CVE-2026-74018

CVE-2026-74018 is an Arbitrary File Upload vulnerability in the WordPress Theme Warehouse Cargo (versions ≤ 2.6.9 ). The vulnerability is accessible to users with Subscriber privileges and carries a CVSS 3.1 score of 9.9 (Critical) , with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicatin...

EUVD-2026-63318

Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...

`aronenao` was removed from crates.io due to malicious code

We identified that aronenao contained malicious code executed through a build script. This crate had 11 versions, with the most recent one being published at 2026-08-18. The crate was removed from crates.io and the user account was locked. This crate was used as part of a malware campaign targete...

WordPress Warehouse Cargo theme <= 2.7.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Denver Jackson in WordPress Theme Warehouse Cargo versions = 2.7.0...

MAL-2026-14336 Malicious code in arrayref (crates.io)

arrayref 0.3.10 was published to crates.io from a maintainer account droundy that appears to be compromised. Unlike every prior release, 0.3.10 declares a dependency on the malicious crate proc-macro1. The arrayref source itself is unchanged genuine macro code, but Cargo compiles the declared...

PT-2026-78991

Name of the Vulnerable Software and Affected Versions Warehouse Cargo versions prior to 2.7.0 Description An issue allows subscribers to perform arbitrary file uploads, which could lead to the upload of unauthorized files to the server. Recommendations Update to a version newer than 2.6.9...

a-gpt (>=0.1.0, <=0.4.0), a11ywatch_cli (>=0.0.16, <=0.10.15) +13712 more potentially affected by unknown CVE via h2 (>=0.1.26, <=0.3.27)

h2 CARGO version =0.1.26, =0.1.0, =0.0.16, =0.2.0, =0.1.0, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0-beta.4, =0.2.0-beta.7 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0258...

cargo-audit-0.22.2~git0.281452c-2.1 on GA media (moderate)

cargo-audit-0.22.2git0.281452c-2.1 on GA media Announcement ID: openSUSE-SU-2026:11512-1 Rating: moderate Cross-References: CVE-2026-25541 CVSS scores: CVE-2026-25541 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-25541 SUSE : 8.7...

cargo-c-0.10.23-2.1 on GA media (moderate)

cargo-c-0.10.23-2.1 on GA media Announcement ID: openSUSE-SU-2026:11513-1 Rating: moderate Cross-References: CVE-2026-25541 CVSS scores: CVE-2026-25541 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-25541 SUSE : 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N...

avml (>=0.7.0, <=0.8.0), azeventhubs (>=0.1.0, <=0.19.4) +335 more potentially affected by unknown CVE via azure_core (>=0.2.2, <=0.21.0)

azurecore CARGO version =0.2.2, =0.7.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.1.0, =0.2.0, =0.3.0, =0.3.0, =0.3.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.21.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0275...

PT-2026-76439

These are all security issues fixed in the cargo-c-0.10.23-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-76438

These are all security issues fixed in the cargo-audit-0.22.2git0.281452c-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11522-1 obs-service-cargo-7.2.2-2.1 on GA media

These are all security issues fixed in the obs-service-cargo-7.2.2-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11513-1 cargo-c-0.10.23-2.1 on GA media

These are all security issues fixed in the cargo-c-0.10.23-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-76448

These are all security issues fixed in the obs-service-cargo-7.2.2-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11512-1 cargo-audit-0.22.2~git0.281452c-2.1 on GA media

These are all security issues fixed in the cargo-audit-0.22.2git0.281452c-2.1 package on the GA media of openSUSE Tumbleweed...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: shadowsocks-rust, buck2, pixi, deno, sdp-k8s-injector, ntpd-rs, qdrant, rustls-ffi, ztunnel, atuin, parseable, wasmcloud, kdash, zizmor, sqlx, rye, cargo-audit, zed, fnm, ztunnel-fips, oranda, wadm, samply, linkerd-extension-init, wasmtime, sccache, tealdeer, uv,...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: wasm-pack, zed, xh, rustup, shadowsocks-rust, rye, samply, nushell, pixi, wasmtime, buck2, sqlx, ntpd-rs, wadm, rustls-ffi, wash, deno, uv, sccache, cargo-audit, tealdeer, linkerd-extension-init, wasmcloud, linkerd2-proxy, lychee, sdp-k8s-injector, kdash, zola,...

CVE-2026-19787

A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=savecargotype. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-19787

The CVE-2026-19787 affects SourceCodester Air Cargo Management System 1.0. The vulnerability is an SQL injection via manipulation of the argument ID in the file /classes/Master.php?f=save_cargo_type, which can be triggered remotely. Public exploit information exists. This entry documents the affe...