Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-11573Denial of Service issue in Amazon.IonDotnetNuGet · amazon.iondotnet · fixed in 1.3.2
- CVE-2025-61778Akka.Remote TLS did not properly implement certificate-based authenticationNuGet · akka.cluster, akka.remote · fixed in 1.5.52
- CVE-2025-55797An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauthenticated attackers NuGet · formcms · fixed in 0.5.5
- CVE-2025-57692PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution ofNuGet · piranha
- CVE-2025-59821DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profileNuGet · dotnetnuke.core · fixed in 10.1.0
- CVE-2025-59546DNN Vulnerable to Stored XSS Using Backend Admin CredentialsNuGet · dotnetnuke.core · fixed in 10.1.0
- CVE-2025-59545DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt moduleNuGet · dotnetnuke.core · fixed in 10.1.0
- CVE-2025-59539DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography fieldNuGet · dotnetnuke.core · fixed in 10.1.0
- CVE-2025-59535DotNetNuke.Core allows loading of unused themes on anonymous clients through query parametersNuGet · dotnetnuke.core · fixed in 10.1.0
- CVE-2025-9708Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacksNuGet · kubernetesclient · fixed in 17.0.14
- CVE-2025-57807ImageMagick BlobStream Forward-Seek Under-AllocationNuGet · magick.net-q16-arm64, magick.net-q16-hdri-arm64 +10 · fixed in 14.8.2
- CVE-2025-56236FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature.NuGet · formcms · fixed in 0.5.7
- CVE-2025-57803ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflowNuGet · magick.net-q16-anycpu, magick.net-q16-hdri-anycpu +4 · fixed in 14.8.1
- CVE-2025-55298ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code executionNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.8.1
- CVE-2025-55212ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crashNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.8.1
- CVE-2025-55160ImageMagick Undefined Behavior (function-type-mismatch) in CloneSplayTreeNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.8.0
- CVE-2025-55154ImageMagick: integer overflows in MNG magnificationNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.8.0
- CVE-2025-55004ImageMagick: heap-buffer overflow read in MNG magnification with alphaNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.8.0
- CVE-2025-54575ImageSharp Triggers an Infinite Loop in its GIF Decoder When Skipping Malformed Comment Extension BlocksNuGet · sixlabors.imagesharp · fixed in 2.1.11, 3.1.11
- CVE-2025-54425Umbraco's Delivery API allows for cached requests to be returned with an invalid API keyNuGet · umbraco.cms.api.delivery · fixed in 13.9.3, 15.4.4, 16.1.1
- CVE-2025-6965Integer Truncation on SQLiteNuGet · sqlitepclraw.lib.e_sqlite3, sqlitepclraw.lib.e_sqlite3.android +1
- CVE-2025-53101ImageMagick has Stack Buffer Overflow in image.cNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.7.0
- CVE-2025-53019ImageMagick has Memory Leak in magick streamNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.7.0
- CVE-2025-53015ImageMagick has XMP profile write that triggers hang due to unbounded loopNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +17 · fixed in 14.7.0
- CVE-2025-53014ImageMagick has Heap Buffer Overflow in InterpretImageFilenameNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +16 · fixed in 14.7.0
- CVE-2025-49147Umbraco.Cms Vulnerable to Disclosure of Configured Password RequirementsNuGet · umbraco.cms · fixed in 10.8.11, 13.9.2
- CVE-2025-52488DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user inputNuGet · dnn.platform · fixed in 10.0.1
- CVE-2025-52487DNN.PLATFORM possibly allows bypass of IP FiltersNuGet · dnn.platform · fixed in 10.0.1
- CVE-2025-52486DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjectsNuGet · dnn.platform · fixed in 10.0.1
- CVE-2025-52485DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity FeedNuGet · dnn.platform · fixed in 10.0.1