Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-11322Mangati NovoSGA User Creation new weak passwordPackagist · novosga/novosga
- CVE-2025-11287samanhappy MCPHub sseService.ts handleSseConnectionfunction improper authenticationnpm · @samanhappy/mcphub
- CVE-2025-11285samanhappy MCPHub serverController.ts os command injectionnpm · @samanhappy/mcphub
- CVE-2025-11277Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile heap-based overflowPyPI · pyassimp
- CVE-2025-11275Open Asset Import Library Assimp OpenDDLParserUtils.h getNextSeparator heap-based overflowPyPI · pyassimp
- CVE-2025-11274Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile allocation of resourcesPyPI · pyassimp
- CVE-2025-56514Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rnpm · fiora
- CVE-2025-56515File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality.npm · fiora
- CVE-2025-11149This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static.npm · @nubosoftware/node-static
- CVE-2025-11148All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted withnpm · check-branches
- CVE-2025-56571Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter.npm · financejs
- CVE-2025-56572An issue in finance.js v.4.1.0 allows a remote attacker to cause a denial of service via the seekZero() parameter.npm · financejs
- CVE-2025-1396Username Enumeration in Multiple WSO2 Products with Multi-Attribute Login EnabledMaven · org.wso2.carbon.identity.framework:org.wso2.carbon.identity.input.validation.mgt
- CVE-2025-57692PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution ofNuGet · piranha
- CVE-2025-10952geyang ml-logger File server.py stream_handler information disclosurePyPI · ml-logger
- CVE-2025-10951geyang ml-logger server.py log_handler path traversalPyPI · ml-logger
- CVE-2020-36851Rob--W cors-anywhere Misconfigured CORS Proxy Allows SSRFnpm · cors-anywhere
- CVE-2025-10950geyang ml-logger Ping server.py log_handler deserializationPyPI · ml-logger
- CVE-2025-59839Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributesPackagist · starcitizenwiki/embedvideo
- CVE-2025-59834Command Injection in adb-mcp MCP Servernpm · adb-mcp
- CVE-2025-26278A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted paynpm · dref
- CVE-2025-57317apidoc-core is the core parser library to generate apidoc result following the apidoc-spec.npm · apidoc-core
- CVE-2025-10909Mangati NovoSGA SVG File admin cross site scriptingPackagist · novosga/novosga
- CVE-2025-57318A Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject properties on Object.pronpm · csvjson
- CVE-2025-57320json-schema-editor-visual is a package that provides jsonschema editor.npm · json-schema-editor-visual
- CVE-2025-57321A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 allows attackers to injnpm · magix-combine-ex
- CVE-2025-57323mpregular is a package that provides a small program development framework based on RegularJS.npm · mpregular
- CVE-2025-57326A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject propertiesnpm · sassdoc-extras
- CVE-2025-57327spmrc is a package that provides the rc manager for spm.npm · spmrc
- CVE-2025-57328toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other objnpm · toggle-array