Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-41471Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the PyPI · copyparty
- CVE-2025-58050PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCSPyPI · pcre2
- CVE-2025-50979NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories).npm · nodebb
- CVE-2025-52353An arbitrary code execution vulnerability in Badaso CMS 2.9.11.Packagist · badaso/core
- CVE-2025-43960Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., usingPackagist · vrana/adminer
- CVE-2025-43760A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.QMaven · com.liferay.portal:release.portal.bom
- CVE-2025-53363Dpanel has an arbitrary file read vulnerabilityGo · github.com/donknap/dpanel
- CVE-2025-43752Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.Maven · com.liferay.portal:release.portal.bom
- CVE-2025-43754Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 throughMaven · com.liferay.portal:release.portal.bom
- CVE-2025-43756<!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}-->A reflected cross-site scripting (XSS) vulnerability in the Liferay Maven · com.liferay.portal:release.portal.bom
- CVE-2025-51606hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation.Maven · cn.hippo4j:hippo4j-core
- CVE-2025-9262wong2 mcp-cli oAuth provider.js redirectToAuthorization os command injectionnpm · @wong2/mcp-cli
- CVE-2025-43757A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.QMaven · com.liferay.portal:release.portal.bom
- CVE-2025-43749Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.Maven · com.liferay.portal:release.portal.bom
- CVE-2025-4437Cri-o: large /etc/passwd file may lead to denial of serviceGo · github.com/cri-o/cri-o
- CVE-2025-43741A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.QMaven · com.liferay.portal:release.portal.bom
- CVE-2024-39954Apache EventMesh Runtime: SSRFMaven · org.apache.eventmesh:eventmesh-runtime
- CVE-2025-43744A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 202Maven · com.liferay.portal:release.portal.bom
- CVE-2025-43743Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.Maven · com.liferay.portal:release.portal.bom
- CVE-2025-43745A CSRF vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.7, 2025.Q1.0 through 2025.Q1.14, 2Maven · com.liferay.portal:release.portal.bom
- CVE-2025-43738A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.QMaven · com.liferay:com.liferay.expando.web
- CVE-2025-43740A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, Maven · com.liferay.portal:release.portal.bom
- CVE-2025-51510MoonShine was discovered to contain a SQL injection vulnerability under the Blog -> Categories page when using the moonshine-tree-resource (Packagist · moonshine/moonshine
- CVE-2025-43731A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.QMaven · com.liferay.portal:release.portal.bom
- CVE-2025-3639Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13Maven · com.liferay.portal:release.portal.bom
- CVE-2025-9096ExpressGateway express-gateway REST Endpoint apps.js cross site scriptingnpm · express-gateway
- CVE-2025-9095ExpressGateway express-gateway REST Endpoint users.js cross site scriptingnpm · express-gateway
- CVE-2025-8996Layout Builder Advanced Permissions - Moderately critical - Access bypass - SA-CONTRIB-2025-097Packagist · drupal/layout_builder_perms
- CVE-2025-8943Unsupervised OS command execution leads to remote code execution by unauthenticated network attackersnpm · flowise
- CVE-2025-55346Unintended dynamic code execution leads to remote code execution by network attackersnpm · flowise