Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-82251gitoxide before 0.52.1 Path Traversal via Submodule Namecrates.io · gitoxide, gix · fixed in 0.52.1, 0.83.0
- CVE-2026-82250gitoxide gix-packetline before 0.21.5 Denial of Servicecrates.io · gix-packetline · fixed in 0.21.5
- CVE-2026-46369Nimiq: Validity store off by one errorcrates.io · nimiq-blockchain · fixed in 1.5.1
- CVE-2026-55663mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)crates.io · mediasoup · fixed in 0.22.5
- RUSTSEC-2026-0437Rejected authentication challenges can poison the Key Vault scope cachecrates.io · azure_security_keyvault_certificates · fixed in 1.0.1, 1.1.0-beta.2
- RUSTSEC-2026-0438Rejected authentication challenges can poison the Key Vault scope cachecrates.io · azure_security_keyvault_secrets · fixed in 1.0.1
- RUSTSEC-2026-0439Rejected authentication challenges can poison the Key Vault scope cachecrates.io · azure_security_keyvault_keys · fixed in 1.0.1
- CVE-2026-53531ratex-parser has unbounded parser recursion that leads to stack overflow (process abort)crates.io · ratex-parser · fixed in 0.1.11
- CVE-2026-53530ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)crates.io · ratex-parser · fixed in 0.1.11
- CVE-2026-54136Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_searchcrates.io · windmill-api · fixed in 1.715.0
- CVE-2026-63481Hurl: Cookies in Cookies section leak when redirecting to a different hostcrates.io · hurl
- GHSA-QWGH-2VCV-G2F7block_buffer: panic corrupts inline buffer positioncrates.io · block_buffer · fixed in 0.12.1
- CVE-2026-52834jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platformscrates.io · jxl-grid · fixed in 0.6.2
- CVE-2026-76234libcrux before 0.0.6 Cryptographic Implementation Bug Fixescrates.io · libcrux-ecdh, libcrux-ed25519 +1 · fixed in 0.0.6, 0.0.7
- CVE-2026-52829ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Bookcrates.io · zebra-network, zebrad · fixed in 7.0.0, 4.5.0
- CVE-2026-52736ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cachecrates.io · zebra-state, zebrad · fixed in 7.0.0, 4.5.0
- CVE-2026-52732ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturationcrates.io · zebrad · fixed in 4.5.0
- CVE-2026-52731ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplatecrates.io · zebra-rpc, zebrad · fixed in 8.0.0, 4.5.0
- CVE-2026-52733ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tipcrates.io · zebra-state, zebrad · fixed in 7.0.0, 4.5.0
- CVE-2026-52738ZEBRA: Finalized address balance credit-first overflow on consensus-valid blockscrates.io · zebra-state, zebrad · fixed in 7.0.0, 4.5.0
- CVE-2026-52735ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parsercrates.io · zebra-script, zebrad · fixed in 7.0.0, 4.5.0
- CVE-2026-52739ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejectioncrates.io · zebra-state, zebrad · fixed in 7.0.0, 4.5.0
- CVE-2026-52734ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retentioncrates.io · zebrad · fixed in 4.5.0
- CVE-2026-52737ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead blockcrates.io · zebra-consensus, zebrad · fixed in 7.0.0, 4.5.0
- CVE-2026-75915CodeWhale before 0.8.64 Environment Variable Leak via js_executioncrates.io · codewhale-tui, deepseek-tui · fixed in 0.8.64
- CVE-2026-75914CodeWhale before 0.8.64 Path Traversal via image_analyze symlinkcrates.io · codewhale-tui, deepseek-tui · fixed in 0.8.64
- CVE-2026-75913CodeWhale before 0.8.64 Argument Injection via git_showcrates.io · codewhale-tui, deepseek-tui · fixed in 0.8.64
- CVE-2026-75912CodeWhale before 0.8.64 Argument Injection via git_blamecrates.io · codewhale-tui, deepseek-tui · fixed in 0.8.64
- CVE-2026-75911CodeWhale before 0.8.64 Remote Code Execution via allow_shellcrates.io · codewhale-tui, deepseek-tui · fixed in 0.8.64
- CVE-2026-75859CodeWhale before 0.8.64 Arbitrary File Read via instructionscrates.io · codewhale-tui, deepseek-tui · fixed in 0.8.64