Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- RUSTSEC-2026-0433Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`crates.io · pulldown-cmark · fixed in 0.13.6
- RUSTSEC-2026-0436Panic and unbounded allocation (OOM) in the CFB/OLE2 parser on malformed inputcrates.io · calamine · fixed in 0.38.0
- CVE-2026-116775pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)crates.io · pageant · fixed in 0.2.5
- CVE-2026-116774russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)crates.io · russh · fixed in 0.65
- CVE-2026-116773russh's SSH client is susceptible to unbounded allocations via EXT_INFO packetscrates.io · russh · fixed in 0.65
- CVE-2026-116696russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messagescrates.io · russh · fixed in 0.65.0
- CVE-2026-115909zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extractioncrates.io · zip · fixed in 9.0.0
- CVE-2026-115908zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)crates.io · zip · fixed in 9.0.0
- CVE-2026-115907zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed sizecrates.io · zip · fixed in 9.0.0
- CVE-2026-115906zip: AES Entry HMAC Authentication Bypass on Premature EOFcrates.io · zip · fixed in 9.0.0
- CVE-2026-115905zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File…crates.io · zip · fixed in 9.0.5
- RUSTSEC-2026-0412Arbitrary code execution when rerunning tests from a portable recordingcrates.io · cargo-nextest · fixed in 0.9.150
- RUSTSEC-2026-0413Use-after-free of caller-owned server name in client connection constructorscrates.io · rustls-ffi · fixed in 0.15.7
- RUSTSEC-2026-0408Aliasing violations in splice, mutable iteration and cursorscrates.io · skiplist · fixed in 1.3.0
- RUSTSEC-2026-0409Use-after-free from a comparator that answers inconsistentlycrates.io · skiplist · fixed in 1.3.0
- GHSA-H4FR-CMH5-QR62Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project rootcrates.io · fallow-cli, fallow-config +1 · fixed in 3.34.0
- CVE-2026-115893Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructioncrates.io · wasmtime · fixed in 36.0.19, 48.0.7, 49.0.4
- CVE-2026-115892Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload typecrates.io · wasmtime · fixed in 48.0.7, 49.0.4
- CVE-2026-115889Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilationcrates.io · wasmtime · fixed in 36.0.19, 43.0.0
- CVE-2026-115569Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project rootcrates.io · fallow-cli, fallow-core · fixed in 3.34.0
- CVE-2026-115567Tokio: Race condition in `tokio::time::Interval`crates.io · tokio · fixed in 1.54.1
- RUSTSEC-2026-0387Multiple timing variability issues in operations intended to be constant-timecrates.io · crypto-bigint · fixed in 0.7.6
- CVE-2026-115393Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusioncrates.io · wasmtime · fixed in 24.0.12, 36.0.13, 46.0.2 and more
- CVE-2026-115392Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashescrates.io · wasmtime · fixed in 24.0.13, 36.0.14, 46.0.3 and more
- CVE-2026-115391Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streamscrates.io · wasmtime · fixed in 46.0.3, 47.0.4
- CVE-2026-115390Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoScrates.io · wasmtime · fixed in 48.0.3, 49.0.1
- CVE-2026-115389Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val APIcrates.io · wasmtime · fixed in 36.0.16, 48.0.3, 49.0.1
- CVE-2026-115388Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Writecrates.io · wasmtime-wasi-http · fixed in 36.0.16, 48.0.3, 49.0.1
- CVE-2026-115387Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflowcrates.io · wasmtime-wasi · fixed in 36.0.16, 48.0.3, 49.0.1
- CVE-2026-115386Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdircrates.io · wasmtime-wasi · fixed in 36.0.17, 48.0.4, 49.0.2