Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-32650Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client inputcrates.io · rustls · fixed in 0.21.11, 0.22.4, 0.23.5
- CVE-2024-30266Wasmtime vulnerable to panic when using a dropped extenref-typed element segmentcrates.io · wasmtime · fixed in 19.0.1
- CVE-2024-29640An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid paramecrates.io · aliyundrive-webdav
- CVE-2024-28854Slow loris vulnerability with default configuration in tls-listenercrates.io · tls-listener · fixed in 0.10.0
- CVE-2024-1410Unbounded storage of information related to connection ID retirement, in quiche crates.io · quiche · fixed in 0.19.2, 0.20.1
- CVE-2024-1765Unlimited resource allocation by QUIC CRYPTO frames flooding in quichecrates.io · quiche · fixed in 0.19.2, 0.20.1
- CVE-2024-28123Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameterscrates.io · wasmi · fixed in 0.31.1
- CVE-2024-28101Apollo Router's Compressed Payloads do not respect HTTP Payload Limitscrates.io · apollo-router · fixed in 1.40.2
- CVE-2024-27936Deno interactive permission prompt spoofing via improper ANSI strippingcrates.io · deno, deno_runtime · fixed in 1.41.0, 0.147.0
- CVE-2024-27935Deno's Node.js Compatibility Runtime has Cross-Session Data Contaminationcrates.io · deno · fixed in 1.36.3
- CVE-2024-27934*const c_void / ExternalPointer unsoundness leading to use-after-freecrates.io · deno · fixed in 1.40.3
- CVE-2024-27933Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypasscrates.io · deno · fixed in 1.39.1
- CVE-2024-27932Deno's improper suffix match testing for DENO_AUTH_TOKENScrates.io · deno · fixed in 1.40.4
- CVE-2024-27308Mio's tokens for named pipes may be delivered after deregistrationcrates.io · mio · fixed in 0.8.11
- CVE-2024-27931Insufficient permission checking in `Deno.makeTemp*` APIscrates.io · deno · fixed in 1.41.1
- CVE-2024-25817Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, acrates.io · eza · fixed in 0.18.2
- CVE-2024-27284cassandra-rs non-idiomatic use of iterators leads to use after freecrates.io · cassandra-cpp · fixed in 3.0.0
- CVE-2024-21491Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures ocrates.io · svix · fixed in 1.17.0
- CVE-2024-23644trillium-http and trillium-client vulnerable to HTTP Request/Response Splittingcrates.io · trillium-client, trillium-http · fixed in 0.5.4, 0.3.12
- CVE-2024-23649Any authenticated user may obtain private message details from other users on the same instancecrates.io · lemmy_server · fixed in 0.19.1
- CVE-2024-22192Ursa CL-Signatures Revocation allows verifiers to generate unique identifiers for holderscrates.io · anoncreds-clsignatures, ursa · fixed in 0.1.0
- CVE-2024-21670CL-Signatures Revocation Scheme in Ursa has flaws that allow a holder to demonstrate non-revocation of a revoked credentialcrates.io · anoncreds-clsignatures, ursa
- CVE-2022-31021Unlinkability broken in ursa when verifiers use malicious keyscrates.io · anoncreds-clsignatures, ursa
- CVE-2024-21629Erroneous handling of `record_external_operation` error returncrates.io · evm · fixed in 0.41.1
- CVE-2023-50711`serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory accesscrates.io · vmm-sys-util · fixed in 0.12.0
- CVE-2023-51661Filesystem sandbox not enforced in wasmer-clicrates.io · wasmer-cli · fixed in 4.2.4
- CVE-2023-48795The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypascrates.io · russh · fixed in 0.40.2
- CVE-2023-6193Unbounded queuing of path validation messages in cloudflare-quichecrates.io · quiche · fixed in 0.19.1
- CVE-2023-6245Infinite decoding loop through specially crafted payloadcrates.io · candid · fixed in 0.9.10
- CVE-2023-26154Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; alcrates.io · pubnub · fixed in 0.4.0