Brains (>=0.1.0 <=0.2.0), MFEKmath (>=0.1.0 <=0.1.1) +1604 more potentially affected by CVE-2026-33055 via tar (>=0.2.14 <=0.4.40)

tar CARGO version =0.2.14, =0.1.0, =0.1.0, =0.1.0, =0.10.2, =0.1.0, =0.1.2, =0.23.0, =0.23.0, =0.9.0, =1.2.0, =0.5.4, =0.5.4, =1.0.1 and more Source cves: CVE-2026-33055 Source advisory: OSV:RUSTSEC-2026-0068...

Brains (>=0.1.0 <=0.2.0), MFEKmath (>=0.1.0 <=0.1.1) +1604 more potentially affected by CVE-2026-33056 via tar (>=0.2.14 <=0.4.40)

tar CARGO version =0.2.14, =0.1.0, =0.1.0, =0.1.0, =0.10.2, =0.1.0, =0.1.2, =0.23.0, =0.23.0, =0.9.0, =1.2.0, =0.5.4, =0.5.4, =1.0.1 and more Source cves: CVE-2026-33056 Source advisory: OSV:RUSTSEC-2026-0067...

acril (=0.1.0), acril-http (=0.1.0) +883 more potentially affected by unknown CVE via http-types (>=1.3.1 <=2.12.0)

http-types CARGO version =1.3.1, =4.0.0, =0.1.0, =0.1.0, =0.3.0, =0.10.0, =0.3.0, =0.1.0, =0.1.0, =0.6.0, =0.0.1, =0.0.6 - aquadoggo =0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0174...

Five Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets

Cybersecurity researchers have discovered five malicious Rust crates that masquerade as time-related utilities to transmit .env file data to the threat actors. The Rust packages, published to crates.io, are listed below - chronoanchor dnp3times timecalibrator timecalibrators time-sync The crates,...

bws-web-server (>=0.1.0 <=0.1.1), pingora (>=0.1.0 <=0.6.0) +6 more potentially affected by CVE-2026-2835 via pingora-core (>=0.1.1 <=0.6.0)

pingora-core CARGO version =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.7 - revoke-gateway =0.3.0 - static-files-module =0.1.0 Source cves: CVE-2026-2835 Source advisory: OSV:RUSTSEC-2026-0034...

[SECURITY] Fedora 43 Update: rust-ingredients-0.2.2-2.fc43

Check ingredients of published Rust crates...

Fedora 43 : asciinema / atuin / bustle / envision / glycin / greetd / helix / etc (2026-f400579a21)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-f400579a21 advisory. - Update the time crate to version 0.3.47. - Update the time-macros crate to version 0.2.27. - Update the time-core crate to version 0.1.8. - Update...

a-gpt (>=0.1.0 <=0.4.0), abacuz (=0.1.1) +1061 more potentially affected by unknown CVE via git2 (>=0.10.0 <=0.1.21)

git2 CARGO version =0.10.0, =0.1.0, =1.1.0, =0.0.1, =0.3.0, =1.0.0, =0.1.0, =0.3.3 - amisgitpm =0.0.1 - amp =0.6.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-J39J-6GW9-JW6H...

aperture-shared (=0.1.0), assemblylift-awslambda-host (>=0.2.0 <=0.3.0) +98 more potentially affected by unknown CVE via capnp (>=0.0.1 <=0.23.2)

capnp CARGO version =0.0.1, =0.2.0, =0.3.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.0.1, =0.1.0, =0.0.1, =0.4.0, =0.5.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5W5R-MF82-595P...

acmer (>=0.0.1 <=0.0.16), dynamo-es (>=0.3.0 <=0.4.8) +11 more potentially affected by unknown CVE via aws-sdk-dynamodb (>=0.0.25-alpha <=0.9.0)

aws-sdk-dynamodb CARGO version =0.0.25-alpha, =0.0.1, =0.3.0, =0.1.0, =0.1.0, =0.8.0, =0.1.0, =0.3.0, =0.1.3, =0.0.1, =3.0.0, =4.2.8 - steel-plate =0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-G59M-GF8J-GJF5...

