Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-24376The kubewarden-controller AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resourcesGo · github.com/kubewarden/kubewarden-controller · fixed in 1.21.0
- CVE-2025-24784kubewarden-controller has an Information leak via AdmissionPolicyGroup ResourceGo · github.com/kubewarden/kubewarden-controller · fixed in 1.21.0
- CVE-2025-23216Argo CD does not scrub secret values from patch errorsGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.13.4, 2.12.10, 2.11.13
- CVE-2025-24884kube-audit-rest's example logging configuration could disclose secret values in the audit logGo · github.com/richardoc/kube-audit-rest · fixed in 0.0.0-20250205113217-9df8886b4819, 0.0.0-20250129191722-db1aa5b86725
- CVE-2025-24882regclient may ignore pinned manifest digestsGo · github.com/regclient/regclient · fixed in 0.7.1
- CVE-2021-3978Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpkiGo · github.com/cloudflare/cfrpki · fixed in 1.4.2
- CVE-2024-13484Openshift-gitops-operator-container: namespace isolation breakGo · github.com/redhat-developer/gitops-operator · fixed in 1.16.2
- CVE-2025-0750Cri-o: cri-o path traversal in log handling functions allows arbitrary unmountingGo · github.com/cri-o/cri-o
- CVE-2025-22865ParsePKCS1PrivateKey panic with partial keys in crypto/x509Go · stdlib · fixed in 1.24.0-rc.2
- CVE-2024-45336Sensitive headers incorrectly sent after cross-domain redirect in net/httpGo · stdlib · fixed in 1.22.11, 1.23.5, 1.24.0-rc.2
- CVE-2024-45340GOAUTH credential leak in cmd/goGo · toolchain · fixed in 1.24.0-rc.2
- CVE-2024-45341Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509Go · stdlib · fixed in 1.22.11, 1.23.5, 1.24.0-rc.2
- CVE-2024-45339Vulnerability when creating log files in github.com/golang/glogGo · github.com/golang/glog · fixed in 1.2.4
- CVE-2025-24369Anubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0Go · github.com/xe/x
- CVE-2025-24354imgproxy is vulnerable to SSRF against 0.0.0.0Go · github.com/imgproxy/imgproxy, github.com/imgproxy/imgproxy/v2 +1 · fixed in 3.27.2
- CVE-2025-24355Updatecli may expose Maven credentials in console outputGo · github.com/updatecli/updatecli · fixed in 0.93.0
- CVE-2024-10846Excessive Platform Resource Consumption within a Loop when unmarshalling Compose file having recursive loopGo · github.com/compose-spec/compose-go/v2 · fixed in 2.4.1
- CVE-2025-24030Envoy Admin Interface Exposed through prometheus metrics endpointGo · github.com/envoyproxy/gateway · fixed in 1.2.6
- CVE-2025-23047Cilium vulnerable to information leakage via insecure default Hubble UI CORS headerGo · github.com/cilium/cilium · fixed in 1.14.19, 1.15.13, 1.16.6
- CVE-2025-23028DoS in Cilium agent DNS proxy from crafted DNS responsesGo · github.com/cilium/cilium · fixed in 1.14.18, 1.15.12, 1.16.5
- CVE-2024-11218Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfileGo · github.com/containers/buildah · fixed in 1.38.1, 1.37.6, 1.35.5 and more
- CVE-2025-0377HashiCorp go-slug Vulnerable to Zip Slip AttackGo · github.com/hashicorp/go-slug · fixed in 0.16.3
- CVE-2025-24337WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.Go · github.com/writefreely/writefreely
- CVE-2025-23208IdP group membership revocation ignored in zotGo · zotregistry.dev/zot · fixed in 2.1.2
- CVE-2024-36402Unauthenticated writes to the media repository allow planting of problematic content in Matrix Media RepoGo · github.com/t2bot/matrix-media-repo · fixed in 1.3.5
- CVE-2024-36403Denial of service/high operating costs through unauthenticated downloads in Matrix Media RepoGo · github.com/t2bot/matrix-media-repo · fixed in 1.3.5
- CVE-2024-52602Server-Side Request Forgery (SSRF) on redirects and federation in Matrix Media RepoGo · github.com/t2bot/matrix-media-repo · fixed in 1.3.8
- CVE-2024-52791Denial of service through memory exhaustion in Matrix Media RepoGo · github.com/t2bot/matrix-media-repo · fixed in 1.3.8
- CVE-2024-56515Untrusted file formats can be thumbnailed, invoking potentially further untrusted decoders in Matrix Media RepoGo · github.com/t2bot/matrix-media-repo · fixed in 1.3.8
- CVE-2024-52594Server-Side Request Forgery (SSRF) on redirects and federation in gomatrixserverlibGo · github.com/matrix-org/gomatrixserverlib · fixed in 0.0.0-20250116181547-c4f1e01eab0d