Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-6278Upsonic server.py os.path.join path traversalPyPI · upsonic · fixed in 0.56.0
- CVE-2025-6272wasm3 m3_compile.c MarkSlotAllocated out-of-bounds writePyPI · pywasm3
- CVE-2025-50182urllib3 does not control redirects in browsers and Node.jsPyPI · urllib3 · fixed in 2.5.0
- CVE-2025-50181urllib3 redirects are not disabled when retries are disabled on PoolManager instantiationPyPI · urllib3 · fixed in 2.5.0
- CVE-2025-6050Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin InterfacePyPI · mezzanine · fixed in 6.1.1
- CVE-2025-6167themanojdesai python-a2a api.py create_workflow path traversalPyPI · python-a2a · fixed in 0.5.6
- CVE-2025-49134Weblate exposes personal IP address via e-mailPyPI · weblate · fixed in 5.12
- CVE-2025-47951Weblate lacks rate limiting when verifying second factorPyPI · weblate · fixed in 5.12
- CVE-2025-4565Unbounded recursion in Python ProtobufPyPI · protobuf · fixed in 4.25.8, 5.29.5, 6.31.1
- CVE-2024-38824CVE-2024-38824 salt advisoryPyPI · salt · fixed in 3007.4, 3006.12
- CVE-2025-22242CVE-2025-22242 salt advisoryPyPI · salt · fixed in 3007.4, 3006.12
- CVE-2025-22241CVE-2025-22241 salt advisoryPyPI · salt · fixed in 3007.4, 3006.12
- CVE-2025-22240CVE-2025-22240 salt advisoryPyPI · salt · fixed in 3007.4, 3006.12
- CVE-2025-22239CVE-2025-22239 salt advisoryPyPI · salt · fixed in 3006.12, 3007.4
- CVE-2025-22238CVE-2025-22238 salt advisoryPyPI · salt · fixed in 3006.12, 3007.4
- CVE-2025-22237CVE-2025-22237 salt advisoryPyPI · salt · fixed in 3006.12, 3007.4
- CVE-2025-22236CVE-2025-22236 salt advisoryPyPI · salt · fixed in 3007.4, 3006.12
- CVE-2024-38825CVE-2024-38825 Salt AdvisoryPyPI · salt · fixed in 3006.12, 3007.4
- CVE-2025-28380A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injePyPI · openc3
- CVE-2025-28381A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all contaPyPI · openc3
- CVE-2025-28382An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.PyPI · openc3
- CVE-2025-28384An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.PyPI · openc3
- CVE-2025-28386A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitraryPyPI · openc3
- CVE-2025-28388OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.PyPI · openc3
- CVE-2025-28389Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.PyPI · openc3
- CVE-2025-43866Vantage6 Server JWT secret not cryptographically securePyPI · vantage6-server · fixed in 4.11.0
- CVE-2025-43863vantage6 lacks brute-force protection on change password functionalityPyPI · vantage6 · fixed in 4.11.0
- CVE-2025-49143Nautobot may allows uploaded media files to be accessible without authenticationPyPI · nautobot · fixed in 1.6.32, 2.4.10
- CVE-2025-49142Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templatingPyPI · nautobot · fixed in 1.6.32, 2.4.10
- CVE-2025-48879OctoPrint Vulnerable to Denial of Service through malformed HTTP requestPyPI · octoprint · fixed in 1.11.2