avml (>=0.4.1, <=0.6.1), azure_data_cosmos (0.1.0) +241 more potentially affected by unknown CVE via azure_core (0.1.1)

azurecore CARGO version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on azurecore and may be impacted: - avml =0.4.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0 and more Source cves: unknown CVE Source advisory:...

OPENSUSE-SU-2026:11528-1 wasm-bindgen-0.2.100-2.1 on GA media

These are all security issues fixed in the wasm-bindgen-0.2.100-2.1 package on the GA media of openSUSE Tumbleweed...

AZL-95628 CVE-2026-70622 affecting package rust 1.75.0-31

tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::appenddirall function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrust...

AZL-95631 CVE-2026-70622 affecting package rust 1.96.1-1

tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::appenddirall function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrust...

AZL-95592 CVE-2026-70622 affecting package clamav 1.5.4-2

tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::appenddirall function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrust...

coreutils (>=0.0.14, <=0.0.16) potentially affected by CVE-2026-35370 via uu_id (>=0.0.14, <=0.0.16)

uuid CARGO version =0.0.14, =0.0.14, =0.0.16 Source cves: CVE-2026-35370 Source advisory: OSV:GHSA-47C7-QRM7-MQW7...

[SECURITY] Fedora 43 Update: rust-reqsign-aws-v4-3.0.1-2.fc43

AWS SigV4 signing implementation for reqsign...

CVE-2026-46673

Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth...

Amazon Linux 2023 : papers, papers-devel, papers-libs (ALAS2023-2026-1782)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1782 advisory. CVE-2026-46529 is a command injection vulnerability in Evince, Atril, and Xreader caused by missing quoting of shell-like input in evspawn in ev-application.c. CVE-2026-46529 An unsoundness issue...

[SECURITY] Fedora 44 Update: rust-astral_async_http_range_reader-0.11.0-2.fc44

A library for streaming reading of files over HTTP using range requests...

[SECURITY] Fedora 43 Update: rust-astral_async_http_range_reader-0.11.0-2.fc43

A library for streaming reading of files over HTTP using range requests...

CVE-2026-44983 smallbitvec: Safe API Triggered Heap Buffer Overflow via Integer Overflow

smallbitvec is a growable bit-vector for Rust, optimized for size. From 1.0.1 to 2.6.0, an integer overflow in the internal capacity calculation of smallbitvec can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only. This allows memory corruption...

[SECURITY] Fedora 43 Update: rust-rpki-0.18.6-4.fc43

A library for validating and creating RPKI data...

[SECURITY] Fedora 42 Update: rust-astral-tokio-tar-0.6.1-1.fc42

A Rust implementation of an async TAR file reader and writer. This library does not currently handle compression, but it is abstract over all I/O readers and writers. Additionally, great lengths are taken to ensure that the entire contents are never required to be entirely resident in memory all ...

MAL-2026-3431 Malicious code in apkeep (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d545ff7c3c178485cfb49d0028c4c808e67d0ee0fddcb4b7b195c943bb07d888 The package pretends to be a fork of a legitimate Rust library and uses the identity of the original authors. During usage, the obfuscated code targets...

Malicious code in apkeep (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d545ff7c3c178485cfb49d0028c4c808e67d0ee0fddcb4b7b195c943bb07d888 The package pretends to be a fork of a legitimate Rust library and uses the identity of the original authors. During usage, the obfuscated code targets...

ironhide (>=1.0.0, <=1.0.7), rorm-cli (0.5.0) +1 more potentially affected by unknown CVE via rpassword (>=7.0.0, <=7.2.0)

rpassword CARGO version =7.0.0, =1.0.0, =0.1.0, =0.1.4 Source cves: unknown CVE Source advisory: OSV:GHSA-2P6R-X3VV-XQM2...

RUSTSEC-2026-0127 Integer overflow in `array::ReadWrite::new()` leading to potential memory corruption

In array::ReadWrite::new line 83 of accessor/src/array.rs, let bytes = mem::sizeof:: len can overflow usize when len is very large. In release mode, this silently wraps, potentially making bytes = 0. The mapper then maps with 0 bytes, and subsequent accesses e.g. readvolatileat lead to undefined...

The vulnerability of the libp2p-rust library server allows a hacker to trigger a service failure.

The vulnerability of the libp2p-rust library server is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Medium: rust-below

Issue Overview: tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size...