Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-36470An issue was discovered in the disrustor crate through 2020-12-17 for Rust.crates.io · disrustor · fixed in 0.3.0
- CVE-2020-36471An issue was discovered in the generator crate before 0.7.0 for Rust.crates.io · generator · fixed in 0.7.0
- CVE-2020-36472An issue was discovered in the max7301 crate before 0.2.0 for Rust.crates.io · max7301 · fixed in 0.2.0
- CVE-2021-38186An issue was discovered in the comrak crate before 0.10.1 for Rust.crates.io · comrak · fixed in 0.10.1
- CVE-2021-38187An issue was discovered in the anymap crate through 0.12.1 for Rust.crates.io · anymap
- CVE-2021-38188An issue was discovered in the iced-x86 crate through 1.10.3 for Rust.crates.io · iced-x86 · fixed in 1.10.4-0, 1.11.0
- CVE-2021-38189An issue was discovered in the lettre crate before 0.9.6 for Rust.crates.io · lettre · fixed in 0.9.6, 0.10.0-rc.3
- CVE-2021-38190An issue was discovered in the nalgebra crate before 0.27.1 for Rust.crates.io · nalgebra · fixed in 0.27.1
- CVE-2021-38191An issue was discovered in the tokio crate before 1.8.1 for Rust.crates.io · tokio · fixed in 1.8.1, 1.7.2, 1.6.3 and more
- CVE-2021-38192An issue was discovered in the prost-types crate before 0.8.0 for Rust.crates.io · prost-types · fixed in 0.8.0
- CVE-2021-38193An issue was discovered in the ammonia crate before 3.1.0 for Rust.crates.io · ammonia · fixed in 3.1.0, 2.1.3
- CVE-2021-38194An issue was discovered in the ark-r1cs-std crate before 0.3.1 for Rust.crates.io · ark-r1cs-std · fixed in 0.3.1
- CVE-2021-38195An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust.crates.io · libsecp256k1 · fixed in 0.5.0
- CVE-2021-38196An issue was discovered in the better-macro crate through 2021-07-22 for Rust.crates.io · better-macro
- CVE-2021-32810Data race in crossbeam-dequecrates.io · crossbeam-deque · fixed in 0.7.4, 0.8.1
- CVE-2021-20332MongoDB Rust Driver may publish events containing authentication-related data to a connection pool event listener configured by an applicationcrates.io · mongodb · fixed in 2.0.0-beta
- CVE-2021-36753sharkdp BAT before 0.18.2 executes less.exe from the current working directory.crates.io · bat · fixed in 0.18.2
- CVE-2021-36376dandavison delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory.crates.io · git-delta · fixed in 0.8.3
- CVE-2021-32715Lenient Parsing of Content-Length Header When Prefixed with Plus Signcrates.io · hyper · fixed in 0.14.10
- CVE-2021-32714Integer Overflow in Chunked Transfer-Encodingcrates.io · hyper · fixed in 0.14.10
- CVE-2021-3013ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--seacrates.io · grep-cli, ripgrep · fixed in 0.1.6, 13.0.0
- CVE-2021-32619Static imports inside dynamically imported modules do not adhere to permission checkscrates.io · deno · fixed in 1.10.2
- CVE-2021-31155Failure to normalize the umask in please before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at lcrates.io · pleaser · fixed in 0.4.0
- CVE-2021-31154pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory.crates.io · pleaser · fixed in 0.4.0
- CVE-2021-31153please before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locationscrates.io · pleaser · fixed in 0.4.0
- CVE-2021-32629Memory access due to code generation flaw in Cranelift modulecrates.io · cranelift-codegen · fixed in 0.73.1
- CVE-2021-29511Memory over-allocation in evm cratecrates.io · evm, evm-core · fixed in 0.21.1, 0.22.1, 0.23.1 and more
- CVE-2021-31996An issue was discovered in the algorithmica crate through 2021-03-07 for Rust.crates.io · algorithmica
- CVE-2021-31919An issue was discovered in the rkyv crate before 0.6.0 for Rust.crates.io · rkyv · fixed in 0.6.0
- CVE-2021-30454An issue was discovered in the outer_cgi crate before 0.2.1 for Rust.crates.io · outer_cgi · fixed in 0.2.1