Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-14894CVE-2025-14894Packagist · livewire-filemanager/filemanager
- CVE-2025-68924In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remNuGet · umbracoforms
- CVE-2026-23622CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeoverPackagist · alextselegidis/easyappointments
- CVE-2021-47776Umbraco v8.14.1 - 'baseUrl' SSRFNuGet · umbracocms
- CVE-2021-47763Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injectionPackagist · aimeos/aimeos-laravel
- CVE-2026-0976Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url pathsMaven · org.keycloak:keycloak-quarkus-server
- CVE-2025-63644A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field.Packagist · ph7software/ph7builder
- CVE-2025-15056Quill 2.0.3 - Lack of data validation in HTML export allowing XSSnpm · quill
- CVE-2026-22786Gin-vue-admin has arbitrary file upload vulnerability caused by path traversalGo · github.com/flipped-aurora/gin-vue-admin
- CVE-2026-22033Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys fieldPyPI · label-studio
- CVE-2026-22700RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKEcrates.io · sm2
- CVE-2026-22699RustCrypto SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt()crates.io · sm2
- CVE-2026-22698RustCrypto SM2-PKE has 32-bit Biased Nonce Vulnerabilitycrates.io · sm2
- CVE-2025-60538A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.Go · github.com/go-shiori/shiori
- CVE-2025-14505Elliptic Cryptanalysis vulnerability when `k` has leading zerosnpm · elliptic
- CVE-2025-62877Harvest may expose OS default ssh login password via SUSE Virtualization Interactive InstallerGo · github.com/harvester/harvester-installer
- CVE-2026-0707Keycloak: keycloak authorization header parsing leading to potential security control bypassMaven · org.keycloak:keycloak-parent
- CVE-2026-22187Bio-Formats <= 8.3.0 Memoizer Unsafe Deserialization via .bfmemo Cache FilesMaven · ome:pom-bio-formats
- CVE-2026-22186Bio-Formats <= 8.3.0 XXE in Leica XLEF Metadata ParserMaven · ome:pom-bio-formats
- CVE-2025-61492A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary comPyPI · terminal-controller
- CVE-2025-67364fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file operation tools including fast_read_file.npm · fast-filesystem-mcp
- CVE-2025-67419A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resnpm · @evershop/evershop
- CVE-2025-67427A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server tonpm · @evershop/evershop
- CVE-2025-15107actiontech sqle JWT Secret jwt.go hard-coded keyGo · github.com/actiontech/sqle
- CVE-2025-13158apidoc-core - prototype pollution in api_group.js, api_param_title.js, api_use.js, and api_permission.js workernpm · apidoc-core
- CVE-2024-42718A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'editPackagist · croogo/croogo
- CVE-2025-25341A vulnerability exists in the libxmljs 1.0.11 when parsing a specially crafted XML document.npm · libxmljs
- CVE-2025-14931Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution VulnerabilityPyPI · smolagents
- CVE-2025-14930Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution VulnerabilityPyPI · transformers
- CVE-2025-14928Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution VulnerabilityPyPI · transformers