Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-49401Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)crates.io · deno · fixed in 2.7.14
- CVE-2026-49402Deno: Command Injection via spawnSync & spawn on Windowscrates.io · deno · fixed in 2.7.10
- CVE-2026-49406Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictionscrates.io · deno · fixed in 2.7.12
- CVE-2026-49411Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checkscrates.io · deno · fixed in 2.8.0
- CVE-2026-49983Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read accesscrates.io · deno · fixed in 2.8.1
- CVE-2026-49860Deno: WebSocket API sandbox bypass via missing post-DNS checkcrates.io · deno · fixed in 2.8.1
- CVE-2026-49859Deno: `fetch()` API sandbox bypass via missing DNS resolution checkcrates.io · deno · fixed in 2.8.1
- CVE-2026-49440Deno: Miller-Rabin Primality Test Allows Zero Roundscrates.io · deno · fixed in 2.8.1
- CVE-2026-11941Use-after-free in connection ID iterator and FFI functionscrates.io · quiche · fixed in 0.29.2
- CVE-2026-47261Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restrictioncrates.io · wasmtime-wasi · fixed in 44.0.2, 36.0.10, 24.0.9 and more
- CVE-2026-46690unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX racecrates.io · unbounded-spsc
- CVE-2026-46695BoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Filescrates.io · boxlite, boxlite-cli · fixed in 0.9.0
- CVE-2026-46703BoxLite: Path Traversal Vulnerability in boxlite Leads to Arbitrary File Write on the Hostcrates.io · boxlite, boxlite-cli · fixed in 0.9.0
- CVE-2026-46689Kanidm: Unauthenticated process abort via SCIM filter stack exhaustioncrates.io · kanidm_proto, scim_proto · fixed in 1.9.3
- CVE-2026-48110Russh: SSH message fields were decoded through allocation-first parsers before field-specific boundscrates.io · russh · fixed in 0.61.0
- CVE-2026-48108Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner inputcrates.io · russh · fixed in 0.61.0
- CVE-2026-48107Russh: Unchecked keyboard-interactive prompt count in client auth pathcrates.io · russh · fixed in 0.61.0
- CVE-2026-46705russh server userauth state is not reset when authentication principal changescrates.io · russh · fixed in 0.61.0
- CVE-2026-46702Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packetscrates.io · russh · fixed in 0.61.1
- CVE-2026-46673Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releasescrates.io · russh, russh-cryptovec · fixed in 0.60.3
- CVE-2026-46654Plonky3 MultiField32Challenger: transcript malleability and challenge entropy losscrates.io · p3-challenger · fixed in 0.4.3, 0.5.3
- CVE-2026-10740Excessive memory allocation in s2n-quiccrates.io · s2n-quic · fixed in 1.82.0
- CVE-2026-46545nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed itemcrates.io · nimiq-primitives · fixed in 1.5.0
- CVE-2026-46543nimiq-blockchain: Genesis batch set requestcrates.io · nimiq-blockchain · fixed in 1.5.0
- CVE-2026-46542nimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve pointscrates.io · nimiq-keys · fixed in 1.4.0
- CVE-2026-46539nimiq-primitives: BlockInclusionProof interlink issue when hops are emptycrates.io · nimiq-primitives
- CVE-2026-49235Routinator crashes on specifically crafted RRDP XML filescrates.io · routinator · fixed in 0.15.2
- CVE-2026-49234Routinator crashes on specifically crafted ASN strings in the APIcrates.io · routinator · fixed in 0.15.2
- CVE-2026-49233Routinator cache path traversal using rogue rsync URIscrates.io · routinator · fixed in 0.15.2
- CVE-2026-45311CodeWhale: run_tests Tool Enables RCE via Malicious Repository Without Approvalcrates.io · deepseek-tui, deepseek-tui-cli · fixed in 0.8.23