Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-35362uutils coreutils Missing TOCTOU Protection on Non-Linux Unix Platforms in Safe Traversal Modulecrates.io · uucore · fixed in 0.6.0
- CVE-2026-35361uutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux Systemscrates.io · uu_mknod · fixed in 0.6.0
- CVE-2026-35360uutils coreutils touch Arbitrary File Truncation via TOCTOU Race Conditioncrates.io · coreutils
- CVE-2026-35359uutils coreutils cp Information Disclosure via Time-of-Check to Time-of-Use Symlink Swapcrates.io · coreutils
- CVE-2026-35358uutils coreutils cp Semantic Loss and Potential Denial of Service with -R via Device Node Stream Readingcrates.io · uu_cp · fixed in 0.7.0
- CVE-2026-35357uutils coreutils cp Information Disclosure via Permission Handling Racecrates.io · coreutils
- CVE-2026-35356uutils coreutils install Arbitrary File Overwrite with -D via Path Component Symlink Racecrates.io · uu_install · fixed in 0.7.0
- CVE-2026-35355uutils coreutils install Arbitrary File Overwrite via Symlink TOCTOU Racecrates.io · uu_install · fixed in 0.6.0
- CVE-2026-35354uutils coreutils mv Security Xattr TOCTOU Race in Cross-Devicecrates.io · coreutils
- CVE-2026-35353uutils coreutils mkdir Permission Exposure Race Condition with -mcrates.io · uu_mkdir · fixed in 0.6.0
- CVE-2026-35352uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Conditioncrates.io · coreutils
- CVE-2026-35351uutils coreutils mv Silent Ownership Loss in Cross-Device Operationscrates.io · coreutils
- CVE-2026-35350uutils coreutils cp Unexpected Privileged Executable Creation with -pcrates.io · coreutils
- CVE-2026-35349uutils coreutils Path-Based Safety Bypass with --preserve-rootcrates.io · uu_rm · fixed in 0.7.0
- CVE-2026-35348uutils coreutils sort Local Denial of Service via Forced UTF-8 Parsingcrates.io · coreutils
- CVE-2026-35347uutils coreutils comm Silent Data Loss or Denial of Service via Improper Input Validationcrates.io · uu_comm · fixed in 0.6.0
- CVE-2026-35346uutils coreutils comm Silent Data Corruption via Lossy UTF-8 Normalizationcrates.io · uu_comm · fixed in 0.6.0
- CVE-2026-35345uutils coreutils tail Privileged Information Disclosure via Symlink Replacement Racecrates.io · coreutils
- CVE-2026-35344uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppressioncrates.io · coreutils
- CVE-2026-35343uutils coreutils cut Inconsistent Output Suppression with Newline Delimiterscrates.io · uu_cut · fixed in 0.7.0
- CVE-2026-35342uutils coreutils mktemp Insecure Temporary File Placement via Empty TMPDIRcrates.io · uu_mktemp · fixed in 0.6.0
- CVE-2026-35341uutils coreutils mkfifo Unauthorized Permission Change on Existing Filescrates.io · uu_mkfifo · fixed in 0.6.0
- CVE-2026-35339uutils coreutils chmod False Success Exit Code in Recursive Modecrates.io · uu_chmod · fixed in 0.6.0
- CVE-2026-35338uutils coreutils chmod Path Traversal Bypass of --preserve-rootcrates.io · uu_chmod · fixed in 0.6.0
- CVE-2026-6859Instructlab: instructlab: arbitrary code execution due to hardcoded `trust_remote_code=true`PyPI · instructlab
- CVE-2026-6857Camel-infinispan: camel-infinispan: remote code execution via unsafe deserializationMaven · org.apache.camel:camel-infinispan · fixed in 4.20.0
- CVE-2026-6855Instructlab: instructlab: path traversal allows arbitrary directory creation and file writePyPI · instructlab
- CVE-2026-40542Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verificationMaven · org.apache.httpcomponents.client5:httpclient5 · fixed in 5.6.1
- CVE-2026-22754ervlet Path Not Correctly Included in Path Matching of XML Authorization RulesMaven · org.springframework.security:spring-security-config · fixed in 7.0.5
- CVE-2026-22753Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchersMaven · org.springframework.security:spring-security-config · fixed in 7.0.5