Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-64141A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an atMaven · org.jenkins-ci.plugins:nexus-task-runner
- CVE-2025-64140Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with IteMaven · org.jenkins-ci.plugins:azure-cli
- CVE-2025-64139A missing permission check in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers with Overall/Read permission to connMaven · org.jenkins-ci.plugins:windocks-start-container
- CVE-2025-64138A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect toMaven · org.jenkins-ci.plugins:windocks-start-container
- CVE-2025-64137A missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows attackers with Overall/Read permission to connect to an attackeMaven · org.jenkins-ci.plugins:themis
- CVE-2025-64136A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specMaven · org.jenkins-ci.plugins:themis
- CVE-2025-64135Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` Maven · io.jenkins.plugins:eggplant-runner
- CVE-2025-64134Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevMaven · org.jenkins-ci.plugins:jdepend
- CVE-2025-64133A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackeMaven · jp.ikedam.jenkins.plugins:extensible-choice-parameter
- CVE-2025-62594ImageMagick CLAHE : Unsigned underflow and division-by-zero lead to OOB pointer arithmetic and process crash (DoS)NuGet · magick.net-q16-arm64, magick.net-q16-hdri-arm64 +10
- CVE-2025-60837A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a useMaven · net.mingsoft:ms-mcms
- CVE-2025-61413A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute arbitraryNuGet · piranha
- CVE-2025-62710Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImplMaven · org.sakaiproject.kernel:sakai-kernel-impl
- CVE-2025-62247Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025Maven · com.liferay:com.liferay.search.experiences.service
- CVE-2025-62248A reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.Maven · com.liferay:com.liferay.dynamic.data.mapping.web
- CVE-2025-62249A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.QMaven · com.liferay.portal:com.liferay.portal.impl
- CVE-2025-60790ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted withoPackagist · processwire/processwire
- CVE-2025-61417Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/media_manager component.Packagist · tastyigniter/tastyigniter
- CVE-2025-62515Remote Code Execution by Pickle Deserialization via FlightServer in pyquokkaPyPI · pyquokka
- CVE-2025-61581Apache Traffic Control: ReDoS issue in Traffic Router configurationGo · github.com/apache/trafficcontrol, github.com/apache/trafficcontrol/v8
- CVE-2025-62379Open Redirect in reflex-dev/reflexPyPI · reflex
- CVE-2025-9554Owl Carousel 2 - Critical - Unsupported - SA-CONTRIB-2025-104Packagist · drupal/owlcarousel2
- CVE-2025-9553API Key manager - Critical - Unsupported - SA-CONTRIB-2025-103Packagist · drupal/api_key_manager
- CVE-2025-9552Synchronize composer.json With Contrib Modules - Critical - Unsupported - SA-CONTRIB-2025-102Packagist · drupal/sync_composer_with_contrib
- CVE-2025-11581PowerJob OpenAPIController runJob authorizationMaven · tech.powerjob:powerjob-server-starter
- CVE-2025-11580PowerJob list authorizationMaven · tech.powerjob:powerjob
- CVE-2025-30001Apache StreamPark: Authenticated users can trigger remote command executionMaven · org.apache.streampark:streampark
- CVE-2025-11570Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficiePackagist · drupal-pattern-lab/unified-twig-extensions
- CVE-2025-61788Opencast Paella Player 7 vulnerable to Cross-Site-ScriptingMaven · org.opencastproject:opencast-common
- CVE-2025-61183Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of Packagist · webreinvent/vaahcms