Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-53655Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potenMaven · org.jenkins.plugins.statistics.gatherer:statistics-gatherer
- CVE-2025-53654Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins cMaven · org.jenkins.plugins.statistics.gatherer:statistics-gatherer
- CVE-2025-53653Jenkins Aqua Security Scanner Plugin 3.2.8 and earlier stores Scanner Tokens for Aqua API unencrypted in job config.xml files on the JenkinsMaven · org.jenkins-ci.plugins:aqua-security-scanner
- CVE-2025-7346Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packagesPyPI · pyload-ng
- CVE-2025-6386Timing Attack Vulnerability in parisneo/lollmsPyPI · lollms
- CVE-2025-53602Zipkin through 3.5.1 has a /heapdump endpoint (associated with the use of Spring Boot Actuator), a similar issue to CVE-2025-48927.Maven · io.zipkin:zipkin-server
- CVE-2025-34086Bolt CMS Authenticated Remote Code Execution via Profile Injection and File RenamePackagist · bolt/bolt
- CVE-2025-52996File Browser's Password Protection of Links Vulnerable to BypassGo · github.com/filebrowser/filebrowser, github.com/filebrowser/filebrowser/v2
- CVE-2025-45143string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.npm · string-math
- CVE-2025-6855chatchat-space Langchain-Chatchat file path traversalPyPI · langchain-chatchat
- CVE-2025-6854chatchat-space Langchain-Chatchat files path traversalPyPI · langchain-chatchat
- CVE-2025-6853chatchat-space Langchain-Chatchat Backend upload_temp_docs path traversalPyPI · langchain-chatchat
- CVE-2025-53393In Akka through 2.10.6, akka-cluster-metrics uses Java serialization for cluster metrics.Maven · com.typesafe.akka:akka-cluster-metrics_2.13, com.typesafe.akka:akka-cluster-metrics_3
- CVE-2025-6736juzaweb CMS Add New Themes Page install improper authorizationPackagist · juzaweb/cms
- CVE-2025-6735juzaweb CMS Import Page imports improper authorizationPackagist · juzaweb/cms
- CVE-2025-5731Infinispan: credential leakage in infinispan cliMaven · org.infinispan:infinispan-cli-client
- CVE-2025-6701Xuxueli xxl-sso doLogin redirectMaven · com.xuxueli:xxl-sso
- CVE-2025-6700Xuxueli xxl-sso login cross site scriptingMaven · com.xuxueli:xxl-sso
- CVE-2025-53002LLaMA-Factory Remote Code Execution (RCE) VulnerabilityPyPI · llamafactory
- CVE-2025-6518PySpur-Dev pyspur Jinja2 Template single_llm_call.py SingleLLMCallNode special elements used in a template enginePyPI · pyspur
- CVE-2025-6272wasm3 m3_compile.c MarkSlotAllocated out-of-bounds writePyPI · pywasm3
- CVE-2025-28380A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injePyPI · openc3
- CVE-2025-28381A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all contaPyPI · openc3
- CVE-2025-28382An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.PyPI · openc3
- CVE-2025-28384An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.PyPI · openc3
- CVE-2025-28386A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitraryPyPI · openc3
- CVE-2025-28388OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.PyPI · openc3
- CVE-2025-28389Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.PyPI · openc3
- CVE-2025-36852Build Cache Poisoning via Untrusted Pull Requestsnpm · @nx/azure-cache
- CVE-2025-5897vuejs vue-cli Markdown Code HtmlPwaPlugin.js HtmlPwaPlugin redosnpm · @vue/cli-plugin-pwa