Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-14924Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution VulnerabilityPyPI · transformers
- CVE-2025-14920Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution VulnerabilityPyPI · transformers
- CVE-2025-14926Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution VulnerabilityPyPI · transformers
- CVE-2025-14927Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution VulnerabilityPyPI · transformers
- CVE-2025-14921Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution VulnerabilityPyPI · transformers
- CVE-2025-14929Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution VulnerabilityPyPI · transformers
- CVE-2025-51511Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads.Packagist · cadmium-org/cadmium-cms
- CVE-2025-67288An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file.NuGet · umbraco.cms
- CVE-2025-67290A stored cross-site scripting (XSS) vulnerability in the Page Settings module of Piranha CMS v12.1 allows attackers to execute arbitrary webNuGet · piranha
- CVE-2025-67291A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scriptsNuGet · piranha
- CVE-2023-53957Kimai 1.30.10 SameSite Cookie Vulnerability Session HijackingPackagist · kimai/kimai
- CVE-2025-63387Dify 1.9.1 and 1.17.0 exposes the /console/api/system-features endpoint to unauthenticated HTTP GET requests that return system feature…PyPI · dify-client
- CVE-2025-63389A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3.Go · github.com/ollama/ollama
- CVE-2023-53929phpMyFAQ 3.1.12 CSV Injection via User Profile ExportPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq
- CVE-2025-13321Mattermost Desktop App logging sensitive information and fails to clear data on server deletionnpm · mattermost-desktop
- CVE-2024-29370In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by craftingPyPI · python-jose
- CVE-2025-67164An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arPackagist · pagekit/pagekit
- CVE-2025-67165An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.Packagist · pagekit/pagekit
- CVE-2025-14443Ose-openshift-apiserver: openshift api server: server-side request forgery (ssrf) vulnerability in imagestreamimport mechanismGo · github.com/openshift/openshift-apiserver
- CVE-2025-11393Insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator: improper proxy configuration allows unauthorized administrative commandsGo · github.com/redhatinsights/runtimes-inventory-operator
- CVE-2025-66843grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality.Packagist · getgrav/grav
- CVE-2025-66844In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig anPackagist · getgrav/grav
- CVE-2025-65854Insecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full accoPackagist · mineadmin/mineadmin
- CVE-2024-58303FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template SettingsPackagist · fof/pretty-mail
- CVE-2025-14518PowerJob Network Request PingPongUtils.java checkConnectivity server-side request forgeryMaven · tech.powerjob:powerjob-common
- CVE-2025-67511Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent toolPyPI · cai-framework
- CVE-2025-344291Panel CSRF Web Port Configuration ChangeGo · github.com/1panel-dev/1panel
- CVE-2025-344301Panel CSRF Panel Name ModificationGo · github.com/1panel-dev/1panel
- CVE-2025-67643Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workMaven · org.jenkinsci.plugins:pipeline-reporter-by-redpen
- CVE-2025-67642Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing aMaven · com.datapipe.jenkins.plugins:hashicorp-vault-plugin