Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-52813matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identitycrates.io · matrix-sdk-crypto · fixed in 0.8.0
- CVE-2025-21620Deno's authorization headers not dropped when redirecting cross-origincrates.io · deno, deno_fetch · fixed in 2.1.2, 0.204.0
- CVE-2024-11738Rustls: rustls network-reachable panic in `acceptor::accept`crates.io · rustls · fixed in 0.23.0, 0.23.18
- CVE-2024-53856rPGP Panics on Malformed Untrusted Inputcrates.io · pgp · fixed in 0.14.1
- CVE-2024-53857rPGP Potential Resource Exhaustion when handling Untrusted Messagescrates.io · pgp · fixed in 0.14.2
- CVE-2023-1521Local Privilege Escalation in sccachecrates.io · sccache · fixed in 0.4.0
- CVE-2024-32468Improper neutralization of input during web page generation ("Cross-site Scripting") in deno_doc HTML generatorcrates.io · deno_doc · fixed in 0.119.0
- CVE-2024-27529wasm3 139076a contains memory leaks in Read_utf8.crates.io · wasm3
- CVE-2024-51990Path traversal via crafted Git repositories in jjcrates.io · jj-lib · fixed in 0.23.0
- CVE-2024-51756cap-std doesn't fully sandbox all the Windows device filenamescrates.io · cap-async-std, cap-primitives +1 · fixed in 3.4.1
- CVE-2024-51745Wasmtime doesn't fully sandbox all the Windows device filenamescrates.io · wasmtime · fixed in 24.0.2, 25.0.3, 26.0.1
- CVE-2024-51502Panic Vulnerability in loona-hpackcrates.io · loona-hpack · fixed in 0.4.3
- CVE-2024-9979Pyo3: risk of use-after-free in `borrowed` reads from python weak referencescrates.io · pyo3 · fixed in 0.22.4
- CVE-2024-47813Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violationscrates.io · wasmtime · fixed in 21.0.2, 22.0.1, 23.0.3 and more
- CVE-2024-47763Wasmtime runtime crash when combining tail calls with trapping importscrates.io · wasmtime · fixed in 21.0.2, 22.0.1, 23.0.3 and more
- CVE-2024-47614async-graphql vulnerable to Directive Overloadcrates.io · async-graphql · fixed in 7.0.10
- CVE-2024-21530Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functcrates.io · cocoon · fixed in 0.4.0
- CVE-2024-47609Remotely exploitable DoS in Tonic `<=v0.12.2`crates.io · tonic · fixed in 0.12.3
- CVE-2024-46488sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function.crates.io · sqlite-vec · fixed in 0.1.3
- CVE-2024-45405gix-path improperly resolves configuration path reported by Gitcrates.io · gix-path · fixed in 0.10.11
- CVE-2024-7884Memory leak when calling a canister method via `ic_cdk::call`crates.io · ic-cdk, ic_cdk · fixed in 0.8.2, 0.9.3, 0.10.1 and more
- CVE-2024-8418Containers/aardvark-dns: tcp query handling flaw in aardvark-dns leading to denial of servicecrates.io · aardvark-dns · fixed in 1.12.2
- CVE-2024-45389Pagefind DOM clobbering could escalate to Cross-site Scripting (XSS)crates.io · pagefind · fixed in 1.1.1
- CVE-2024-45311Denial of service in quinn-proto when using `Endpoint::retry()`crates.io · quinn-proto · fixed in 0.11.7
- CVE-2024-45305gix-path uses local config across repos when it is the highest scopecrates.io · gix-path · fixed in 0.10.10
- CVE-2024-43414Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queriescrates.io · apollo-router · fixed in 1.52.1
- CVE-2024-43783Apollo Router Coprocessors may cause Denial-of-Service when handling request bodiescrates.io · apollo-router · fixed in 1.52.1
- CVE-2024-43806`rustix::fs::Dir` iterator with the `linux_raw` backend can cause memory explosioncrates.io · rustix · fixed in 0.35.15, 0.36.16, 0.37.25 and more
- CVE-2024-43785gitoxide-core does not neutralize special characters for terminalscrates.io · gitoxide, gitoxide-core
- CVE-2024-43410Russh has an OOM Denial of Service due to allocation of untrusted amountcrates.io · russh · fixed in 0.44.1