crates.io package vulnerabilities
The newest vulnerabilities affecting crates.io packages, up to 200. Subscribe by RSS.
- RUSTSEC-2026-0425`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)nix-nar
- RUSTSEC-2026-0426LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-timeorion
- RUSTSEC-2026-0428BLAKE2b produces wrong tag when using `reset()` with a different-length keyorion
- GHSA-C33X-VCV4-VG3GCedar: JSON template is in scope missing slot-id validation allows link panic and decision divergencecedar-policy · @cedar-policy/cedar-wasm
- CVE-2026-119143Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writesbytecodealliance wasmtime · wasmtime
- CVE-2026-119142Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Dropbytecodealliance wasmtime · wasmtime
- CVE-2026-119138Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trapbytecodealliance wasmtime · wasmtime
- CVE-2026-119137Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registrybytecodealliance wasmtime · wasmtime
- CVE-2026-119136Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypassbytecodealliance wasmtime · wasmtime
- CVE-2026-119132Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapterbytecodealliance wasmtime · wasmtime
- CVE-2026-119131Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-httpbytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-119130Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smugglingbytecodealliance wasmtime · wasmtime-wasi-http
- RUSTSEC-2026-0419Unbounded memory use on large request bodiesjuniper_warp
- RUSTSEC-2026-0420wasip3 UDP `send` can deliver a datagram to an address only allowed for receivingwasmtime-wasi
- RUSTSEC-2026-0421wasi-http p2: outgoing content-length can be invalid or not match bodywasmtime-wasi-http
- RUSTSEC-2026-0422Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-checkwasmtime
- RUSTSEC-2026-0423Cross-engine type confusion with host-created struct-types-with-supertypeswasmtime
- RUSTSEC-2026-0424Unchecked memory usage in transferring borrowed resources between componentswasmtime
- RUSTSEC-2026-0427`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)sn-releases
- RUSTSEC-2026-0415Unbounded memory use on large request bodiesjuniper_hyper
- RUSTSEC-2026-0416Stack overflow on deeply nested GraphQL documentsjuniper
- RUSTSEC-2026-0417Excessive CPU and memory use on crafted GraphQL documentsjuniper
- RUSTSEC-2026-0418libz-sys build script leaks environment variables in the build directorylibz-sys
- GHSA-VP88-798V-H67Frustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alertrustls
- GHSA-W44R-93J7-QV28rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 sharerustls
- GHSA-C8M5-C952-6CM4Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKsrustls
- GHSA-H2V8-394M-P7VVRustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.rustls
- CVE-2026-115909zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extractionzip-rs zip2 · zip
- CVE-2026-115908zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)zip-rs zip2 · zip
- CVE-2026-115907zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed sizezip-rs zip2 · zip
- CVE-2026-115906zip: AES Entry HMAC Authentication Bypass on Premature EOFzip-rs zip2 · zip
- CVE-2026-115905zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCEzip-rs zip2 · zip
- RUSTSEC-2026-0412Arbitrary code execution when rerunning tests from a portable recordingcargo-nextest
- RUSTSEC-2026-0413Use-after-free of caller-owned server name in client connection constructorsrustls-ffi
- RUSTSEC-2026-0408Aliasing violations in splice, mutable iteration and cursorsskiplist
- RUSTSEC-2026-0409Use-after-free from a comparator that answers inconsistentlyskiplist
- GHSA-H4FR-CMH5-QR62Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project rootfallow · @fallow-cli/fallow-node +3
- CVE-2026-115893Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionbytecodealliance wasmtime · wasmtime
- CVE-2026-115892Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload typebytecodealliance wasmtime · wasmtime
- CVE-2026-115889Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilationbytecodealliance wasmtime · wasmtime
- CVE-2026-115569Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project rootfallow-rs fallow · @fallow-cli fallow-node +6
