Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-96889Librsvg: use-after-free when xml includes have duplicated entitiescrates.io · librsvg · fixed in 2.57.5, 2.60.3, 2.61.5 and more
- RUSTSEC-2026-0394Build environment compiled into the library and readable at runtimecrates.io · rustpython-vm · fixed in 0.6.0
- CVE-2026-92612In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::ascrates.io · iceoryx2-bb-container · fixed in 0.10.0
- CVE-2026-61670microsandbox: Secret values exposed in world-readable process argumentscrates.io · microsandbox · fixed in 0.5.10
- CVE-2026-93657hickory-resolver before 0.26.2 DNSSEC Validation Bypasscrates.io · hickory-resolver · fixed in 0.26.2
- CVE-2026-93602rustls-webpki before 0.103.10 CRL Revocation Check Bypasscrates.io · rustls-webpki · fixed in 0.103.10, 0.104.0-alpha.5
- CVE-2026-93601rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypasscrates.io · rustls-webpki · fixed in 0.103.12, 0.104.0-alpha.6
- CVE-2026-93600rustls webpki Name Constraints URI Validation Bypasscrates.io · rustls-webpki · fixed in 0.103.12, 0.104.0-alpha.6
- CVE-2026-93599rustls-webpki before 0.103.13 Panic via empty BIT STRINGcrates.io · rustls-webpki · fixed in 0.103.13, 0.104.0-alpha.7
- CVE-2026-68523Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of servicecrates.io · fulgur · fixed in 0.19.0
- CVE-2026-68537Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of servicecrates.io · fulgur · fixed in 0.26.0
- CVE-2026-64684RMCP: Custom HTTP headers leak to cross-origin redirect targetscrates.io · rmcp · fixed in 2.1.0
- CVE-2026-63127RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discoverycrates.io · rmcp · fixed in 2.0.0
- CVE-2026-63128RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-servicecrates.io · rmcp · fixed in 2.0.0
- CVE-2026-61544libp2p-quic: Remote panic via certificate expiry race during QUIC handshakecrates.io · libp2p-quic · fixed in 0.13.1
- CVE-2026-55093tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model loadcrates.io · tract-nnef · fixed in 0.23.1, 0.22.2, 0.21.16
- CVE-2026-55832Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnxcrates.io · tract-onnx · fixed in 0.21.17, 0.22.3, 0.23.2
- CVE-2026-54541Nimiq: Panic in TrieProof::verify via child_index unwrap on equal-length keyscrates.io · nimiq-primitives · fixed in 1.6.0
- CVE-2026-54542Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proofcrates.io · nimiq-primitives · fixed in 1.6.0
- CVE-2025-24890gix-sec safe.directory protections absent for elevated administratorscrates.io · gix-sec · fixed in 0.13.3
- CVE-2026-45056Matrix Rust SDK: Sender-binding gaps in to-device and room-key attributioncrates.io · matrix-sdk-crypto · fixed in 0.16.1
- CVE-2026-45057matrix-sdk-ui: Incomplete edit validationcrates.io · matrix-sdk-ui · fixed in 0.16.1
- CVE-2026-53956Rattler vulnerable to package cache path traversal via conda package build stringcrates.io · rattler_cache · fixed in 0.9.0
- CVE-2026-53600async-tar PAX extension-header desync enables tar entry/content smugglingcrates.io · async-tar · fixed in 0.6.1
- CVE-2026-78422zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UIDcrates.io · zbus_polkit · fixed in 5.1.0
- CVE-2026-54788dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoScrates.io · datadog-opentelemetry · fixed in 0.3.3
- CVE-2026-82255gitoxide 0.25.4 HTTP Credential Leak via Redirectcrates.io · gix-transport · fixed in 0.56.0
- CVE-2026-82254gitoxide before 0.69.0 Denial of Service via gix-packcrates.io · gix-pack · fixed in 0.69.0
- CVE-2026-82253gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypasscrates.io · gix, gix-validate · fixed in 0.83.0, 0.11.1
- CVE-2026-82252gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodulescrates.io · gitoxide, gix · fixed in 0.52.1, 0.83.0