Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-45719An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust.crates.io · rusqlite · fixed in 0.25.4, 0.26.2
- CVE-2021-45720An issue was discovered in the lru crate before 0.7.1 for Rust.crates.io · lru · fixed in 0.7.1
- CVE-2021-45686An issue was discovered in the csv-sniffer crate through 2021-01-05 for Rust.crates.io · csv-sniffer · fixed in 0.2.0
- CVE-2018-25023An issue was discovered in the smallvec crate before 0.6.13 for Rust.crates.io · smallvec · fixed in 0.6.13
- CVE-2021-4044Invalid handling of X509_verify_cert() internal errors in libsslcrates.io · openssl-src · fixed in 300.0.4
- CVE-2021-43790Use After Free in lucetcrates.io · lucet-runtime
- CVE-2021-43620An issue was discovered in the fruity crate through 0.2.0 for Rust.crates.io · fruity · fixed in 0.3.0
- CVE-2021-43174gzip transfer encoding caused out-of-memory crashcrates.io · routinator · fixed in 0.10.2
- CVE-2021-43172Infinite length chain of RRDP repositoriescrates.io · routinator · fixed in 0.10.2
- CVE-2021-41150Improper sanitization of delegated role names in toughcrates.io · tough · fixed in 0.12.0
- CVE-2021-41149Improper sanitization of target names in toughcrates.io · tough · fixed in 0.12.0
- CVE-2021-41153Specification non-compliance in JUMPIcrates.io · evm · fixed in 0.31.0
- CVE-2021-41138Validity check for signed Frontier-specific extrinsic not called in block executioncrates.io · pallet-ethereum
- CVE-2021-39218Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtimecrates.io · wasmtime · fixed in 0.30.0
- CVE-2021-39219Wrong type for `Linker`-define functions when used across two `Engine`scrates.io · wasmtime · fixed in 0.30.0
- CVE-2021-39216Use after free passing `externref`s to Wasm in Wasmtimecrates.io · wasmtime · fixed in 0.30.0
- CVE-2021-39228Memory Safety Issue when using patch or merge on state and assign the result back to statecrates.io · tremor-script · fixed in 0.11.6
- CVE-2021-39193Transaction validity oversight in pallet-ethereumcrates.io · pallet-ethereum
- CVE-2021-3712Read buffer overruns processing ASN.1 stringscrates.io · openssl-src · fixed in 111.16.0
- CVE-2021-3711SM2 Decryption Buffer Overflowcrates.io · openssl-src · fixed in 111.16.0
- CVE-2021-38511An issue was discovered in the tar crate before 0.4.36 for Rust.crates.io · tar · fixed in 0.4.36
- CVE-2021-38512An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust.crates.io · actix-http · fixed in 2.2.1, 3.0.0-beta.9
- CVE-2020-36432An issue was discovered in the alg_ds crate through 2020-08-25 for Rust.crates.io · alg_ds
- CVE-2020-36433An issue was discovered in the chunky crate through 2020-08-25 for Rust.crates.io · chunky
- CVE-2020-36434An issue was discovered in the sys-info crate before 0.8.0 for Rust.crates.io · sys-info · fixed in 0.8.0
- CVE-2020-36435An issue was discovered in the ruspiro-singleton crate before 0.4.1 for Rust.crates.io · ruspiro-singleton · fixed in 0.4.1
- CVE-2020-36436An issue was discovered in the unicycle crate before 0.7.1 for Rust.crates.io · unicycle · fixed in 0.7.1
- CVE-2020-36437An issue was discovered in the conqueue crate before 0.4.0 for Rust.crates.io · conqueue · fixed in 0.4.0
- CVE-2020-36438An issue was discovered in the tiny_future crate before 0.4.0 for Rust.crates.io · tiny_future · fixed in 0.4.0
- CVE-2020-36439An issue was discovered in the ticketed_lock crate before 0.3.0 for Rust.crates.io · ticketed_lock · fixed in 0.3.0