- CVE-2026-115567Tokio: Race condition in `tokio::time::Interval`tokio-rs tokio · tokio
- RUSTSEC-2026-0387Multiple timing variability issues in operations intended to be constant-timecrypto-bigint
- CVE-2026-115393Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusionbytecodealliance wasmtime · wasmtime
- CVE-2026-115392Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashesbytecodealliance wasmtime · wasmtime
- CVE-2026-115391Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streamsbytecodealliance wasmtime · wasmtime
- CVE-2026-115390Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoSbytecodealliance wasmtime · wasmtime
- CVE-2026-115389Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val APIbytecodealliance wasmtime · wasmtime
- CVE-2026-115388Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Writebytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-115387Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflowbytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-115386Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdirbytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-115385Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestampsbytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-115384Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflowbytecodealliance wasmtime · wasmtime
- CVE-2026-115383Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Importsbytecodealliance wasmtime · wasmtime
- CVE-2026-115382Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoSbytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-115381Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroesbytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-115380Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoffbytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-115379Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_callbytecodealliance wasmtime · wasmtime
- RUSTSEC-2026-0407SSRF and local file disclosure via unvalidated URLswebpage
- RUSTSEC-2026-0411Out-of-bounds read in `Log2Cache::nlog2n()`, `nlog2n_difference()` and `plog2p()`dahl-salso
- CVE-2026-113799Slack Morphism verifier errors disclose valid HMACs in the logsabdolence slack-morphism-rust · slack-morphism
- CVE-2026-111943Distrust compromised intermediate certificates in crypto/x509Go standard library crypto/x509 · stdlib +3
- CVE-2026-114109uv before 0.11.15 Arbitrary File Write via Entry Point Namesastral-sh uv · uv
- CVE-2026-105299Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deploymentshttps://github.com/cloudflare/pingora · pingora-proxy
- CVE-2026-105298Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypasshttps://github.com/cloudflare/pingora · pingora-core
- CVE-2026-105297Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limitshttps://github.com/cloudflare/pingora · pingora-core
- CVE-2026-111061russh agent server converts constraint records into unbounded never-rolled-back tasksEugeny russh · russh
- RUSTSEC-2026-0414Exponential event growth with `ENABLE_WIKILINKS`pulldown-cmark
- RUSTSEC-2026-0391Data from an abandoned stream leaks into the next stream on a reused contextzstd
- RUSTSEC-2026-0392Uninitialized memory exposed by `write::Decoder` on a corrupt legacy framezstd
- RUSTSEC-2026-0393Out-of-bounds read when training a dictionary from inconsistent sample sizeszstd
- RUSTSEC-2026-0395Use-after-free with `CParameter::StableInBuffer`zstd-safe
- RUSTSEC-2026-0396`Seekable` reads a NULL or out-of-bounds seek tablezstd-safe
- RUSTSEC-2026-0397`OutBuffer::around_pos` exposes uninitialized memoryzstd-safe
- RUSTSEC-2026-0398`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the endzstd-safe
- RUSTSEC-2026-0399Use-after-free through `init_using_cdict` and `init_using_ddict`zstd-safe
- RUSTSEC-2026-0400Use-after-free of a dictionary after a one-shot call on a context with an open streamzstd-safe
- RUSTSEC-2026-0401Out-of-bounds read in `train_from_buffer` when sample sizes overflowzstd-safe
- RUSTSEC-2026-0402Heap buffer overflow in `CCtx::try_clone` on a multithreaded contextzstd-safe
- RUSTSEC-2026-0403Uninitialized memory exposed when streaming decompression of a legacy frame failszstd-safe
