# cve.now: crates.io packages

The newest entries affecting crates.io packages (up to 200). To check exact package versions, use the MCP stack.check operation or /stack.

- [RUSTSEC-2026-0529](https://cve.now/RUSTSEC-2026-0529.md): bsv-rs signature check bypass in KVStoreInterpreter (no CVSS, bsv-rs)
- [RUSTSEC-2026-0501](https://cve.now/RUSTSEC-2026-0501.md): Shamir backup recovery accepts a share at x = 0, so a supplied share can substitute the recovered private key (no CVSS, bsv-rs)
- [RUSTSEC-2026-0528](https://cve.now/RUSTSEC-2026-0528.md): Ref Swap use-after-free in swap types reachable from safe code (no CVSS, ref-swap)
- [RUSTSEC-2026-0533](https://cve.now/RUSTSEC-2026-0533.md): ammonia cross-site scripting in HTML sanitizer via SVG and MathML (no CVSS, ammonia)
- [RUSTSEC-2026-0497](https://cve.now/RUSTSEC-2026-0497.md): Transaction::from\_json holds an input txid that is not 64 hex digits and writes the input as spending the zero txid (no CVSS, bsv-rs)
- [RUSTSEC-2026-0499](https://cve.now/RUSTSEC-2026-0499.md): Signature::from\_der reads a signature with bytes after it, a wrong sequence length or an unneeded zero as the signature (no CVSS, bsv-rs)
- [RUSTSEC-2026-0510](https://cve.now/RUSTSEC-2026-0510.md): Panic when decoding malformed Ed25519 keys from Base64 (no CVSS, vodozemac)
- [CVE-2026-42067](https://cve.now/CVE-2026-42067.md): Improper certificate validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow an… (CVSS 5.9, Intel(R) TDX Workload Attestation software · tdx\_workload\_a…)
- [CVE-2026-40693](https://cve.now/CVE-2026-40693.md): Improper input validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow a denial of… (CVSS 5.7, Intel(R) TDX Workload Attestation software · tdx\_workload\_a…)
- [RUSTSEC-2026-0483](https://cve.now/RUSTSEC-2026-0483.md): \`lwd-uri-util\` was removed from crates.io for malicious code (no CVSS, lwd-uri-util)
- [RUSTSEC-2026-0498](https://cve.now/RUSTSEC-2026-0498.md): Transaction readers accept trailing bytes, so a parsed transaction can carry another transaction id (no CVSS, bsv-rs)
- [RUSTSEC-2026-0500](https://cve.now/RUSTSEC-2026-0500.md): BEEF validation answers valid for a raw entry that is not a transaction (no CVSS, bsv-rs)
- [RUSTSEC-2026-0464](https://cve.now/RUSTSEC-2026-0464.md): \`webhook\_commands\` was removed from crates.io for malicious code (no CVSS, webhook\_commands)
- [RUSTSEC-2026-0465](https://cve.now/RUSTSEC-2026-0465.md): \`electrumd\` was removed from crates.io for malicious code (no CVSS, electrumd)
- [RUSTSEC-2026-0469](https://cve.now/RUSTSEC-2026-0469.md): \`env-test-guard\` was removed from crates.io for malicious code (no CVSS, env-test-guard)
- [RUSTSEC-2026-0470](https://cve.now/RUSTSEC-2026-0470.md): \`gabby-types-sec\` was removed from crates.io for malicious code (no CVSS, gabby-types-sec)
- [CVE-2026-123613](https://cve.now/CVE-2026-123613.md): Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass (CVSS 6.9, rustls)
- [CVE-2026-123612](https://cve.now/CVE-2026-123612.md): rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure (CVSS 4.6, rustls)
- [CVE-2026-123611](https://cve.now/CVE-2026-123611.md): Rustls key exchange downgrade via ServerHello record poisoning (CVSS 6.3, rustls)
- [CVE-2026-123610](https://cve.now/CVE-2026-123610.md): rustls before 0.23.46 Denial of Service via Brotli Certificate Decompression (CVSS 6.3, rustls)
- [CVE-2026-123609](https://cve.now/CVE-2026-123609.md): Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug (CVSS 4.1, rustls)
- [CVE-2026-123608](https://cve.now/CVE-2026-123608.md): Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression (CVSS 8.7, hickory-dns · hickory-proto)
- [CVE-2026-123607](https://cve.now/CVE-2026-123607.md): Hickory DNS denial of service via loop in DNSSEC NSEC3 validation (CVSS 8.7, hickory-dns · hickory-net +1)
- [CVE-2026-123606](https://cve.now/CVE-2026-123606.md): Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplification (CVSS 8.7, hickory-dns · hickory-recursor +1)
