PatchTheCVEpackage analytics vulnerabilities and fixes
Recent CVEs affecting package analytics, with upgrade or downgrade steps. 13 tracked.
Also searched as: packageanalytics.
package analytics has 13 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2025-10-06. Highest priority: CVE-2025-49184 (score 42/100).
- CVE-2025-58587 MEDIUM 6.5 MITIGATE MITIGATE The application does not implement sufficient measures to prevent multiple failed authentication attempts with
- CVE-2025-58590 MEDIUM 6.5 UPGRADE UPGRADE It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.
- CVE-2025-58591 MEDIUM 6.5 MITIGATE MITIGATE A remote, unauthorized attacker can brute force folders and files and read them like private keys or configura
- CVE-2025-58585 MEDIUM 5.3 MITIGATE MITIGATE Multiple endpoints with sensitive information do not require authentication, making the application susceptibl
- CVE-2025-58579 MEDIUM 5.3 MITIGATE MITIGATE Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint
- CVE-2025-58584 MEDIUM 5.3 MITIGATE MITIGATE In the HTTP request, the username and password are transferred directly in the URL as parameters
- CVE-2025-58586 MEDIUM 5.3 MITIGATE MITIGATE For failed login attempts, the application returns different error messages depending on whether the login fai
- CVE-2025-9914 MEDIUM 4.3 MITIGATE MITIGATE The credentials of the users stored in the system's local database can be used for the log in, making it possi
- CVE-2025-9913 MEDIUM 4.5 MITIGATE MITIGATE JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the applicatio
- CVE-2025-58589 LOW 2.7 MITIGATE MITIGATE When an error occurs in the application a full stacktrace is provided to the user
- CVE-2025-49193 MEDIUM 4.2 MITIGATE MITIGATE The application fails to implement several security headers
- CVE-2025-49186 MEDIUM 5.3 MITIGATE MITIGATE The product does not implement sufficient measures to prevent multiple failed authentication attempts within a
- CVE-2025-49184 HIGH 7.5 MITIGATE MITIGATE A remote unauthorized attacker may gather sensitive information of the application, due to missing authorizati
FAQ
How do I fix package analytics vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is package analytics being exploited right now?
None of the tracked package analytics CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which package analytics CVE should I patch first?
CVE-2025-49184 currently ranks highest (42/100): A remote unauthorized attacker may gather sensitive information of the application, due to missing authorizati.