- RUSTSEC-2026-0404Double free in `DCtx::try_clone`zstd-safe
- RUSTSEC-2026-0405Out-of-bounds read with an out-of-range `InBuffer::pos`zstd-safe
- RUSTSEC-2026-0406Use-after-free when changing a multithreaded context with an unfinished framezstd-safe
- RUSTSEC-2026-0410WebAssembly allocator shim corrupts memory on allocation failurezstd-sys
- CVE-2026-63430ammonia: mXSS in ammonia via MathML `annotation-xml` encoding striprust-ammonia ammonia · ammonia
- CVE-2026-103929mise permits untrusted local configuration to override default shell argumentsjdx mise · mise
- RUSTSEC-2026-0352Filesystem sandbox escape when renaming symlinks with trailing slasheswasmtime-wasi
- RUSTSEC-2026-0353Panic when invoking an async-lifted function via `call`wasmtime
- RUSTSEC-2026-0355Panic viewing component model stream or future as the wrong typewasmtime
- RUSTSEC-2026-0356Panic on erroneous call-to-host from guest realloc callwasmtime
- RUSTSEC-2026-0358Yielding in a component start function can lead to a host panicwasmtime
- RUSTSEC-2026-0363Component-model handle tables are capped only per instance and charged to no limitwasmtime
- RUSTSEC-2026-0364Exception tags can cause host data structures to be unalignedwasmtime
- CVE-2026-102342ammonia allows stored XSS through unsanitized SVG animate and set attributesrust-ammonia ammonia · ammonia
- GHSA-2MJX-QC3C-RQVCRustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundariesrustls
- CVE-2026-104855Wasmtime: Preemption and traps during bulk operations enable breaking internal VM statebytecodealliance wasmtime · wasmtime
- CVE-2026-104843uv: Path traversal on Windows through wheel extractionastral-sh uv · uv
- CVE-2026-104437Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output HandlingZcashFoundation zebra · zebrad
- CVE-2026-104436Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator LengthZcashFoundation zebra · ZcashFoundation zebra-chain +2
- CVE-2026-104435Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without OutputZcashFoundation zebra · zebrad +1
- CVE-2026-104434Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPCZcashFoundation zebra · zebra-rpc +1
- CVE-2026-102825Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime pathEugeny russh · russh
- CVE-2026-102824Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchangeEugeny russh · russh
- CVE-2026-102823russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never openedEugeny russh · russh
- CVE-2026-102822russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panicEugeny russh · russh
- CVE-2026-102821Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekeyEugeny russh · russh
- CVE-2026-102820pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)Eugeny russh · rust pageant +1
- CVE-2026-97875DNS rebinding vulnerability in rojo serve HTTP APIrojo-rbx rojo · rojo
- CVE-2026-96889Librsvg: use-after-free when xml includes have duplicated entitiesRed Hat Enterprise Linux · librsvg
- RUSTSEC-2026-0394Build environment compiled into the library and readable at runtimerustpython-vm
- CVE-2026-92612In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::asEclipse Foundation Eclipse iceoryx™ · iceoryx2-bb-container
- CVE-2026-61670microsandbox: Secret values exposed in world-readable process argumentssuperradcompany microsandbox · microsandbox
- CVE-2026-93657hickory-resolver before 0.26.2 DNSSEC Validation Bypasshickory-dns hickory-resolver · hickory-resolver
- CVE-2026-93602rustls-webpki before 0.103.10 CRL Revocation Check Bypassrustls webpki · rustls-webpki
- CVE-2026-93601rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypassrustls webpki · rustls-webpki
- CVE-2026-93600rustls webpki Name Constraints URI Validation Bypassrustls webpki · rustls-webpki
- CVE-2026-93599rustls-webpki before 0.103.13 Panic via empty BIT STRINGrustls webpki · rustls-webpki
- CVE-2026-68523Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of servicefulgur-rs fulgur · fulgur
- CVE-2026-68537Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of servicefulgur-rs fulgur · fulgur
- CVE-2026-64684RMCP: Custom HTTP headers leak to cross-origin redirect targetsmodelcontextprotocol rust-sdk · rmcp
- CVE-2026-63127RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discoverymodelcontextprotocol rust-sdk · rmcp
