Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-2123GeSHi CSS cssgen.php get_var cross site scriptingPackagist · geshi/geshi
- CVE-2025-27155In-memory stored Cross-site scripting (XSS) vulnerability in pineconesimGo · github.com/matrix-org/pinecone
- CVE-2025-26319FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.npm · flowise
- CVE-2024-51091Cross Site Scripting vulnerability in seajs v.2.2.3 allows a remote attacker to execute arbitrary code via the seajs packagenpm · seajs
- CVE-2024-53384A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to docunpm · tsup
- CVE-2024-53386Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaSnpm · stage-js
- CVE-2024-53388A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element.npm · mavo
- CVE-2025-1686Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the inMaven · io.pebbletemplates:pebble
- CVE-2024-2321Incorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh TokenMaven · org.wso2.am:am-parent, org.wso2.is:identity-server-parent
- CVE-2025-22952elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can beGo · github.com/usememos/memos
- CVE-2025-0868Remote Code Execution in DocsGPTnpm · docsgpt
- CVE-2024-57716An issue in trenoncourt AutoQueryable v.1.7.0 allows a remote attacker to obtain sensitive information via the Unselectable function.NuGet · autoqueryable
- CVE-2024-4028Keycloak-core: stored xss in keycloak when creating a items in admin consoleMaven · org.keycloak:keycloak-core
- CVE-2024-57601Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbitrary code via the lePackagist · alextselegidis/easyappointments
- CVE-2024-57602An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php file.Packagist · alextselegidis/easyappointments
- CVE-2024-57603An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting.Go · github.com/mayswind/ezbookkeeping
- CVE-2024-57604An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component.Go · github.com/mayswind/ezbookkeeping
- CVE-2025-24976Distribution's token authentication allows attacker to inject an untrusted signing key in a JWTGo · github.com/distribution/distribution
- CVE-2024-12366CVE-2024-12366PyPI · pandasai
- CVE-2025-25194Server-Side Request Forgery (SSRF) in activitypub_federationcrates.io · activitypub_federation
- CVE-2024-8550Local File Inclusion (LFI) in modelscope/agentscopePyPI · agentscope
- CVE-2024-57177A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2.npm · @perfood/couch-auth
- CVE-2024-57066A prototype pollution in the lib.deep function of @ndhoule/defaults v2.0.1 allows attackers to cause a Denial of Service (DoS) via supplyingnpm · @ndhoule/defaults
- CVE-2024-57072A prototype pollution in the lib.requireFromString function of module-from-string v3.3.1 allows attackers to cause a Denial of Service (DoS)npm · module-from-string
- CVE-2024-57077The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend.npm · utils-extend
- CVE-2024-57080A prototype pollution in the lib.install function of vxe-table v4.8.10 allows attackers to cause a Denial of Service (DoS) via supplying a cnpm · vxe-table
- CVE-2024-55456lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cellPyPI · lunasvg
- CVE-2024-53615A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remotnpm · files.photo.gallery
- CVE-2024-55415DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass.Packagist · tcg/voyager
- CVE-2024-55416DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass.Packagist · tcg/voyager