1267 matches found
Cargo can be coerced to share credentials between registries
The Rust Security Response Team was notified that Cargo incorrectly normalized the URLs of third-party registries using the sparse index protocol1. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a...
armory_cli (>=0.3.3, <=0.3.28), armory_lib (>=0.1.0, <=0.3.28) +140 more potentially affected by CVE-2026-5222 via cargo (>=0.4.0, <=0.70.1)
cargo CARGO version =0.4.0, =0.3.3, =0.1.0, =0.10.0, =0.10.0, =0.1.0, =0.3.1, =0.0.1, =0.1.0, =0.1.0, =0.2.2, =0.6.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-5222 Source advisory: OSV:GHSA-P688-R7JV-FM6F...
Amazon Linux 2023 : cargo-c (ALAS2023-2026-1872)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1872 advisory. gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-controlled...
a-gpt (>=0.1.0, <=0.4.0), abd-clam (>=0.21.6, <=0.21.7) +2859 more potentially affected by unknown CVE via memmap2 (>=0.1.0, <=0.9.10)
memmap2 CARGO version =0.1.0, =0.1.0, =0.21.6, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.2, =0.23.0, =0.23.0, =1.0.5, =1.1.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0186...
bolic-network (0.0.1), futures-quic (>=0.2.4, <=0.2.8) +10 more potentially affected by CVE-2026-11941 via quiche (>=0.20.1, <=0.24.9)
quiche CARGO version =0.20.1, =0.2.4, =0.1.1, =2.0.0, =0.1.0, =0.1.19, =0.1.19, =0.1.19, =0.1.19, =0.1.21 Source cves: CVE-2026-11941 Source advisory: OSV:GHSA-MH64-PH39-MRC9...
CVE-2026-54815
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows Blind SQL Injection. This issue affects Cargo Shipping Location for WooCommerce: from n/a through 5.6...
CVE-2026-54815 WordPress Cargo Shipping Location for WooCommerce plugin <= 5.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows Blind SQL Injection. This issue affects Cargo Shipping Location for WooCommerce: from n/a through 5.6...
CVE-2026-54815
CVE-2026-54815 affects the WordPress plugin Cargo Shipping Location for WooCommerce (Cargo RD Cargo Shipping Location for WooCommerce) up to version 5.6. The vulnerability is an SQL Injection (blind) caused by improper neutralization of special elements in SQL commands. CVSS v3.1 shows a base sco...
EUVD-2026-37708
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows Blind SQL Injection. This issue affects Cargo Shipping Location for WooCommerce: from n/a through 5.6...
The vulnerability of the Cargo package manager in the Rust programming language arises from deficiencies in the mechanism for handling symbolic references, allowing an attacker to execute arbitrary code.
The vulnerability of the Cargo package manager in the Rust programming language is related to deficiencies in the mechanism for handling symbolic references. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the Cargo package manager in the Rust programming language arises from the use of non-canonical URL paths for authentication solutions. This allows a malicious actor to gain unauthorized access to protected information.
The vulnerability of the Cargo package manager in the Rust programming language is related to the use of non-canonical URL paths for authentication solutions. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
abd-clam (>=0.21.8, <=0.25.3), abe_gpsw (>=0.8.0, <=2.0.0) +634 more potentially affected by unknown CVE via pyo3 (>=0.2.7, <=0.28.3)
pyo3 CARGO version =0.2.7, =0.21.8, =0.8.0, =0.12.0, =0.2.1, =0.3.0, =0.1.0, =0.1.2, =2.0.0-rc.1, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.14 and more Source cves: unknown CVE Source advisory: OSV:GHSA-36HH-V3QG-5JQ4...
actix-postgres (>=0.1.0, <=0.4.0), actyx_sdk (>=0.1.0, <=0.3.0) +562 more potentially affected by unknown CVE via postgres-protocol (>=0.4.0, <=0.6.10)
postgres-protocol CARGO version =0.4.0, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.4.0, =0.1.1, =0.4.0, =0.4.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0179...
assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-48110 via russh (>=0.34.0, <=0.43.0)
russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-48110 Source advisory: OSV:GHSA-4R3C-5HPG-58QR...
Fedora 43 : rust (2026-d7436d12ae)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d7436d12ae advisory. Update to Rust 1.96.0: New Range types Assert matching patterns Changes to WebAssembly targets Stabilized APIs Cargo CVE-2026-5222 and CVE-2026-5223...
libcrux-aead (>=0.0.4-pre.1, <=0.0.8) potentially affected by unknown CVE via libcrux-aesgcm (>=0.0.4, <=0.0.8-rc.2)
libcrux-aesgcm CARGO version =0.0.4, =0.0.4-pre.1, =0.0.8 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0209...
Fedora 44 : rust (2026-e251935c8f)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e251935c8f advisory. Update to Rust 1.96.0: New Range types Assert matching patterns Changes to WebAssembly targets Stabilized APIs Cargo CVE-2026-5222 and CVE-2026-5223...
CVE-2026-5222
A flaw was found in rust-cargo. The Cargo tool, used for managing Rust projects, incorrectly handled the URLs of third-party registries when using the sparse index protocol. This vulnerability could allow an attacker, who is able to publish packages in a registry, to obtain sensitive credentials...
