Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-45310CodeWhale: SSRF via HTTP Redirect Bypass in fetch_url Toolcrates.io · deepseek-tui, deepseek-tui-cli · fixed in 0.8.22
- CVE-2026-45373CodeWhale: SSRF IPV6 bypasscrates.io · deepseek-tui · fixed in 0.8.26
- CVE-2026-45374CodeWhale: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Filescrates.io · deepseek-tui · fixed in 0.8.26
- CVE-2026-45137Anchor: Program<'info, System> is not properly validatedcrates.io · anchor-lang · fixed in 1.0.2
- CVE-2026-42184Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commandscrates.io · tauri · fixed in 2.11.1
- CVE-2026-44983smallbitvec: Safe API Triggered Heap Buffer Overflow via Integer Overflowcrates.io · smallbitvec
- CVE-2026-40034gitoxide - Command Injection via Partial .gitmodules Override in gix-submodulecrates.io · gix · fixed in 0.83.0
- CVE-2026-5223Crates in third party registries can override the cached source of other cratescrates.io · cargo · fixed in 0.97.0
- CVE-2026-5222Cargo can be coerced to share credentials between registriescrates.io · cargo · fixed in 0.97.0
- CVE-2026-40092nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHTcrates.io · nimiq-keys
- CVE-2026-44662rust-openssl: Heap buffer overflow when encrypting with AES key-wrap-with-paddingcrates.io · openssl · fixed in 0.10.79
- CVE-2026-42327rust-openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLscrates.io · openssl · fixed in 0.10.79
- CVE-2026-44216Wasmtime: Panic when allocating a table exceeding the size of the host's address spacecrates.io · wasmtime · fixed in 36.0.8, 43.0.2, 44.0.1
- CVE-2026-42559RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transportcrates.io · dynoxide-rs, rmcp · fixed in 0.9.13, 1.4.0
- CVE-2026-44471gitoxide: Symlink prefix-reuse allows worktree escape during checkoutcrates.io · gix-fs · fixed in 0.21.1
- CVE-2026-42199Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behaviorcrates.io · grid · fixed in 1.0.1
- CVE-2026-42189Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive authcrates.io · russh · fixed in 0.60.1
- CVE-2026-42180Lemmy: SSRF in /api/v3/post via Webmention dispatchcrates.io · lemmy_api_common · fixed in 0.19.18
- CVE-2026-42181Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:imagecrates.io · lemmy_api_common · fixed in 0.19.18
- CVE-2026-44499ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoningcrates.io · zebrad · fixed in 4.4.0
- CVE-2026-44500ZEBRA: Allocation Amplification in Inbound Network Deserializerscrates.io · zebra-chain, zebra-network +1 · fixed in 7.0.0, 6.0.0, 4.4.0
- CVE-2026-44498ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigopscrates.io · zebrad · fixed in 4.4.0
- CVE-2026-44497ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffercrates.io · zebra-script, zebrad · fixed in 6.0.0, 4.4.0
- CVE-2026-41585ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clientscrates.io · zebra-rpc, zebrad · fixed in 6.0.2, 4.3.1
- CVE-2026-41584ZEBRA: rk Identity Point Panic in Transaction Verificationcrates.io · zebra-chain, zebrad · fixed in 6.0.2, 4.3.1
- CVE-2026-41583ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handlingcrates.io · zebra-script, zebrad · fixed in 5.0.2, 4.3.1
- CVE-2026-43868Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 patterncrates.io · thrift · fixed in 0.23.0
- CVE-2026-42254Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query thatcrates.io · hickory-recursor · fixed in 0.26.0
- CVE-2026-6967Missing Delegated Metadata Validation in awslabs/toughcrates.io · tough, tuftool · fixed in 0.22.0, 0.15.0
- CVE-2026-6966Signature Threshold Bypass in awslabs/tough Delegated Rolescrates.io · tough, tuftool · fixed in 0.22.0, 0.15.0