Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-41898rust-openssl: Unchecked callback-returned length in PSK and cookie generate trampolines can cause OpenSSL to leak adjacent memory to the network peercrates.io · openssl · fixed in 0.10.78
- CVE-2026-41681rust-openssl: MdCtxRef::digest_final() writes past caller buffer with no length checkcrates.io · openssl · fixed in 0.10.78
- CVE-2026-41678rust-openssl: Incorrect bounds assertion in aes key wrapcrates.io · openssl · fixed in 0.10.78
- CVE-2026-41677rust-openssl: Out-of-bounds read in PEM password callback when user callback returns an oversized lengthcrates.io · openssl · fixed in 0.10.78
- CVE-2026-41676rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1crates.io · openssl · fixed in 0.10.78
- CVE-2026-41197Brillig: Heap corruption in foreign call results with nested tuple arrayscrates.io · brillig · fixed in 1.0.0-beta.19
- CVE-2026-40937RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhookscrates.io · rustfs
- CVE-2026-34068nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledgecrates.io · nimiq-transaction
- CVE-2026-34067nimiq-transaction vulnerable to panic via `HistoryTreeProof` length mismatchcrates.io · nimiq-transaction
- CVE-2026-34066nimiq-blockchain: Peer-triggerable panic during history synccrates.io · nimiq-blockchain
- CVE-2026-34065nimiq-primitives: Node crash due to missing interlink validation in election macro block proposalscrates.io · nimiq-primitives
- CVE-2026-34064nimiq-account: Vesting insufficient funds error can paniccrates.io · nimiq-account
- CVE-2026-33471nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncationcrates.io · nimiq-block · fixed in 1.7.2
- CVE-2026-35381uutils coreutils cut Local Logic Error and Data Integrity Issue in Output Filteringcrates.io · uu_cut · fixed in 0.8.0
- CVE-2026-35380uutils coreutils cut Local Logic Error and Data Integrity Issue in Delimiter Parsingcrates.io · coreutils · fixed in 0.8.0
- CVE-2026-35379uutils coreutils tr Local Logic Error and Data Integrity Issue in Character Class Handlingcrates.io · coreutils · fixed in 0.8.0
- CVE-2026-35378uutils coreutils expr Local Denial of Service via Eager Evaluation of Parenthesized Subexpressionscrates.io · coreutils · fixed in 0.8.0
- CVE-2026-35377uutils coreutils env Local Denial of Service via Improper Handling of Backslashes in Split-String Modecrates.io · coreutils
- CVE-2026-35376uutils coreutils chcon Security Bypass and Mandatory Access Control (MAC) Inconsistency via TOCTOU Race Conditioncrates.io · coreutils
- CVE-2026-35375uutils coreutils split Local Data Integrity Issue via Lossy Filename Encodingcrates.io · coreutils · fixed in 0.8.0
- CVE-2026-35374uutils coreutils split Arbitrary File Truncation via Time-of-Check to Time-of-Use (TOCTOU) Race Conditioncrates.io · coreutils
- CVE-2026-35373uutils coreutils ln Local Denial of Service via Improper Handling of Non-UTF-8 Filenamescrates.io · uu_ln · fixed in 0.6.0
- CVE-2026-35372uutils coreutils ln Security Bypass via Improper Handling of the --no-dereference Flagcrates.io · coreutils · fixed in 0.8.0
- CVE-2026-35371uutils coreutils id Misleading Identity Reporting in Pretty Print Modecrates.io · uu_id · fixed in 0.6.0
- CVE-2026-35370uutils coreutils id Incorrect Access-Control Decisions via Misrepresented Group Membershipcrates.io · uu_id · fixed in 0.6.0
- CVE-2026-35369uutils coreutils kill System-wide Process Termination and Denial of Service via Argument Misinterpretationcrates.io · uu_kill · fixed in 0.6.0
- CVE-2026-35368uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injectioncrates.io · coreutils
- CVE-2026-35367uutils coreutils nohup Information Disclosure via Insecure Default Output Permissionscrates.io · coreutils
- CVE-2026-35366uutils coreutils printenv Security Inspection Bypass via UTF-8 Enforcementcrates.io · uu_printenv · fixed in 0.6.0
- CVE-2026-35365uutils coreutils mv Denial of Service and Data Duplication via Improper Symlink Expansioncrates.io · uu_mv · fixed in 0.7.0