Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-24370Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication BypassPyPI · django-unicorn · fixed in 0.62.0
- CVE-2024-55456lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cellPyPI · lunasvg
- CVE-2025-24795The Snowflake Connector for Python uses insecure cache files permissionsPyPI · snowflake-connector-python · fixed in 3.13.1
- CVE-2025-24794The Snowflake Connector for Python uses insecure deserialization of the OCSP response cachePyPI · snowflake-connector-python · fixed in 3.13.1
- CVE-2025-24793Snowflake Connector for Python has an SQL Injection in write_pandasPyPI · snowflake-connector-python · fixed in 3.13.1
- CVE-2025-24357vLLM allows a malicious model RCE by torch.load in hf_model_weights_iteratorPyPI · vllm · fixed in 0.7.0
- CVE-2025-24359ASTEVAL Vulnerable to Maliciously Crafted Format Strings Leading to Sandbox EscapePyPI · asteval · fixed in 1.0.6
- CVE-2025-22153try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreterPyPI · restrictedpython · fixed in 8.0
- CVE-2024-57719lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend_transformed_tiled_argb.isra.0.PyPI · lunasvg
- CVE-2024-57720lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend.PyPI · lunasvg
- CVE-2024-57721lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path.PyPI · lunasvg
- CVE-2024-57722lunasvg v3.0.0 was discovered to contain a allocation-size-too-big bug via the component plutovg_surface_create.PyPI · lunasvg
- CVE-2024-57723lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over.PyPI · lunasvg
- CVE-2024-57724lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell.PyPI · lunasvg
- CVE-2024-53829Cross-Site Request Forgery in CodeChecker APIPyPI · codechecker · fixed in 6.25.0, 6.24.5
- CVE-2025-23205`frame-ancestors: self` grants all users access to formgrader in nbgraderPyPI · nbgrader · fixed in 0.9.5
- CVE-2024-50633A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted PPyPI · indico · fixed in 3.3.3
- CVE-2025-22146Improper authentication on SAML SSO process allows user impersonation in sentryPyPI · sentry · fixed in 25.1.0
- CVE-2024-49375Remote Code Execution via Remote Model Loading in RasaPyPI · rasa, rasa-pro · fixed in 3.6.21, 3.8.18, 3.10.12 and more
- CVE-2025-23042Gradio Blocked Path ACL Bypass VulnerabilityPyPI · gradio · fixed in 5.6.0, 5.11.0
- CVE-2025-21607Success of Certain Precompile Calls not Checked in VyperPyPI · vyper · fixed in 0.4.1
- CVE-2024-56374An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18.PyPI · django · fixed in 5.1.5, 5.0.11, 4.2.18
- CVE-2025-22151Strawberry GraphQL has a type resolution vulnerabilityPyPI · strawberry-graphql · fixed in 0.257.0
- CVE-2023-1907Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong sessionPyPI · pgadmin4 · fixed in 7.0
- CVE-2024-53995GHSL-2024-288: SickChill open redirect in loginPyPI · sickchill
- CVE-2024-45033Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cliPyPI · apache-airflow-providers-fab · fixed in 1.5.2
- CVE-2024-53526composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls functPyPI · composio-claude, composio-julep +1 · fixed in 0.6.9
- CVE-2024-55459An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_fPyPI · keras
- CVE-2025-21618NiceGUI On Air authentication issuePyPI · nicegui · fixed in 2.9.1
- CVE-2024-52294khoj has an IDOR in subscription management that allows unauthorized subscription modificationsPyPI · khoj · fixed in 1.29.0