Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-62379Open Redirect in reflex-dev/reflexPyPI · reflex
- CVE-2025-55039Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacksPyPI · pyspark · fixed in 3.4.4, 3.5.2
- CVE-2025-62172Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity NamePyPI · homeassistant · fixed in 2025.10.2
- CVE-2025-7707World-Writable NLTK Cache Directory Vulnerability in run-llama/llama_indexPyPI · llama-index · fixed in 0.13.0
- CVE-2025-61912python-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null TerminationPyPI · python-ldap · fixed in 3.4.5
- CVE-2025-61911python-ldap has sanitization bypass in ldap.filter.escape_filter_charsPyPI · python-ldap · fixed in 3.4.5
- CVE-2025-61920Authlib is vulnerable to Denial of Service via Oversized JOSE SegmentsPyPI · authlib · fixed in 1.6.5
- CVE-2025-61783Python Social Auth - Django has unsafe account associationPyPI · social-auth-app-django · fixed in 5.6.0
- CVE-2025-61773pyLoad CNL and captcha handlers allow code Injection via unsanitized parametersPyPI · pyload-ng · fixed in 0.5.0b3.dev91
- CVE-2025-10284Improper Archive Extraction in unarchive Enables RCEPyPI · bbot · fixed in 2.7.0
- CVE-2025-10283Improper .git Sanitization in gitdumper Enables RCEPyPI · bbot · fixed in 2.7.0
- CVE-2025-10282GitLab Domain Confusion in gitlab Leaks API KeyPyPI · bbot · fixed in 2.7.2
- CVE-2025-10281Insecure URL Handling in git_clone Leading to Leaked API KeyPyPI · bbot · fixed in 2.7.0
- CVE-2025-61672Synapse: Invalid device keys degrade federation functionalityPyPI · matrix-synapse · fixed in 1.138.3, 1.139.1
- CVE-2025-6242Vllm: server side request forgery (ssrf) in mediaconnectorPyPI · vllm · fixed in 0.11.0
- CVE-2025-61784LLaMA Factory's Chat API has Critical SSRF and LFI VulnerabilitiesPyPI · llamafactory · fixed in 0.9.4
- CVE-2025-61670Wasmtime has memory leak in C API with `externref` and `anyref` typesPyPI · wasmtime-bin · fixed in 37.0.2
- CVE-2025-59425vLLM vulnerable to timing attack at bearer authPyPI · vllm · fixed in 0.11.0
- CVE-2025-6985XXE Vulnerability in langchain-ai/langchainPyPI · langchain-text-splitters · fixed in 0.3.9
- CVE-2025-61765python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server deploymentsPyPI · python-socketio · fixed in 5.14.0
- CVE-2025-59152X-Forwarded-For Header Spoofing Bypasses Litestar Rate LimitingPyPI · litestar · fixed in 2.18.0
- CVE-2025-8917Path Traversal Leading to Remote Code Execution in allegroai/clearmlPyPI · clearml · fixed in 2.0.2
- CVE-2025-8406Path Traversal in zenml-io/zenmlPyPI · zenml · fixed in 0.84.2
- CVE-2025-11277Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile heap-based overflowPyPI · pyassimp
- CVE-2025-11275Open Asset Import Library Assimp OpenDDLParserUtils.h getNextSeparator heap-based overflowPyPI · pyassimp
- CVE-2025-11274Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile allocation of resourcesPyPI · pyassimp
- CVE-2025-61677DataChain: Deserialization of Untrusted Data from Environment VariablesPyPI · datachain · fixed in 0.34.2
- CVE-2025-53354NiceGUI is vulnerable to Reflected XSS attackPyPI · nicegui · fixed in 3.0.0
- CVE-2025-60787MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name.PyPI · motioneye · fixed in 0.43.1b5
- CVE-2025-61587Weblate integration with Anubis can lead to Open Redirect via redir parameterPyPI · weblate · fixed in 5.13.3