Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-49653Exposure of sensitive Information allows account takeoverPyPI · backend-ai
- CVE-2025-49651Missing Authorization for Interactive SessionsPyPI · backend-ai
- CVE-2025-25208Rhcl: authorino denial of service through authpolicy with sharedsecretref severityGo · github.com/kuadrant/authorino
- CVE-2025-25207Rhcl: authpolicy callbacks result in denial of service in authorino severityGo · github.com/kuadrant/authorino
- CVE-2025-45001react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as planpm · react-native-keys
- CVE-2025-49619Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation PyPI · skyvern
- CVE-2025-5806Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introducMaven · org.jenkins-ci.plugins:gatling
- CVE-2025-5791Users: `root` appended to group listingscrates.io · users
- CVE-2025-2336AngularJS improper sanitization in SVG '<image>' element with 'ngSanitize'npm · angular-sanitize
- CVE-2025-45855An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary Maven · xyz.erupt:erupt
- CVE-2025-48996Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpointnpm · @haxtheweb/open-apis
- CVE-2025-5420juzaweb CMS Profile Page upload cross site scriptingPackagist · juzaweb/cms
- CVE-2025-5321aimhubio aim run_view Object query.py RestrictedPythonQuery privilege escalationPyPI · aim
- CVE-2025-5320gradio-app gradio CORS is_valid_origin privilege escalationPyPI · gradio
- CVE-2025-5276Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Server-Side Request Forgery (SSRF) via the Markdownify.get() fnpm · mcp-markdownify-server
- CVE-2025-5273Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Files or Directories Accessible to External Parties via the genpm · mcp-markdownify-server
- CVE-2025-4057Activemq-artemis-operator: amq broker operator starting credentials reuseGo · github.com/arkmq-org/activemq-artemis-operator
- CVE-2025-5173HumanSignal label-studio-ml-backend PT File neural_nets.py load deserializationPyPI · label-studio-ml
- CVE-2025-5169Open Asset Import Library Assimp MDLLoader.cpp InternReadFile_3DGS_MDL345 out-of-boundsPyPI · pyassimp
- CVE-2025-5168Open Asset Import Library Assimp MDLLoader.cpp ImportUVCoordinate_3DGS_MDL345 out-of-boundsPyPI · pyassimp
- CVE-2025-5167Open Asset Import Library Assimp LWOLoader.h GetS0 out-of-boundsPyPI · pyassimp
- CVE-2025-5166Open Asset Import Library Assimp MDC File Parser MDCLoader.cpp InternReadFile out-of-boundsPyPI · pyassimp
- CVE-2025-5165Open Asset Import Library Assimp MDCLoader.cpp ValidateSurfaceHeader out-of-boundsPyPI · pyassimp
- CVE-2025-5150docarray Web API torch_dataset.py __getitem__ prototype pollutionPyPI · docarray
- CVE-2025-5148FunAudioLLM InspireMusic Pickle Data model.py load_state_dict deserializationPyPI · inspiremusic
- CVE-2025-48751The process_lock crate 0.1.0 for Rust allows data races in unlock.crates.io · process_lock
- CVE-2025-48752In the process-sync crate 0.2.2 for Rust, the drop function lacks a check for whether the pthread_mutex is unlocked.crates.io · process-sync
- CVE-2025-48754In the memory_pages crate 0.1.0 for Rust, division by zero can occur.crates.io · memory_pages
- CVE-2025-48756In group_number in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits (e.gcrates.io · scsir
- CVE-2025-5031Ackites KillWxapkg wxapkg File Decompression resource consumptionGo · github.com/ackites/killwxapkg