Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-50946OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.Go · github.com/olivetin/olivetin
- CVE-2025-52392Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms.Packagist · soosyze/soosyze
- CVE-2025-55149Path Traversal Vulnerability in PDF Review Function (CWE-22)PyPI · tiny-scientist
- CVE-2025-55152oak: ReDoS in x-forwarded-proto and x-forwarded-for headersnpm · @oakserver/oak
- CVE-2025-54952An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated, potentPyPI · executorch
- CVE-2025-7954Race Condition in Shopware Voucher SubmissionPackagist · shopware/platform
- CVE-2025-50706An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck functionPackagist · topthink/framework
- CVE-2025-50460A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py usingPyPI · ms-swift
- CVE-2025-51501Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows executionPackagist · microweber/microweber
- CVE-2025-51502Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScriPackagist · microweber/microweber
- CVE-2025-51504Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.Packagist · microweber/microweber
- CVE-2025-45768pyjwt v2.10.1 was discovered to contain weak encryption.PyPI · pyjwt
- CVE-2025-51503A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fieldPackagist · microweber/microweber
- CVE-2025-54656Apache Struts Extras: Improper Output Neutralization for LogsMaven · org.apache.struts:struts-extras, struts:struts
- CVE-2025-8183NULL Pointer Dereference in µD3TNPyPI · pyd3tn
- CVE-2025-7404Calibre Web 0.6.24 & Autocaliweb 0.7.0 - Blind CPyPI · calibreweb
- CVE-2025-6998Calibre Web 0.6.24 & Autocaliweb 0.7.0 - ReDoSPyPI · calibreweb
- CVE-2025-8021All versions of the package files-bucket-server are vulnerable to Directory Traversal where an attacker can traverse the file system and accnpm · files-bucket-server
- CVE-2025-8020All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide an IP or hostname npm · private-ip
- CVE-2025-50481A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitraryPyPI · mezzanine
- CVE-2025-51464Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious PyPI · aim
- CVE-2025-51471Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and Go · github.com/ollama/ollama
- CVE-2025-7787Xuxueli xxl-job SampleXxlJob.java httpJobHandler server-side request forgeryMaven · com.xuxueli:xxl-job-core
- CVE-2025-46001An arbitrary file upload vulnerability in the is_allowed_file_type() function of Filemanager v2.3.0 allows attackers to execute arbitrary coPackagist · simogeo/filemanager
- CVE-2025-46002An issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanPackagist · simogeo/filemanager
- CVE-2024-9408In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints.Maven · org.glassfish.main.admingui:console-common
- CVE-2024-10032In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.Maven · org.glassfish.main.admingui:console-cluster-plugin
- CVE-2024-10031In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the unMaven · org.glassfish.main.admingui:console-common
- CVE-2024-10029In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console.Maven · org.glassfish.main.admingui:console-cluster-plugin, org.glassfish.main.admingui:console-common
- CVE-2024-9343In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.Maven · org.glassfish.main.admingui:console-common