Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-12764pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.PyPI · pgadmin4 · fixed in 9.10
- CVE-2025-12763Command injection vulnerability allowing arbitrary command execution on WindowsPyPI · pgadmin4 · fixed in 9.10
- CVE-2025-12762Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)PyPI · pgadmin4 · fixed in 9.10
- CVE-2025-64429DuckDB Encryption Crypto implementation is vulnerablePyPI · duckdb · fixed in 1.4.2
- CVE-2025-63396An issue was discovered in PyTorch v2.5 and v2.7.1.PyPI · torch
- CVE-2025-64512pdfminer.six vulnerable to Arbitrary Code Execution via Crafted PDF InputPyPI · pdfminer-six · fixed in 20251107
- CVE-2025-64509Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)PyPI · bugsink · fixed in 2.0.6
- CVE-2025-64508Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli inputPyPI · bugsink · fixed in 2.0.5
- CVE-2025-64183OpenEXR has use after free in PyObject_StealAttrStringPyPI · openexr · fixed in 3.2.5, 3.3.6, 3.4.3
- CVE-2025-64182OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()PyPI · openexr · fixed in 3.2.5, 3.3.6, 3.4.3
- CVE-2025-64181OpenEXR Makes Use of Uninitialized MemoryPyPI · openexr · fixed in 3.3.6, 3.4.3
- CVE-2025-62780changedetection.io vulnerable to stored XSS in Watch update via APIPyPI · changedetection-io · fixed in 0.50.34
- CVE-2025-12967An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role.PyPI · aws-advanced-python-wrapper · fixed in 1.4.0
- CVE-2025-64496Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE EventsPyPI · open-webui · fixed in 0.6.35
- CVE-2025-64495Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCEPyPI · open-webui · fixed in 0.6.35
- CVE-2025-64481Open redirect endpoint in DatasettePyPI · datasette · fixed in 0.65.2, 1.0a21
- CVE-2025-64439LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializerPyPI · langgraph-checkpoint · fixed in 3.0.0
- CVE-2025-64187OctoPrint is vulnerable to XSS through Action Command Notifications and PromptsPyPI · octoprint · fixed in 1.11.4
- CVE-2025-64184Dosage vulnerable to Directory Traversal through crafted HTTP responsesPyPI · dosage · fixed in 3.2
- CVE-2025-57697AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64.PyPI · astrbot
- CVE-2025-57698AstrBot Project v3.5.22 contains a directory traversal vulnerability.PyPI · astrbot
- CVE-2025-64326Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit logPyPI · late, weblate · fixed in 5.14.1
- CVE-2025-64459Potential SQL injection via _connector keyword argument in QuerySet and Q objectsPyPI · django · fixed in 5.2.8, 5.1.14, 4.2.26
- CVE-2025-64458Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on WindowsPyPI · django · fixed in 5.2.8, 5.1.14, 4.2.26
- CVE-2025-58337Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode for doris-mcp-server MCP ServerPyPI · doris-mcp-server · fixed in 0.6.0
- CVE-2025-12695Insecure configuration in DSPy lead to arbitrary file read when running untrusted code inside the sandboxPyPI · dspy
- CVE-2025-64168Agno session state overwrites between different sessions/usersPyPI · agno · fixed in 2.2.2
- CVE-2025-6176Brotli decompression bomb DoS in scrapy/scrapyPyPI · brotli, scrapy · fixed in 1.2.0, 2.13.4
- CVE-2025-57106Kitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader.PyPI · vtk · fixed in 9.5.1
- CVE-2025-57107Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader.PyPI · vtk · fixed in 9.5.1