Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- RUSTSEC-2026-0425`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)crates.io · nix-nar · fixed in 0.6.0
- RUSTSEC-2026-0426LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-timecrates.io · orion · fixed in 0.17.16, 0.18.1
- RUSTSEC-2026-0428BLAKE2b produces wrong tag when using `reset()` with a different-length keycrates.io · orion · fixed in 0.17.16, 0.18.1
- RUSTSEC-2026-0450`ocipkg`: unpacking an OCI archive can write and delete files outside the local image store (path traversal)crates.io · ocipkg · fixed in 0.4.1
- CVE-2026-119375SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatchcrates.io · libsqlite3-sys · fixed in 0.39.0
- GHSA-C33X-VCV4-VG3GCedar: JSON template is in scope missing slot-id validation allows link panic and decision divergencecrates.io · cedar-policy · fixed in 4.11.1, 3.4.3
- CVE-2026-119143Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writescrates.io · wasmtime · fixed in 48.0.6, 49.0.3
- CVE-2026-119142Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Dropcrates.io · wasmtime · fixed in 48.0.6, 49.0.3
- CVE-2026-119140Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yieldcrates.io · wasmtime · fixed in 48.0.6, 49.0.3
- CVE-2026-119139Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::callcrates.io · wasmtime · fixed in 48.0.6, 49.0.3
- CVE-2026-119138Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trapcrates.io · wasmtime · fixed in 48.0.6, 49.0.3
- CVE-2026-119137Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registrycrates.io · wasmtime · fixed in 48.0.6, 49.0.3
- CVE-2026-119136Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypasscrates.io · wasmtime · fixed in 48.0.6, 49.0.3
- CVE-2026-119135Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatchcrates.io · wasmtime · fixed in 48.0.6, 49.0.3
- CVE-2026-119132Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adaptercrates.io · wasmtime · fixed in 49.0.3
- CVE-2026-119131Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-httpcrates.io · wasmtime-wasi-http · fixed in 48.0.6, 49.0.3
- CVE-2026-119130Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smugglingcrates.io · wasmtime-wasi-http · fixed in 36.0.18, 48.0.6, 49.0.3
- RUSTSEC-2026-0419Unbounded memory use on large request bodiescrates.io · juniper_warp · fixed in 0.9.1
- RUSTSEC-2026-0420wasip3 UDP `send` can deliver a datagram to an address only allowed for receivingcrates.io · wasmtime-wasi · fixed in 48.0.8, 49.0.5, 50.0.1
- RUSTSEC-2026-0421wasi-http p2: outgoing content-length can be invalid or not match bodycrates.io · wasmtime-wasi-http · fixed in 36.0.20, 48.0.8, 49.0.5 and more
- RUSTSEC-2026-0422Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-checkcrates.io · wasmtime · fixed in 48.0.8, 49.0.5, 50.0.1
- RUSTSEC-2026-0423Cross-engine type confusion with host-created struct-types-with-supertypescrates.io · wasmtime · fixed in 48.0.8, 49.0.5, 50.0.1
- RUSTSEC-2026-0424Unchecked memory usage in transferring borrowed resources between componentscrates.io · wasmtime · fixed in 36.0.20, 48.0.8, 49.0.5 and more
- RUSTSEC-2026-0427`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)crates.io · sn-releases
- CVE-2026-118688Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Renamecrates.io · wasmtime-wasi · fixed in 36.0.18, 48.0.6, 49.0.3
- CVE-2026-116794russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationcrates.io · russh · fixed in 0.65
- RUSTSEC-2026-0415Unbounded memory use on large request bodiescrates.io · juniper_hyper · fixed in 0.10.1
- RUSTSEC-2026-0416Stack overflow on deeply nested GraphQL documentscrates.io · juniper · fixed in 0.17.2
- RUSTSEC-2026-0417Excessive CPU and memory use on crafted GraphQL documentscrates.io · juniper · fixed in 0.17.2
- RUSTSEC-2026-0418libz-sys build script leaks environment variables in the build directorycrates.io · libz-sys · fixed in 1.1.31