Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-10902Arbitrary File Upload with Path Traversal in eosphoros-ai/db-gptPyPI · dbgpt
- CVE-2024-10821Denial of Service (DoS) in invoke-ai/invokeaiPyPI · invokeai
- CVE-2024-6838Uncontrolled Resource Consumption in mlflow/mlflowPyPI · mlflow
- CVE-2025-0188SSRF in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-10831Arbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gptPyPI · dbgpt
- CVE-2024-7760CSRF in aimhubio/aimPyPI · aim
- CVE-2024-12761Denial of Service in brycedrennan/imaginairyPyPI · imaginairy
- CVE-2025-0190Denial of Service in aimhubio/aimPyPI · aim
- CVE-2024-12055DoS using malicious gguf model file in ollama/ollamaGo · github.com/ollama/ollama
- CVE-2024-10713Denial of Service (DoS) via Multipart Request in szad670401/hyperlprPyPI · hyperlpr3
- CVE-2024-7765Denial of Service in h2oai/h2o-3PyPI · h2o
- CVE-2024-8501Arbitrary File Download in modelscope/agentscopePyPI · agentscope
- CVE-2024-7631Openshift-console: openshift console: path traversalGo · github.com/openshift/console
- CVE-2024-25132Openshift-dedicated: hive: hibernation controller denial of serviceGo · github.com/openshift/hive
- CVE-2025-30196Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the `javascript:` schemeMaven · org.jenkins-ci.plugins:anchorchain
- CVE-2025-2241Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acmGo · github.com/openshift/hive
- CVE-2025-2368WebAssembly wabt Malformed File binary-reader-interp.cc OnExport heap-based overflowPyPI · wabt-bin
- CVE-2025-30077Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of Go · github.com/onosproject/onos-lib-go
- CVE-2025-30089gurk (aka gurk-rs) through 0.6.3 mishandles ANSI escape sequences.crates.io · gurk
- CVE-2025-29780Post-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix OperationsPyPI · postquantum-feldman-vss
- CVE-2025-29779Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`PyPI · postquantum-feldman-vss
- CVE-2025-1767This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same Go · k8s.io/kubernetes
- CVE-2025-28010A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0.Packagist · modx/revolution
- CVE-2024-27763XPixelGroup BasicSR through 1.4.2 might locally allow code execution in contrived situations where "scontrol show hostname" is executed in tPyPI · basicsr
- CVE-2025-25975An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys functionnpm · parse-git-config
- CVE-2025-2214Microweber Settings index.php cross site scriptingPackagist · microweber/microweber
- CVE-2025-2152Open Asset Import Library Assimp File BaseImporter.cpp ConvertToUTF8 heap-based overflowPyPI · pyassimp
- CVE-2025-2151Open Asset Import Library Assimp File ParsingUtils.h GetNextLine stack-based overflowPyPI · pyassimp
- CVE-2025-2149PyTorch Quantized Sigmoid Module nnq_Sigmoid initializationPyPI · torch
- CVE-2025-2148PyTorch Tuple torch.ops.profiler._call_end_callbacks_on_jit_fut memory corruptionPyPI · torch