CVE-2026-53600

async-tar (crates.io), a tar archive reading/writing library for async Rust, is vulnerable in versions

RUSTSEC-2026-0278 `zbus_polkit`: authorization bypass via PID reuse

Subject::newforowner in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer D-Bus type u, whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer D-Bus type i. Because of this type mismatch, polkit silently...

GHSA-9PWQ-GCRX-WGHH Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

A soundness bug in buffa's OwnedView allowed safe Rust code to trigger a use-after-free. The OwnedView::decode constructor transmuted a borrowed slice to &'static u8, and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields such as &'static str and &'static u8 to...

UBUNTU-CVE-2026-82253

gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.findb"..", allowing crafted names such as 'a..b/../../../.git/' to bypass the check;...

actix-postgres (>=0.1.0, <=0.4.0), actyx_sdk (>=0.1.0, <=0.3.0) +567 more potentially affected by unknown CVE via postgres-protocol (>=0.4.0, <=0.6.10)

postgres-protocol CARGO version =0.4.0, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.4.0, =0.1.1, =0.4.0, =0.4.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5X78-73V4-XG6W...

UBUNTU-CVE-2026-77651

The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

openSUSE 16: git-cliff / git-cliff-bash-completion / git-cliff-fish-completion / etc (openSUSE-SU-2026:21584-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21584-1 advisory. Changes in git-cliff: - Update to version 2.13.1: Support more configuration file locations Add per-commit statistics Expose determined bump typ...

avml (>=0.4.1, <=0.6.1), azure_data_cosmos (0.1.0) +241 more potentially affected by unknown CVE via azure_core (0.1.1)

azurecore CARGO version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on azurecore and may be impacted: - avml =0.4.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0 and more Source cves: unknown CVE Source advisory:...

OPENSUSE-SU-2026:11528-1 wasm-bindgen-0.2.100-2.1 on GA media

These are all security issues fixed in the wasm-bindgen-0.2.100-2.1 package on the GA media of openSUSE Tumbleweed...

sp-im (>=0.2.0, <=0.3.0), yatima-core (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via sp-sized-chunks (0.1.0)

sp-sized-chunks CARGO version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on sp-sized-chunks and may be impacted: - sp-im =0.2.0, =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0270...

AZL-95631 CVE-2026-70622 affecting package rust for versions less than 1.96.0-1

tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::appenddirall function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrust...

AZL-95628 CVE-2026-70622 affecting package rust for versions less than 1.75.0-30

tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::appenddirall function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrust...

AZL-95592 CVE-2026-70622 affecting package clamav 1.5.4-2

tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::appenddirall function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrust...

UBUNTU-CVE-2026-70622

tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::appenddirall function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrust...

[SECURITY] Fedora 43 Update: rust-rpki-0.19.3-2.fc43

A library for validating and creating RPKI data...

[SECURITY] Fedora 44 Update: rust-rpki-0.19.3-2.fc44

A library for validating and creating RPKI data...

actix-prost (>=0.1.0, <=0.3.2), adns-server (>=0.1.0, <=0.3.0) +1309 more potentially affected by unknown CVE via serde_with (>=2.3.3, <=3.14.1)

serdewith CARGO version =2.3.3, =0.1.0, =0.1.0, =0.1.0, =0.40.23-1, =0.1.5, =0.4.0, =0.0.1, =1.0.0, =0.0.7, =0.1.1, =0.1.1, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-7GCF-G7XR-8HXJ...

coreutils (>=0.0.14, <=0.0.16) potentially affected by CVE-2026-35370 via uu_id (>=0.0.14, <=0.0.16)

uuid CARGO version =0.0.14, =0.0.14, =0.0.16 Source cves: CVE-2026-35370 Source advisory: OSV:GHSA-47C7-QRM7-MQW7...

[SECURITY] Fedora 43 Update: rust-reqsign-aws-v4-3.0.1-2.fc43

AWS SigV4 signing implementation for reqsign...

CVE-2026-46673

Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth...