Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-24012Umbraco Backoffice Components Have XSS/HTML Injection VulnerabilityNuGet · umbraco.cms.staticassets · fixed in 14.3.2, 15.1.2
- CVE-2025-24011Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response CodesNuGet · umbraco.cms · fixed in 14.3.2, 15.1.2
- CVE-2024-51417An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields.NuGet · system.linq.dynamic.core · fixed in 1.6.0
- CVE-2025-23041Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.FormsNuGet · umbraco.forms, umbracoforms · fixed in 10.5.7, 13.2.2, 14.1.2 and more
- CVE-2024-50338Carriage-return character in remote URL allows malicious repository to leak credentials in Git Credential ManagerNuGet · git-credential-manager · fixed in 2.6.1
- CVE-2025-21172.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 9.0.1, 8.0.12
- CVE-2025-21176.NET, .NET Framework, and Visual Studio Remote Code Execution VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 9.0.1, 8.0.12
- CVE-2025-21171.NET Remote Code Execution VulnerabilityNuGet · microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 · fixed in 9.0.1
- CVE-2024-55186An IDOR (Insecure Direct Object Reference) vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messageNuGet · oqtane.client, oqtane.framework +2
- CVE-2024-55341A stored cross-site scripting (XSS) vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web broNuGet · piranha
- CVE-2024-55342A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media.NuGet · piranha
- CVE-2024-55470Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control.NuGet · oqtane.framework, oqtane.server
- CVE-2024-55471Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController.NuGet · oqtane.framework, oqtane.server
- CVE-2024-11862Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption NuGet · devolutions.xts.net · fixed in 2024.11.26
- CVE-2024-48510Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.SharedNuGet · dotnetzip, prodotnetzip · fixed in 1.19.0
- CVE-2024-43498.NET and Visual Studio Remote Code Execution VulnerabilityNuGet · system.formats.nrbf · fixed in 9.0.0
- CVE-2024-43499.NET and Visual Studio Denial of Service VulnerabilityNuGet · system.formats.nrbf · fixed in 9.0.0
- CVE-2024-51987HTTP Client uses incorrect token after refresh in Duende.AccessTokenManagement.OpenIdConnectNuGet · duende.accesstokenmanagement.openidconnect · fixed in 3.0.1
- CVE-2024-51501CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributesNuGet · refit · fixed in 7.2.22
- CVE-2024-10761Umbraco CMS Dashboard frame cross site scriptingNuGet · umbraco.cms, umbraco.cms.web.common · fixed in 13.5.3, 14.3.2, 15.1.2 and more
- CVE-2024-43383Apache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.ReplicatorNuGet · lucene.net.replicator · fixed in 4.8.0-beta00017
- CVE-2024-50353ICG.AspNetCore.Utilities.CloudStorage's Secure Token Durations Different Than ExpectedNuGet · icg.aspnetcore.utilities.cloudstorage · fixed in 8.0.0
- CVE-2024-49755Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIsNuGet · duende.identityserver · fixed in 7.0.8
- CVE-2024-49771MPXJ has a Potential Path Traversal VulnerabilityNuGet · mpxj.net, net.sf.mpxj +2 · fixed in 13.5.1
- CVE-2024-48929Umbraco CMS Has Incomplete Server Termination During Explicit Sign-OutNuGet · umbraco.cms · fixed in 13.5.2, 10.8.7
- CVE-2024-48927Potential Code Execution Risk When Viewing SVG Files in Full Screen in BackofficeNuGet · umbraco.cms, umbracocms · fixed in 10.8.7, 13.5.2, 8.18.15
- CVE-2024-48926Umbraco CMS logout page displayed before session expirationNuGet · umbraco.cms, umbracocms · fixed in 13.5.2, 10.8.7, 8.18.15
- CVE-2024-48925Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook APINuGet · umbraco.cms · fixed in 14.3.0
- CVE-2024-47819Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary sectionNuGet · umbraco.cms.staticassets · fixed in 14.3.1
- CVE-2024-45526An issue was discovered in OPC Foundation OPCFoundation/UA-.NETStandard through 1.5.374.78.NuGet · opcfoundation.netstandard.opc.ua, opcfoundation.netstandard.opc.ua.core · fixed in 1.5.374.118