Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-3162InternLM LMDeploy PT File utils.py load_weight_ckpt deserializationPyPI · lmdeploy
- CVE-2025-3160Open Asset Import Library Assimp File SceneCombiner.cpp AddNodeHashes out-of-boundsPyPI · pyassimp
- CVE-2025-3159Open Asset Import Library Assimp ASE File ASEParser.cpp ParseLV4MeshBonesVertices heap-based overflowPyPI · pyassimp
- CVE-2025-3158Open Asset Import Library Assimp LWO File LWOAnimation.cpp UpdateAnimRangeSetup heap-based overflowPyPI · pyassimp
- CVE-2025-3136PyTorch CUDACachingAllocator.cpp torch.cuda.memory.caching_allocator_delete memory corruptionPyPI · torch
- CVE-2025-3122WebAssembly wabt binary-reader-interp.cc BeginFunctionBody null pointer dereferencePyPI · wabt-bin
- CVE-2025-3121PyTorch torch.jit.jit_module_from_flatbuffer memory corruptionPyPI · torch
- CVE-2025-31728Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form, increasinMaven · org.codefirst.jenkins.asakusasatellite:asakusa-satellite-plugin
- CVE-2025-31727Jenkins AsakusaSatellite Plugin 0.1.1 and earlier stores AsakusaSatellite API keys unencrypted in job config.xml files on the Jenkins controMaven · org.codefirst.jenkins.asakusasatellite:asakusa-satellite-plugin
- CVE-2025-31726Jenkins Stack Hammer Plugin 1.0.6 and earlier stores Stack Hammer API keys unencrypted in job config.xml files on the Jenkins controller wheMaven · org.jenkins-ci.plugins:stackhammer
- CVE-2025-31725Jenkins monitor-remote-job Plugin 1.0 stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be vieweMaven · org.ukiuni.monitor-remote-job-plugin:monitor-remote-job
- CVE-2025-29085SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/eMaven · com.vip.saturn:saturn-console
- CVE-2025-3062Drupal Admin LTE theme - Critical - Unsupported - SA-CONTRIB-2025-010Packagist · drupal/druadmin_lte_theme
- CVE-2025-3061Material Admin - Critical - Unsupported - SA-CONTRIB-2025-006Packagist · drupal/material_admin
- CVE-2025-3059Profile Private - Critical - Unsupported - SA-CONTRIB-2025-002Packagist · drupal/profile_private
- CVE-2025-3016Open Asset Import Library Assimp MDL File MDLMaterialLoader.cpp ParseTextureColorData resource consumptionPyPI · pyassimp
- CVE-2025-3015Open Asset Import Library Assimp ASE File ASELoader.cpp BuildUniqueRepresentation out-of-boundsPyPI · pyassimp
- CVE-2025-2998PyTorch torch.nn.utils.rnn.pad_packed_sequence memory corruptionPyPI · torch
- CVE-2025-2961opensolon org.noear.solon.core.handle.RenderManager aa render_mav path traversalMaven · org.noear:solon-view
- CVE-2024-6875Infinispan: infinispan: rest compare api has buffer leakMaven · org.infinispan:infinispan-query
- CVE-2024-38985janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/innpm · cool-path, depath
- CVE-2025-28092ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function.Packagist · shopxo/shopxo
- CVE-2025-28093ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.Packagist · shopxo/shopxo
- CVE-2025-28094shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places.Packagist · shopxo/shopxo
- CVE-2024-11847WP SVG Upload <= 1.0.0 - Author+ Stored XSS via SVGPackagist · digimix/wp-svg-upload
- CVE-2025-2757Open Asset Import Library Assimp MD5 File MD5Parser.cpp AI_MD5_PARSE_STRING_IN_QUOTATION heap-based overflowPyPI · pyassimp
- CVE-2025-2756Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection heap-based overflowPyPI · pyassimp
- CVE-2025-2755Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection out-of-boundsPyPI · pyassimp
- CVE-2025-2754Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection heap-based overflowPyPI · pyassimp
- CVE-2025-2753Open Asset Import Library Assimp LWS File LWSLoader.cpp MergeScenes out-of-boundsPyPI · pyassimp