Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-64725Weblate has improper validation upon invitation acceptancePyPI · weblate · fixed in 5.15
- CVE-2025-66388Apache Airflow: Secrets in rendered templates not redacted properly and exposed in the UIPyPI · apache-airflow, apache-airflow-core · fixed in 3.1.5, 3.1.4
- CVE-2025-65430An issue was discovered in allauth-django before 65.13.0.PyPI · django-allauth · fixed in 65.13.0
- CVE-2025-65431An issue was discovered in allauth-django before 65.13.0.PyPI · django-allauth · fixed in 65.13.0
- CVE-2025-14692Mayan EDMS authentication redirectPyPI · mayan-edms · fixed in 4.10.2, 4.9.7, 4.8.10 and more
- CVE-2025-14691Mayan EDMS authentication cross site scriptingPyPI · mayan-edms · fixed in 4.10.2, 4.9.7, 4.8.10 and more
- CVE-2025-14542Command execution in python-utcp allows attackers to achieve remote code execution when fetching a remote Manual from a malicious endpointPyPI · utcp · fixed in 1.1.0
- CVE-2025-67726Tornado is Vulnerable to Quadratic DoS via Crafted Multipart ParametersPyPI · tornado · fixed in 6.5.3
- CVE-2025-67725Tornado is Vulnerable to Quadratic DoS via Repeated Header CoalescingPyPI · tornado · fixed in 6.5.3
- CVE-2025-67724Tornado vulnerable to Header Injection and XSS via reason argumentPyPI · tornado · fixed in 6.5.3
- CVE-2025-13780Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)PyPI · pgadmin4 · fixed in 9.11
- CVE-2025-67720Pyrofork has a Path Traversal in download_media MethodPyPI · pyrofork · fixed in 2.3.69
- CVE-2025-67644LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list methodPyPI · langgraph-checkpoint-sqlite · fixed in 3.0.1
- CVE-2025-67511Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent toolPyPI · cai-framework
- CVE-2025-67485HTTP/HTTPS Traffic Interception Bypass in mad-proxyPyPI · mad-proxy
- CVE-2025-67502Taguette does not safeguard against Open RedirectPyPI · taguette · fixed in 1.5.2
- CVE-2025-66645NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File ReadingPyPI · nicegui · fixed in 3.4.0
- CVE-2025-66470NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG contentPyPI · nicegui · fixed in 3.4.0
- CVE-2025-66469NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style InjectionPyPI · nicegui · fixed in 3.4.0
- CVE-2025-65548NUT-14 allows cashu tokens to be created with a preimage hash.PyPI · cashu · fixed in 0.18.0
- CVE-2025-34291Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCEPyPI · langflow · fixed in 1.7.0
- CVE-2025-66471urllib3 Streaming API improperly handles highly compressed dataPyPI · urllib3 · fixed in 2.6.0
- CVE-2025-66418urllib3 allows an unbounded number of links in the decompression chainPyPI · urllib3 · fixed in 2.6.0
- CVE-2025-65958Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/webPyPI · open-webui · fixed in 0.6.37
- CVE-2025-14010Ansible-collection-community-general: ansible-collection-community-general: keycloak user module leaks credentials in verbose outputPyPI · ansible · fixed in 12.2.0
- CVE-2025-56427Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the _download_file_or_PyPI · composio
- CVE-2025-63681open-webui v0.6.33 is vulnerable to Incorrect Access Control.PyPI · open-webui · fixed in 0.9.0
- CVE-2025-66454Arcade MCP Default Hardcoded Worker Secret Allows Full Unauthorized Access to All HTTP MCP Worker EndpointsPyPI · arcade-mcp-server · fixed in 1.9.1
- CVE-2025-66416DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on LocalhostPyPI · mcp · fixed in 1.23.0
- CVE-2025-64460Potential denial-of-service vulnerability in XML serializer text extractionPyPI · django · fixed in 5.2.9, 5.1.15, 4.2.27