Medium: rust

Issue Overview: gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-controlled symlink into any existing directory the user has write access to. During checkout, all symlin...

Medium: rust

Issue Overview: gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-controlled symlink into any existing directory the user has write access to. During checkout, all symlin...

Amazon Linux 2023 : clamav1.5, clamav1.5-data, clamav1.5-devel (ALAS2023-2026-1870)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1870 advisory. rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive and PkeyCtxRef::derive sets len = buf.len and passes it as the in/out...

Amazon Linux 2 : rust, --advisory ALAS2-2026-3375 (ALAS-2026-3375)

The version of rust installed on the remote host is prior to 1.96.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3375 advisory. gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked ou...

Important: clamav1.5

Issue Overview: rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive and PkeyCtxRef::derive sets len = buf.len and passes it as the in/out length to EVPPKEYderive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, D...

a-gpt (>=0.1.0, <=0.4.0), abd-clam (>=0.21.6, <=0.21.7) +2939 more potentially affected by unknown CVE via memmap2 (>=0.1.0, <=0.9.10)

memmap2 CARGO version =0.1.0, =0.1.0, =0.21.6, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.2, =0.23.0, =0.23.0, =1.0.5, =0.18.0, =0.20.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0186...

SUSE SLED15 / SLES15 Security Update : rustup (SUSE-SU-2026:2441-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:2441-1 advisory. This update for rustup fixes the following issues - CVE-2026-25727: time: parsing of user-provided input by the RFC 282...

alass-util (0.3.0), cervo (>=0.1.0, <=0.5.1) +17 more potentially affected by CVE-2026-55832 via tract-onnx (>=0.1.1, <=0.20.7)

tract-onnx CARGO version =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.2.0, =1.2.0, =0.4.0, =0.2.0, =0.1.1, =0.19.0-alpha.8, =0.19.0-alpha.8, =0.20.7 and more Source cves: CVE-2026-55832 Source advisory: OSV:GHSA-H668-6X6G-F8R5...

GHSA-93G4-M6XV-CMVR CedarJava has type confusion vulnerability

Summary CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, improper input handling could allow type confusion across the Java-Rust FFI boundary. Impact Record-to-Entity type confusion across the...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' through improper handling of reserved keys in the JSON protocol when serializing CedarMap. An attacker can cause unauthorized access or manipulation of data by supplying...

CedarJava has type confusion vulnerability

Summary CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, improper input handling could allow type confusion across the Java-Rust FFI boundary. Impact Record-to-Entity type confusion across the...

PT-2026-50975

Name of the Vulnerable Software and Affected Versions CedarJava versions prior to 2.3.6 CedarJava versions prior to 3.4.1 CedarJava versions prior to 4.9 Description Improper input handling allows Record-to-Entity type confusion across the Java-Rust FFI Foreign Function Interface boundary...

alass-util (0.3.0), cervo (>=0.1.0, <=0.5.1) +25 more potentially affected by CVE-2026-55093 via tract-nnef (>=0.10.10, <=0.20.7)

tract-nnef CARGO version =0.10.10, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.2.0, =1.2.0, =0.4.0, =0.2.0, =0.10.0, =0.19.0-alpha.8, =0.11.0, =0.12.5 and more Source cves: CVE-2026-55093 Source advisory: OSV:GHSA-X5MV-8WGW-29HG...

INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023

Cybersecurity researchers have charted the evolution of INC from an nascent ransomware-as-a-service RaaS operation to one of the most prolific cybercrime groups in 2026, claiming no less than 830 victims since August 2023. "The disruption of LockBit and the shutdown of BlackCat created...

alass-util (0.3.0), cervo (>=0.1.0, <=0.5.1) +25 more potentially affected by CVE-2026-55093 via tract-nnef (>=0.10.10, <=0.20.7)

tract-nnef CARGO version =0.10.10, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.2.0, =1.2.0, =0.4.0, =0.2.0, =0.10.0, =0.19.0-alpha.8, =0.11.0, =0.12.5 and more Source cves: CVE-2026-55093 Source advisory: OSV:RUSTSEC-2026-0217...

SUSE-SU-2026:2441-1 Security update for rustup

This update for rustup fixes the following issues - CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion bsc1257902. - rust-shlex: Multiple issues involving quote API RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27 bsc1230032...

Security update for rustup

This update for rustup fixes the following issues CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion bsc1257902. rust-shlex: Multiple issues involving quote API RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27 bsc1230032. Patch Instructions: To...

Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments

An unknown threat actor has been observed leveraging paid or promoted posts on legitimate news websites to drum up buzz for their warez, according to new findings from Check Point Research. The threat actor also has at their disposal a dedicated WordPress phishing page that acts as the central hu...

The vulnerability of the Cargo package manager in the Rust programming language arises from deficiencies in the mechanism for handling symbolic references, allowing an attacker to execute arbitrary code.

The vulnerability of the Cargo package manager in the Rust programming language is related to deficiencies in the mechanism for handling symbolic references. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Cargo package manager in the Rust programming language arises from the use of non-canonical URL paths for authentication solutions. This allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Cargo package manager in the Rust programming language is related to the use of non-canonical URL paths for authentication solutions. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...