3526 matches found
CVE-2026-16727
Concurrent Execution using Shared Resource with Improper Synchronization “Race Condition” in ASUS Armoury Crate allows a local user to execute arbitrary code with elevated privileges via a crafted file replacement. Refer to the ' Security Update for ASUS Armoury Crate ' section on the ASUS Securi...
CVE-2026-16727
Concurrent Execution using Shared Resource with Improper Synchronization “Race Condition” in ASUS Armoury Crate allows a local user to execute arbitrary code with elevated privileges via a crafted file replacement. Refer to the ' Security Update for ASUS Armoury Crate ' section on the ASUS Securi...
CVE-2026-16727
CVE-2026-16727 describes a race condition in ASUS Armoury Crate caused by Concurrent Execution using a shared resource due to improper synchronization. The vulnerability allows a local user to replace a crafted file and achieve arbitrary code execution with elevated privileges. Affected product: ...
EUVD-2026-50946
Concurrent Execution using Shared Resource with Improper Synchronization “Race Condition” in ASUS Armoury Crate allows a local user to execute arbitrary code with elevated privileges via a crafted file replacement. Refer to the ' Security Update for ASUS Armoury Crate ' section on the ASUS Securi...
Remote Denial of Service via malformed NIP-04 IV
The nostr crate did not validate the length of the initialization vector decoded from the ?iv= portion of a NIP-04 encrypted message. The decoded IV was converted from a byte slice to the 16-byte AES-CBC IV type using a conversion that asserts the slice length. As a result, an IV whose decoded...
cargo: Cargo: Source code overwrite due to symlink mishandling in third-party registries
A flaw was found in Cargo. When processing crate tarballs from third-party registries, Cargo mishandled symbolic links symlinks embedded within these archives. This vulnerability enables a malicious crate to overwrite the source code of another crate originating from the same registry. Such an...
CVE-2026-46428
lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...
OESA-2026-3013 rpm-ostree security update
rpm-ostree is a hybrid image/package system. It supports "composing" packages on a build server into an OSTree repository, which can then be replicated by client systems with atomic upgrades. Additionally, unlike many "pure" image systems, with rpm-ostree each client system can layer on additiona...
RUSTSEC-2026-0210 `libcrux-aesgcm` Renamed to `libcrux-aes`
Crate libcrux-aesgcm was renamed to libcrux-aes and will no longer receive new versions under the name libcrux-aesgcm, with the final released version under that name being version 0.0.8. The original functionality is now provided in crate libcrux-aes, where development continues at version 0.0.9...
SUSE-SU-2026:3026-1 Security update for python-cryptography
This update for python-cryptography fixes the following issues - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270208. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-...
GHSA-VVP9-H8P2-XWFC Wasmtime: Memory leak in C API with `externref` and `anyref` types
Impact Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the anyref or externref WebAssembly values. This is caused by a regression introduced during the development of 37.0.0 and all prior versions of Wasmtime are unaffected. If anyref or externref is not used...
GHSA-99J7-FHR2-XFJ4 `exploration` was removed from crates.io for malicious code
A method within the exploration crate attempted to download and execute a payload from a remote site. The malicious crate had 1 version published on 2026-06-02, approximately 1 hour before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Rustsec to Kirill...
OESA-2026-2946 rpm-ostree security update
rpm-ostree is a hybrid image/package system. It supports "composing" packages on a build server into an OSTree repository, which can then be replicated by client systems with atomic upgrades. Additionally, unlike many "pure" image systems, with rpm-ostree each client system can layer on additiona...
[SECURITY] Fedora 44 Update: python-nh3-0.3.6-1.fc44
Python binding to Ammonia HTML sanitizer Rust crate...
[SECURITY] Fedora 43 Update: python-fastar-0.11.0-7.fc43
The fastar library wraps the Rust tar, flate2, and zstd crates, providing a high-performance way to work with compressed and uncompressed tar archives in Python...
Malicious code in proton_pfff (crates.io)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0aa190f5fe08b29ab6f7230c099bdc2a201b7d5212f434f9e44b2be1feba5de1 The OpenSSF Package Analysis project identified 'proton-pfff' @ 99.99.5 crates.io as malicious. It is considered malicious because: - The packag...
[SECURITY] Fedora 44 Update: python-rpds-py-0.29.0-4.fc44
Python bindings to the Rust rpds crate...
CVE-2026-49989
creationtimestamp| type| source ---|---|--- 2026-07-01 20:35:07+00:00| published-proof-of-concept| https://github.com/crate/crate/security/advisories/GHSA-2xv8-gjwh-fv8p...
RUSTSEC-2026-0192 `ttf-parser` is unmaintained
The author of ttf-parser has stated that the crate is unmaintained and will not receive further fixes see the referenced issue. Alternatives - skrifa, an actively maintained TrueType and OpenType font parsing crate, part of the Google Fonts "oxidize" fontations project...