Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-54433Bugsink is vulnerable to Path Traversal attacks via event_id in ingestionPyPI · bugsink · fixed in 1.7.4, 1.6.4, 1.5.5 and more
- CVE-2025-54381BentoML is Vulnerable to an SSRF Attack Through File Upload ProcessingPyPI · bentoml · fixed in 1.4.19
- CVE-2025-52490An issue was discovered in Couchbase Sync Gateway before 3.2.6.PyPI · couchbase · fixed in 3.2.6
- CVE-2025-54423copyparty has a DOM-Based XSS vulnerability when displaying multimedia metadataPyPI · copyparty · fixed in 1.18.5
- CVE-2025-5120Sandbox Escape Vulnerability in huggingface/smolagentsPyPI · smolagents · fixed in 1.17.0
- CVE-2025-54413skops' MethodNode can access unexpected object fields through dot notation, leading to arbitrary code execution at load timePyPI · skops · fixed in 0.12.0
- CVE-2025-54412skops' Inconsistent Trusted Type Validation Enables Hidden `operator` Methods ExecutionPyPI · skops · fixed in 0.12.0
- CVE-2025-8183NULL Pointer Dereference in µD3TNPyPI · pyd3tn
- CVE-2025-54379eKuiper API endpoints handling SQL queries with user-controlled table names.PyPI · ekuiper
- CVE-2025-7404Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind CPyPI · calibreweb
- CVE-2025-6998Calibre Web 0.6.24 & Autocaliweb 0.7.0 - ReDoSPyPI · calibreweb
- CVE-2025-54365fastapi-guard patch contains bypassable RegExPyPI · fastapi-guard · fixed in 3.0.2
- CVE-2025-50481A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitraryPyPI · mezzanine
- CVE-2025-54140pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File WritePyPI · pyload-ng · fixed in 0.5.0b3.dev90
- CVE-2025-51464Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious PyPI · aim
- CVE-2025-51480Path Traversal vulnerability in onnx.external_data_helper.save_external_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files byPyPI · onnx · fixed in 1.16.2
- CVE-2025-51481Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbiPyPI · dagster, dagster-ge · fixed in 1.10.16
- CVE-2025-53528Cadwyn is vulnerable to an XSS attack through its docs pagePyPI · cadwyn · fixed in 5.4.3
- CVE-2025-54121Starlette has possible denial-of-service vector when parsing large files in multipart formsPyPI · starlette · fixed in 0.47.2
- CVE-2025-7885Huashengdun WebSSH Login Page cross site scriptingPyPI · webssh · fixed in 1.6.3
- CVE-2025-46732OpenCTI's GraphQL IDOR enables authenticated users to modify or delete notifications of other usersPyPI · pycti · fixed in 6.6.6
- CVE-2025-53890pyLoad vulnerable to remote code execution through js2py onCaptchaResultPyPI · pyload-ng · fixed in 0.20
- CVE-2025-53643AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sectionsPyPI · aiohttp · fixed in 3.12.14
- CVE-2025-53640Indico vulnerable to user enumeration via API endpointPyPI · indico · fixed in 3.3.7
- CVE-2025-29606py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key.PyPI · libp2p · fixed in 0.2.3
- CVE-2025-53865In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).PyPI · roundup · fixed in 2.5.0
- CVE-2025-30402A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code execPyPI · executorch · fixed in 0.7.0
- CVE-2025-3933Regular Expression Denial of Service (ReDoS) in huggingface/transformersPyPI · transformers · fixed in 4.52.1
- CVE-2025-6211MD5 Hash Collision in run-llama/llama_indexPyPI · llama-index, llama-index-readers-docugami · fixed in 0.12.41, 0.3.1
- CVE-2025-7346Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packagesPyPI · pyload-ng