Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-15346wolfSSL Python library `CERT_REQUIRED` mode fails to enforce client certificate requirementPyPI · wolfssl · fixed in 5.8.4.post0
- CVE-2023-7333bluelabsio records-mover Table Object sql injectionPyPI · records-mover · fixed in 1.6.0
- CVE-2026-21851MONAI has Path Traversal (Zip Slip) in NGC Private Bundle DownloadPyPI · monai · fixed in 1.5.2
- CVE-2026-21441urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)PyPI · urllib3 · fixed in 2.6.3
- CVE-2025-61782Open Redirect in OpenCTI's SAML Authentication FlowPyPI · pycti · fixed in 6.8.3
- CVE-2025-61492A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary comPyPI · terminal-controller
- CVE-2026-21439badkeys vulnerable to ASCII control character injection on console via malformed inputPyPI · badkeys · fixed in 0.0.16
- CVE-2025-69230AIOHTTP Vulnerable to Cookie Parser Warning StormPyPI · aiohttp · fixed in 3.13.3
- CVE-2025-69229AIOHTTP vulnerable to DoS through chunked messagesPyPI · aiohttp · fixed in 3.13.3
- CVE-2025-69228AIOHTTP vulnerable to denial of service through large payloadsPyPI · aiohttp · fixed in 3.13.3
- CVE-2025-69227AIOHTTP vulnerable to DoS when bypassing assertsPyPI · aiohttp · fixed in 3.13.3
- CVE-2025-69225AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol FieldsPyPI · aiohttp · fixed in 3.13.3
- CVE-2025-69226AIOHTTP allows for a brute-force leak of internal static filepath componentsPyPI · aiohttp · fixed in 3.13.3
- CVE-2025-69224AIOHTTP's Unicode processing of header values could cause parsing discrepanciesPyPI · aiohttp · fixed in 3.13.3
- CVE-2025-69223AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bombPyPI · aiohttp · fixed in 3.13.3
- CVE-2025-61781GraphQL IDOR allows authenticated user to delete workspace content of other usersPyPI · pycti · fixed in 6.8.1
- CVE-2025-67303An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data.PyPI · comfyui-manager · fixed in 3.38
- CVE-2026-21445Langflow Missing Authentication on Critical API EndpointsPyPI · langflow, langflow-base · fixed in 1.7.1, 0.7.1
- CVE-2025-11157Arbitrary Code Execution in feast-dev/feastPyPI · feast · fixed in 0.54.0
- CVE-2025-34469Cowrie < 2.9.0 Unrestricted wget/curl Emulation Enables SSRF-Based DDoS AmplificationPyPI · cowrie · fixed in 2.9.0
- CVE-2025-69277libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_poinPyPI · hdwallet, pynacl · fixed in 3.6.1, 1.6.2
- CVE-2025-68131CBORDecoder reuse can leak shareable values across decode callsPyPI · cbor2 · fixed in 5.8.0
- CVE-2025-67729lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()PyPI · lmdeploy · fixed in 0.11.1
- CVE-2025-68664LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIsPyPI · langchain-core · fixed in 1.2.5, 0.3.81
- CVE-2025-14931Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution VulnerabilityPyPI · smolagents
- CVE-2025-14930Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution VulnerabilityPyPI · transformers
- CVE-2025-14928Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution VulnerabilityPyPI · transformers
- CVE-2025-14924Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution VulnerabilityPyPI · transformers
- CVE-2025-14920Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution VulnerabilityPyPI · transformers
- CVE-2025-14926Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution VulnerabilityPyPI · transformers