Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-30353Directus's webhook trigger flows can leak sensitive datanpm · directus · fixed in 11.5.0
- CVE-2025-30352Directus `search` query parameter allows enumeration of non permitted fieldsnpm · directus · fixed in 11.5.0
- CVE-2025-30351Suspended Directus user can continue to use session token to access APInpm · @directus/api, @directus/types +1 · fixed in 24.0.1, 13.0.0, 11.5.0
- CVE-2025-30350Directus's S3 assets become unavailable after a burst of HEAD requestsnpm · @directus/storage-driver-s3, directus · fixed in 12.0.1, 11.5.0
- CVE-2025-30225Directus's S3 assets become unavailable after a burst of malformed transformationsnpm · @directus/storage-driver-s3, directus · fixed in 12.0.1, 11.5.0
- CVE-2025-30222Shescape has potential environment variable exposure on Windows with CMDnpm · shescape · fixed in 2.1.2
- CVE-2025-30208Vite bypasses server.fs.deny when using `?raw??`npm · vite · fixed in 6.2.3, 6.1.2, 6.0.12 and more
- CVE-2025-2699GetmeUK ContentTools Image cross site scriptingnpm · contenttools
- CVE-2025-2691Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide a hostname thnpm · nossrf · fixed in 1.0.4
- CVE-2025-30168Parse Server has an OAuth login vulnerabilitynpm · parse-server · fixed in 7.5.2, 8.0.2
- CVE-2025-29927Authorization Bypass in Next.js Middlewarenpm · next · fixed in 13.5.9, 14.2.25, 15.2.3 and more
- CVE-2025-2598AWS CDK CLI prints AWS credentials retrieved by custom credential pluginsnpm · aws-cdk, cdk · fixed in 2.178.2
- CVE-2025-27415Nuxt allows DOS via cache poisoning with payload rendering responsenpm · nuxt · fixed in 3.16.0
- CVE-2025-30144Fast-JWT Improperly Validates iss Claimsnpm · fast-jwt · fixed in 5.0.6
- CVE-2025-29907jsPDF Bypass Regular Expression Denial of Service (ReDoS)npm · jspdf · fixed in 3.0.1
- CVE-2025-1398macOS TCC Bypass via Code Injectionnpm · mattermost-desktop · fixed in 5.11.0
- CVE-2025-26042Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service.npm · uptime-kuma · fixed in 2.0.0-beta.2
- CVE-2025-29771HtmlSanitizer vulnerable to XSS when used with contentEditablenpm · @jitbit/htmlsanitizer · fixed in 2.0.3
- CVE-2025-29775xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Commentnpm · xml-crypto · fixed in 6.0.1, 3.2.1, 2.1.6
- CVE-2025-29774xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo Referencesnpm · xml-crypto · fixed in 6.0.1, 3.2.1, 2.1.6
- CVE-2025-29776Azle calling `setTimer` causes infinite loop of timersnpm · azle · fixed in 0.30.0
- CVE-2024-29409File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.npm · @nestjs/common · fixed in 11.0.16, 10.4.16
- CVE-2025-25975An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys functionnpm · parse-git-config
- CVE-2025-27789Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groupsnpm · @babel/helpers, @babel/runtime +2 · fixed in 7.26.10, 8.0.0-alpha.17
- CVE-2025-25977An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.npm · canvg · fixed in 4.0.3, 3.0.11
- CVE-2025-27597Vue I18n Prototype Pollution in `handleFlatJson`npm · @intlify/core, @intlify/core-base +4 · fixed in 9.1.11, 9.14.3, 10.0.6 and more
- CVE-2025-27152Possible SSRF and Credential Leakage via Absolute URL in axios Requestsnpm · axios · fixed in 1.8.2, 0.30.0
- CVE-2025-27506NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Pagenpm · nocodb · fixed in 0.258.0
- CVE-2025-26319FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.npm · flowise
- CVE-2024-51091Cross Site Scripting vulnerability in seajs v.2.2.3 allows a remote attacker to execute arbitrary code via the seajs packagenpm · seajs