Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- RUSTSEC-2026-0402Heap buffer overflow in `CCtx::try_clone` on a multithreaded contextcrates.io · zstd-safe · fixed in 8.2.0
- RUSTSEC-2026-0403Uninitialized memory exposed when streaming decompression of a legacy frame failscrates.io · zstd-safe · fixed in 7.4.0, 8.2.0
- RUSTSEC-2026-0404Double free in `DCtx::try_clone`crates.io · zstd-safe · fixed in 8.2.0
- RUSTSEC-2026-0405Out-of-bounds read with an out-of-range `InBuffer::pos`crates.io · zstd-safe · fixed in 8.2.0
- RUSTSEC-2026-0406Use-after-free when changing a multithreaded context with an unfinished framecrates.io · zstd-safe · fixed in 8.2.0
- RUSTSEC-2026-0410WebAssembly allocator shim corrupts memory on allocation failurecrates.io · zstd-sys · fixed in 2.1.2
- CVE-2026-63430ammonia: mXSS in ammonia via MathML `annotation-xml` encoding stripcrates.io · ammonia · fixed in 3.3.2, 4.0.2, 4.1.3
- CVE-2026-103929mise permits untrusted local configuration to override default shell argumentscrates.io · mise · fixed in 2026.7.14
- RUSTSEC-2026-0356Panic on erroneous call-to-host from guest realloc callcrates.io · wasmtime · fixed in 48.0.6, 49.0.3
- RUSTSEC-2026-0363Component-model handle tables are capped only per instance and charged to no limitcrates.io · wasmtime · fixed in 36.0.18, 48.0.6, 49.0.3
- RUSTSEC-2026-0364Exception tags can cause host data structures to be unalignedcrates.io · wasmtime · fixed in 48.0.6, 49.0.3
- CVE-2026-102342ammonia allows stored XSS through unsanitized SVG animate and set attributescrates.io · ammonia · fixed in 3.3.3, 4.0.3, 4.1.4
- GHSA-6F2X-V7Q7-M7M5hickory-resolver follows irrelevant CNAME recordscrates.io · hickory-resolver · fixed in 0.26.2
- GHSA-6W6G-HM98-MHGMhickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)crates.io · hickory-resolver · fixed in 0.26.2
- RUSTSEC-2026-0444`astral-tl` is unmaintainedcrates.io · astral-tl
- CVE-2026-104855Wasmtime: Preemption and traps during bulk operations enable breaking internal VM statecrates.io · wasmtime · fixed in 46.0.2, 47.0.3
- GHSA-C9XM-49CP-XCR9rmcp OAuth client fetches server-controlled resource_metadata URLscrates.io · rmcp · fixed in 2.0.0
- CVE-2026-104843uv: Path traversal on Windows through wheel extractioncrates.io · uv · fixed in 0.12.18
- CVE-2026-104437Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handlingcrates.io · zebrad · fixed in 4.4.0
- CVE-2026-104436Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Lengthcrates.io · zebra-chain, zebrad · fixed in 8.0.0, 4.5.0
- CVE-2026-104435Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Outputcrates.io · zebra-script, zebrad · fixed in 6.0.1, 4.4.1
- CVE-2026-104434Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPCcrates.io · zebra-rpc, zebrad · fixed in 8.0.0, 4.5.0
- RUSTSEC-2026-0441`pin-utils` is unmaintainedcrates.io · pin-utils
- CVE-2026-102825Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime pathcrates.io · russh · fixed in 0.62.6
- CVE-2026-102824Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchangecrates.io · russh · fixed in 0.63.0
- CVE-2026-102823russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never openedcrates.io · russh · fixed in 0.63.1
- CVE-2026-102822russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range paniccrates.io · russh · fixed in 0.63.1
- CVE-2026-102821Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekeycrates.io · russh · fixed in 0.63.2
- CVE-2026-102820pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)crates.io · pageant · fixed in 0.2.3
- CVE-2026-97875DNS rebinding vulnerability in rojo serve HTTP APIcrates.io · rojo · fixed in 7.7.0