Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-49015The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates.NuGet · couchbasenetclient · fixed in 3.7.1
- CVE-2025-30399.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 9.0.6, 8.0.17
- CVE-2025-48953Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File UploadsNuGet · umbraco.cms · fixed in 15.4.2
- CVE-2020-36846IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C libraryNuGet · microsoft.netcore.app.runtime.aot.linux-x64.cross.android-arm, microsoft.netcore.app.runtime.aot.linux-x64.cross.android-arm64 +114 · fixed in 6.0.3, 5.0.15, 3.1.23
- CVE-2025-48377Dnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit modeNuGet · dotnetnuke.core, dotnetnuke.web · fixed in 9.13.9
- CVE-2025-48378Dnn.Platform vulnerable to Stored Cross-Site Scripting (XSS) with svg files rendered inlineNuGet · dotnetnuke.core · fixed in 9.13.9
- CVE-2025-48376Dnn.Platform's Site Import could use an external source with a crafted requestNuGet · dotnetnuke.siteexportimport · fixed in 9.13.9
- CVE-2025-26646.NET, Visual Studio, and Build Tools for Visual Studio Spoofing VulnerabilityNuGet · microsoft.build.tasks.core · fixed in 15.9.30, 16.11.6, 17.8.29 and more
- CVE-2025-47280Umbraco.Forms has HTML injection vulnerability in 'Send email' workflowNuGet · umbraco.forms, umbracoforms · fixed in 13.4.2, 15.1.2
- CVE-2025-46736Umbraco Makes User Enumeration Feasible Based on Timing of Login ResponseNuGet · umbraco.cms · fixed in 13.8.1, 10.8.10
- CVE-2025-46326Snowflake Connector for .NET has race condition when checking access to Easy Logging configuration fileNuGet · snowflake.data · fixed in 4.4.1
- CVE-2025-43858YoutubeDLSharp allows command injection on windows system due to non sanitized argumentsNuGet · youtubedlsharp · fixed in 1.1.2
- CVE-2025-3857Infinite loop condition in Amazon.IonDotnetNuGet · amazon.iondotnet · fixed in 1.3.1
- CVE-2025-29953Apache ActiveMQ NMS OpenWire Client: deserialization allowlist bypassNuGet · apache.nms.activemq · fixed in 2.1.1
- CVE-2025-32016Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service LogsNuGet · microsoft.identity.abstractions, microsoft.identity.web · fixed in 9.0.0, 3.8.2
- CVE-2025-32372Server-Side Request Forgery (SSRF) in DotNetNuke.CoreNuGet · dotnetnuke.core · fixed in 9.13.8
- CVE-2025-32017Umbraco has a Management API Vulnerability to Path Traversal With Authenticated UsersNuGet · umbraco.cms · fixed in 14.3.4, 15.3.1
- CVE-2025-24070ASP.NET Core and Visual Studio Elevation of Privilege VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +11 · fixed in 9.0.3, 8.0.14, 2.3.1
- CVE-2025-24043WinDbg Remote Code Execution VulnerabilityNuGet · dotnet-debugger-extensions, dotnet-dump +1 · fixed in 9.0.607601, 9.0.607501
- CVE-2025-27602Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized ContentNuGet · umbraco.cms.web.backoffice · fixed in 10.8.9, 13.7.1
- CVE-2025-27601Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type FunctionalityNuGet · umbraco.cms.api.management · fixed in 15.2.3, 14.3.3
- CVE-2025-27598Out-of-bounds Write in SixLabors ImageSharpNuGet · sixlabors.imagesharp · fixed in 3.1.7, 2.1.10
- CVE-2025-27513OpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API PackageNuGet · opentelemetry.api · fixed in 1.11.2
- CVE-2024-57716An issue in trenoncourt AutoQueryable v.1.7.0 allows a remote attacker to obtain sensitive information via the Unselectable function.NuGet · autoqueryable
- CVE-2025-24895SAML Response Signature Verification Bypass in CIE.AspNetCore.AuthenticationNuGet · cie.aspnetcore.authentication · fixed in 2.1.0
- CVE-2025-24894SAML Response Signature Verification Bypass in SPID.AspNetCore.AuthenticationNuGet · spid.aspnetcore.authentication · fixed in 3.4.0
- CVE-2025-26620Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access TokensNuGet · duende.accesstokenmanagement · fixed in 3.2.0
- CVE-2024-42512Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication whenNuGet · opcfoundation.netstandard.opc.ua.core · fixed in 1.5.374.158
- CVE-2024-42513Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication whenNuGet · opcfoundation.netstandard.opc.ua.bindings.https · fixed in 1.5.374.158
- CVE-2025-24788Snowflake Connector for .NET has weak temporary files permissionsNuGet · snowflake.data · fixed in 4.3.0