Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-75858CodeWhale rlm_eval before 0.8.64 Remote Code Executioncrates.io · codewhale-tui, deepseek-tui · fixed in 0.8.64
- CVE-2026-75857CodeWhale before 0.8.64 Privilege Escalation via exec_shell_interactcrates.io · codewhale-tui, deepseek-tui · fixed in 0.8.64
- CVE-2026-75856CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOUcrates.io · codewhale-tui, deepseek-tui · fixed in 0.8.64
- CVE-2026-73051actix-http before 3.12.1 HTTP Request Smuggling via CL.TEcrates.io · actix-http · fixed in 3.12.1
- CVE-2026-72814actix-files before 0.6.10 Information Disclosure via Filescrates.io · actix-files · fixed in 0.6.10
- CVE-2026-72813actix-files before 0.6.10 Denial of Service via empty Range headercrates.io · actix-files · fixed in 0.6.10
- CVE-2026-73489Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode recordscrates.io · russh · fixed in 0.62.4
- CVE-2026-73430Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)crates.io · russh · fixed in 0.62.4
- CVE-2026-73429Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)crates.io · russh · fixed in 0.62.4
- CVE-2026-72925SWC HTML minifier may allow script element breakout when minifying embedded JSONcrates.io · swc_html_minifier · fixed in 59.0.0
- CVE-2026-68930Russh: Channel-scoped server callbacks can be reached without an open channelcrates.io · russh · fixed in 0.62.5
- CVE-2026-18140Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated serverscrates.io · aws-smithy-json · fixed in 0.62.7
- CVE-2026-25800quinn-proto has remote memory exhaustion from unbounded out-of-order stream reassemblycrates.io · quinn-proto · fixed in 0.11.15
- CVE-2026-16756Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of servicecrates.io · aws-smithy-http-server · fixed in 0.66.5
- CVE-2026-47425Rattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)crates.io · rattler · fixed in 0.43.2
- CVE-2026-47144Shamefile has an arbitrary file read via shamefile.yaml in shame nextcrates.io · shamefile · fixed in 0.1.7
- CVE-2026-47128nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`crates.io · nono-cli · fixed in 0.55.0
- CVE-2026-46671Rust OneNote File Parser: Path traversal in `Parser::parse_notebook` allows reading files outside the notebook directorycrates.io · onenote_parser · fixed in 1.1.1
- CVE-2026-46428lettre has TLS hostname verification disabled when using Boring TLS backendcrates.io · lettre · fixed in 0.11.22
- CVE-2026-63763SurrealDB before 2.5.0 Privilege Escalation via Future Fieldscrates.io · surrealdb · fixed in 2.5.0, 3.0.0-beta.3
- CVE-2026-63762SurrealDB before v2.6.1 Denial of Service via scriptingcrates.io · surrealdb · fixed in 2.6.1, 3.0.0-beta.3
- CVE-2026-63761SurrealDB before 3.1.0 Algorithm Downgrade via ES512crates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63760SurrealDB before 3.1.0 Denial of Service via JSON Parsercrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63759SurrealDB before 3.1.0 Denial of Service nested type annotationscrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63758SurrealDB before 3.1.0 Authorization Bypass via KILL Statementcrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63757SurrealDB before 3.1.0 Session Hijacking via /rpc sessionscrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63756SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Conditioncrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63755SurrealDB before 3.1.0 Permission Bypass via WHERE Clausecrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63754SurrealDB before 3.1.0 Denial of Service via LIVE Querycrates.io · surrealdb · fixed in 3.1.0
- CVE-2026-63753SurrealDB before 3.1.0 Authentication Bypass via LIVE Querycrates.io · surrealdb · fixed in 3.1.0