- CVE-2026-63128RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-servicemodelcontextprotocol rust-sdk · rmcp
- CVE-2026-61544libp2p-quic: Remote panic via certificate expiry race during QUIC handshakerust-libp2p · libp2p-quic
- CVE-2026-55093tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model loadsonos tract · tract-nnef
- CVE-2026-55832Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnxsonos tract · tract-onnx
- CVE-2026-54541Nimiq: Panic in TrieProof::verify via child_index unwrap on equal-length keysnimiq core-rs-albatross · nimiq-primitives
- CVE-2026-54542Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proofnimiq core-rs-albatross · nimiq-primitives
- CVE-2025-24890gix-sec safe.directory protections absent for elevated administratorsGitoxideLabs gitoxide · gix-sec
- CVE-2026-45056Matrix Rust SDK: Sender-binding gaps in to-device and room-key attributionmatrix-org matrix-rust-sdk · matrix-sdk-crypto
- CVE-2026-45057matrix-sdk-ui: Incomplete edit validationmatrix-org matrix-sdk-ui · matrix-sdk-ui
- CVE-2026-53956Rattler vulnerable to package cache path traversal via conda package build stringconda rattler_cache · conda py-rattler +2
- CVE-2026-53600async-tar PAX extension-header desync enables tar entry/content smugglingdignifiedquire async-tar · async-tar
- CVE-2026-78422zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UIDz-galaxy zbus_polkit · zbus_polkit
- CVE-2026-54788dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoSDataDog dd-trace-rs · datadog-opentelemetry
- CVE-2026-82255gitoxide 0.25.4 HTTP Credential Leak via RedirectGitoxideLabs gitoxide · gix-transport
- CVE-2026-82254gitoxide before 0.69.0 Denial of Service via gix-packGitoxideLabs gitoxide · gix-pack
- CVE-2026-82253gitoxide before 0.82.0 Path Traversal via Submodule Name Validation BypassGitoxideLabs gitoxide · gix +1
- CVE-2026-82252gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodulesGitoxideLabs gitoxide · gitoxide +1
- CVE-2026-82251gitoxide before 0.52.1 Path Traversal via Submodule NameGitoxideLabs gitoxide · gitoxide +1
- CVE-2026-82250gitoxide gix-packetline before 0.21.5 Denial of ServiceGitoxideLabs gitoxide · gix-packetline
- CVE-2026-46369Nimiq: Validity store off by one errornimiq core-rs-albatross · nimiq-blockchain
- CVE-2026-55663mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)versatica mediasoup · mediasoup
- CVE-2026-53531ratex-parser has unbounded parser recursion that leads to stack overflow (process abort)erweixin RaTeX · ratex-parser
- CVE-2026-53530ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)erweixin RaTeX · ratex-parser
- CVE-2026-54136Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_searchwindmill-labs windmill · windmill-api
- CVE-2026-63481Hurl: Cookies in Cookies section leak when redirecting to a different hostOrange-OpenSource hurl · hurl
- CVE-2026-52834jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platformstirr-c jxl-oxide · tirr-c jxl-grid +1
- CVE-2026-76234libcrux before 0.0.6 Cryptographic Implementation Bug Fixescelabshq libcrux-ecdh · celabshq libcrux-ed25519 +4
- CVE-2026-52829ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address BookZcashFoundation zebra · zebra-network +1
- CVE-2026-52736ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cacheZcashFoundation zebra · zebra-state +1
- CVE-2026-52732ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturationZcashFoundation zebra · zebrad
- CVE-2026-52731ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplateZcashFoundation zebra · ZcashFoundation zebra-rpc +2
- CVE-2026-52733ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tipZcashFoundation zebra · ZcashFoundation zebra-state +2
- CVE-2026-52738ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocksZcashFoundation zebra · ZcashFoundation zebra-state +2
- CVE-2026-52735ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parserZcashFoundation zebra · zebra-script +1
- CVE-2026-52739ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier RejectionZcashFoundation zebra · ZcashFoundation zebra-state +2
- CVE-2026-52734ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retentionZcashFoundation zebra · zebrad
