-24016Remote code execution in Wazuh serverGo · github.com/wazuh/wazuh · fixed in 4.9.1, 4.9.1+incompatible
- CVE-2025-24366Insufficient sanitization of user provided rsync command in SFTPGoGo · github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2 · fixed in 2.6.5
- CVE-2025-24786Path traversal opening Sqlite3 database in WhoDBGo · github.com/clidey/whodb/core · fixed in 0.0.0-20250127172032-547336ac73c8
- CVE-2025-24787Parameter injection in DB connection URIs leading to local file inclusion in WhoDBGo · github.com/clidey/whodb/core · fixed in 0.0.0-20250127202645-8d67b767e005
- CVE-2025-22867Arbitrary code execution during build on darwin in cmd/goGo · toolchain · fixed in 1.24.0-rc.3
- CVE-2025-22866Timing sidechannel for P-256 on ppc64le in crypto/internal/nistecGo · stdlib · fixed in 1.22.12, 1.23.6, 1.24.0-rc.3
- CVE-2024-35177Improper Access Control in wazuh-agentGo · github.com/wazuh/wazuh · fixed in 4.9.0+incompatible
- CVE-2024-47770Ability to view Agent list with no privilege access in wazuh-dashboardGo · github.com/wazuh/wazuh · fixed in 4.9.1+incompatible
- CVE-2025-24371Malicious peer can make node stuck in blocksync in github.com/cometbft/cometbftGo · github.com/cometbft/cometbft · fixed in 0.38.17, 1.0.1
- CVE-2024-11741Grafana is an open-source platform for monitoring and observability.Go · github.com/grafana/grafana · fixed in 11.4.1, 11.3.3, 11.2.6 and more
- CVE-2023-0092An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from thGo · github.com/juju/juju · fixed in 2.9.38, 3.0.3
- CVE-2025-24883go-ethereum has a DoS via malicious p2p messageGo · github.com/ethereum/go-ethereum · fixed in 1.14.13