Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-32439pleezer allows resource exhaustion through uncollected hook script processescrates.io · pleezer · fixed in 0.16.0
- CVE-2025-32380Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processingcrates.io · apollo-router · fixed in 1.61.2, 2.1.1
- CVE-2025-32034Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansioncrates.io · apollo-router · fixed in 1.61.2, 2.1.1
- CVE-2025-32033Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflowcrates.io · apollo-router · fixed in 1.61.2, 2.1.1
- CVE-2025-32032Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypasscrates.io · apollo-router · fixed in 1.61.2, 2.1.1
- CVE-2025-31496apollo-compiler Named Fragment Processing Vulnerabilitycrates.io · apollo-compiler · fixed in 1.27.0
- CVE-2025-31130gitoxide does not detect SHA-1 collision attackscrates.io · gitoxide, gitoxide-core +25 · fixed in 0.42.0, 0.46.0, 0.71.0 and more
- CVE-2025-31477Improper Scope Validation in the open Endpoint of tauri-plugin-shellcrates.io · tauri-plugin-shell · fixed in 2.2.1
- CVE-2024-13941ouch-org ouch zip.rs convert_zip_date_time memory corruptioncrates.io · ouch · fixed in 0.4.0
- CVE-2025-2888Improper timestamp caching during snapshot rollback in toughcrates.io · tough · fixed in 0.20.0
- CVE-2025-2887Failure to detect delegated target rollback in toughcrates.io · tough · fixed in 0.20.0
- CVE-2025-2886Terminating targets role delegations are not respected in toughcrates.io · tough · fixed in 0.20.0
- CVE-2025-2885Root metadata version not validated in toughcrates.io · tough · fixed in 0.20.0
- CVE-2025-27612Libcontainer is affected by capabilities elevationcrates.io · libcontainer · fixed in 0.5.3
- CVE-2025-30160Redlib allows a Denial of Service via DEFLATE Decompression Bomb in restore_preferences Formcrates.io · redlib · fixed in 0.36.0
- CVE-2025-25500An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capabcrates.io · cosmwasm · fixed in 2.2.0
- CVE-2025-27512Zincati allows unprivileged access to rpm-ostree D-Bus `Deploy()` and `FinalizeDeployment()` methodscrates.io · zincati · fixed in 0.0.30
- CVE-2025-29787zip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File Writecrates.io · zip · fixed in 2.3.0
- CVE-2025-30089gurk (aka gurk-rs) through 0.6.3 mishandles ANSI escape sequences.crates.io · gurk
- CVE-2025-27591A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/crates.io · below · fixed in 0.9.0
- CVE-2025-27498AEADs/ascon-aead: Plaintext exposed in decrypt_in_place_detached even on tag verification failurecrates.io · ascon_aead · fixed in 0.4.3
- CVE-2025-25194Server-Side Request Forgery (SSRF) in activitypub_federationcrates.io · activitypub_federation
- CVE-2025-25188DNSSEC validation may accept broken authentication chainscrates.io · hickory-proto · fixed in 0.24.3
- CVE-2025-24898rust openssl ssl::select_next_proto use after freecrates.io · openssl · fixed in 0.10.70
- CVE-2025-24802Soundness issue with Plonky2 look up tablescrates.io · plonky2 · fixed in 1.0.1
- CVE-2025-24800Critical vulnerability in `ismp-grandpa` <v15.0.1crates.io · grandpa-verifier, grandpa-verifier-primitives +1 · fixed in 0.1.2, 15.0.1
- CVE-2025-22620gix-worktree-state nonexclusive checkout sets executable files world-writablecrates.io · gix-worktree-state · fixed in 0.17.0
- CVE-2024-55224An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload icrates.io · vaultwarden · fixed in 1.32.5
- CVE-2024-55225An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administratorcrates.io · vaultwarden · fixed in 1.32.5
- CVE-2024-55226Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/corcrates.io · vaultwarden · fixed in 1.32.5