- CVE-2026-52737ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead blockZcashFoundation zebra · ZcashFoundation zebra-consensus +2
- CVE-2026-75915CodeWhale before 0.8.64 Environment Variable Leak via js_executionHmbown CodeWhale · deepseek-tui +2
- CVE-2026-75914CodeWhale before 0.8.64 Path Traversal via image_analyze symlinkHmbown CodeWhale · deepseek-tui +2
- CVE-2026-75913CodeWhale before 0.8.64 Argument Injection via git_showHmbown CodeWhale · deepseek-tui +2
- CVE-2026-75912CodeWhale before 0.8.64 Argument Injection via git_blameHmbown CodeWhale · deepseek-tui +2
- CVE-2026-75911CodeWhale before 0.8.64 Remote Code Execution via allow_shellHmbown CodeWhale · deepseek-tui +2
- CVE-2026-75859CodeWhale before 0.8.64 Arbitrary File Read via instructionsHmbown CodeWhale · deepseek-tui +2
- CVE-2026-75858CodeWhale rlm_eval before 0.8.64 Remote Code ExecutionHmbown CodeWhale · deepseek-tui +2
- CVE-2026-75857CodeWhale before 0.8.64 Privilege Escalation via exec_shell_interactHmbown CodeWhale · deepseek-tui +2
- CVE-2026-75856CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOUHmbown CodeWhale · deepseek-tui +2
- CVE-2026-73051actix-http before 3.12.1 HTTP Request Smuggling via CL.TEactix-http
- CVE-2026-72814actix-files before 0.6.10 Information Disclosure via Filesactix-files
- CVE-2026-72813actix-files before 0.6.10 Denial of Service via empty Range headeractix-files
- CVE-2026-73489Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode recordsEugeny russh · russh
- CVE-2026-73430Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)Eugeny russh · russh
- CVE-2026-73429Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)Eugeny russh · russh
- CVE-2026-72925SWC HTML minifier may allow script element breakout when minifying embedded JSONswc-project swc · @swc html +3
- CVE-2026-68930Russh: Channel-scoped server callbacks can be reached without an open channelEugeny russh · russh
- CVE-2026-18140Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated serversaws-smithy-json
- CVE-2026-25800quinn-proto has remote memory exhaustion from unbounded out-of-order stream reassemblyquinn-rs quinn · quinn-proto
- CVE-2026-16756Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of serviceaws-smithy-http-server
- CVE-2026-47425Rattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)conda rattler · conda py-rattler +4
- CVE-2026-47144Shamefile has an arbitrary file read via shamefile.yaml in shame nextBKDDFS shamefile · shamefile
- CVE-2026-47128nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`always-further nono · nono-cli
- CVE-2026-46671Rust OneNote File Parser: Path traversal in `Parser::parse_notebook` allows reading files outside the notebook directorymsiemens onenote.rs · onenote_parser
- CVE-2026-46428lettre has TLS hostname verification disabled when using Boring TLS backendlettre
- CVE-2026-63763SurrealDB before 2.5.0 Privilege Escalation via Future Fieldssurrealdb
- CVE-2026-63762SurrealDB before v2.6.1 Denial of Service via scriptingsurrealdb
- CVE-2026-63761SurrealDB before 3.1.0 Algorithm Downgrade via ES512surrealdb
- CVE-2026-63760SurrealDB before 3.1.0 Denial of Service via JSON Parsersurrealdb
- CVE-2026-63758SurrealDB before 3.1.0 Authorization Bypass via KILL Statementsurrealdb
- CVE-2026-63755SurrealDB before 3.1.0 Permission Bypass via WHERE Clausesurrealdb
- CVE-2026-63751SurrealDB before 3.1.0 Field Permission Bypass via JSON Patchsurrealdb
- CVE-2026-63748SurrealDB before 3.1.0 Information Disclosure via Error Messagessurrealdb
- CVE-2026-63746SurrealDB before 3.1.0 Permission Bypass via Graph Traversalsurrealdb
- CVE-2026-63743SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirectsurrealdb
- CVE-2026-63740SurrealDB before 3.1.4 Array Element Permission Bypasssurrealdb
- CVE-2026-63738SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversalsurrealdb
- CVE-2026-63735SurrealDB before 3.2.0 Authentication Bypass via Custom APIsurrealdb
- CVE-2026-63733SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clausesurrealdb · surrealdb-core
- CVE-2025-71398SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypasssurrealdb
- CVE-2025-71397SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loopssurrealdb
- CVE-2025-71396SurrealDB before 2.2.2 Denial of Service via JavaScript Scriptingsurrealdb