assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-68930 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-68930 Source advisory: OSV:GHSA-M65R-RPRJ-R5RG...

bitcoin-nostr-relay (0.1.1), kormir (>=0.1.0, <=1.0.11) +5 more potentially affected by unknown CVE via nostr (>=0.1.5, <=0.40.0)

nostr CARGO version =0.1.5, =0.1.0, =0.2.6, =0.0.1, =0.1.6, =0.19.0, =0.21.0 - nostr-web 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0225...

bitcoin-nostr-relay (0.1.1), kormir (>=0.1.0, <=1.0.11) +5 more potentially affected by unknown CVE via nostr (>=0.1.5, <=0.40.0)

nostr CARGO version =0.1.5, =0.1.0, =0.2.6, =0.0.1, =0.1.6, =0.19.0, =0.21.0 - nostr-web 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0228...

bitcoin-nostr-relay (0.1.1), kormir (>=0.1.0, <=1.0.11) +5 more potentially affected by unknown CVE via nostr (>=0.1.5, <=0.40.0)

nostr CARGO version =0.1.5, =0.1.0, =0.2.6, =0.0.1, =0.1.6, =0.19.0, =0.21.0 - nostr-web 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0227...

bitcoin-nostr-relay (0.1.1), kormir (>=0.1.0, <=1.0.11) +5 more potentially affected by unknown CVE via nostr (>=0.1.5, <=0.40.0)

nostr CARGO version =0.1.5, =0.1.0, =0.2.6, =0.0.1, =0.1.6, =0.19.0, =0.21.0 - nostr-web 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0230...

bitcoin-nostr-relay (0.1.1), kormir (>=0.1.0, <=1.0.11) +5 more potentially affected by unknown CVE via nostr (>=0.1.5, <=0.40.0)

nostr CARGO version =0.1.5, =0.1.0, =0.2.6, =0.0.1, =0.1.6, =0.19.0, =0.21.0 - nostr-web 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0229...

chatgpt-panic-hook (>=0.1.1, <=0.1.5), formation-chess-web (0.2.0) +5 more potentially affected by unknown CVE via webbrowser (1.0.0)

webbrowser CARGO version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on webbrowser and may be impacted: - chatgpt-panic-hook =0.1.1, =0.13.2, =0.1.0, =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0257...

Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of gix

Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.92.0.2 and 1.94.0.0 uses gix and gix-submodule crates that are vulnerable to command injection. Vulnerability Details CVEID:CVE-2026-40034 DESCRIPTION: gix-submodule before 0.29.0 gitoxide before 0.5.21, gix before 0.84.0...

Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of the cargo crate

Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.92.0.2 and 1.94.0.0 ships a version of the cargo crate that incorrectly handles symlinks inside tar balls. Vulnerability Details CVEID:CVE-2026-5222 DESCRIPTION: Cargo between 1.68 and 1.96 incorrectly normalized the URLs of...

anansi (>=0.10.0, <=0.14.2), anansi-core (>=0.10.0, <=0.14.2) +77 more potentially affected by CVE-2026-46428 via lettre (>=0.10.1, <=0.10.4)

lettre CARGO version =0.10.1, =0.10.0, =0.10.0, =0.1.0, =0.111.0, =0.1.2, =1.6.0, =1.0.0, =1.3.0-beta1, =1.6.4, =0.0.1, =0.1.0, =0.1.1 and more Source cves: CVE-2026-46428 Source advisory: OSV:GHSA-4PJ9-G833-QX53...

CVE-2026-65925

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...

CVE-2026-65925 Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...

CVE-2026-65925

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...

CVE-2026-65925 Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...

CVE-2026-65925

CVE-2026-65925 describes a Server-Side Request Forgery (SSRF) in JFrog Artifactory when using the Cargo remote repository. A user with read access to the Cargo remote repository could cause Artifactory to request unintended URLs and return the response. The CVSS 3.1 vector is NETWORK, PRIVILEGES ...

EUVD-2026-49577

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...

PT-2026-65113

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...

GHSA-4W2J-M93H-CJ5J vulnerabilities

Vulnerabilities for packages: asciinema, sccache, zola, komodo, pixi, xh, berg, cargo-audit, garage, deno...

GHSA-4W2J-M93H-CJ5J vulnerabilities

Vulnerabilities for packages: deno, sccache, pixi, zola, cargo-audit, xh, berg...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rust: cargo-1.97.1-2.hum1 aarch64, x8664 clippy-1.97.1-2.hum1 aarch64, x8664 rust-1.97.1-2.hum1 aarch64, x8664 rust-analyzer-1.97.1-2.hum1 aarch64, x8664 rust-debugger-common-1.97.1-2.hum1 noarch...