Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-55417DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /aPackagist · tcg/voyager
- CVE-2024-57436RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring.Maven · com.ruoyi:ruoyi
- CVE-2024-57438Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles.Maven · com.ruoyi:ruoyi
- CVE-2024-57439An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicMaven · com.ruoyi:ruoyi
- CVE-2025-0750Cri-o: cri-o path traversal in log handling functions allows arbitrary unmountingGo · github.com/cri-o/cri-o
- CVE-2025-0736Org.infinispan-infinispan-parent: exposure of sensitive information in application logsMaven · org.infinispan:infinispan-parent
- CVE-2025-24369Anubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0Go · github.com/xe/x
- CVE-2025-24783Apache Cocoon: continuations may not be privateMaven · org.apache.cocoon:cocoon-forms-impl, org.apache.cocoon:cocoon-sitemap-impl
- CVE-2024-55227A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scPackagist · dolibarr/dolibarr
- CVE-2024-55228A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts Packagist · dolibarr/dolibarr
- CVE-2024-57719lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend_transformed_tiled_argb.isra.0.PyPI · lunasvg
- CVE-2024-57720lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend.PyPI · lunasvg
- CVE-2024-57721lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path.PyPI · lunasvg
- CVE-2024-57722lunasvg v3.0.0 was discovered to contain a allocation-size-too-big bug via the component plutovg_surface_create.PyPI · lunasvg
- CVE-2024-57723lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over.PyPI · lunasvg
- CVE-2024-57724lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell.PyPI · lunasvg
- CVE-2025-24403A missing permission check in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers with Overall/Read permission to enumerateMaven · org.jenkins-ci.plugins:service-fabric
- CVE-2025-24402A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers to connect to a SeMaven · org.jenkins-ci.plugins:service-fabric
- CVE-2025-24401Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that permissions configured to be granted Maven · io.jenkins.plugins:folder-auth
- CVE-2025-24337WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.Go · github.com/writefreely/writefreely
- CVE-2024-36751An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.npm · parse-uri, parseuri
- CVE-2024-33297Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal Packagist · microweber/microweber
- CVE-2024-33298Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new baPackagist · microweber/microweber
- CVE-2024-33299Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last NamePackagist · microweber/microweber
- CVE-2024-13311Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075Packagist · drupal/all_extensions
- CVE-2024-13310Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074Packagist · drupal/git_utils
- CVE-2024-13285wkhtmltopdf - Highly critical - Unsupported - SA-CONTRIB-2024-049Packagist · drupal/wkhtmltopdf
- CVE-2024-13242Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006Packagist · drupal/swiftmailer
- CVE-2024-53995GHSL-2024-288: SickChill open redirect in loginPyPI · sickchill
- CVE-2024-55459An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_fPyPI · keras