Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-35364uutils coreutils mv Arbitrary File Overwrite via Cross-Device TOCTOU Race Conditioncrates.io · coreutils
- CVE-2026-35363uutils coreutils rm Safeguard Bypass via Improper Path Normalizationcrates.io · uu_rm · fixed in 0.6.0
- CVE-2026-35362uutils coreutils Missing TOCTOU Protection on Non-Linux Unix Platforms in Safe Traversal Modulecrates.io · uucore · fixed in 0.6.0
- CVE-2026-35361uutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux Systemscrates.io · uu_mknod · fixed in 0.6.0
- CVE-2026-35360uutils coreutils touch Arbitrary File Truncation via TOCTOU Race Conditioncrates.io · coreutils
- CVE-2026-35359uutils coreutils cp Information Disclosure via Time-of-Check to Time-of-Use Symlink Swapcrates.io · coreutils
- CVE-2026-35358uutils coreutils cp Semantic Loss and Potential Denial of Service with -R via Device Node Stream Readingcrates.io · uu_cp · fixed in 0.7.0
- CVE-2026-35357uutils coreutils cp Information Disclosure via Permission Handling Racecrates.io · coreutils
- CVE-2026-35356uutils coreutils install Arbitrary File Overwrite with -D via Path Component Symlink Racecrates.io · uu_install · fixed in 0.7.0
- CVE-2026-35355uutils coreutils install Arbitrary File Overwrite via Symlink TOCTOU Racecrates.io · uu_install · fixed in 0.6.0
- CVE-2026-35354uutils coreutils mv Security Xattr TOCTOU Race in Cross-Devicecrates.io · coreutils
- CVE-2026-35353uutils coreutils mkdir Permission Exposure Race Condition with -mcrates.io · uu_mkdir · fixed in 0.6.0
- CVE-2026-35352uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Conditioncrates.io · coreutils
- CVE-2026-35351uutils coreutils mv Silent Ownership Loss in Cross-Device Operationscrates.io · coreutils
- CVE-2026-35350uutils coreutils cp Unexpected Privileged Executable Creation with -pcrates.io · coreutils
- CVE-2026-35349uutils coreutils Path-Based Safety Bypass with --preserve-rootcrates.io · uu_rm · fixed in 0.7.0
- CVE-2026-35348uutils coreutils sort Local Denial of Service via Forced UTF-8 Parsingcrates.io · coreutils
- CVE-2026-35347uutils coreutils comm Silent Data Loss or Denial of Service via Improper Input Validationcrates.io · uu_comm · fixed in 0.6.0
- CVE-2026-35346uutils coreutils comm Silent Data Corruption via Lossy UTF-8 Normalizationcrates.io · uu_comm · fixed in 0.6.0
- CVE-2026-35345uutils coreutils tail Privileged Information Disclosure via Symlink Replacement Racecrates.io · coreutils
- CVE-2026-35344uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppressioncrates.io · coreutils
- CVE-2026-35343uutils coreutils cut Inconsistent Output Suppression with Newline Delimiterscrates.io · uu_cut · fixed in 0.7.0
- CVE-2026-35342uutils coreutils mktemp Insecure Temporary File Placement via Empty TMPDIRcrates.io · uu_mktemp · fixed in 0.6.0
- CVE-2026-35341uutils coreutils mkfifo Unauthorized Permission Change on Existing Filescrates.io · uu_mkfifo · fixed in 0.6.0
- CVE-2026-35339uutils coreutils chmod False Success Exit Code in Recursive Modecrates.io · uu_chmod · fixed in 0.6.0
- CVE-2026-35338uutils coreutils chmod Path Traversal Bypass of --preserve-rootcrates.io · uu_chmod · fixed in 0.6.0
- CVE-2026-40881Zebra: addr/addrv2 Deserialization Resource Exhaustioncrates.io · zebra-network, zebrad · fixed in 5.0.1, 4.3.1
- CVE-2026-40880Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blockscrates.io · zebra-consensus, zebrad · fixed in 5.0.2, 4.3.1
- CVE-2026-6654Use-After-Free and Double-Free in IntoIter::drop when element drop panicscrates.io · thin-vec · fixed in 0.2.16
- CVE-2026-40323SP1 V6 Recursion Circuit Row-Count Binding Gapcrates.io · sp1_prover, sp1_recursion_circuit +1 · fixed in 6.1.0