Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-61588risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`crates.io · risc0-aggregation, risc0-zkos-v1compat +2 · fixed in 0.9, 2.1.0, 2.3.2 and more
- CVE-2025-11060Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptionscrates.io · surrealdb · fixed in 2.3.8, 2.2.8, 2.1.9 and more
- CVE-2025-59825astral-tokio-tar has a path traversal in tar extractioncrates.io · astral-tokio-tar · fixed in 0.5.4
- CVE-2025-59058httpsig-rs's HMAC verification is vulnerable to timing attackcrates.io · httpsig · fixed in 0.0.19
- CVE-2025-59047matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` methodcrates.io · matrix-sdk-base · fixed in 0.14.1
- CVE-2025-58359frost-core: refresh shares with smaller min_signers will reduce group securitycrates.io · frost-core · fixed in 2.2.0
- CVE-2025-58160Tracing logging user input may result in poisoning logs with ANSI escape sequencescrates.io · tracing-subscriber · fixed in 0.3.20
- CVE-2025-58066DoS Vulnerability in ntpd-rscrates.io · ntpd-rs · fixed in 1.6.2
- CVE-2025-54867Youki Symlink Following Vulnerabilitycrates.io · youki · fixed in 0.5.5
- CVE-2025-8671CVE-2025-8671crates.io · pingora-core · fixed in 0.6.0
- CVE-2025-55159slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds checkcrates.io · slab · fixed in 0.4.11
- CVE-2025-7054Infinite loop triggered by connection ID retirementcrates.io · quiche · fixed in 0.24.5
- CVE-2025-54873RISC Zero Underconstrained Vulnerability: Divisioncrates.io · risc0-circuit-rv32im, risc0-circuit-rv32im-sys +1 · fixed in 3.0.0, 2.2.0
- CVE-2025-54804Russh is missing an overflow check during channel windows adjustcrates.io · russh · fixed in 0.54.1
- CVE-2025-54581vproxy is vulnerable to a divide by zero DoS attackcrates.io · vproxy · fixed in 2.4.0
- CVE-2025-8283Netavark: podman: netavark may resolve hostnames to unexpected hostscrates.io · netavark · fixed in 1.15.1
- CVE-2022-50237The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack.crates.io · ed25519-dalek · fixed in 2.0.0
- CVE-2023-53158The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring.crates.io · gix-transport · fixed in 0.36.1
- CVE-2023-53159The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.crates.io · openssl · fixed in 0.10.55
- CVE-2023-53160The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.crates.io · sequoia-openpgp · fixed in 1.1.1, 1.8.1, 1.16.0
- CVE-2023-53161The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic.crates.io · buffered-reader · fixed in 1.0.2, 1.1.5, 1.2.0
- CVE-2023-53156The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments.crates.io · transpose · fixed in 0.2.3
- CVE-2023-53157The rosenpass crate before 0.2.1 for Rust allows remote attackers to cause a denial of service (panic) via a one-byte UDP packet.crates.io · rosenpass · fixed in 0.2.1
- CVE-2024-58261The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" mescrates.io · sequoia-openpgp · fixed in 1.21.0
- CVE-2024-58262The curve25519-dalek crate before 4.1.3 for Rust has a constant-time operation on elliptic curve scalars that is removed by LLVM.crates.io · curve25519-dalek · fixed in 4.1.3
- CVE-2024-58263The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations.crates.io · cosmwasm-std · fixed in 1.4.4, 1.5.4, 2.0.2
- CVE-2024-58264The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.crates.io · serde-json-wasm · fixed in 0.5.2, 1.0.1
- CVE-2024-58265The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message deliverycrates.io · snow · fixed in 0.9.5
- CVE-2024-58266The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injcrates.io · shlex · fixed in 1.3.0
- CVE-2025-53901Wasmtime has host panic with `fd_renumber` WASIp1 functioncrates.io · wasmtime, wasmtime-wasi · fixed in 24.0.4, 33.0.2, 34.0.2