Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-27480Static Web Server: Timing-Based Username Enumeration in Basic Authenticationcrates.io · static-web-server · fixed in 2.41.0
- CVE-2026-27190Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_processcrates.io · deno · fixed in 2.6.8
- CVE-2026-26275httpsig-hyper has Improper Digest Verification that May Allow Message Integrity Bypasscrates.io · httpsig-hyper · fixed in 0.0.23
- CVE-2026-26267rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collidecrates.io · soroban-sdk-macros · fixed in 25.1.1, 23.5.2, 22.0.10
- CVE-2026-25628Qdrant affected by arbitrary file write via `/logger` endpointcrates.io · qdrant · fixed in 1.15.6
- CVE-2026-25727time affected by a stack exhaustion denial of service attackcrates.io · time · fixed in 0.3.47
- CVE-2026-25541Bytes is vulnerable to integer overflow in BytesMut::reservecrates.io · bytes · fixed in 1.11.1
- CVE-2026-25537jsonwebtoken has Type Confusion that leads to potential authorization bypasscrates.io · jsonwebtoken · fixed in 10.3.0
- CVE-2026-24762RustFS Logs Sensitive Credentials in Plaintextcrates.io · rustfs · fixed in 1.0.0-alpha.82
- CVE-2026-21862RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headerscrates.io · rustfs · fixed in 1.0.0-alpha.78
- CVE-2026-24889soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64crates.io · soroban-sdk · fixed in 25.0.2, 23.5.1, 22.0.9
- CVE-2026-24850ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indicescrates.io · ml-dsa · fixed in 0.1.0-rc.4
- CVE-2026-24785Clatter has a PSK Validity Rule Violation issuecrates.io · clatter · fixed in 2.2.0
- CVE-2026-24783soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negativescrates.io · soroban-fixed-point-math · fixed in 1.4.1, 1.3.1
- CVE-2026-24116Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64crates.io · wasmtime · fixed in 36.0.5, 40.0.3, 41.0.1
- CVE-2026-22696dcap-qvl has Missing Verification for QE Identitycrates.io · dcap-qvl · fixed in 0.3.9
- CVE-2026-0810Gix-date: gix-date: undefined behavior due to invalid string generationcrates.io · gix-date · fixed in 0.12.0
- CVE-2025-67124A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arcrates.io · miniserve · fixed in 0.32.0
- CVE-2026-22782RustFS RPC signature verification logs shared secretcrates.io · rustfs · fixed in 1.0.0-alpha.80
- CVE-2026-22864Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypasscrates.io · deno · fixed in 2.5.6
- CVE-2026-22863Deno node:crypto doesn't finalize ciphercrates.io · deno · fixed in 2.6.0
- CVE-2026-23519RustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnzcrates.io · cmov · fixed in 0.4.4
- CVE-2025-15504lief-project LIEF ELF Binary Parser.tcc parse_binary null pointer dereferencecrates.io · lief · fixed in 0.17.2
- CVE-2026-22705RustCrypto: Signatures has timing side-channel in ML-DSA decompositioncrates.io · ml-dsa · fixed in 0.1.0-rc.3
- CVE-2026-22700RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKEcrates.io · sm2
- CVE-2026-22699RustCrypto SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt()crates.io · sm2
- CVE-2026-22698RustCrypto SM2-PKE has 32-bit Biased Nonce Vulnerabilitycrates.io · sm2
- CVE-2026-22257Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious namescrates.io · salvo · fixed in 0.88.1
- CVE-2026-22256Salvo is vulnerable to reflected XSS in the list_html functioncrates.io · salvo · fixed in 0.88.1
- CVE-2026-22043RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Mintingcrates.io · rustfs · fixed in 1.0.0-alpha.79