Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-27815SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname.crates.io · simple-wayland-hotkey-daemon · fixed in 1.2.0
- CVE-2022-24783Sandbox bypass leading to arbitrary code execution in Denocrates.io · deno · fixed in 1.20.3
- CVE-2022-0778Infinite loop in BN_mod_sqrt() reachable when parsing certificatescrates.io · openssl-src · fixed in 300.0.5, 111.18.0
- CVE-2022-24713Regular expression denial of service in Rust's regex cratecrates.io · regex · fixed in 1.5.5
- CVE-2021-20319An improper signature verification vulnerability was found in coreos-installer.crates.io · coreos-installer · fixed in 0.10.1
- CVE-2022-23636Invalid drop of partially-initialized instances in wasmtimecrates.io · cranelift-codegen, wasmtime · fixed in 0.85.2, 0.38.2, 0.34.1 and more
- CVE-2022-23639Improper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utilscrates.io · crossbeam-utils · fixed in 0.8.7
- CVE-2022-24988In galois_2p8 before 0.1.2, PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector.crates.io · galois_2p8 · fixed in 0.1.2
- CVE-2021-46102From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.st_valcrates.io · solana_rbpf · fixed in 0.2.17
- CVE-2021-39480Bingrep v0.8.5 was discovered to contain a memory allocation failure which can cause a Denial of Service (DoS).crates.io · bingrep
- CVE-2022-21685Integer underflow in Frontiercrates.io · pallet-evm-precompile-modexp
- CVE-2018-25024An issue was discovered in the actix-web crate before 0.7.15 for Rust.crates.io · actix-web · fixed in 0.7.19, 0.7.20-0
- CVE-2018-25025An issue was discovered in the actix-web crate before 0.7.15 for Rust.crates.io · actix-web · fixed in 0.7.19, 0.7.20-0
- CVE-2018-25026An issue was discovered in the actix-web crate before 0.7.15 for Rust.crates.io · actix-web · fixed in 0.7.19, 0.7.20-0
- CVE-2018-25027An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust.crates.io · libpulse-binding · fixed in 1.2.1
- CVE-2018-25028An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust.crates.io · libpulse-binding · fixed in 1.2.1
- CVE-2019-25054An issue was discovered in the pnet crate before 0.27.2 for Rust.crates.io · pnet · fixed in 0.27.2
- CVE-2019-25055An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust.crates.io · libpulse-binding · fixed in 2.6.0
- CVE-2020-36511An issue was discovered in the bite crate through 2020-12-31 for Rust.crates.io · bite
- CVE-2020-36512An issue was discovered in the buffoon crate through 2020-12-31 for Rust.crates.io · buffoon
- CVE-2020-36513An issue was discovered in the acc_reader crate through 2020-12-27 for Rust.crates.io · acc_reader
- CVE-2020-36514An issue was discovered in the acc_reader crate through 2020-12-27 for Rust.crates.io · acc_reader
- CVE-2021-45680An issue was discovered in the vec-const crate before 2.0.0 for Rust.crates.io · vec-const · fixed in 2.0.0
- CVE-2021-45681An issue was discovered in the derive-com-impl crate before 0.1.2 for Rust.crates.io · derive-com-impl · fixed in 0.1.2
- CVE-2021-45682An issue was discovered in the bronzedb-protocol crate through 2021-01-03 for Rust.crates.io · bronzedb-protocol
- CVE-2021-45683An issue was discovered in the binjs_io crate through 2021-01-03 for Rust.crates.io · binjs_io
- CVE-2021-45684An issue was discovered in the flumedb crate through 2021-01-07 for Rust.crates.io · flumedb · fixed in 0.1.6
- CVE-2021-45685An issue was discovered in the columnar crate through 2021-01-07 for Rust.crates.io · columnar · fixed in 0.1.0
- CVE-2021-45687An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust.crates.io · raw-cpuid · fixed in 9.1.1
- CVE-2021-45688An issue was discovered in the ash crate before 0.33.1 for Rust.crates.io · ash · fixed in 0.33.1