- [CVE-2026-123605](https://cve.now/CVE-2026-123605.md): Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name (CVSS 8.7, hickory-dns · hickory-net)
- [CVE-2026-123604](https://cve.now/CVE-2026-123604.md): Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try\_send TC-Retry Loop (CVSS 8.7, hickory-dns · hickory-resolver)
- [CVE-2026-123601](https://cve.now/CVE-2026-123601.md): Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery (CVSS 8.3, hickory-dns · hickory-proto +1)
- [CVE-2026-123596](https://cve.now/CVE-2026-123596.md): Hickory DNS DNSSEC validation bypass in NSEC handler (CVSS 8.7, hickory-dns · hickory-net +1)
- [CVE-2026-123595](https://cve.now/CVE-2026-123595.md): Hickory DNS DNSSEC validation bypass in NSEC3 handling (CVSS 8.7, hickory-dns · hickory-net +1)
- [CVE-2026-123594](https://cve.now/CVE-2026-123594.md): Hickory DNS through 0.26.0-alpha.1 DNSSEC NSEC Validation Bypass for Empty Non-Terminals (CVSS 6.3, hickory-dns · hickory-proto +1)
- [CVE-2026-123592](https://cve.now/CVE-2026-123592.md): Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Name Hash Collision (CVSS 8.2, hickory-dns · hickory-net)
- [CVE-2026-123591](https://cve.now/CVE-2026-123591.md): Hickory DNS validation bypass in DNSSEC delegation handling (CVSS 8.2, hickory-dns · hickory-proto +1)
- [CVE-2026-123587](https://cve.now/CVE-2026-123587.md): Hickory DNS authentication bypass in DNSSEC nonexistence validation (CVSS 8.9, hickory-dns · hickory-net)
- [CVE-2026-123586](https://cve.now/CVE-2026-123586.md): Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic Referrals (CVSS 8.7, hickory-dns · hickory-resolver +1)
- [CVE-2026-123585](https://cve.now/CVE-2026-123585.md): Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Records (CVSS 6.9, hickory-dns · hickory-resolver)
- [CVE-2026-123584](https://cve.now/CVE-2026-123584.md): Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responses (CVSS 8.2, hickory-dns · hickory-net)
- [CVE-2026-123581](https://cve.now/CVE-2026-123581.md): Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Unrelated RRset (CVSS 6.9, hickory-dns · hickory-proto +1)
- [CVE-2026-123580](https://cve.now/CVE-2026-123580.md): Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3 (CVSS 8.7, hickory-dns · hickory-proto +1)
- [CVE-2026-123574](https://cve.now/CVE-2026-123574.md): Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parser (CVSS 8.7, hickory-dns · hickory-proto)
- [CVE-2026-123572](https://cve.now/CVE-2026-123572.md): Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parser (CVSS 8.7, hickory-dns · hickory-proto)
- [CVE-2026-123571](https://cve.now/CVE-2026-123571.md): Hickory DNS remote denial of service via panic in TSIG RDATA decoding (CVSS 8.7, hickory-dns · hickory-proto)
- [RUSTSEC-2026-0503](https://cve.now/RUSTSEC-2026-0503.md): eazip: symlink-target validation checks the wrong argument, allowing extraction path escapes on Windows (no CVSS, eazip)
- [RUSTSEC-2026-0443](https://cve.now/RUSTSEC-2026-0443.md): Hidden file disclosure through Windows short names (no CVSS, actix-files)
- [RUSTSEC-2026-0445](https://cve.now/RUSTSEC-2026-0445.md): Degraded secret zeroization capabilities (no CVSS, vodozemac)
- [RUSTSEC-2026-0446](https://cve.now/RUSTSEC-2026-0446.md): Request smuggling through malformed chunked request trailers (no CVSS, actix-http)
- [RUSTSEC-2026-0447](https://cve.now/RUSTSEC-2026-0447.md): Compressed request bodies can exhaust memory before extractor limits apply (no CVSS, actix-web)
- [RUSTSEC-2026-0448](https://cve.now/RUSTSEC-2026-0448.md): Unbounded decompression can exhaust memory and CPU resources (no CVSS, actix-http)
- [RUSTSEC-2026-0451](https://cve.now/RUSTSEC-2026-0451.md): Degraded secret zeroization capabilities (no CVSS, vodozemac)
- [RUSTSEC-2026-0455](https://cve.now/RUSTSEC-2026-0455.md): Large-window Brotli bodies bypass decompression memory limits (no CVSS, actix-http)
