Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-67642Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing aMaven · com.datapipe.jenkins.plugins:hashicorp-vault-plugin
- CVE-2025-344101Panel CSRF in Change Username Functionality Allows Account LockoutGo · github.com/1panel-dev/1panel
- CVE-2025-8110File overwrite in file update API in GogsGo · gogs.io/gogs
- CVE-2025-67485HTTP/HTTPS Traffic Interception Bypass in mad-proxyPyPI · mad-proxy
- CVE-2025-65807An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command.crates.io · sd
- CVE-2025-67488SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCEGo · github.com/siyuan-note/siyuan/kernel
- CVE-2025-65513fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery (SSRF) vulnerability, which allows attackers to bypass private IP vnpm · mcp-fetch-server
- CVE-2025-65849A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Wonpm · altcha
- CVE-2025-56427Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the _download_file_or_PyPI · composio
- CVE-2025-65346alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal.Packagist · alexusmai/laravel-file-manager
- CVE-2025-65345alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal.Packagist · alexusmai/laravel-file-manager
- CVE-2025-65186Grav CMS 1.7.49 is vulnerable to Cross Site Scripting (XSS).Packagist · getgrav/grav
- CVE-2025-65657FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management.Packagist · feehi/cms
- CVE-2025-65858A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username'PyPI · calibreweb
- CVE-2025-65896SQL injection vulnerability in long2ice assyncmy thru 0.2.10 allows attackers to execute arbitrary SQL commands via crafted dict keys.PyPI · asyncmy
- CVE-2025-66401MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URLnpm · mcp-watch
- CVE-2025-12756Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment DeletionGo · github.com/mattermost/mattermost, github.com/mattermost/mattermost-server +3
- CVE-2025-13806nutzam NutzBoot Transaction API EthModule.java improper authorizationMaven · org.nutz:nutzboot-parent
- CVE-2025-13805nutzam NutzBoot LiteRpc-Serializer HttpServletRpcEndpoint.java getInputStream deserializationMaven · org.nutz:nutzboot-parent
- CVE-2025-13804nutzam NutzBoot Ethereum Wallet EthModule.java information disclosureMaven · org.nutz:nutzboot-parent
- CVE-2025-63520Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).Packagist · feehi/feehicms
- CVE-2025-63522Reverse Tabnabbing vulnerability in FeehiCMS 2.1.1 in the Comments Management functionPackagist · feehi/feehicms
- CVE-2025-63523FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticatPackagist · feehi/feehicms
- CVE-2025-13785yungifez Skuul School Management System Image profile information disclosurePackagist · yungifez/skuul
- CVE-2025-13784yungifez Skuul School Management System SVG File edit cross site scriptingPackagist · yungifez/skuul
- CVE-2025-66219willitmerge has a command Injection vulnerabilitynpm · willitmerge
- CVE-2025-54057Apache SkyWalking: Stored XSS vulnerabilityMaven · org.apache.skywalking:apm-webapp
- CVE-2025-65681An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sePyPI · tutor
- CVE-2025-62703Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServerPyPI · fugue
- CVE-2025-13435Dreampie Resty HttpClient HttpClient.java request path traversalMaven · cn.dreampie:resty