Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-3986Apereo CAS CasConfigurationMetadataServerController.java redosMaven · org.apereo.cas:cas-server-core-configuration-metadata-repository
- CVE-2025-3985Apereo CAS ResponseEntity redosMaven · org.apereo.cas:cas-management-webapp-support
- CVE-2025-3984Apereo CAS Groovy Code RegisteredServiceSimpleFormController.java saveService code injectionMaven · org.apereo.cas:cas-management-webapp-support
- CVE-2025-3903UEditor - 百度编辑器 - Critical - Unsupported - SA-CONTRIB-2025-044Packagist · drupal/ueditor
- CVE-2025-1520PostHog ClickHouse Table Functions SQL Injection Remote Code Execution Vulnerabilitynpm · @posthog/plugin-server
- CVE-2024-41446A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a cMaven · org.opencms:opencms-core
- CVE-2024-42699Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payMaven · org.opencms:opencms-core
- CVE-2025-3801songquanpeng one-api System Setting cross site scriptingGo · github.com/songquanpeng/one-api
- CVE-2024-29643An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component.Packagist · croogo/croogo
- CVE-2024-41447A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a cMaven · org.opencms:opencms-core
- CVE-2025-28197Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py.PyPI · crawl4ai
- CVE-2024-53924Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginniPyPI · pycel
- CVE-2024-55238OpenMetadata <=1.4.1 is vulnerable to SQL Injection.Maven · org.open-metadata:openmetadata-service
- CVE-2025-32783XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wikiMaven · org.xwiki.platform:xwiki-platform-messagestream
- CVE-2025-3739Drupal 8 Google Optimize Hide Page - Critical - Unsupported - SA-CONTRIB-2025-040Packagist · drupal/d8_google_optimize_hide_page
- CVE-2025-3738Google Optimize - Critical - Unsupported - SA-CONTRIB-2025-039Packagist · drupal/google_optimize
- CVE-2025-3737Google Maps: Store Locator - Critical - Unsupported - SA-CONTRIB-2025-038Packagist · drupal/gmap_store_locator
- CVE-2025-3736Simple GTM - Critical - Unsupported - SA-CONTRIB-2025-037Packagist · drupal/simple_gtm
- CVE-2025-3735Panelizer (obsolete) - Critical - Unsupported - SA-CONTRIB-2025-036Packagist · drupal/panelizer
- CVE-2025-3588joelittlejohn jsonschema2pojo JSON File SchemaRule.java apply stack-based overflowMaven · org.jsonschema2pojo:jsonschema2pojo-core
- CVE-2025-3549Open Asset Import Library Assimp File MD3Loader.cpp ValidateSurfaceHeaderOffsets heap-based overflowPyPI · pyassimp
- CVE-2025-32931DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands vPackagist · tcg/voyager
- CVE-2025-3445A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go.Go · github.com/mholt/archiver, github.com/mholt/archiver/v3
- CVE-2025-29480Buffer Overflow vulnerability in gdal 3.10.2 allows a local attacker to cause a denial of service via the OGRSpatialReference::Release functPyPI · gdal
- CVE-2025-3192Versions of the package spatie/browsershot from 0.0.0 are vulnerable to Server-side Request Forgery (SSRF) in the setUrl() function due to aPackagist · spatie/browsershot
- CVE-2025-3191All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result npm · react-draft-wysiwyg
- CVE-2025-3197Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js.npm · expand-object
- CVE-2025-3194Versions of the package bigint-buffer from 0.0.0 are vulnerable to Buffer Overflow in the toBigIntLE() function.npm · bigint-buffer
- CVE-2025-3196Open Asset Import Library Assimp Malformed File MD2Loader.cpp InternReadFile stack-based overflowPyPI · pyassimp
- CVE-2025-3163InternLM LMDeploy conf.py open code injectionPyPI · lmdeploy