- [RUSTSEC-2026-0466](https://cve.now/RUSTSEC-2026-0466.md): \`build\_dep\` was removed from crates.io for malicious code (no CVSS, build\_dep)
- [RUSTSEC-2026-0467](https://cve.now/RUSTSEC-2026-0467.md): \`top\_level\_crate\` was removed from crates.io for malicious code (no CVSS, top\_level\_crate)
- [RUSTSEC-2026-0468](https://cve.now/RUSTSEC-2026-0468.md): \`shinchina\` was removed from crates.io for malicious code (no CVSS, shinchina)
- [RUSTSEC-2026-0471](https://cve.now/RUSTSEC-2026-0471.md): \`sec-gemini\` was removed from crates.io for malicious code (no CVSS, sec-gemini)
- [RUSTSEC-2026-0472](https://cve.now/RUSTSEC-2026-0472.md): \`shinchina-test\` was removed from crates.io for malicious code (no CVSS, shinchina-test)
- [RUSTSEC-2026-0449](https://cve.now/RUSTSEC-2026-0449.md): \`ocipkg\` is unmaintained (no CVSS, ocipkg)
- [RUSTSEC-2026-0462](https://cve.now/RUSTSEC-2026-0462.md): Unbounded response body buffering in Streamable HTTP clients (no CVSS, rmcp)
- [RUSTSEC-2026-0456](https://cve.now/RUSTSEC-2026-0456.md): Panic on an HEVC tile layout that does not match the active SPS (no CVSS, heifer-hevc-dec)
- [RUSTSEC-2026-0458](https://cve.now/RUSTSEC-2026-0458.md): Memory exhaustion when parsing a crafted \`iloc\` box (no CVSS, heifer-isobmff)
- [RUSTSEC-2026-0460](https://cve.now/RUSTSEC-2026-0460.md): Panic on chroma QP offsets enabled with an empty offset list (no CVSS, heifer-hevc-dec)
- [CVE-2026-121441](https://cve.now/CVE-2026-121441.md): Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling (CVSS 6.3, bytecodealliance wasmtime · wasmtime-wasi-http)
- [CVE-2026-121440](https://cve.now/CVE-2026-121440.md): Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass (CVSS 6.3, bytecodealliance wasmtime · wasmtime-wasi-http)
- [CVE-2026-121439](https://cve.now/CVE-2026-121439.md): Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http (CVSS 6.9, bytecodealliance wasmtime · wasmtime-wasi-http)
- [RUSTSEC-2026-0440](https://cve.now/RUSTSEC-2026-0440.md): \`astral-tokio-tar\` is unmaintained (no CVSS, astral-tokio-tar)
- [RUSTSEC-2026-0452](https://cve.now/RUSTSEC-2026-0452.md): Out-of-bounds read when decoding internal keys shorter than 16 bytes (no CVSS, surrealkv)
- [RUSTSEC-2026-0454](https://cve.now/RUSTSEC-2026-0454.md): Data race and double free via unsound \`Send\`/\`Sync\` in \`reblessive\` (no CVSS, surrealdb-core)
- [CVE-2026-111959](https://cve.now/CVE-2026-111959.md): Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads (CVSS 9.1, Apache Software Foundation arrow · arrow-data)
- [RUSTSEC-2026-0430](https://cve.now/RUSTSEC-2026-0430.md): Path traversal in \`rio-vt\` Kitty graphics protocol handler allows out-of-bounds file delete (and read) (no CVSS, rio-vt)
- [RUSTSEC-2026-0431](https://cve.now/RUSTSEC-2026-0431.md): Unbounded memory allocation in \`evtx\` parsing a \`.wevtcache\` file (no CVSS, evtx)
- [RUSTSEC-2026-0432](https://cve.now/RUSTSEC-2026-0432.md): \`codeq\`: decoding untrusted input can allocate memory from an unchecked length prefix (denial of service) (no CVSS, codeq)
- [RUSTSEC-2026-0434](https://cve.now/RUSTSEC-2026-0434.md): \`ant-releases\`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip) (no CVSS, ant-releases)
- [RUSTSEC-2026-0425](https://cve.now/RUSTSEC-2026-0425.md): \`nix-nar\`: \`Decoder::unpack\` writes archive entries outside the destination directory (path traversal) (no CVSS, nix-nar)
- [RUSTSEC-2026-0426](https://cve.now/RUSTSEC-2026-0426.md): LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-time (no CVSS, orion)
- [RUSTSEC-2026-0428](https://cve.now/RUSTSEC-2026-0428.md): BLAKE2b produces wrong tag when using \`reset()\` with a different-length key (no CVSS, orion)
- [RUSTSEC-2026-0450](https://cve.now/RUSTSEC-2026-0450.md): \`ocipkg\`: unpacking an OCI archive can write and delete files outside the local image store (path traversal) (no CVSS, ocipkg)