acme-compilers (>=0.2.2 <=0.2.4), acvm (>=0.23.0 <=0.26.1) +286 more potentially affected by unknown CVE via rkyv (>=0.1.1 <=0.7.45)

rkyv CARGO version =0.1.1, =0.2.2, =0.23.0, =0.23.0, =0.0.1, =0.2.0, =0.39.0, =0.23.0, =0.26.1 - cairn-import-geonames =0.0.2-alpha - cairn-import-oa =0.0.2-alpha - cairn-import-osm =0.0.2-alpha - cairn-import-wof =0.0.2-alpha and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-00...

lunarbase-pmm-math (>=0.1.0 <=0.2.4), ruint-macro (=0.1.1) +5 more potentially affected by unknown CVE via ruint (>=0.1.0 <=1.16.0)

ruint CARGO version =0.1.0, =0.1.0, =0.3.0, =0.3.0, =0.1.0, =0.3.0, =0.1.0, =0.5.1 Source cves: unknown CVE Source advisory: OSV:GHSA-9FJQ-45QV-PCM7...

aperture-shared (=0.1.0), assemblylift-awslambda-host (>=0.2.0 <=0.3.0) +98 more potentially affected by unknown CVE via capnp (>=0.0.1 <=0.23.2)

capnp CARGO version =0.0.1, =0.2.0, =0.3.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.0.1, =0.1.0, =0.0.1, =0.4.0, =0.5.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0143...

Cryptonic (>=0.1.0 <=0.1.2), IMAPServer (=0.1.0) +6348 more potentially affected by unknown CVE via bincode (>=0.0.1 <=3.0.0)

bincode CARGO version =0.0.1, =0.1.0, =0.19.0, =0.4.1, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0141...

actix-web-location (>=0.1.0 <=0.7.0), bext-waf (=0.2.0) +18 more potentially affected by unknown CVE via maxminddb (>=0.12.0 <=0.24.0)

maxminddb CARGO version =0.12.0, =0.1.0, =0.1.3, =1.5.1, =0.1.0, =0.7.0, =0.4.0, =0.0.1, =0.1.8, =0.3.0, =0.5.0, =0.1.0, =0.1.0, =0.1.0, =0.5.7 and more Source cves: unknown CVE Source advisory: OSV:GHSA-MJ73-J457-8X9Q...

actix-web-location (>=0.1.0 <=0.7.0), bext-waf (=0.2.0) +18 more potentially affected by unknown CVE via maxminddb (>=0.12.0 <=0.24.0)

maxminddb CARGO version =0.12.0, =0.1.0, =0.1.3, =1.5.1, =0.1.0, =0.7.0, =0.4.0, =0.0.1, =0.1.8, =0.3.0, =0.5.0, =0.1.0, =0.1.0, =0.1.0, =0.5.7 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0132...

actix-web-opentelemetry (>=0.2.0 <=0.17.0), atomic-server (>=0.32.1 <=0.34.0) +39 more potentially affected by unknown CVE via opentelemetry-jaeger (>=0.10.0 <=0.9.0)

opentelemetry-jaeger CARGO version =0.10.0, =0.2.0, =0.32.1, =0.2.1, =4.1.0, =0.1.0, =0.4.0-prerelease1, =0.3.2, =0.2.0-rc-8, =0.2.0-rc-9, =0.2.0-rc-10, =0.2.0-rc, =0.1.0, =0.31.0, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0123...

Fedora 42 : python-uv-build / ruff / rust-get-size-derive2 / rust-get-size2 / etc (2025-e60a4ba4d7)

The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-e60a4ba4d7 advisory. uv / python-uv-build 0.9.7 https://github.com/astral-sh/uv/releases/tag/0.9.7 0.9.6 This release contains an upgrade to Astral's fork of asynczip, which...

card-backend-scdc (>=0.4.0 <=0.5.0), cfs_openpgp (=0.1.0) +43 more potentially affected by CVE-2025-67897 via sequoia-openpgp (>=0.11.0 <=1.22.0)

sequoia-openpgp CARGO version =0.11.0, =0.4.0, =0.0.1, =0.5.0, =0.3.0, =0.12.0, =0.1.0, =0.10.1, =0.10.1, =0.0.1, =0.0.1, =0.2.2 and more Source cves: CVE-2025-67897 Source advisory: OSV:RUSTSEC-2025-0136...

alpha-g-analysis (=0.1.0), apecrunch (>=0.0.1 <=0.0.3) +179 more potentially affected by unknown CVE via ncurses (>=5.101.0 <=6.0.1)

ncurses CARGO version =5.101.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.8.7 - btui =0.6.5 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0108...