Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-6180Resource exhaustion via memory leak in tokio-boringcrates.io · tokio-boring · fixed in 4.1.0
- CVE-2023-49092RustCrypto/RSA vulnerable to a Marvin Attack via key recovery through timing sidechannelscrates.io · rsa
- CVE-2023-46135Panic in SignedPayload::from_payloadcrates.io · stellar-strkey · fixed in 0.0.8
- CVE-2023-46277please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl.crates.io · pleaser
- CVE-2023-46115Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-clicrates.io · tauri-cli · fixed in 2.0.0-alpha.16, 1.5.6
- CVE-2023-45812Improper Check or Handling of Exceptional Conditions in apollo-routercrates.io · apollo-router · fixed in 1.33.0
- CVE-2023-42811AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failurecrates.io · aes-gcm · fixed in 0.10.3
- CVE-2023-42805quinn-proto Denial of Service vulnerabilitycrates.io · quinn-proto · fixed in 0.9.5, 0.10.5
- CVE-2023-42456sudo-rs Session File Relative Path Traversal vulnerabilitycrates.io · sudo-rs · fixed in 0.2.1
- CVE-2023-43669The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excesscrates.io · tungstenite · fixed in 0.20.1
- CVE-2023-42447blurhash panics on parsing crafted inputscrates.io · blurhash · fixed in 0.2.0
- CVE-2023-42444phonenumber panics on parsing crafted RF3966 inputscrates.io · phonenumber · fixed in 0.2.5, 0.3.3
- CVE-2023-42454SQLpage vulnerable to public exposure of database credentialscrates.io · sqlpage · fixed in 0.11.1
- CVE-2023-41880Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86_64crates.io · wasmtime · fixed in 10.0.2, 11.0.2, 12.0.2
- CVE-2023-39916Possible path traversal when storing RRDP responsescrates.io · routinator · fixed in 0.12.2
- CVE-2023-39914BER/CER/DER decoder panics on invalid inputcrates.io · bcder · fixed in 0.7.3
- CVE-2023-4863Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bocrates.io · libwebp-sys, libwebp-sys2 +1 · fixed in 0.9.3, 0.1.8, 0.2.6
- CVE-2023-41317Unnamed "Subscription" operation results in Denial-of-Service in apollographql/routercrates.io · apollo-router · fixed in 1.29.1
- CVE-2023-41051Default functions in VolatileMemory trait lack bounds checks in vm-memorycrates.io · vm-memory · fixed in 0.12.2
- CVE-2023-40030Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reportscrates.io · cargo · fixed in 1.72
- CVE-2023-4241lol-html panics on certain HTML inputscrates.io · lol-html · fixed in 1.1.1
- CVE-2023-40274An issue was discovered in zola 0.13.0 through 0.17.2.crates.io · zola
- CVE-2023-38688twitch-tui's connection is not encryptedcrates.io · twitch-tui · fixed in 2.4.1
- CVE-2023-38497Cargo not respecting umask when extracting crate archivescrates.io · cargo · fixed in 0.72.2
- CVE-2023-3766Invalid Slice Split Results in Server Paniccrates.io · odoh-rs · fixed in 1.0.2
- CVE-2022-47085An issue was discovered in ostree before 2022.7 allows attackers to cause a denial of service or other unspecified impacts via the print_pancrates.io · ostree · fixed in 0.17.1
- CVE-2023-34460Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfilescrates.io · tauri · fixed in 1.4.1
- CVE-2023-34449ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`crates.io · ink, ink_env · fixed in 4.2.1
- CVE-2023-33290The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize_url in libcrates.io · git-url-parse
- CVE-2023-34411The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nestingcrates.io · xml-rs · fixed in 0.8.14