Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-4428CRL Distribution Point Scope Check Logic Error in AWS-LCcrates.io · aws-lc-fips-sys, aws-lc-sys · fixed in 0.13.13, 0.39.0
- RUSTSEC-2026-0044AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CNcrates.io · aws-lc-sys · fixed in 0.39.0
- CVE-2026-32314Yamux remote Panic via malformed Data frame with SYN set and len = 262145crates.io · yamux · fixed in 0.13.10
- CVE-2026-31814Yamux remote Panic via malformed WindowUpdate creditcrates.io · yamux · fixed in 0.13.9
- CVE-2026-32322soroban-sdk: `Fr` scalar field equality comparison bypasses modular reductioncrates.io · soroban-sdk · fixed in 25.3.0, 23.5.3, 22.0.11
- CVE-2026-32260Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)crates.io · deno · fixed in 2.7.2
- CVE-2026-32232ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlinkcrates.io · zeptoclaw · fixed in 0.7.6
- CVE-2026-32231ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload datacrates.io · zeptoclaw · fixed in 0.7.6
- CVE-2026-32129Poseidon V1 variable-length input collision via implicit zero-paddingcrates.io · soroban-poseidon · fixed in 25.0.1
- CVE-2026-31812Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsingcrates.io · quinn-proto · fixed in 0.11.14
- CVE-2026-30960RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interfacecrates.io · rssn · fixed in 0.2.9
- CVE-2026-29795stellar-xdr: `StringM::from_str` bypasses max length validationcrates.io · stellar-xdr · fixed in 25.0.1
- CVE-2026-29178Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpointcrates.io · lemmy_routes · fixed in 0.19.16
- CVE-2026-2836Cache poisoning via insecure-by-default cache keycrates.io · pingora-cache · fixed in 0.8.0
- CVE-2026-2835HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsingcrates.io · pingora-core · fixed in 0.8.0
- CVE-2026-2833HTTP Request Smuggling via Premature Upgradecrates.io · pingora-core · fixed in 0.8.0
- CVE-2026-27898Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Ciphercrates.io · vaultwarden · fixed in 1.35.4
- CVE-2026-27803Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Rolecrates.io · vaultwarden · fixed in 1.35.4
- CVE-2026-27802Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Managercrates.io · vaultwarden · fixed in 1.35.4
- CVE-2026-27801Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcementcrates.io · vaultwarden · fixed in 1.35.0
- CVE-2026-3338PKCS7_verify Signature Validation Bypass in AWS-LCcrates.io · aws-lc-sys · fixed in 0.38.0
- CVE-2026-3337Timing Side-Channel in AES-CCM Tag Verification in AWS-LCcrates.io · aws-lc-fips-sys, aws-lc-sys · fixed in 0.13.12, 0.38.0
- CVE-2026-3336PKCS7_verify Certificate Chain Validation Bypass in AWS-LCcrates.io · aws-lc-sys · fixed in 0.38.0
- CVE-2026-21882theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-executioncrates.io · theshit · fixed in 0.2.0
- CVE-2025-13327Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentialscrates.io · uv · fixed in 0.9.6
- CVE-2026-27822Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeovercrates.io · rustfs · fixed in 1.0.0-alpha.83
- CVE-2026-27607RustFS's Missing Post Policy Validation leads to Arbitrary Object Writecrates.io · rustfs · fixed in 1.0.0-alpha.83
- CVE-2026-27572Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instancecrates.io · wasmtime · fixed in 24.0.6, 36.0.6, 40.0.4 and more
- CVE-2026-27204Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustioncrates.io · wasmtime · fixed in 24.0.6, 36.0.6, 40.0.4 and more
- CVE-2026-27195Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` futurecrates.io · wasmtime · fixed in 40.0.4, 41.0.4