Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-2559Org.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloakMaven · org.keycloak:keycloak-services
- CVE-2025-2752Open Asset Import Library Assimp CSM File fast_atof.h fast_atoreal_move out-of-boundsPyPI · pyassimp
- CVE-2025-2751Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile out-of-boundsPyPI · pyassimp
- CVE-2025-2750Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile out-of-bounds writePyPI · pyassimp
- CVE-2024-55028A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a craftedPyPI · fprime
- CVE-2024-55029NASA Fprime v3.4.3 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.PyPI · fprime
- CVE-2024-55030A command injection vulnerability in the Command Dispatcher Service of NASA Fprime v3.4.3 allows attackers to execute arbitrary commands.PyPI · fprime
- CVE-2025-2699GetmeUK ContentTools Image cross site scriptingnpm · contenttools
- CVE-2025-2689yiisoft Yii2 SortableIterator.php getIterator deserializationPackagist · yiisoft/yii2-dev
- CVE-2025-29313Use of incorrectly resolved name or reference in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allows attMaven · org.opendaylight.sfc:odl-sfc-openflow-renderer, org.opendaylight.sfc:odl-sfc-ovs
- CVE-2025-29314Insecure Shiro cookie configurations in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allow attackers to Maven · org.opendaylight.sfc:odl-sfc-openflow-renderer, org.opendaylight.sfc:odl-sfc-ovs
- CVE-2025-29315An issue in the Shiro-based RBAC (Role-based Access Control) mechanism of OpenDaylight Service Function Chaining (SFC) Subproject SFC SodiumMaven · org.opendaylight.sfc:sfc-parent
- CVE-2025-2622aizuda snail-job Workflow-Task Management Module check-node-expression getRuntime deserializationMaven · com.aizuda:snail-job
- CVE-2025-26796Apache Oozie: XSS in Oozie Web ConsoleMaven · org.apache.oozie:oozie-core
- CVE-2025-2592Open Asset Import Library Assimp CSMLoader.cpp InternReadFile heap-based overflowPyPI · pyassimp
- CVE-2025-2591Open Asset Import Library Assimp MDLLoader.cpp InternReadFile_Quake1 divide by zeroPyPI · pyassimp
- CVE-2025-2584WebAssembly wabt binary-reader-interp.cc GetReturnCallDropKeepCount heap-based overflowPyPI · wabt-bin
- CVE-2024-53348LoxiLB v.0.9.7 and before is vulnerable to Incorrect Access Control which allows attackers to obtain sensitive information and escalate privGo · github.com/loxilb-io/loxilb
- CVE-2024-53351Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.Go · github.com/pipe-cd/pipecd
- CVE-2024-7598Network restriction bypass via race condition during namespace terminationGo · k8s.io/kubernetes, k8s.io/kubernetes/cmd/kube-apiserver
- CVE-2024-12215Remote Code Execution in kedro-org/kedroPyPI · kedro
- CVE-2024-8613Improper Access Control in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-9216Authentication Bypass in gaizhenbiao/ChuanhuChatGPTPyPI · chuanhuchatgpt
- CVE-2024-6825Remote Code Execution in BerriAI/litellmPyPI · litellm
- CVE-2024-10549Denial of Service by ReDOS in h2oai/h2o-3PyPI · h2o
- CVE-2024-10650Denial of Service (DoS) in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-8487CORS Vulnerability in modelscope/agentscopePyPI · agentscope
- CVE-2024-8769Arbitrary File Deletion via Relative Path Traversal in aimhubio/aimPyPI · aim
- CVE-2024-8556Stored XSS in modelscope/agentscopePyPI · agentscope
- CVE-2024-10830Path Traversal in eosphoros-ai/db-gptPyPI · dbgpt