Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-14927Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution VulnerabilityPyPI · transformers
- CVE-2025-14921Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution VulnerabilityPyPI · transformers
- CVE-2025-14929Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution VulnerabilityPyPI · transformers
- CVE-2025-67743Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download ServicePyPI · local-deep-research · fixed in 1.3.9
- CVE-2025-65713Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal.PyPI · homeassistant · fixed in 2025.8.0
- CVE-2025-68480Marshmallow has DoS in Schema.load(many)PyPI · marshmallow · fixed in 3.26.2, 4.1.2
- CVE-2025-68481FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSOPyPI · fastapi-users · fixed in 15.0.2
- CVE-2025-68478Langflow Vulnerable to External Control of File Name or PathPyPI · langflow · fixed in 1.7.0, 1.7.1
- CVE-2025-68477Langflow vulnerable to Server-Side Request ForgeryPyPI · langflow · fixed in 1.7.1
- CVE-2025-14881Insecure direct object referencePyPI · pretix · fixed in 2025.10.1, 2025.9.3, 2025.8.3
- CVE-2025-14882Insecure direct object referencePyPI · pretix · fixed in 2025.8.3, 2025.9.3, 2025.10.1
- CVE-2025-14546Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the PyPI · fastapi-sso · fixed in 0.19.0
- CVE-2025-68398Weblate has git config file overwrite vulnerability that leads to remote code executionPyPI · weblate · fixed in 5.15.1
- CVE-2025-68279Weblate has an arbitrary file read via symbolic linksPyPI · weblate · fixed in 5.15.1
- CVE-2025-68463Bio.Entrez in Biopython through 186 allows doctype XXE.PyPI · biopython · fixed in 1.87
- CVE-2025-63387Dify 1.9.1 and 1.17.0 exposes the /console/api/system-features endpoint to unauthenticated HTTP GET requests that return system feature…PyPI · dify-client
- CVE-2025-68145mcp-server-git has missing path validation when using --repository flagPyPI · mcp-server-git · fixed in 2025.12.18
- CVE-2025-68144mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local filesPyPI · mcp-server-git · fixed in 2025.12.18
- CVE-2025-68143mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locationsPyPI · mcp-server-git · fixed in 2025.9.25
- CVE-2025-53000nbconvert has an uncontrolled search path that leads to unauthorized code execution on WindowsPyPI · nbconvert · fixed in 7.17.0
- CVE-2025-67895Apache Airflow Providers Edge3: Edge3 Worker RPC RCE on Airflow 2PyPI · apache-airflow, apache-airflow-providers-edge3 · fixed in 2.0.0
- CVE-2024-29370In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by craftingPyPI · python-jose
- CVE-2025-68146filelock has TOCTOU race condition that allows symlink attacks during lock file creationPyPI · filelock · fixed in 3.20.1
- CVE-2025-68142PyMdown Extensions has ReDOS bug in Figure Capture extensionPyPI · pymdown-extensions · fixed in 10.16.1
- CVE-2025-68113ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and ReplayPyPI · altcha · fixed in 1.0.0
- CVE-2025-67748Fickling has Code Injection vulnerability via pty.spawn()PyPI · fickling · fixed in 0.1.6
- CVE-2025-67747Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules listPyPI · fickling · fixed in 0.1.6
- CVE-2025-67715Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)PyPI · weblate · fixed in 5.15
- CVE-2025-67492Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumerationPyPI · weblate · fixed in 5.15
- CVE-2025-66407Weblate has Server-Side Request Forgery vulnerabilityPyPI · weblate · fixed in 5.15