- [CVE-2026-119375](https://cve.now/CVE-2026-119375.md): SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch (CVSS 6.8, SQLite · libsqlite3-sys +1)
- [GHSA-C33X-VCV4-VG3G](https://cve.now/GHSA-C33X-VCV4-VG3G.md): Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence (low (no CVSS), cedar-policy · @cedar-policy/cedar-wasm)
- [CVE-2026-119143](https://cve.now/CVE-2026-119143.md): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes (CVSS 5.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-119142](https://cve.now/CVE-2026-119142.md): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call\_async Drop (CVSS 5.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-119140](https://cve.now/CVE-2026-119140.md): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yield (CVSS 5.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-119139](https://cve.now/CVE-2026-119139.md): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::call (CVSS 5.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-119138](https://cve.now/CVE-2026-119138.md): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap (CVSS 5.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-119137](https://cve.now/CVE-2026-119137.md): Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry (CVSS 6.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-119136](https://cve.now/CVE-2026-119136.md): Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass (CVSS 5.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-119135](https://cve.now/CVE-2026-119135.md): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch (CVSS 5.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-119132](https://cve.now/CVE-2026-119132.md): Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter (CVSS 5.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-119131](https://cve.now/CVE-2026-119131.md): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http (CVSS 6.9, bytecodealliance wasmtime · wasmtime-wasi-http)
- [CVE-2026-119130](https://cve.now/CVE-2026-119130.md): Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling (CVSS 2.1, bytecodealliance wasmtime · wasmtime-wasi-http)
- [RUSTSEC-2026-0419](https://cve.now/RUSTSEC-2026-0419.md): Unbounded memory use on large request bodies (no CVSS, juniper\_warp)
- [RUSTSEC-2026-0420](https://cve.now/RUSTSEC-2026-0420.md): wasip3 UDP \`send\` can deliver a datagram to an address only allowed for receiving (no CVSS, wasmtime-wasi)
- [RUSTSEC-2026-0421](https://cve.now/RUSTSEC-2026-0421.md): wasi-http p2: outgoing content-length can be invalid or not match body (no CVSS, wasmtime-wasi-http)
- [RUSTSEC-2026-0422](https://cve.now/RUSTSEC-2026-0422.md): Typed functions with \`i31\` or \`nullref\` arguments may panic due to insufficient type-check (no CVSS, wasmtime)
- [RUSTSEC-2026-0423](https://cve.now/RUSTSEC-2026-0423.md): Cross-engine type confusion with host-created struct-types-with-supertypes (no CVSS, wasmtime)
- [RUSTSEC-2026-0424](https://cve.now/RUSTSEC-2026-0424.md): Unchecked memory usage in transferring borrowed resources between components (no CVSS, wasmtime)
- [RUSTSEC-2026-0427](https://cve.now/RUSTSEC-2026-0427.md): \`sn-releases\`: \`extract\_release\_archive\` writes archive entries without a path-traversal check (zip-slip) (no CVSS, sn-releases)
- [CVE-2026-118688](https://cve.now/CVE-2026-118688.md): Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename (CVSS 8.8, bytecodealliance wasmtime · wasmtime-wasi)
- [CVE-2026-116794](https://cve.now/CVE-2026-116794.md): russh: Agent server never calls \`Agent::confirm\`, so keys added with the confirm constraint (\`ssh-add -c\`) sign without confirmation (CVSS 8.3, Eugeny russh · russh)
- [RUSTSEC-2026-0415](https://cve.now/RUSTSEC-2026-0415.md): Unbounded memory use on large request bodies (no CVSS, juniper\_hyper)
- [RUSTSEC-2026-0416](https://cve.now/RUSTSEC-2026-0416.md): Stack overflow on deeply nested GraphQL documents (no CVSS, juniper)
