Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-58367SurrealDB before 2.0.4 Improper Authorization via SELECT Permissionscrates.io · surrealdb, surrealdb-core · fixed in 2.0.4
- CVE-2024-58366SurrealDB before 1.1.1 Format String via Scripting Functionscrates.io · surrealdb · fixed in 1.1.1
- CVE-2024-58365SurrealDB before 1.2.0 Denial of Service via Nonexistent Functioncrates.io · surrealdb · fixed in 1.2.0
- CVE-2024-58364SurrealDB before 1.2.1 Denial of Service via Parsing Errorcrates.io · surrealdb · fixed in 1.2.1
- CVE-2024-58363SurrealDB before 1.5.4 Authentication Bypass via Database Switchcrates.io · surrealdb, surrealdb-core · fixed in 1.5.4, 2.0.0-alpha.6, 1.5.1
- CVE-2024-58362SurrealDB before 1.5.5 Query Injection via RPC APIcrates.io · surrealdb, surrealdb-core · fixed in 1.5.5, 2.0.0-beta.3, 1.5.2
- CVE-2024-58361SurrealDB before 2.0.4 Denial of Service via Parser Exceptioncrates.io · surrealdb, surrealdb-core · fixed in 2.0.4
- CVE-2024-58359SurrealDB before 2.1.0 Denial of Service via rand() Sortingcrates.io · surrealdb, surrealdb-core · fixed in 2.1.0
- CVE-2024-58358SurrealDB before 2.1.0 Denial of Service via Nonexistent Rolecrates.io · surrealdb, surrealdb-core · fixed in 2.1.0
- CVE-2024-58357SurrealDB before 2.1.0 Denial of Service via rand::time()crates.io · surrealdb, surrealdb-core · fixed in 2.1.0
- CVE-2024-58356SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITEcrates.io · surrealdb, surrealdb-core · fixed in 2.1.4
- CVE-2023-54366SurrealDB before 1.0.1 Insecure Default Table Permissionscrates.io · surrealdb · fixed in 1.0.1
- CVE-2026-45784rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD cipherscrates.io · openssl · fixed in 0.10.80
- CVE-2026-48504OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagationcrates.io · opentelemetry_sdk · fixed in 0.32.1
- CVE-2026-50185RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are setcrates.io · cmov · fixed in 0.5.4
- CVE-2026-54496Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundnesscrates.io · halo2_gadgets, orchard +2 · fixed in 0.5.0, 0.14.0, 0.28.0 and more
- CVE-2026-63309SurrealDB < 3.1.5 Information Disclosure via ORDER BYcrates.io · surrealdb · fixed in 3.1.5
- CVE-2026-55407Buffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocationcrates.io · buffa · fixed in 0.8.0
- CVE-2026-55406Buffa: Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Derefcrates.io · buffa · fixed in 0.7.0
- CVE-2026-53598Prompty: Arbitrary File Read via ${file:path} Reference Expansioncrates.io · prompty · fixed in 2.0.0-beta.2
- CVE-2026-49997SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deletedcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-58494Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destinationcrates.io · wasmtime-wasi · fixed in 24.0.11, 36.0.12, 45.0.3 and more
- CVE-2026-54786Wasmtime: Leak in WASIp1 `fd_renumber` implementationcrates.io · wasmtime-wasi · fixed in 24.0.10, 45.0.2, 36.0.11 and more
- CVE-2026-33646mise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)crates.io · mise · fixed in 2026.3.10
- CVE-2026-55441mise: Arbitrary command execution via task-include files in an untrusted, config-less repositorycrates.io · mise · fixed in 2026.6.4
- CVE-2026-54557mise HTTP backend uses raw version path for install symlink destinationcrates.io · mise · fixed in 2026.6.1
- CVE-2026-55448mise: Local credential_command executes untrusted configcrates.io · mise · fixed in 2026.6.4
- CVE-2026-45792RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLMcrates.io · rtk · fixed in 0.32.0
- CVE-2026-55517Deno: Denial of service via non-ASCII bytes in WebSocket response headerscrates.io · deno · fixed in 2.7.5
- CVE-2026-44726Deno: TLS retry copies stale upgrade hook, risking plaintext trafficcrates.io · deno · fixed in 2.7.8