Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-53549Matrix Rust SDK allows SQL injection in the EventCache implementationcrates.io · matrix-sdk, matrix-sdk-sqlite · fixed in 0.13.0
- CVE-2025-53604The web-push crate before 0.10.3 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a Ccrates.io · web-push · fixed in 0.10.4, 0.10.3
- CVE-2025-53605The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parcrates.io · protobuf · fixed in 3.7.2
- CVE-2025-53359ethereum does not check transaction malleability for EIP-2930, EIP-1559 and EIP-7702 transactionscrates.io · ethereum · fixed in 0.18.0
- CVE-2025-52884risc0-ethereum-contracts allows invalid commitment with digest value of zero to be accepted by Steel.validateCommitmentcrates.io · risc0-ethereum-contracts · fixed in 2.1.1
- CVE-2025-52570Letmein connection limiter allows an arbitrary amount of simultaneous connectionscrates.io · letmeind, letmeinfwd · fixed in 10.2.1
- CVE-2025-52926In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface.crates.io · spytrap-adb · fixed in 0.3.5
- CVE-2025-52484RISC Zero zkVM Underconstrained Vulnerabilitycrates.io · risc0-circuit-rv32im, risc0-zkvm · fixed in 2.0.4, 2.1.0
- CVE-2025-48937matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administratorcrates.io · matrix-sdk-crypto · fixed in 0.11.1
- CVE-2025-5791Users: `root` appended to group listingscrates.io · users
- CVE-2025-48935Deno has --allow-read / --allow-write permission bypass in `node:sqlite`crates.io · deno, deno_node · fixed in 2.2.5, 0.134.0
- CVE-2025-48934Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variablescrates.io · deno, deno_runtime · fixed in 2.1.13, 2.2.13, 0.212.0
- CVE-2025-48888Deno run with --allow-read and --deny-read flags results in allowedcrates.io · deno, deno_runtime · fixed in 2.1.13, 2.2.13, 2.3.2 and more
- CVE-2025-24015Deno's AES GCM authentication tags are not verifiedcrates.io · deno, deno_node · fixed in 2.1.7, 0.125.0
- CVE-2024-12224idna accepts Punycode labels that do not produce any non-ASCII when decodedcrates.io · idna · fixed in 1.0.0
- CVE-2020-36846IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C librarycrates.io · brotli-sys, compu-brotli-sys · fixed in 1.0.9
- CVE-2025-48751The process_lock crate 0.1.0 for Rust allows data races in unlock.crates.io · process_lock
- CVE-2025-48752In the process-sync crate 0.2.2 for Rust, the drop function lacks a check for whether the pthread_mutex is unlocked.crates.io · process-sync
- CVE-2025-48754In the memory_pages crate 0.1.0 for Rust, division by zero can occur.crates.io · memory_pages
- CVE-2025-48756In group_number in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits (e.gcrates.io · scsir
- CVE-2025-4366Request Smuggling Vulnerability in Pingoracrates.io · pingora-core · fixed in 0.5.0
- CVE-2025-4574Crossbeam-channel: crossbeam-channel vulnerable to double free on dropcrates.io · crossbeam-channel · fixed in 0.5.15
- CVE-2025-46718sudo-rs Allows Low Privilege Users to Enumerate Privileges of Otherscrates.io · sudo-rs · fixed in 0.2.6
- CVE-2025-46717sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folderscrates.io · sudo-rs · fixed in 0.2.6
- CVE-2025-4432Ring: some aes functions may panic when overflow checking is enabled in ringcrates.io · ring · fixed in 0.17.12, 0.17.13
- CVE-2025-47735inner::drop in inner.rs in the wgp crate through 0.2.0 for Rust lacks drop_slow thread synchronization.crates.io · wgp
- CVE-2025-47736dialect/mod.rs in the libsql-sqlite3-parser crate through 0.13.0 before 14f422a for Rust can crash if the input is not valid UTF-8.crates.io · libsql-sqlite3-parser
- CVE-2025-47737lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero.crates.io · trailer
- CVE-2025-46723OpenVM byte decomposition of pc in AUIPC chip can overflowcrates.io · openvm · fixed in 1.1.0
- CVE-2024-58253In the obfstr crate before 0.4.4 for Rust, the obfstr! argument type is not restricted to string slices, leading to invalid UTF-8 conversioncrates.io · obfstr · fixed in 0.4.4