Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-53539ReDoS in fastapi-guard's penetration attempts detectorPyPI · fastapi-guard · fixed in 3.0.1
- CVE-2025-6209Arbitrary File Read through Path Traversal in run-llama/llama_indexPyPI · llama-index, llama-index-core · fixed in 0.12.41
- CVE-2025-5472Denial of Service via Uncontrolled Recursive JSON Parsing in JSONReader in run-llama/llama_indexPyPI · llama-index, llama-index-core · fixed in 0.12.38
- CVE-2025-6210Hardlink-Based Path Traversal in run-llama/llama_indexPyPI · llama-index, llama-index-readers-obsidian · fixed in 0.5.2
- CVE-2025-3777Improper Input Validation in huggingface/transformersPyPI · transformers · fixed in 4.52.1
- CVE-2025-6386Timing Attack Vulnerability in parisneo/lollmsPyPI · lollms
- CVE-2025-3264Regular Expression Denial of Service (ReDoS) in huggingface/transformersPyPI · transformers · fixed in 4.51.0
- CVE-2025-3263Regular Expression Denial of Service (ReDoS) in huggingface/transformersPyPI · transformers · fixed in 4.51.0
- CVE-2025-3046Path Traversal via Symbolic Links in run-llama/llama_indexPyPI · llama-index, llama-index-readers-obsidian · fixed in 0.12.28, 0.5.1
- CVE-2025-3262Regular Expression Denial of Service (ReDoS) in huggingface/transformersPyPI · transformers · fixed in 4.51.0
- CVE-2025-3044MD5 Hash Collision in run-llama/llama_indexPyPI · llama-index, llama-index-readers-papers · fixed in 0.12.28, 0.3.1
- CVE-2025-3225XML Entity Expansion vulnerability in run-llama/llama_indexPyPI · llama-index, llama-index-readers-papers · fixed in 0.12.29, 0.3.2
- CVE-2023-51232Directory Traversal vulnerability in dagster-webserver Dagster thru 1.5.11 allows remote attackers to obtain sensitive information via craftPyPI · dagster · fixed in 1.5.11
- CVE-2025-3108Unsafe Deserialization in JsonPickleSerializer Enables Remote Code Execution in run-llama/llama_indexPyPI · llama-index, llama-index-core · fixed in 0.12.41
- CVE-2025-53366MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of ServicePyPI · mcp · fixed in 1.9.4
- CVE-2025-53365MCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of ServicePyPI · mcp · fixed in 1.10.0
- CVE-2025-48379Pillow Vulnerable to Write Buffer Overflow on BCn encodingPyPI · pillow · fixed in 11.3.0
- CVE-2025-6855chatchat-space Langchain-Chatchat file path traversalPyPI · langchain-chatchat
- CVE-2025-6854chatchat-space Langchain-Chatchat files path traversalPyPI · langchain-chatchat
- CVE-2025-6853chatchat-space Langchain-Chatchat Backend upload_temp_docs path traversalPyPI · langchain-chatchat
- CVE-2025-6773HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversalPyPI · lightrag-hku · fixed in 1.3.8
- CVE-2025-53002LLaMA-Factory Remote Code Execution (RCE) VulnerabilityPyPI · llamafactory
- CVE-2025-50213Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperatorPyPI · apache-airflow-providers-snowflake · fixed in 6.4.0
- CVE-2025-52558ChangeDetection.io XSS in watch overviewPyPI · changedetection-io · fixed in 0.50.4
- CVE-2025-2828SSRF Vulnerability in RequestsToolkit in langchain-ai/langchainPyPI · langchain-community · fixed in 0.0.28
- CVE-2025-6518PySpur-Dev pyspur Jinja2 Template single_llm_call.py SingleLLMCallNode special elements used in a template enginePyPI · pyspur
- CVE-2025-52967gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.PyPI · mlflow · fixed in 3.1.0, 2.22.2
- CVE-2025-52556rfc3161-client has insufficient verification for timestamp response signaturesPyPI · rfc3161-client · fixed in 1.0.3
- CVE-2025-48945pycares has a Use-After-Free VulnerabilityPyPI · pycares · fixed in 4.9.0
- CVE-2025-6279Upsonic Pickle add_tool cloudpickle.loads deserializationPyPI · upsonic · fixed in 0.56.0