- [RUSTSEC-2026-0417](https://cve.now/RUSTSEC-2026-0417.md): Excessive CPU and memory use on crafted GraphQL documents (no CVSS, juniper)
- [RUSTSEC-2026-0418](https://cve.now/RUSTSEC-2026-0418.md): libz-sys build script leaks environment variables in the build directory (no CVSS, libz-sys)
- [RUSTSEC-2026-0433](https://cve.now/RUSTSEC-2026-0433.md): Quadratic parsing of nested image wikilinks with \`ENABLE\_WIKILINKS\` (no CVSS, pulldown-cmark)
- [RUSTSEC-2026-0436](https://cve.now/RUSTSEC-2026-0436.md): Panic and unbounded allocation (OOM) in the CFB/OLE2 parser on malformed input (no CVSS, calamine)
- [CVE-2026-116775](https://cve.now/CVE-2026-116775.md): pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS) (CVSS 2.3, Eugeny russh · pageant)
- [CVE-2026-116774](https://cve.now/CVE-2026-116774.md): russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) (CVSS 4.3, Eugeny russh · russh)
- [CVE-2026-116773](https://cve.now/CVE-2026-116773.md): russh's SSH client is susceptible to unbounded allocations via EXT\_INFO packets (CVSS 4.3, Eugeny russh · russh)
- [CVE-2026-116696](https://cve.now/CVE-2026-116696.md): russh's SSH agent server is susceptible to unbound allocations via repeated SSH\_AGENT\_CONSTRAIN\_CONFIRM messages (CVSS 3.3, Eugeny russh · russh)
- [RUSTSEC-2026-0486](https://cve.now/RUSTSEC-2026-0486.md): xattr functions mark unwritten bytes as initialized when given a zero-length buffer (no CVSS, rustix)
- [CVE-2026-115909](https://cve.now/CVE-2026-115909.md): zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction (CVSS 7.5, zip-rs zip2 · zip)
- [CVE-2026-115908](https://cve.now/CVE-2026-115908.md): zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0) (CVSS 7.4, zip-rs zip2 · zip)
- [CVE-2026-115907](https://cve.now/CVE-2026-115907.md): zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size (CVSS 7.5, zip-rs zip2 · zip)
- [CVE-2026-115906](https://cve.now/CVE-2026-115906.md): zip: AES Entry HMAC Authentication Bypass on Premature EOF (CVSS 6.5, zip-rs zip2 · zip)
- [CVE-2026-115905](https://cve.now/CVE-2026-115905.md): zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File… (CVSS 10.0, zip-rs zip2 · zip)
- [RUSTSEC-2026-0412](https://cve.now/RUSTSEC-2026-0412.md): Arbitrary code execution when rerunning tests from a portable recording (no CVSS, cargo-nextest)
- [RUSTSEC-2026-0413](https://cve.now/RUSTSEC-2026-0413.md): Use-after-free of caller-owned server name in client connection constructors (no CVSS, rustls-ffi)
- [RUSTSEC-2026-0408](https://cve.now/RUSTSEC-2026-0408.md): Aliasing violations in splice, mutable iteration and cursors (no CVSS, skiplist)
- [RUSTSEC-2026-0409](https://cve.now/RUSTSEC-2026-0409.md): Use-after-free from a comparator that answers inconsistently (no CVSS, skiplist)
- [GHSA-H4FR-CMH5-QR62](https://cve.now/GHSA-H4FR-CMH5-QR62.md): Fallow: A \`.\*\` glob segment let an analyzed repository make Fallow test paths in the parent of the project root (low (no CVSS), fallow · @fallow-cli/fallow-node +3)
- [CVE-2026-115893](https://cve.now/CVE-2026-115893.md): Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm \`br\_table\` instruction (CVSS 9.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-115892](https://cve.now/CVE-2026-115892.md): Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type (CVSS 5.7, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-115889](https://cve.now/CVE-2026-115889.md): Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation (CVSS 9.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-115569](https://cve.now/CVE-2026-115569.md): Fallow: Jest and Vitest \`projects\` entries let an analyzed repository make Fallow read files outside the project root (CVSS 3.3, fallow-rs fallow · @fallow-cli fallow-node +6)
- [CVE-2026-115567](https://cve.now/CVE-2026-115567.md): Tokio: Race condition in \`tokio::time::Interval\` (CVSS 5.8, tokio-rs tokio · tokio)
