Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-5173HumanSignal label-studio-ml-backend PT File neural_nets.py load deserializationPyPI · label-studio-ml
- CVE-2025-5169Open Asset Import Library Assimp MDLLoader.cpp InternReadFile_3DGS_MDL345 out-of-boundsPyPI · pyassimp
- CVE-2025-5168Open Asset Import Library Assimp MDLLoader.cpp ImportUVCoordinate_3DGS_MDL345 out-of-boundsPyPI · pyassimp
- CVE-2025-5167Open Asset Import Library Assimp LWOLoader.h GetS0 out-of-boundsPyPI · pyassimp
- CVE-2025-5166Open Asset Import Library Assimp MDC File Parser MDCLoader.cpp InternReadFile out-of-boundsPyPI · pyassimp
- CVE-2025-5165Open Asset Import Library Assimp MDCLoader.cpp ValidateSurfaceHeader out-of-boundsPyPI · pyassimp
- CVE-2025-5150docarray Web API torch_dataset.py __getitem__ prototype pollutionPyPI · docarray
- CVE-2025-5148FunAudioLLM InspireMusic Pickle Data model.py load_state_dict deserializationPyPI · inspiremusic
- CVE-2025-47277vLLM Allows Remote Code Execution via PyNcclPipe Communication ServicePyPI · vllm · fixed in 0.8.5
- CVE-2025-46725Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_storePyPI · langroid · fixed in 0.53.15
- CVE-2025-46724Langroid has a Code Injection vulnerability in TableChatAgentPyPI · langroid · fixed in 0.53.15
- CVE-2025-26621OpenCTI vulnerable to Denial of Service through web hookPyPI · pycti · fixed in 6.5.2
- CVE-2025-2099Regular Expression Denial of Service (ReDoS) in huggingface/transformersPyPI · transformers · fixed in 4.49.0, 4.50.0
- CVE-2025-47273setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File WritePyPI · setuptools · fixed in 78.1.1
- CVE-2025-32962Flask-AppBuilder open redirect vulnerability using HTTP host injectionPyPI · flask-appbuilder · fixed in 4.6.2
- CVE-2025-47287Tornado vulnerable to excessive logging caused by malformed multipart form dataPyPI · tornado · fixed in 6.5
- CVE-2025-47774Vyper's `slice()` may elide side-effects when output length is 0PyPI · vyper
- CVE-2025-47285Vyper's `concat()` builtin may elide side-effects for zero-length argumentsPyPI · vyper
- CVE-2025-47783label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.PyPI · label-studio · fixed in 1.18.0
- CVE-2025-47782motionEye vulnerable to RCE in add_camera Function Due to unsafe command executionPyPI · motioneye · fixed in 0.43.1b4
- CVE-2025-26864Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID AuthenticationPyPI · apache-iotdb · fixed in 1.3.4, 2.0.2
- CVE-2024-24780Apache IoTDB: Remote Code Execution with untrusted URI of User-defined functionPyPI · apache-iotdb · fixed in 1.3.4
- CVE-2025-47278Flask uses fallback key instead of current signing keyPyPI · flask · fixed in 3.1.1
- CVE-2025-27696Apache Superset: Incorrect authorization leading to resource ownership takeoverPyPI · apache-superset · fixed in 4.1.2
- CVE-2025-1752Denial of Service in run-llama/llama_indexPyPI · llama-index · fixed in 0.12.21
- CVE-2025-32873An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1.PyPI · django · fixed in 4.2.21, 5.1.9, 5.2.1
- CVE-2025-44021OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via thePyPI · ironic · fixed in 24.1.3, 26.1.1, 29.0.1
- CVE-2025-30165Remote Code Execution Vulnerability in vLLM Multi-Node Cluster ConfigurationPyPI · vllm · fixed in 0.10.0
- CVE-2025-46814FastAPI Guard Remote Header Injection via X-Forwarded-For ManipulationPyPI · fastapi-guard · fixed in 2.0.0
- CVE-2025-46730Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death AttackPyPI · mobsf