Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-22042RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalationcrates.io · rustfs · fixed in 1.0.0-alpha.79
- CVE-2026-21895rsa crate has potential panic on a prime being equal to 1crates.io · rsa · fixed in 0.9.10
- CVE-2025-69255RustFS gRPC GetMetrics deserialization panic enables remote DoScrates.io · rustfs · fixed in 1.0.0-alpha.78
- CVE-2025-68705RustFS Path Traversal Vulnerabilitycrates.io · rustfs · fixed in 1.0.0-alpha.79
- CVE-2025-69257theshit vulnerable to unsafe loading of user-owned Python rules when running as root.crates.io · theshit · fixed in 0.1.1
- CVE-2025-68926RustFS has a gRPC Hardcoded Token Authentication Bypasscrates.io · rustfs · fixed in 1.0.0-alpha.78
- CVE-2025-67897In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short.crates.io · sequoia-openpgp · fixed in 2.1.0
- CVE-2025-65807An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command.crates.io · sd
- CVE-2025-67487Static Web Server is vulnerable to symbolic link Path Traversalcrates.io · static-web-server · fixed in 2.40.1
- CVE-2025-66627Wasmi's Linear Memory has a Critical Use After Free Vulnerabilitycrates.io · wasmi · fixed in 0.41.2, 0.47.1, 0.51.3 and more
- CVE-2025-66622matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event valuescrates.io · matrix-sdk-base · fixed in 0.16.0
- CVE-2025-66017CGGMP21 presignatures can be used in the way that significantly reduces securitycrates.io · cggmp21, cggmp24 · fixed in 0.7.0-alpha.2
- CVE-2025-66016CGGMP24 is missing a check in the ZK proof used in CGGMP21crates.io · cggmp21, cggmp24 · fixed in 0.6.3, 0.7.0-alpha.2
- CVE-2025-65947thread-amount is Vulnerable to Resource Exhaustion (Memory and Handle Leaks) on Windows and macOScrates.io · thread-amount · fixed in 0.2.2
- CVE-2025-64517sudo-rs doesn't record authenticating user properly in timestampcrates.io · sudo-rs · fixed in 0.2.10
- CVE-2025-64345Wasmtime provides unsound API access to a WebAssembly shared linear memorycrates.io · wasmtime · fixed in 38.0.4, 37.0.3, 36.0.3 and more
- CVE-2025-64170sudo-rs: Partial password reveal is possible after timeoutcrates.io · sudo-rs · fixed in 0.2.10
- CVE-2025-64347Apollo Router Improperly Enforces Renamed Access Control Directivescrates.io · apollo-router · fixed in 1.61.12, 2.8.1
- CVE-2025-64173Apollo Router Core: Access Control Bypass on Polymorphic Typescrates.io · apollo-router · fixed in 1.61.12, 2.8.1
- CVE-2025-62596youki container escape and denial of service due to arbitrary write gadgets and procfs write redirectscrates.io · youki · fixed in 0.5.7
- CVE-2025-62161youki container escape via "masked path" abuse due to mount race conditionscrates.io · youki · fixed in 0.5.7
- CVE-2025-62711Wasmtime vulnerable to segfault when using component resourcescrates.io · wasmtime · fixed in 38.0.3
- CVE-2025-62518astral-tokio-tar Vulnerable to PAX Header Desynchronizationcrates.io · astral-tokio-tar, tokio-tar · fixed in 0.5.6
- CVE-2025-62370Alloy Core has a DoS vulnerability on `alloy_dyn_abi::TypedData` hashingcrates.io · alloy-dyn-abi · fixed in 0.8.26, 1.4.1
- CVE-2025-11695Configuration may unexpectedly disable certificate validationcrates.io · mongodb · fixed in 3.2.5
- CVE-2025-62162cel-rust May Panic During Parsing of Invalid CEL Expressionscrates.io · cel · fixed in 0.11.4
- CVE-2025-61787Deno is Vulnerable to Command Injection on Windows During Batch File Executioncrates.io · deno · fixed in 2.5.2
- CVE-2025-61786Deno's --deny-read check does not prevent permission bypasscrates.io · deno · fixed in 2.5.3
- CVE-2025-61785Deno's --deny-write check does not prevent permission bypasscrates.io · deno · fixed in 2.5.3
- CVE-2025-61670Wasmtime has memory leak in C API with `externref` and `anyref` typescrates.io · wasmtime-c-api-impl · fixed in 37.0.2