- [RUSTSEC-2026-0387](https://cve.now/RUSTSEC-2026-0387.md): Multiple timing variability issues in operations intended to be constant-time (no CVSS, crypto-bigint)
- [CVE-2026-115392](https://cve.now/CVE-2026-115392.md): Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes (CVSS 8.8, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-115391](https://cve.now/CVE-2026-115391.md): Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams (CVSS 6.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-115390](https://cve.now/CVE-2026-115390.md): Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS (CVSS 6.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-115389](https://cve.now/CVE-2026-115389.md): Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API (CVSS 1.0, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-115386](https://cve.now/CVE-2026-115386.md): Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd\_readdir (CVSS 2.1, bytecodealliance wasmtime · wasmtime-wasi)
- [CVE-2026-115384](https://cve.now/CVE-2026-115384.md): Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow (CVSS 9.4, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-115383](https://cve.now/CVE-2026-115383.md): Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports (CVSS 5.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2026-115381](https://cve.now/CVE-2026-115381.md): Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes (CVSS 5.9, bytecodealliance wasmtime · wasmtime-wasi)
- [RUSTSEC-2026-0407](https://cve.now/RUSTSEC-2026-0407.md): SSRF and local file disclosure via unvalidated URLs (no CVSS, webpage)
- [RUSTSEC-2026-0411](https://cve.now/RUSTSEC-2026-0411.md): Out-of-bounds read in \`Log2Cache::nlog2n()\`, \`nlog2n\_difference()\` and \`plog2p()\` (no CVSS, dahl-salso)
- [RUSTSEC-2026-0457](https://cve.now/RUSTSEC-2026-0457.md): OAuth client SSRF filter checks host strings, not resolved addresses (no CVSS, rmcp)
- [CVE-2026-111943](https://cve.now/CVE-2026-111943.md): Distrust compromised intermediate certificates in crypto/x509 (CVSS 6.8, needs attention: First public exploit on GitHub Nov 5, Go standard library crypto/x509 · stdlib +3)
- [RUSTSEC-2026-0461](https://cve.now/RUSTSEC-2026-0461.md): Unbounded tool schema cache in Streamable HTTP server transport (no CVSS, rmcp)
- [CVE-2026-105299](https://cve.now/CVE-2026-105299.md): Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments (CVSS 8.7, https://github.com/cloudflare/pingora · pingora-proxy)
- [CVE-2026-105298](https://cve.now/CVE-2026-105298.md): Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass (CVSS 6.3, https://github.com/cloudflare/pingora · pingora-core)
- [CVE-2026-105297](https://cve.now/CVE-2026-105297.md): Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits (CVSS 7.5, https://github.com/cloudflare/pingora · pingora-core)
- [RUSTSEC-2026-0453](https://cve.now/RUSTSEC-2026-0453.md): Use-after-free in KV backends via leaked \`affinitypool::spawn\_local\` future (no CVSS, surrealdb)
- [RUSTSEC-2026-0534](https://cve.now/RUSTSEC-2026-0534.md): libp2p-gossipsub remote memory exhaustion via unbounded PRUNE backoff state (no CVSS, libp2p-gossipsub)
- [RUSTSEC-2026-0414](https://cve.now/RUSTSEC-2026-0414.md): Exponential event growth with \`ENABLE\_WIKILINKS\` (no CVSS, pulldown-cmark)
- [CVE-2026-95859](https://cve.now/CVE-2026-95859.md): rust-libp2p denial of service in Gossipsub via unbounded GRAFT topics (CVSS 8.7, rust-libp2p · libp2p-gossipsub)
- [RUSTSEC-2026-0391](https://cve.now/RUSTSEC-2026-0391.md): Data from an abandoned stream leaks into the next stream on a reused context (no CVSS, zstd)
- [RUSTSEC-2026-0392](https://cve.now/RUSTSEC-2026-0392.md): Uninitialized memory exposed by \`write::Decoder\` on a corrupt legacy frame (no CVSS, zstd)
- [RUSTSEC-2026-0393](https://cve.now/RUSTSEC-2026-0393.md): Out-of-bounds read when training a dictionary from inconsistent sample sizes (no CVSS, zstd)
