Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-30214Frappe vulnerable to information disclosure leading to account takeoverPyPI · frappe · fixed in 14.89.0, 15.51.0
- CVE-2025-30213Frappe has Possibility of Remote Code Execution due to improper validationPyPI · frappe · fixed in 14.91.0, 15.52.0
- CVE-2025-30212Frappe has possibility of SQL injection due to improper validationsPyPI · frappe · fixed in 14.89.0, 15.51.0
- CVE-2025-2757Open Asset Import Library Assimp MD5 File MD5Parser.cpp AI_MD5_PARSE_STRING_IN_QUOTATION heap-based overflowPyPI · pyassimp
- CVE-2025-2756Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection heap-based overflowPyPI · pyassimp
- CVE-2025-2755Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection out-of-boundsPyPI · pyassimp
- CVE-2025-2754Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection heap-based overflowPyPI · pyassimp
- CVE-2025-2753Open Asset Import Library Assimp LWS File LWSLoader.cpp MergeScenes out-of-boundsPyPI · pyassimp
- CVE-2025-2752Open Asset Import Library Assimp CSM File fast_atof.h fast_atoreal_move out-of-boundsPyPI · pyassimp
- CVE-2025-2751Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile out-of-boundsPyPI · pyassimp
- CVE-2025-2750Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile out-of-bounds writePyPI · pyassimp
- CVE-2024-55028A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a craftedPyPI · fprime
- CVE-2024-55029NASA Fprime v3.4.3 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.PyPI · fprime
- CVE-2024-55030A command injection vulnerability in the Command Dispatcher Service of NASA Fprime v3.4.3 allows attackers to execute arbitrary commands.PyPI · fprime
- CVE-2025-2592Open Asset Import Library Assimp CSMLoader.cpp InternReadFile heap-based overflowPyPI · pyassimp
- CVE-2025-2591Open Asset Import Library Assimp MDLLoader.cpp InternReadFile_Quake1 divide by zeroPyPI · pyassimp
- CVE-2025-2584WebAssembly wabt binary-reader-interp.cc GetReturnCallDropKeepCount heap-based overflowPyPI · wabt-bin
- GHSA-W466-2WFC-8G58Open WebUI has vulnerable dependency on starlette via fastapiPyPI · open-webui · fixed in 0.5.8
- CVE-2024-12215Remote Code Execution in kedro-org/kedroPyPI · kedro
- CVE-2024-8613Improper Access Control in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-9216Authentication Bypass in gaizhenbiao/ChuanhuChatGPTPyPI · chuanhuchatgpt
- CVE-2024-6825Remote Code Execution in BerriAI/litellmPyPI · litellm
- CVE-2024-10549Denial of Service by ReDOS in h2oai/h2o-3PyPI · h2o
- CVE-2025-0508MD5 Hash Collision in SageMaker Workflow in aws/sagemaker-python-sdkPyPI · sagemaker · fixed in 2.237.3
- CVE-2024-10650Denial of Service (DoS) in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-8487CORS Vulnerability in modelscope/agentscopePyPI · agentscope
- CVE-2024-8769Arbitrary File Deletion via Relative Path Traversal in aimhubio/aimPyPI · aim
- CVE-2024-8556Stored XSS in modelscope/agentscopePyPI · agentscope
- CVE-2024-10830Path Traversal in eosphoros-ai/db-gptPyPI · dbgpt
- CVE-2024-8524Directory Traversal in modelscope/agentscopePyPI · agentscope