Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-5166Open Asset Import Library Assimp MDC File Parser MDCLoader.cpp InternReadFile out-of-boundsPyPI · pyassimp
- CVE-2025-5165Open Asset Import Library Assimp MDCLoader.cpp ValidateSurfaceHeader out-of-boundsPyPI · pyassimp
- CVE-2025-5150docarray Web API torch_dataset.py __getitem__ prototype pollutionPyPI · docarray
- CVE-2025-5148FunAudioLLM InspireMusic Pickle Data model.py load_state_dict deserializationPyPI · inspiremusic
- CVE-2025-48751The process_lock crate 0.1.0 for Rust allows data races in unlock.crates.io · process_lock
- CVE-2025-48752In the process-sync crate 0.2.2 for Rust, the drop function lacks a check for whether the pthread_mutex is unlocked.crates.io · process-sync
- CVE-2025-48754In the memory_pages crate 0.1.0 for Rust, division by zero can occur.crates.io · memory_pages
- CVE-2025-48756In group_number in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits (e.gcrates.io · scsir
- CVE-2025-5031Ackites KillWxapkg wxapkg File Decompression resource consumptionGo · github.com/ackites/killwxapkg
- CVE-2025-5030Ackites KillWxapkg wxapkg File Parser unpack.go processFile os command injectionGo · github.com/ackites/killwxapkg
- CVE-2025-1975Improper Validation of Array Index in ollama/ollamaGo · github.com/ollama/ollama
- CVE-2025-4727Meteor livedata_server.js Object.assign redosnpm · meteor
- CVE-2025-47774Vyper's `slice()` may elide side-effects when output length is 0PyPI · vyper
- CVE-2025-47285Vyper's `concat()` builtin may elide side-effects for zero-length argumentsPyPI · vyper
- CVE-2025-1647XSS in Bootstrap title attribute for Tooltip and Popovernpm · bootstrap
- CVE-2025-47889In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, alloMaven · org.jenkins-ci.plugins:wso2id-oauth
- CVE-2025-47888Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configMaven · io.jenkins.plugins:dingding-notifications
- CVE-2025-3931Yggdrasil: local privilege escalation in yggdrasilGo · github.com/redhatinsights/yggdrasil
- CVE-2025-46392Apache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.xMaven · commons-configuration:commons-configuration
- CVE-2025-47735inner::drop in inner.rs in the wgp crate through 0.2.0 for Rust lacks drop_slow thread synchronization.crates.io · wgp
- CVE-2025-47736dialect/mod.rs in the libsql-sqlite3-parser crate through 0.13.0 before 14f422a for Rust can crash if the input is not valid UTF-8.crates.io · libsql-sqlite3-parser
- CVE-2025-47737lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero.crates.io · trailer
- CVE-2025-29448Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causPackagist · alextselegidis/easyappointments
- CVE-2025-46735Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`Go · github.com/nrkno/terraform-provider-windns
- CVE-2025-46730Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death AttackPyPI · mobsf
- CVE-2025-29573Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module.PyPI · mezzanine
- CVE-2025-45616Incorrect access control in the /admin/** API of brcc v1.2.0 allows attackers to gain access to Admin rights via a crafted request.Maven · com.baidu.mapp:brcc-core
- CVE-2025-46349YesWiki Vulnerable to Unauthenticated Reflected Cross-site ScriptingPackagist · yeswiki/yeswiki
- CVE-2025-0716AngularJS improper sanitization in SVG '<image>' elementnpm · angular
- CVE-2025-4032inclusionAI AWorld shell_tool.py subprocess.Popen os command injectionPyPI · aworld