Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-24784DotNetNuke.Core has a potential XSS vulnerability in modules' header and footerNuGet · dotnetnuke.core · fixed in 9.13.10, 10.2.0
- CVE-2026-23952ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image loadNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.2
- CVE-2026-23874ImageMagick's MSL: Stack overflow via infinite recursion in ProcessMSLScriptNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.10.2
- CVE-2026-22770ImageMagick vulnerable to Release of Invalid Pointer in BilateralBlur when memory allocation failsNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.10.2
- CVE-2025-68924In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remNuGet · umbracoforms
- CVE-2021-47776Umbraco v8.14.1 - 'baseUrl' SSRFNuGet · umbracocms
- CVE-2026-22611AWS SDK for .NET V4 adopted defense in depth enhancement for region parameter valueNuGet · awssdk.core · fixed in 4.0.3.3
- CVE-2025-68950Magick's failure to limit MVG mutual references forming a loopNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.10.1
- CVE-2025-68618Magick's failure to limit the depth of SVG file reads caused a DoS attack.NuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.10.1
- CVE-2025-67288An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file.NuGet · umbraco.cms
- CVE-2025-67290A stored cross-site scripting (XSS) vulnerability in the Page Settings module of Piranha CMS v12.1 allows attackers to execute arbitrary webNuGet · piranha
- CVE-2025-67291A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scriptsNuGet · piranha
- CVE-2025-68469ImageMagick vulnerable to heap-buffer-overflowNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 13.2.0
- CVE-2025-14759Missing cryptographic key commitment in the Amazon S3 Encryption Client for .NET may allow a user with write access to the S3 bucket to intrNuGet · amazon.extensions.s3.encryption · fixed in 3.2.0
- CVE-2025-65581An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2.NuGet · volo.abp.account.web · fixed in 10.0.0-rc.2
- CVE-2025-66628ImageMagick is vulnerable to an Integer Overflow in TIM decoder leading to out of bounds read (32-bit only)NuGet · magick.net-q16-anycpu, magick.net-q16-hdri-anycpu +4 · fixed in 14.10.0
- CVE-2025-66625Umbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import FunctionalityNuGet · umbraco.cms · fixed in 13.12.1
- CVE-2025-66631CSLA .NET is vulnerable to Remote Code Execution via WcfProxyNuGet · csla · fixed in 6.0.0
- CVE-2025-64095DNN Insufficient Access Control - Image Upload allows for Site Content OverwriteNuGet · dnn.platform · fixed in 10.1.1
- CVE-2025-64094DNN vulnerable to stored cross-site-scripting (XSS) via SVG uploadNuGet · dotnetnuke.core · fixed in 10.1.1
- CVE-2025-62802DNN CKEditor Provider allows unauthenticated upload out-of-the-boxNuGet · dnn.platform · fixed in 10.1.1
- CVE-2025-62594ImageMagick CLAHE : Unsigned underflow and division-by-zero lead to OOB pointer arithmetic and process crash (DoS)NuGet · magick.net-q16-arm64, magick.net-q16-hdri-arm64 +10
- CVE-2025-61413A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute arbitraryNuGet · piranha
- CVE-2025-62171ImageMagick vulnerable to denial of service via integer overflow in BMP decoder on 32-bit systemsNuGet · magick.net-q16-anycpu, magick.net-q16-hdri-anycpu +4 · fixed in 14.9.0
- CVE-2025-11849Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of thNuGet · mammoth · fixed in 1.11.0
- CVE-2025-11842Shazwazza Smidge Bundle path traversalNuGet · smidge · fixed in 4.6.0
- CVE-2025-54539Apache ActiveMQ NMS AMQP Client: Deserialization of Untrusted DataNuGet · apache.nms.amqp · fixed in 2.4.0
- CVE-2025-55248.NET, .NET Framework, and Visual Studio Information Disclosure VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 9.0.10, 8.0.21
- CVE-2025-55315ASP.NET Security Feature Bypass VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +11 · fixed in 10.0.0-rc.2.25502.107, 9.0.10, 8.0.21 and more
- CVE-2025-55247.NET Elevation of Privilege VulnerabilityNuGet · microsoft.build, microsoft.build.tasks.core +1 · fixed in 18.0.0-preview-25476-107, 17.14.28, 17.12.50 and more