Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-61622Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyforyPyPI · pyfory, pyfury · fixed in 0.12.3
- CVE-2025-57275Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.PyPI · spdk · fixed in 25.9
- CVE-2025-59681An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7.PyPI · django · fixed in 4.2.25, 5.1.13, 5.2.7
- CVE-2025-59682An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7.PyPI · django · fixed in 4.2.25, 5.1.13, 5.2.7
- CVE-2025-59940mkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholdersPyPI · mkdocs-include-markdown-plugin · fixed in 7.1.8
- CVE-2025-7647Insecure Temporary File Handling in run-llama/llama_indexPyPI · llama-index-core · fixed in 0.13.0
- CVE-2025-59842JupyterLab LaTeX typesetter links did not enforce `noopener` attributePyPI · jupyterlab · fixed in 4.4.8
- CVE-2025-54831Apache Airflow: Connection sensitive details exposed to users with READ permissionsPyPI · apache-airflow, apache-airflow-core · fixed in 3.0.4
- CVE-2025-11000Open Babel PQSformat.cpp ReadMolecule null pointer dereferencePyPI · openbabel · fixed in 3.2.0
- CVE-2025-10999Open Babel cacaoformat.cpp SetHilderbrandt null pointer dereferencePyPI · openbabel · fixed in 3.2.0
- CVE-2025-10998Open Babel chemkinformat.cpp ReadReactionQualifierLines null pointer dereferencePyPI · openbabel · fixed in 3.2.0
- CVE-2025-10997Open Babel chemkinformat.cpp CheckSpecies heap-based overflowPyPI · openbabel · fixed in 3.2.0
- CVE-2025-10996Open Babel smilesformat.cpp ParseSmiles heap-based overflowPyPI · openbabel · fixed in 3.2.0
- CVE-2025-10995Open Babel zipstreamimpl.h underflow memory corruptionPyPI · openbabel · fixed in 3.2.0
- CVE-2025-10994Open Babel gamessformat.cpp ReadMolecule use after freePyPI · openbabel · fixed in 3.2.0
- CVE-2025-10952geyang ml-logger File server.py stream_handler information disclosurePyPI · ml-logger
- CVE-2025-10951geyang ml-logger server.py log_handler path traversalPyPI · ml-logger
- CVE-2025-10950geyang ml-logger Ping server.py log_handler deserializationPyPI · ml-logger
- CVE-2025-46148In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.PyPI · torch · fixed in 2.7.0
- CVE-2025-46149In PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error.PyPI · torch · fixed in 2.7.0
- CVE-2025-46150In PyTorch before 2.7.0, when torch.compile is used, FractionalMaxPool2d has inconsistent results.PyPI · torch · fixed in 2.7.0
- CVE-2025-46152In PyTorch before 2.7.0, bitwise_right_shift produces incorrect output for certain out-of-bounds values of the "other" argument.PyPI · torch · fixed in 2.7.0
- CVE-2025-46153PyTorch before 3.7.0 has a bernoulli_p decompose function in decompositions.py even though it lacks full consistency with the eager CPU implPyPI · torch · fixed in 2.7.0
- CVE-2025-55551An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service (DoS) when performing a slice operPyPI · torch · fixed in 2.9.0
- CVE-2025-55552pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together.PyPI · torch · fixed in 2.9.0
- CVE-2025-55553A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS).PyPI · torch · fixed in 2.7.1
- CVE-2025-55554pytorch v2.8.0 was discovered to contain an integer overflow in the component torch.nan_to_num-.long().PyPI · torch · fixed in 2.9.0
- CVE-2025-55557A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of ServPyPI · torch · fixed in 2.7.1
- CVE-2025-55558A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.TensoPyPI · torch · fixed in 2.7.1
- CVE-2025-55560An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.PyPI · torch · fixed in 2.7.1