Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-60794Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/usenpm · @perfood/couch-auth
- CVE-2025-60796phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components.Packagist · phppgadmin/phppgadmin
- CVE-2025-60797phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118.Packagist · phppgadmin/phppgadmin
- CVE-2025-60798phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396.Packagist · phppgadmin/phppgadmin
- CVE-2025-60799phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76.Packagist · phppgadmin/phppgadmin
- CVE-2025-64027Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow.Packagist · snipe/snipe-it
- CVE-2025-63828Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leadinPackagist · backdrop/backdrop
- CVE-2025-13266wwwlike vlife VLifeApi SysFileApi.java create path traversalMaven · io.github.wwwlike:vlife-base
- CVE-2025-13265lsfusion platform ZipUtils.java unpackFile path traversalMaven · lsfusion.platform:server
- CVE-2025-13262lsfusion platform UploadFileRequestHandler.java UploadFileRequestHandler path traversalMaven · lsfusion.platform:web-client
- CVE-2025-13261lsfusion platform DownloadFileRequestHandler.java DownloadFileRequestHandler path traversalMaven · lsfusion.platform:web-client
- CVE-2025-63396An issue was discovered in PyTorch v2.5 and v2.7.1.PyPI · torch
- CVE-2025-12919EverShop Order Order.resolvers.js resource injectionnpm · @evershop/evershop
- CVE-2025-12918yungifez Skuul School Management System View Fee Invoice fee-invoices resource injectionPackagist · yungifez/skuul
- CVE-2025-57697AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64.PyPI · astrbot
- CVE-2025-57698AstrBot Project v3.5.22 contains a directory traversal vulnerability.PyPI · astrbot
- CVE-2025-10713XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser ConfigurationMaven · org.wso2.carbon.mediation:org.wso2.carbon.localentry
- CVE-2025-12695Insecure configuration in DSPy lead to arbitrary file read when running untrusted code inside the sandboxPyPI · dspy
- CVE-2025-63675cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used.PyPI · cryptidy
- CVE-2025-50736An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to rePyPI · pdf2zh
- CVE-2025-61141sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environmeGo · github.com/sqls-server/sqls
- CVE-2025-64150A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to connect tMaven · org.jenkins-ci.plugins:publish-to-bitbucket
- CVE-2025-64149A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an aMaven · org.jenkins-ci.plugins:publish-to-bitbucket
- CVE-2025-64148A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerateMaven · org.jenkins-ci.plugins:publish-to-bitbucket
- CVE-2025-64147Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackeMaven · org.jenkins-ci.plugins:curseforge-publisher
- CVE-2025-64146Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewMaven · org.jenkins-ci.plugins:curseforge-publisher
- CVE-2025-64145Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for atMaven · io.jenkins.plugins:byteguard-build-actions
- CVE-2025-64144Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can beMaven · io.jenkins.plugins:byteguard-build-actions
- CVE-2025-64143Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controllMaven · com.openshift.jenkins:openshift-pipeline
- CVE-2025-64142A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect toMaven · org.jenkins-ci.plugins:nexus-task-runner