Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-57816Fides Webserver API Rate Limiting Vulnerability in Proxied EnvironmentsPyPI · ethyca-fides · fixed in 2.69.1
- CVE-2025-57766Fides's Admin UI User Password Change Does Not Invalidate Current SessionPyPI · ethyca-fides · fixed in 2.69.1
- CVE-2025-57815Fides Lacks Brute-Force Protections on Authentication EndpointsPyPI · ethyca-fides · fixed in 2.69.1
- CVE-2025-58446xgrammar vulnerable to denial of service by huge enum grammarPyPI · xgrammar · fixed in 0.1.24
- CVE-2025-58438internetarchive is vulnerable to Directory Traversal through file downloadsPyPI · internetarchive · fixed in 5.5.1
- CVE-2025-58367DeepDiff is vulnerable to DoS and Remote Code Execution via Delta class pollutionPyPI · deepdiff · fixed in 8.6.1
- CVE-2025-55671Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22.PyPI · tkeasygui · fixed in 1.0.22
- CVE-2025-55037Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI versions prior to v1.0.PyPI · tkeasygui · fixed in 1.0.22
- CVE-2025-58352Weblate has long session expiry times during second factor verificationPyPI · weblate · fixed in 5.13.1
- CVE-2025-9636Cross-Origin Opener Policy Vulnerability in pgAdmin 4PyPI · pgadmin4 · fixed in 9.8
- CVE-2025-6984Sensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchainPyPI · langchain-community · fixed in 0.3.27
- CVE-2025-57833An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6.PyPI · django · fixed in 4.2.24, 5.1.12, 5.2.6
- CVE-2025-58162MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a ExtractionPyPI · mobsf · fixed in 4.4.1
- CVE-2025-58161MobSF Path Traversal in GET /download/<filename> using absolute filenamesPyPI · mobsf · fixed in 4.4.1
- CVE-2025-57808ESP-IDF web_server basic auth bypass using empty or incomplete Authorization headerPyPI · esphome · fixed in 2025.8.1
- CVE-2025-58068Eventlet affected by HTTP request smuggling in unparsed trailersPyPI · eventlet · fixed in 0.40.3
- CVE-2025-55304Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadataPyPI · exiv2
- CVE-2025-54080Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS filePyPI · exiv2
- CVE-2023-41471Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the PyPI · copyparty
- CVE-2025-58050PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCSPyPI · pcre2
- CVE-2025-57809XGrammar affected by Denial of Service by infinite recursion grammarsPyPI · xgrammar · fixed in 0.1.21
- CVE-2025-57804h2 allows HTTP Request Smuggling due to illegal characters in headersPyPI · h2 · fixed in 4.3.0
- CVE-2025-57760Langflow Vulnerable to Privilege Escalation via CLI Superuser CreationPyPI · langflow, langflow-base · fixed in 1.5.0, 1.5.1, 0.5.1
- CVE-2025-5302Denial of Service (DOS) in JSONReader in run-llama/llama_indexPyPI · llama-index-core · fixed in 0.12.38
- CVE-2025-57751Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljsPyPI · pyload-ng · fixed in 0.5.0b3.dev92
- CVE-2025-48956vLLM API endpoints vulnerable to Denial of Service AttacksPyPI · vllm · fixed in 0.10.1.1
- CVE-2025-55214Copier safe template has filesystem write access outside destination pathPyPI · copier · fixed in 9.9.1
- CVE-2025-55201Copier safe template has arbitrary filesystem read/write accessPyPI · copier · fixed in 9.9.1
- CVE-2025-55675Apache Superset: Incorrect datasource authorization on REST APIPyPI · apache-superset · fixed in 5.0.0
- CVE-2025-55674Apache Superset: Improper SQL authorisation, parse not checking for specific engine functionsPyPI · apache-superset · fixed in 5.0.0