- [RUSTSEC-2026-0395](https://cve.now/RUSTSEC-2026-0395.md): Use-after-free with \`CParameter::StableInBuffer\` (no CVSS, zstd-safe)
- [RUSTSEC-2026-0396](https://cve.now/RUSTSEC-2026-0396.md): \`Seekable\` reads a NULL or out-of-bounds seek table (no CVSS, zstd-safe)
- [RUSTSEC-2026-0397](https://cve.now/RUSTSEC-2026-0397.md): \`OutBuffer::around\_pos\` exposes uninitialized memory (no CVSS, zstd-safe)
- [RUSTSEC-2026-0398](https://cve.now/RUSTSEC-2026-0398.md): \`Seekable::decompress\` sets a \`Vec\` length beyond its capacity for offsets past the end (no CVSS, zstd-safe)
- [RUSTSEC-2026-0399](https://cve.now/RUSTSEC-2026-0399.md): Use-after-free through \`init\_using\_cdict\` and \`init\_using\_ddict\` (no CVSS, zstd-safe)
- [RUSTSEC-2026-0400](https://cve.now/RUSTSEC-2026-0400.md): Use-after-free of a dictionary after a one-shot call on a context with an open stream (no CVSS, zstd-safe)
- [RUSTSEC-2026-0401](https://cve.now/RUSTSEC-2026-0401.md): Out-of-bounds read in \`train\_from\_buffer\` when sample sizes overflow (no CVSS, zstd-safe)
- [RUSTSEC-2026-0402](https://cve.now/RUSTSEC-2026-0402.md): Heap buffer overflow in \`CCtx::try\_clone\` on a multithreaded context (no CVSS, zstd-safe)
- [RUSTSEC-2026-0403](https://cve.now/RUSTSEC-2026-0403.md): Uninitialized memory exposed when streaming decompression of a legacy frame fails (no CVSS, zstd-safe)
- [RUSTSEC-2026-0404](https://cve.now/RUSTSEC-2026-0404.md): Double free in \`DCtx::try\_clone\` (no CVSS, zstd-safe)
- [RUSTSEC-2026-0405](https://cve.now/RUSTSEC-2026-0405.md): Out-of-bounds read with an out-of-range \`InBuffer::pos\` (no CVSS, zstd-safe)
- [RUSTSEC-2026-0406](https://cve.now/RUSTSEC-2026-0406.md): Use-after-free when changing a multithreaded context with an unfinished frame (no CVSS, zstd-safe)
- [RUSTSEC-2026-0410](https://cve.now/RUSTSEC-2026-0410.md): WebAssembly allocator shim corrupts memory on allocation failure (no CVSS, zstd-sys)
- [RUSTSEC-2026-0356](https://cve.now/RUSTSEC-2026-0356.md): Panic on erroneous call-to-host from guest realloc call (no CVSS, wasmtime)
- [RUSTSEC-2026-0363](https://cve.now/RUSTSEC-2026-0363.md): Component-model handle tables are capped only per instance and charged to no limit (no CVSS, wasmtime)
- [RUSTSEC-2026-0364](https://cve.now/RUSTSEC-2026-0364.md): Exception tags can cause host data structures to be unaligned (no CVSS, wasmtime)
- [RUSTSEC-2026-0444](https://cve.now/RUSTSEC-2026-0444.md): \`astral-tl\` is unmaintained (no CVSS, astral-tl)
- [GHSA-C9XM-49CP-XCR9](https://cve.now/GHSA-C9XM-49CP-XCR9.md): rmcp OAuth client fetches server-controlled resource\_metadata URLs (medium (no CVSS), rmcp)
- [RUSTSEC-2026-0441](https://cve.now/RUSTSEC-2026-0441.md): \`pin-utils\` is unmaintained (no CVSS, pin-utils)
- [RUSTSEC-2026-0523](https://cve.now/RUSTSEC-2026-0523.md): quinn-proto denial of service via crafted MAX\_STREAM\_DATA frame (no CVSS, quinn-proto)
- [RUSTSEC-2026-0524](https://cve.now/RUSTSEC-2026-0524.md): quinn-proto memory exhaustion and panic in QUIC client retry handling (no CVSS, quinn-proto)
- [RUSTSEC-2026-0538](https://cve.now/RUSTSEC-2026-0538.md): Quinn UDP denial of service in receive loop via oversized datagram (no CVSS, quinn-udp)
- [RUSTSEC-2026-0394](https://cve.now/RUSTSEC-2026-0394.md): Build environment compiled into the library and readable at runtime (no CVSS, rustpython-vm)
- [RUSTSEC-2026-0489](https://cve.now/RUSTSEC-2026-0489.md): Panic when an SVCB or HTTPS parameter value is a single quote character (no CVSS, hickory-proto)
- [RUSTSEC-2026-0491](https://cve.now/RUSTSEC-2026-0491.md): Memory amplification from record counts in the DNS message header (no CVSS, hickory-proto)
- [RUSTSEC-2026-0437](https://cve.now/RUSTSEC-2026-0437.md): Rejected authentication challenges can poison the Key Vault scope cache (no CVSS, azure\_security\_keyvault\_certificates)
- [RUSTSEC-2026-0438](https://cve.now/RUSTSEC-2026-0438.md): Rejected authentication challenges can poison the Key Vault scope cache (no CVSS, azure\_security\_keyvault\_secrets)
