Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of openssl (CVE-2026-41676, CVE-2026-41677, CVE-2026-41678, CVE-2026-41681)

Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.90.0.1 and 1.92.0.1 uses versions 0.10.73 and 0.10.74 of the openssl crate, which provides Rust bindings for the OpenSSL library. Several security-related bugs, such as buffer overflows, were identified in these versions of the...

Fedora 45 : helix / rust-asyncgit / rust-cargo / rust-cargo-deny / rust-dua-cli / etc (2026-a843eb2666)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-a843eb2666 advisory. Update gix to version 0.83 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

GHSA-WX44-2Q6H-J6P8 DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval

Summary The runtests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. The source code explicitly states this design choice: rust fn approvalrequirement&self - ApprovalRequirement // Tests are encouraged, so avoid gating th...

DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval

Summary The runtests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. The source code explicitly states this design choice: rust fn approvalrequirement&self - ApprovalRequirement // Tests are encouraged, so avoid gating th...

PT-2026-41166

Name of the Vulnerable Software and Affected Versions CodeWhale versions 0.3.0 through 0.8.22 Description The run tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, allowing it to run without user approval. Because cargo test compiles and executes arbitrary...

a1 (>=1.0.1, <=1.0.2), a1_notation (0.6.0) +601 more potentially affected by unknown CVE via rkyv (>=0.7.3, <=0.8.2)

rkyv CARGO version =0.7.3, =1.0.1, =0.2.2, =0.23.0, =0.23.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.9.0, =0.0.1, =0.0.10 - ars-server 0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0235...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rust: cargo-1.95.0-5.hum1 aarch64, x8664 clippy-1.95.0-5.hum1 aarch64, x8664 rust-1.95.0-5.hum1 aarch64, x8664 rust-analyzer-1.95.0-5.hum1 aarch64, x8664 rust-debugger-common-1.95.0-5.hum1 noarch...

backroll_transport_steam (>=0.1.0, <=0.5.0), bevy-steamworks (>=0.1.0, <=0.2.0) +5 more potentially affected by unknown CVE via steamworks (>=0.6.1, <=0.12.2)

steamworks CARGO version =0.6.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.2.1 Source cves: unknown CVE Source advisory: OSV:GHSA-G588-CJG3-6G78...

a1 (>=1.0.1, <=1.0.2), apfsds-protocol (>=0.1.0, <=0.4.0) +125 more potentially affected by unknown CVE via rkyv (0.8.2)

rkyv CARGO version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on rkyv and may be impacted: - a1 =1.0.1, =0.1.0, =0.9.0, =0.1.0, =0.2.1, =0.1.0, =0.4.0, =0.9.0, =0.5.0, =0.5.0, =2.0.0-alpha.1, =0.1.2, =0.2.24, =0.2.27 and more Source cves: unkno...

Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of libnghttp2-sys (CVE-2025-7207, CVE-2025-12875)

Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.90.0.0 and 1.90.0.0 uses the libnghttp2-sys-0.1.11+1.64.0 crate, which wraps a vulnerable version 1.64 of the nghttp2 library. Vulnerability Details CVEID:CVE-2025-12875 DESCRIPTION: A weakness has been identified in mruby 3.4.0...

annatar (>=0.4.3, <=0.5.8), ansi2png-rs (>=0.1.0, <=0.1.1) +63 more potentially affected by unknown CVE via imageproc (>=0.6.1, <=0.22.0)

imageproc CARGO version =0.6.1, =0.4.3, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.1.0, =1.0.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W5P8-4JCX-2J6R...

armature-diesel (0.1.0), authzen (0.1.0-alpha.0) +21 more potentially affected by unknown CVE via diesel-async (>=0.1.1, <=0.6.1)

diesel-async CARGO version =0.1.1, =0.1.0, =0.18.0-rc.4, =0.18.0-rc.4, =0.18.0-rc.4, =0.18.0-rc.4, =0.17.0, =0.17.0, =0.19.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-FF9Q-RM55-Q7QR...

sshkey-attest (0.5.0), uvb-factors (0.2.1) +3 more potentially affected by unknown CVE via webauthn-rs-core (>=0.4.9, <=0.5.0)

webauthn-rs-core CARGO version =0.4.9, =0.1.0, =0.4.1-beta.2, =0.5.0 Source cves: unknown CVE Source advisory: OSV:GHSA-22W3-693W-X895...

lemmy_server (>=0.11.3-rc.5, <=0.16.7) potentially affected by unknown CVE via lemmy_api (>=0.11.3-rc.5, <=0.16.7)

lemmyapi CARGO version =0.11.3-rc.5, =0.11.3-rc.5, =0.16.7 Source cves: unknown CVE Source advisory: OSV:GHSA-JMXC-HHWX-GVV3...

armature-diesel (0.1.0), aruna_policy (>=0.1.0, <=0.1.2) +112 more potentially affected by unknown CVE via diesel (>=2.0.0, <=2.3.4)

diesel CARGO version =2.0.0, =0.1.0, =0.1.0, =0.6.0, =0.1.0, =0.1.0, =0.0.6, =0.1.1, =0.1.5, =0.1.0, =0.1.2, =0.1.6 and more Source cves: unknown CVE Source advisory: OSV:GHSA-H5X4-M2QF-R4F2...

acta-core (0.1.0-alpha.1), actix-web-opentelemetry (>=0.2.0, <=0.11.0-beta.3) +234 more potentially affected by CVE-2026-43868 via thrift (>=0.0.4, <=0.17.0)

thrift CARGO version =0.0.4, =0.2.0, =0.0.8, =0.0.6, =0.2.0, =0.3.0, =0.3.5, =0.1.3, =0.2.0, =0.7.0, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2026-43868 Source advisory: OSV:GHSA-2F9F-GQ7V-9H6M...

accesskit_consumer (>=0.1.0, <=0.7.1), accesskit_windows (>=0.1.0, <=0.8.0) +996 more potentially affected by unknown CVE via im (>=9.0.0, <=15.1.0)

im CARGO version =9.0.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.0.5, =0.1.0, =0.1.0, =0.1.0, =0.11.0, =0.0.1, =0.0.1, =0.2.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0248...

rustdx-cmd (>=0.1.0, <=0.3.0) potentially affected by unknown CVE via rustdx (>=0.2.5, <=0.3.0)

rustdx CARGO version =0.2.5, =0.1.0, =0.3.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0123...

annatar (>=0.4.3, <=0.5.8), ansi2png-rs (>=0.1.0, <=0.1.1) +63 more potentially affected by unknown CVE via imageproc (>=0.6.1, <=0.22.0)

imageproc CARGO version =0.6.1, =0.4.3, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.1.0, =1.0.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0117...

sar-core (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via imageproc (0.25.0)

imageproc CARGO version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on imageproc and may be impacted: - sar-core =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0115...