Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-115385Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestampscrates.io · wasmtime-wasi · fixed in 48.0.4, 49.0.2
- CVE-2026-115384Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflowcrates.io · wasmtime · fixed in 48.0.4, 49.0.2
- CVE-2026-115383Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Importscrates.io · wasmtime · fixed in 48.0.4, 49.0.2
- CVE-2026-115382Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoScrates.io · wasmtime-wasi-http · fixed in 48.0.4, 49.0.2
- CVE-2026-115381Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroescrates.io · wasmtime-wasi · fixed in 36.0.17, 48.0.4, 49.0.2
- CVE-2026-115380Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoffcrates.io · wasmtime-wasi · fixed in 36.0.17, 48.0.4, 49.0.2
- CVE-2026-115379Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_callcrates.io · wasmtime · fixed in 48.0.4, 49.0.2
- RUSTSEC-2026-0407SSRF and local file disclosure via unvalidated URLscrates.io · webpage · fixed in 2.1.0
- RUSTSEC-2026-0411Out-of-bounds read in `Log2Cache::nlog2n()`, `nlog2n_difference()` and `plog2p()`crates.io · dahl-salso · fixed in 0.7.0
- RUSTSEC-2026-0457OAuth client SSRF filter checks host strings, not resolved addressescrates.io · rmcp · fixed in 3.7.0
- CVE-2026-113799Slack Morphism verifier errors disclose valid HMACs in the logscrates.io · slack-morphism · fixed in 2.28.0
- CVE-2026-111943Distrust compromised intermediate certificates in crypto/x509crates.io · rustls-webpki, webpki-root-certs +1 · fixed in 0.103.16, 0.104.0-alpha.8, 0.26.11 and more
- CVE-2026-114109uv before 0.11.15 Arbitrary File Write via Entry Point Namescrates.io · uv · fixed in 0.11.15
- RUSTSEC-2026-0461Unbounded tool schema cache in Streamable HTTP server transportcrates.io · rmcp · fixed in 3.6.0
- CVE-2026-105299Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deploymentscrates.io · pingora-proxy · fixed in 0.9.0
- CVE-2026-105298Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypasscrates.io · pingora-core · fixed in 0.9.0
- CVE-2026-105297Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limitscrates.io · pingora-core · fixed in 0.8.1
- CVE-2026-111061russh agent server converts constraint records into unbounded never-rolled-back taskscrates.io · russh · fixed in 0.64.1
- RUSTSEC-2026-0453Use-after-free in KV backends via leaked `affinitypool::spawn_local` futurecrates.io · surrealdb · fixed in 3.3.0
- RUSTSEC-2026-0414Exponential event growth with `ENABLE_WIKILINKS`crates.io · pulldown-cmark · fixed in 0.13.5
- RUSTSEC-2026-0391Data from an abandoned stream leaks into the next stream on a reused contextcrates.io · zstd · fixed in 0.14.3
- RUSTSEC-2026-0392Uninitialized memory exposed by `write::Decoder` on a corrupt legacy framecrates.io · zstd · fixed in 0.8.0
- RUSTSEC-2026-0393Out-of-bounds read when training a dictionary from inconsistent sample sizescrates.io · zstd · fixed in 0.4.10
- RUSTSEC-2026-0395Use-after-free with `CParameter::StableInBuffer`crates.io · zstd-safe · fixed in 8.2.0
- RUSTSEC-2026-0396`Seekable` reads a NULL or out-of-bounds seek tablecrates.io · zstd-safe · fixed in 8.2.0
- RUSTSEC-2026-0397`OutBuffer::around_pos` exposes uninitialized memorycrates.io · zstd-safe · fixed in 8.2.0
- RUSTSEC-2026-0398`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the endcrates.io · zstd-safe · fixed in 8.2.0
- RUSTSEC-2026-0399Use-after-free through `init_using_cdict` and `init_using_ddict`crates.io · zstd-safe · fixed in 8.2.0
- RUSTSEC-2026-0400Use-after-free of a dictionary after a one-shot call on a context with an open streamcrates.io · zstd-safe · fixed in 8.2.0
- RUSTSEC-2026-0401Out-of-bounds read in `train_from_buffer` when sample sizes overflowcrates.io · zstd-safe · fixed in 8.2.0