Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-20621Webapp crash via object that can't be cast to String in Attachment FieldGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.6+incompatible, 10.0.4+incompatible, 10.1.4+incompatible and more
- CVE-2025-20088Insufficient Input Validation on Post PropsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.6+incompatible, 10.0.4+incompatible, 10.1.4+incompatible and more
- CVE-2025-20086Insufficient Input Validation on Post PropsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.6+incompatible, 10.0.4+incompatible, 10.1.4+incompatible and more
- CVE-2025-21088WebApp crash via improper validation of proto style in attachmentsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.6+incompatible, 10.0.4+incompatible, 10.1.4+incompatible and more
- CVE-2024-53263Git LFS permits exfiltration of credentials via crafted HTTP URLsGo · github.com/git-lfs/git-lfs, github.com/git-lfs/git-lfs/v3 · fixed in 3.6.1
- CVE-2024-51491Process crash during CRL-based revocation check on OS using separate mount point for temp Directory in notation-goGo · github.com/notaryproject/notation-go · fixed in 1.3.0-rc.2
- CVE-2024-56138Timestamp signature generation lacks certificate revocation check in notion-goGo · github.com/notaryproject/notation-go · fixed in 1.3.0-rc.2
- CVE-2024-56323OpenFGA Authorization BypassGo · github.com/openfga/openfga · fixed in 1.8.3
- CVE-2025-22149JWK Set's HTTP client only overwrites and appends JWK to local cache during refreshGo · github.com/micahparks/jwkset · fixed in 0.6.0
- CVE-2025-22445Misleading UI for undefined admin console settings in Calls causes security confusionGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.3.0+incompatible, 10.3.0, 8.0.0-20250102081831-64c566a8280b
- CVE-2025-20033DoS via custom post type for sysconsole plugin readersGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 10.0.4+incompatible, 10.1.4+incompatible, 10.2.1+incompatible and more
- CVE-2025-22449Access control flaw for team admins allows unauthorized team additionsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.11.6, 8.0.0-20250102081831-64c566a8280b
- CVE-2025-22130Soft Serve allows path traversal attacksGo · github.com/charmbracelet/soft-serve · fixed in 0.8.2
- CVE-2025-21614go-git clients vulnerable to DoS via maliciously crafted Git server repliesGo · github.com/go-git/go-git, github.com/go-git/go-git/v4 +2 · fixed in 5.13.0
- CVE-2025-21613go-git has an Argument Injection via the URL fieldGo · github.com/go-git/go-git/v4, github.com/go-git/go-git/v5 +1 · fixed in 5.13.0
- CVE-2025-21609SiYuan has an arbitrary file deletion vulnerabilityGo · github.com/siyuan-note/siyuan/kernel
- CVE-2024-56514Karmada Tar Slips in CRDs archive extractionGo · github.com/karmada-io/karmada · fixed in 1.12.0
- CVE-2024-56513Karmada PULL Mode Cluster Privilege EscalationGo · github.com/karmada-io/karmada · fixed in 1.12.0
- CVE-2024-25133Openshift-dedicated: hive: rce through aws/kubernetes client configuration leads to privilege escalationGo · github.com/openshift/hive
- CVE-2024-56362Navidrome Stores JWT Secret in Plaintext in navidrome.dbGo · github.com/navidrome/navidrome · fixed in 0.54.1
- CVE-2024-45387Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_commentsGo · github.com/apache/trafficcontrol, github.com/apache/trafficcontrol/v8 · fixed in 8.0.2
- CVE-2024-55947Gogs has a Path Traversal in file update APIGo · gogs.io/gogs · fixed in 0.13.1
- CVE-2024-54148Gogs has a Path Traversal in file editing UIGo · gogs.io/gogs · fixed in 0.13.1
- CVE-2024-12678Nomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity TokensGo · github.com/hashicorp/nomad · fixed in 1.9.4
- CVE-2024-25131Openshift-dedicated: must-gather-operator: yaml template injection leads to privilege escalationGo · github.com/openshift/must-gather · fixed in 0.0.0-20240604173837-d1557bc283dd
- CVE-2024-55196Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords foGo · github.com/gophish/gophish
- CVE-2024-45338Non-linear parsing of case-insensitive content in golang.org/x/net/htmlGo · golang.org/x/net, golang.org/x/net/html · fixed in 0.33.0
- CVE-2024-9779Open-cluster-management-io/ocm: cluster-manager permissions may allow a worker node to obtain service account tokensGo · open-cluster-management.io/ocm · fixed in 0.13.0
- CVE-2024-55949Privilege escalation in IAM import API in MinIOGo · github.com/minio/minio · fixed in 0.0.0-20241213221912-68b004a48f41
- CVE-2024-54682Zipbomb DoS via Missing Slack Import ValidationGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.5.13+incompatible, 9.11.5+incompatible, 10.0.3+incompatible and more