Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-57329web3-core-method is a package designed to creates the methods on the web3 modules.npm · web3-core-method
- CVE-2025-57330The web3-core-subscriptions is a package designed to manages web3 subscriptions.npm · web3-core-subscriptions
- CVE-2025-57348The node-cube package (prior to version 5.0.0) contains a vulnerability in its handling of prototype chain initialization, which could allownpm · node-cube
- CVE-2025-57351A prototype pollution vulnerability exists in the ts-fns package versions prior to 13.0.7, where insufficient validation of user-provided kenpm · ts-fns
- CVE-2025-57354A vulnerability exists in the 'counterpart' library for Node.js and the browser due to insufficient sanitization of user-controlled input innpm · counterpart
- CVE-2025-6544Deserialization Vulnerability in h2oai/h2o-3PyPI · h2o
- CVE-2025-59717In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring manpm · @digitalocean/do-markdownit
- CVE-2025-59341Local File Inclusion in esm.shGo · github.com/esm-dev/esm.sh
- CVE-2025-4953Podman: build context bind mountGo · github.com/containers/podman, github.com/containers/podman/v2 +3
- CVE-2025-59333@executeautomation/database-server does not properly restrict access, bypassing a "read-only" modenpm · @executeautomation/database-server
- CVE-2025-49089wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd.PyPI · moneyprinterturbo
- CVE-2025-59376feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-delePyPI · mcp-kubernetes-server
- CVE-2025-59377feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is usPyPI · mcp-kubernetes-server
- CVE-2025-56556An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query fPackagist · intelliants/subrion
- CVE-2025-54123Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementationGo · github.com/spectolabs/hoverfly
- CVE-2025-57520A Cross Site Scripting (XSS) vulnerability exists in Decap CMS thru 3.8.3.npm · decap-cms
- CVE-2025-59046interactive-git-checkout has Command Injection vulnerabilitynpm · interactive-git-checkout
- CVE-2025-59039Prebid Universal Creative on npm briefly compromisednpm · prebid-universal-creative
- CVE-2025-58430listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account TakeoverGo · github.com/knadh/listmonk
- CVE-2025-54236Adobe Commerce | Improper Input Validation (CWE-20)Packagist · magento/community-edition, magento/project-community-edition
- CVE-2025-52277Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta coPackagist · yeswiki/yeswiki
- CVE-2025-57665Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abnpm · element-plus
- CVE-2025-58450pREST has Systemic SQL Injection VulnerabilityGo · github.com/prest/prest, github.com/prest/prest/v2
- CVE-2025-10097SimStudioAI sim route.ts code injectionnpm · simstudio
- CVE-2025-58445Atlantis Exposes Service Version Publicly on /status API EndpointGo · github.com/runatlantis/atlantis
- CVE-2025-56760When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path travGo · github.com/usememos/memos
- CVE-2025-56761Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features.Go · github.com/usememos/memos
- CVE-2025-47909Improper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrfGo · github.com/gorilla/csrf
- CVE-2025-55304Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadataPyPI · exiv2
- CVE-2025-54080Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS filePyPI · exiv2