3846 matches found
RUSTSEC-2026-0210 `libcrux-aesgcm` Renamed to `libcrux-aes`
Crate libcrux-aesgcm was renamed to libcrux-aes and will no longer receive new versions under the name libcrux-aesgcm, with the final released version under that name being version 0.0.8. The original functionality is now provided in crate libcrux-aes, where development continues at version 0.0.9...
SUSE-SU-2026:3026-1 Security update for python-cryptography
This update for python-cryptography fixes the following issues - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270208. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-...
GHSA-VVP9-H8P2-XWFC Wasmtime: Memory leak in C API with `externref` and `anyref` types
Impact Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the anyref or externref WebAssembly values. This is caused by a regression introduced during the development of 37.0.0 and all prior versions of Wasmtime are unaffected. If anyref or externref is not used...
GHSA-99J7-FHR2-XFJ4 `exploration` was removed from crates.io for malicious code
A method within the exploration crate attempted to download and execute a payload from a remote site. The malicious crate had 1 version published on 2026-06-02, approximately 1 hour before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Rustsec to Kirill...
OESA-2026-2946 rpm-ostree security update
rpm-ostree is a hybrid image/package system. It supports "composing" packages on a build server into an OSTree repository, which can then be replicated by client systems with atomic upgrades. Additionally, unlike many "pure" image systems, with rpm-ostree each client system can layer on additiona...
[SECURITY] Fedora 44 Update: python-nh3-0.3.6-1.fc44
Python binding to Ammonia HTML sanitizer Rust crate...
[SECURITY] Fedora 43 Update: python-fastar-0.11.0-7.fc43
The fastar library wraps the Rust tar, flate2, and zstd crates, providing a high-performance way to work with compressed and uncompressed tar archives in Python...
Malicious code in proton_pfff (crates.io)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0aa190f5fe08b29ab6f7230c099bdc2a201b7d5212f434f9e44b2be1feba5de1 The OpenSSF Package Analysis project identified 'proton-pfff' @ 99.99.5 crates.io as malicious. It is considered malicious because: - The packag...
coreutils (>=0.0.14, <=0.0.16) potentially affected by CVE-2026-35381 via uu_cut (>=0.0.14, <=0.0.16)
uucut CARGO version =0.0.14, =0.0.14, =0.0.16 Source cves: CVE-2026-35381 Source advisory: OSV:GHSA-PMFC-4WJJ-GMHX...
coreutils (>=0.0.14, <=0.0.16) potentially affected by CVE-2026-35358 via uu_cp (>=0.0.14, <=0.0.16)
uucp CARGO version =0.0.14, =0.0.14, =0.0.16 Source cves: CVE-2026-35358 Source advisory: OSV:GHSA-8VRF-R662-2W2V...
coreutils (>=0.0.14, <=0.0.16) potentially affected by CVE-2026-35347 via uu_comm (>=0.0.14, <=0.0.16)
uucomm CARGO version =0.0.14, =0.0.14, =0.0.16 Source cves: CVE-2026-35347 Source advisory: OSV:GHSA-3WFC-MGPM-9RQ6...
coreutils (>=0.0.14, <=0.0.16) potentially affected by CVE-2026-35371 via uu_id (>=0.0.14, <=0.0.16)
uuid CARGO version =0.0.14, =0.0.14, =0.0.16 Source cves: CVE-2026-35371 Source advisory: OSV:GHSA-XV5W-CW7X-72GJ...
coreutils (>=0.0.14, <=0.0.16) potentially affected by CVE-2026-35373 via uu_ln (>=0.0.14, <=0.0.16)
uuln CARGO version =0.0.14, =0.0.14, =0.0.16 Source cves: CVE-2026-35373 Source advisory: OSV:GHSA-JCJR-RH8Q-7XQF...
coreutils (>=0.0.14, <=0.0.16) potentially affected by CVE-2026-35339 via uu_chmod (>=0.0.14, <=0.0.16)
uuchmod CARGO version =0.0.14, =0.0.14, =0.0.16 Source cves: CVE-2026-35339 Source advisory: OSV:GHSA-4X34-CHG5-MWJJ...
[SECURITY] Fedora 44 Update: python-rpds-py-0.29.0-4.fc44
Python bindings to the Rust rpds crate...
ctutils (>=0.0.0, <=0.3.2) potentially affected by CVE-2026-50185 via cmov (>=0.4.6, <=0.5.0-pre.0)
cmov CARGO version =0.4.6, =0.0.0, =0.3.2 Source cves: CVE-2026-50185 Source advisory: OSV:GHSA-3RJW-M598-PQ24...
CVE-2026-49989
creationtimestamp| type| source ---|---|--- 2026-07-01 20:35:07+00:00| published-proof-of-concept| https://github.com/crate/crate/security/advisories/GHSA-2xv8-gjwh-fv8p...
PT-2026-55217
Name of the Vulnerable Software and Affected Versions CrateDB versions prior to 6.2.8 CrateDB versions prior to 6.3.2 Description An authorization bypass exists in the blob HTTP API of CrateDB. While the SQL path for accessing blob storage correctly enforces privilege grants via AccessControl, th...
RUSTSEC-2026-0192 `ttf-parser` is unmaintained
The author of ttf-parser has stated that the crate is unmaintained and will not receive further fixes see the referenced issue. Alternatives - skrifa, an actively maintained TrueType and OpenType font parsing crate, part of the Google Fonts "oxidize" fontations project...
