Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-34069nimiq-consensus panics via RequestMacroChain micro-block locatorcrates.io · nimiq-consensus
- CVE-2026-40093nimiq-blockchain is missing a wall-clock upper bound on block timestampscrates.io · nimiq-blockchain
- CVE-2026-35195Wasmtime has an out-of-bounds write or crash when transcoding component model stringscrates.io · wasmtime · fixed in 24.0.7, 36.0.7, 42.0.2 and more
- CVE-2026-35186Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backendcrates.io · wasmtime · fixed in 36.0.7, 42.0.2, 43.0.1
- CVE-2026-34988Wasmtime leaks data between pooling allocator instancescrates.io · wasmtime · fixed in 36.0.7, 42.0.2, 43.0.1
- CVE-2026-34987Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory accesscrates.io · wasmtime · fixed in 36.0.7, 42.0.2, 43.0.1
- CVE-2026-34983Wasmtime has a use-after-free bug after cloning `wasmtime::Linker`crates.io · wasmtime · fixed in 43.0.1
- CVE-2026-34971Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Craneliftcrates.io · wasmtime · fixed in 36.0.7, 42.0.2, 43.0.1
- CVE-2026-34946Wasmtime's host panics when Winch compiler executes `table.fill`crates.io · wasmtime · fixed in 36.0.7, 42.0.2, 43.0.1
- CVE-2026-34945Wasmtime leaks host data with 64-bit tables and Winchcrates.io · wasmtime · fixed in 36.0.7, 42.0.2, 43.0.1
- CVE-2026-34944Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64crates.io · wasmtime · fixed in 24.0.7, 36.0.7, 42.0.2 and more
- CVE-2026-34943Wasmtime panics when lifting `flags` component valuecrates.io · wasmtime · fixed in 24.0.7, 36.0.7, 42.0.2 and more
- CVE-2026-34942Wasmtime panics when transcoding misaligned utf-16 stringscrates.io · wasmtime · fixed in 24.0.7, 36.0.7, 42.0.2 and more
- CVE-2026-34941Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcodingcrates.io · wasmtime · fixed in 24.0.7, 36.0.7, 42.0.2 and more
- CVE-2026-35406Aardvark-dns has incorrect error handling for malformed tcp packetscrates.io · netavark · fixed in 1.17.1
- CVE-2026-35533mise has a local settings bypass config trust checkscrates.io · mise · fixed in 2026.6.4
- CVE-2026-39360RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltrationcrates.io · rustfs
- CVE-2026-35457libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustioncrates.io · libp2p-rendezvous · fixed in 0.17.1
- CVE-2026-35405libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous serverscrates.io · libp2p-rendezvous · fixed in 0.17.1
- CVE-2026-34219libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflowcrates.io · libp2p-gossipsub · fixed in 0.49.4
- CVE-2026-34377Zebra has a Consensus Failure due to Improper Verification of V5 Transactionscrates.io · zebra-consensus, zebrad · fixed in 5.0.1, 4.3.0
- CVE-2026-34202Zebra node crash — V5 transaction hash panic (P2P reachable)crates.io · zebra-chain, zebrad · fixed in 6.0.1, 4.3.0
- CVE-2026-33693Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()crates.io · activitypub_federation · fixed in 0.7.0-beta.9
- CVE-2026-33241Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsingcrates.io · salvo · fixed in 0.89.3
- CVE-2026-33242Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypasscrates.io · salvo · fixed in 0.89.3
- CVE-2026-33056tar-rs: unpack_in can chmod arbitrary directories by following symlinkscrates.io · tar · fixed in 0.4.45
- CVE-2026-33055tar-rs incorrectly ignores PAX size headers if header size is nonzerocrates.io · tar · fixed in 0.4.45
- CVE-2026-33040libp2p-rust: Gossipsub PRUNE.backoff Duration Overflowcrates.io · libp2p-gossipsub · fixed in 0.49.3
- CVE-2026-32829lz4_flex: Decompression can leak information from uninitialized memory or reused output buffercrates.io · lz4_flex · fixed in 0.11.6, 0.12.1
- CVE-2026-32766astral-tokio-tar insufficiently validates PAX extensions during extractioncrates.io · astral-tokio-tar · fixed in 0.6.0