Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-55672Apache Superset: Stored XSS on charts metadataPyPI · apache-superset · fixed in 5.0.0
- CVE-2025-55673Apache Superset: Metadata exposure in embedded chartsPyPI · apache-superset · fixed in 4.1.3.post1
- CVE-2025-55197pypdf's Manipulated FlateDecode streams can exhaust RAMPyPI · pypdf · fixed in 6.0.0
- CVE-2025-54791OMERO.web displays unecessary user information when requesting to reset the passwordPyPI · omero-web · fixed in 5.29.2
- CVE-2025-55156PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameterPyPI · pyload-ng · fixed in 0.5.0b3.dev91
- CVE-2025-8747Keras safe_mode bypass allows arbitrary code execution when loading a malicious model.PyPI · keras · fixed in 3.11.0
- CVE-2025-55149Path Traversal Vulnerability in PDF Review Function (CWE-22)PyPI · tiny-scientist
- CVE-2025-55013Assemblyline 4 Service Client: Arbitrary Write through path traversal in Client codePyPI · assemblyline-service-client · fixed in 4.6.0.stable11, 4.6.1.dev138
- CVE-2025-54886skops: Card.get_model does not block arbitrary code executionPyPI · skops · fixed in 0.13.0
- CVE-2025-54368uv is vulnerable to ZIP payload obfuscation through parsing differentialsPyPI · uv · fixed in 0.8.6
- CVE-2025-54952An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated, potentPyPI · executorch
- CVE-2025-54951A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially resultPyPI · executorch · fixed in 0.7.0
- CVE-2025-54950An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execPyPI · executorch · fixed in 0.7.0
- CVE-2025-54949A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effecPyPI · executorch · fixed in 0.7.0
- CVE-2025-30405An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, poPyPI · executorch · fixed in 0.7.0
- CVE-2025-30404An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execuPyPI · executorch · fixed in 0.7.0
- CVE-2025-5197Regular Expression Denial of Service (ReDoS) in huggingface/transformersPyPI · transformers · fixed in 4.53.0
- CVE-2025-54802pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)PyPI · pyload-ng · fixed in 0.5.0b3.dev90
- CVE-2025-54796Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" pagePyPI · copyparty · fixed in 1.18.9
- CVE-2025-53012MaterialX's Lack of Import Depth Limit Leads to DoS (Denial-Of-Service) Via Stack ExhaustionPyPI · materialx · fixed in 1.39.3
- CVE-2025-53011MaterialX is Vulnerable to NULL Pointer Dereference due to Unchecked implGraphOutputPyPI · materialx · fixed in 1.39.3
- CVE-2025-53010MaterialX's unchecked nodeGraph->getOutput return is vulnerable to NULL Pointer DereferencePyPI · materialx · fixed in 1.39.3
- CVE-2025-53009MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion LimitPyPI · materialx · fixed in 1.39.3
- CVE-2025-48074OpenEXR's Unbounded File Header Values can Lead to Out-Of-Memory ErrorsPyPI · openexr · fixed in 3.3.3
- CVE-2025-50460A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py usingPyPI · ms-swift
- CVE-2025-48073OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" ModePyPI · openexr · fixed in 3.3.3
- CVE-2025-48072OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds HeapPyPI · openexr · fixed in 3.3.3
- CVE-2025-48071OpenEXR's Forged Unpacked Size can Lead to Heap-Based Buffer Overflow in Deep Scanline ParsingPyPI · openexr · fixed in 3.3.3
- CVE-2025-54589copyparty Reflected XSS via Filter ParameterPyPI · copyparty · fixed in 1.18.7
- CVE-2025-45768pyjwt v2.10.1 was discovered to contain weak encryption.PyPI · pyjwt