xmloxide

xmloxide libxml2 の純Rust再実装 — オープンソース世界で事実上の標準XML/HTMLパースライブラリです。 libxml2は2025年12月に公式メンテナンス終了となり、既知のセキュリティ問題を抱えています。xmloxideは、メモリ安全かつ高性能で、同じ適合性テストスイートを通過する代替品を目指します。 特徴 メモリ安全 — アリーナベースのツリーで、公開APIにunsafeを一切含みません 適合性 — W3C XML適合性テストスイートで100%の合格率（1727/1727の該当テスト） エラーリカバリ —...

a2 (>=0.2.0, <=0.5.0-alpha.7), abci (>=0.5.3, <=0.7.1) +3108 more potentially affected by unknown CVE via tokio-timer (>=0.1.2, <=0.3.0-alpha.6)

tokio-timer CARGO version =0.1.2, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.8.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0060...

RUSTSEC-2026-0053 `tokio-tls` is unmaintained

The tokio-tls crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...

RUSTSEC-2025-0153 hexchat crate is unsound and unmaintained

All versions of this crate have function deregistercommand which can result in use after free. This is unsound. In addition, all versions since 0.3.0 have "safe" macros, which are documented as unsafe to use in threads. In addition, the hexchat crate is no longer actively maintained. If you rely ...

EUVD-2019-19111

Malware in sbrugna...

EUVD-2019-19110

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2024-43407

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A potential vulnerability has been discovered in CKEditor 4 Code Snippet GeSHi plugin. The...

CVE-2019-9748

In tinysvcmdns through 2018-01-16, an mDNS server processing a crafted packet can perform arbitrary data read operations up to 16383 bytes from the start of the buffer. This can lead to a segmentation fault in uncompressnlabel in mdns.c and a crash of the server depending on the memory protection...

Multiple soundness issues

fast-float contains multiple soundness issues: 1. Undefined behavior when checking input length, which has been merged but no package pubished. 1. Many functions marked as safe with non-local safety guarantees The library is also unmaintained. Alternatives For quickly parsing floating-point numbe...

olm-sys: wrapped library unmaintained, potentially vulnerable

After several cryptographic vulnerabilities in libolm were disclosed publicly, the Matrix Foundation has officially deprecated the library. olm-sys is a thin wrapper around libolm and is now deprecated and potentially vulnerable in kind. Users of olm-sys and its higher-level abstraction, olm-rs,...

acari-lib (>=0.1.1, <=0.1.8), agate (1.1.0) +59 more potentially affected by unknown CVE via tree_magic (0.2.3)

treemagic CARGO version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on treemagic and may be impacted: - acari-lib =0.1.1, =1.2.0, =0.6.0, =0.1.0, =0.1.0, =1.1.0, =0.10.1, =0.1.0, =0.1.4 - fractal-matrix-api 4.0.0 and more Source cves: unknown CV...

a2 (>=0.3.6, <=0.5.0-alpha.1), abci-storage (0.0.3) +1467 more potentially affected by unknown CVE via owning_ref (>=0.1.4, <=0.4.1)

owningref CARGO version =0.1.4, =0.3.6, =0.1.0, =0.5.0-rc.0, =0.5.0-rc.0, =0.5.0, =0.5.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.3.0, =0.4.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0040...

a-bot (0.0.1), a-gpt (>=0.1.0, <=0.4.0) +13688 more potentially affected by unknown CVE via ansi_term (>=0.5.2, <=0.12.1)

ansiterm CARGO version =0.5.2, =0.1.0, =0.2.0, =0.0.2, =0.4.1, =0.9.0, =0.2.1, =0.1.0, =0.1.0, =0.7.0, =0.2.4, =0.8.0 - ablescriptcli 0.2.0 - ableton-link 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0139...

accepted (>=0.1.13, <=0.1.20), actors-rs (>=0.1.0, <=0.1.4) +325 more potentially affected by CVE-2020-25573 via linked-hash-map (>=0.0.9, <=0.4.2)

linked-hash-map CARGO version =0.0.9, =0.1.13, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.5.0, =0.3.1, =0.3.2, =0.1.0, =0.1.0, =0.7.1 and more Source cves: CVE-2020-25573 Source advisory: OSV:RUSTSEC-2020-0026...

GHSA-MXHP-79QH-MCX6 TaffyDB can allow access to any data items in the DB

TaffyDB allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. Taffy sets an internal index for each data item in its DB. However, it is found that the internal index can be forged by adding additional properti...

annatar (>=0.4.3, <=0.5.8), ansi2png-rs (>=0.1.0, <=0.1.1) +96 more potentially affected by unknown CVE via rulinalg (>=0.1.0, <=0.4.2)

rulinalg CARGO version =0.1.0, =0.4.3, =0.1.0, =0.2.9, =14.1.0, =0.1.5, =0.1.0, =0.1.0, =0.4.0, =1.0.0, =0.3.2, =0.3.3 - dali 0.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2020-0147...

CVE-2019-9748

In tinysvcmdns through 2018-01-16, an mDNS server processing a crafted packet can perform arbitrary data read operations up to 16383 bytes from the start of the buffer. This can lead to a segmentation fault in uncompressnlabel in mdns.c and a crash of the server depending on the memory protection...

CVE-2019-9747

In tinysvcmdns through 2018-01-16, a maliciously crafted mDNS Multicast DNS packet triggers an infinite loop while parsing an mDNS query. When mDNS compressed labels point to each other, the function uncompressnlabel goes into an infinite loop trying to analyze the packet with an mDNS query. As a...