- [RUSTSEC-2026-0439](https://cve.now/RUSTSEC-2026-0439.md): Rejected authentication challenges can poison the Key Vault scope cache (no CVSS, azure\_security\_keyvault\_keys)
- [RUSTSEC-2026-0482](https://cve.now/RUSTSEC-2026-0482.md): Paths or symlinks ending in a slash escape the sandbox (no CVSS, cap-primitives)
- [GHSA-QWGH-2VCV-G2F7](https://cve.now/GHSA-QWGH-2VCV-G2F7.md): block\_buffer: panic corrupts inline buffer position (medium (no CVSS), block\_buffer)
- [CVE-2026-20765](https://cve.now/CVE-2026-20765.md): Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of… (CVSS 4.6, Intel(R) TDX Guest software · tdx-guest)
- [CVE-2026-20763](https://cve.now/CVE-2026-20763.md): Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation… (CVSS 4.6, Intel(R) TDX Guest software · tdx-guest)
- [CVE-2026-63759](https://cve.now/CVE-2026-63759.md): SurrealDB before 3.1.0 Denial of Service nested type annotations (CVSS 7.1, surrealdb)
- [CVE-2026-63757](https://cve.now/CVE-2026-63757.md): SurrealDB before 3.1.0 Session Hijacking via /rpc sessions (CVSS 8.7, surrealdb)
- [CVE-2026-63756](https://cve.now/CVE-2026-63756.md): SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition (CVSS 9.2, surrealdb)
- [CVE-2026-63754](https://cve.now/CVE-2026-63754.md): SurrealDB before 3.1.0 Denial of Service via LIVE Query (CVSS 7.1, surrealdb)
- [CVE-2026-63753](https://cve.now/CVE-2026-63753.md): SurrealDB before 3.1.0 Authentication Bypass via LIVE Query (CVSS 5.3, surrealdb)
- [CVE-2026-63752](https://cve.now/CVE-2026-63752.md): SurrealDB before 3.1.0 RELATE Statement Record Overwrite (CVSS 5.3, surrealdb)
- [CVE-2026-63750](https://cve.now/CVE-2026-63750.md): SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket (CVSS 6.9, surrealdb)
- [CVE-2026-63749](https://cve.now/CVE-2026-63749.md): SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT (CVSS 5.3, surrealdb)
- [CVE-2026-63747](https://cve.now/CVE-2026-63747.md): SurrealDB before 3.1.0 Denial of Service via malformed RPC use (CVSS 8.7, surrealdb)
- [CVE-2026-63745](https://cve.now/CVE-2026-63745.md): SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id (CVSS 5.3, surrealdb)
- [CVE-2026-63744](https://cve.now/CVE-2026-63744.md): SurrealDB before 3.1.5 SSRF via JWKS URL Redirect (CVSS 5.1, surrealdb)
- [CVE-2026-63742](https://cve.now/CVE-2026-63742.md): SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNT (CVSS 5.3, surrealdb)
- [CVE-2026-63741](https://cve.now/CVE-2026-63741.md): SurrealDB before 3.1.0 Authentication Bypass via USE statement (CVSS 6.9, surrealdb)
- [CVE-2026-63739](https://cve.now/CVE-2026-63739.md): SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER (CVSS 8.3, surrealdb)
- [CVE-2026-63737](https://cve.now/CVE-2026-63737.md): SurrealDB before 3.1.5 Denial of Service via deep operator chains (CVSS 7.1, surrealdb)
- [CVE-2026-63309](https://cve.now/CVE-2026-63309.md): SurrealDB \< 3.1.5 Information Disclosure via ORDER BY (CVSS 5.3, surrealdb)
- [RUSTSEC-2026-0044](https://cve.now/RUSTSEC-2026-0044.md): AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN (no CVSS, aws-lc-sys)
- [CVE-2026-2835](https://cve.now/CVE-2026-2835.md): HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing (CVSS 9.3, https://github.com/cloudflare/pingora · pingora-core)
- [CVE-2023-0286](https://cve.now/CVE-2023-0286.md): X.400 address type confusion in X.509 GeneralName (CVSS 7.4, OpenSSL · cryptography +1)
- [CVE-2021-3711](https://cve.now/CVE-2021-3711.md): SM2 Decryption Buffer Overflow (CVSS 9.8, OpenSSL · openssl-src)
- [CVE-2020-26235](https://cve.now/CVE-2020-26235.md): Segmentation fault in Rust time crate (CVSS 5.3, time-rs time · time)
- [CVE-2020-8927](https://cve.now/CVE-2020-8927.md): Buffer overflow in Brotli library (CVSS 5.3, Google Brotli · brotli +122)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/crates.io
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.