Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-30473Apache Airflow Common SQL Provider: Remote Code Execution via Sql InjectionPyPI · apache-airflow-providers-common-sql · fixed in 1.24.1
- CVE-2025-29480Buffer Overflow vulnerability in gdal 3.10.2 allows a local attacker to cause a denial of service via the OGRSpatialReference::Release functPyPI · gdal
- CVE-2025-32013Server-Side Request Forgery via LNURL Authentication Callback in LNbits Lightning Network Payment SystemPyPI · lnbits · fixed in 0.12.12
- CVE-2025-27520BentoML Allows Remote Code Execution (RCE) via Insecure DeserializationPyPI · bentoml · fixed in 1.4.3
- CVE-2025-3196Open Asset Import Library Assimp Malformed File MD2Loader.cpp InternReadFile stack-based overflowPyPI · pyassimp
- CVE-2025-30370jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"PyPI · jupyterlab-git · fixed in 0.51.1
- CVE-2025-3163InternLM LMDeploy conf.py open code injectionPyPI · lmdeploy
- CVE-2025-3162InternLM LMDeploy PT File utils.py load_weight_ckpt deserializationPyPI · lmdeploy
- CVE-2025-3160Open Asset Import Library Assimp File SceneCombiner.cpp AddNodeHashes out-of-boundsPyPI · pyassimp
- CVE-2025-3159Open Asset Import Library Assimp ASE File ASEParser.cpp ParseLV4MeshBonesVertices heap-based overflowPyPI · pyassimp
- CVE-2025-3158Open Asset Import Library Assimp LWO File LWOAnimation.cpp UpdateAnimRangeSetup heap-based overflowPyPI · pyassimp
- CVE-2025-2946Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4PyPI · pgadmin4 · fixed in 9.2
- CVE-2025-2945pgAdmin 4: Remote Code Execution in Query Tool and Cloud DeploymentPyPI · pgadmin4 · fixed in 9.2
- CVE-2025-3136PyTorch CUDACachingAllocator.cpp torch.cuda.memory.caching_allocator_delete memory corruptionPyPI · torch
- CVE-2025-3122WebAssembly wabt binary-reader-interp.cc BeginFunctionBody null pointer dereferencePyPI · wabt-bin
- CVE-2025-3121PyTorch torch.jit.jit_module_from_flatbuffer memory corruptionPyPI · torch
- CVE-2025-27556An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14.PyPI · django · fixed in 5.0.14, 5.1.8
- CVE-2025-3016Open Asset Import Library Assimp MDL File MDLMaterialLoader.cpp ParseTextureColorData resource consumptionPyPI · pyassimp
- CVE-2025-3015Open Asset Import Library Assimp ASE File ASELoader.cpp BuildUniqueRepresentation out-of-boundsPyPI · pyassimp
- CVE-2025-31116Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS RebindingPyPI · mobsf · fixed in 4.3.2
- CVE-2025-3001PyTorch torch.lstm_cell memory corruptionPyPI · torch · fixed in 2.10.0
- CVE-2025-3048Path Traversal in AWS SAM CLI allows file copy to local cachePyPI · aws-sam-cli · fixed in 1.134.0
- CVE-2025-3047Path Traversal in AWS SAM CLI allows file copy to build containerPyPI · aws-sam-cli · fixed in 1.133.0
- CVE-2025-3000PyTorch torch.jit.script memory corruptionPyPI · torch · fixed in 2.13.0
- CVE-2025-2999PyTorch torch.nn.utils.rnn.unpack_sequence memory corruptionPyPI · torch · fixed in 2.9.1
- CVE-2025-2998PyTorch torch.nn.utils.rnn.pad_packed_sequence memory corruptionPyPI · torch
- CVE-2025-2953PyTorch torch.mkldnn_max_pool2d denial of servicePyPI · torch · fixed in 2.7.1-rc1
- CVE-2025-30358Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacksPyPI · mesop · fixed in 0.14.1
- CVE-2025-30355Synapse vulnerable to federation denial of service via malformed eventsPyPI · matrix-synapse · fixed in 1.127.1
- CVE-2025-30217Frappe has possibility of SQL injection due to improper validationsPyPI · frappe · fixed in 14.93.2, 15.55.0