inigo-rs (>=0.1.1, <=0.1.4) potentially affected by CVE-2025-32032 via apollo-router (1.6.0)

apollo-router CARGO version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on apollo-router and may be impacted: - inigo-rs =0.1.1, =0.1.4 Source cves: CVE-2025-32032 Source advisory: OSV:GHSA-94HH-JMQ8-2FGP...

bitcoin-harness (0.1.0), bitcoin_rpc_client (>=0.5.0, <=0.6.1) +65 more potentially affected by unknown CVE via openssl (>=0.10.40, <=0.10.68)

openssl CARGO version =0.10.40, =0.5.0, =0.2.0, =0.0.1, =0.1.0-alpha.0, =0.1.24, =0.37.0-pre, =0.4.0, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.1.3, =0.1.10 and more Source cves: unknown CVE Source advisory: OSV:GHSA-4FCV-W3QC-PPGG...

gix-fs (>=0.1.0, <=0.9.1), gix-lock (>=5.0.0, <=12.0.1) +1 more potentially affected by CVE-2025-31130 via gix-features (>=0.29.0, <=0.37.2)

gix-features CARGO version =0.29.0, =0.1.0, =5.0.0, =5.0.3, =12.0.1 Source cves: CVE-2025-31130 Source advisory: OSV:RUSTSEC-2025-0021...

Medium: rust

Issue Overview: The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::sethost. CVE-2023-53159 Affected Packages: rust Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference...

GHSA-67R5-RQWV-9P9Q array-init-cursor is unsound when used with types that implement `Drop`

The Drop implementation will get run twice when using the cursor. This issue does not affect you, if you are using only using the crate with types that are Copy such as u8. This issue also does not affect you, if you are only depending on it through the crate planus...

array-init-cursor is unsound when used with types that implement `Drop`

The Drop implementation will get run twice when using the cursor. This issue does not affect you, if you are using only using the crate with types that are Copy such as u8. This issue also does not affect you, if you are only depending on it through the crate planus...

tough-kms (>=0.1.0, <=0.5.0), tough-ssm (>=0.1.0, <=0.8.0) +1 more potentially affected by unknown CVE via tough (>=0.1.0, <=0.13.0)

tough CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0 Source cves: unknown CVE Source advisory: OSV:GHSA-J8X2-777P-23FC...

tough-kms (>=0.1.0, <=0.5.0), tough-ssm (>=0.1.0, <=0.8.0) +1 more potentially affected by CVE-2025-2885 via tough (>=0.1.0, <=0.13.0)

tough CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0 Source cves: CVE-2025-2885 Source advisory: OSV:GHSA-5VMP-M5V2-HX47...

RUSTSEC-2025-0019 `array-init-cursor` in version 0.2.0 and below is unsound when used with types that implement `Drop`

The Drop implementation will get run twice when using the cursor. This issue does not affect you, if you are using only using the crate with types that are Copy such as u8. This issue also does not affect you, if you are only depending on it through the crate planus...

`array-init-cursor` in version 0.2.0 and below is unsound when used with types that implement `Drop`

The Drop implementation will get run twice when using the cursor. This issue does not affect you, if you are using only using the crate with types that are Copy such as u8. This issue also does not affect you, if you are only depending on it through the crate planus...

addr2line (>=0.1.0, <=0.3.0), ai4ose-tg-rcore-tutorial-ch8-doom (0.1.0-preview.1) +142 more potentially affected by unknown CVE via xmas-elf (>=0.3.0, <=0.9.1)

xmas-elf CARGO version =0.3.0, =0.1.0, =0.1.4, =0.1.0, =0.1.0, =0.1.1, =0.11.0-beta, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.0, =0.0.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-9CC5-2PQ7-HFJ8...

addr2line (>=0.1.0, <=0.3.0), ai4ose-tg-rcore-tutorial-ch8-doom (0.1.0-preview.1) +142 more potentially affected by unknown CVE via xmas-elf (>=0.3.0, <=0.9.1)

xmas-elf CARGO version =0.3.0, =0.1.0, =0.1.4, =0.1.0, =0.1.0, =0.1.1, =0.11.0-beta, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.0, =0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0018...

xorc-notifications (0.1.0) potentially affected by CVE-2025-53604 via web-push (0.4.2)

web-push CARGO version 0.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on web-push and may be impacted: - xorc-notifications 0.1.0 Source cves: CVE-2025-53604 Source advisory: OSV:GHSA-FC83-9JWQ-GC2M...

zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write

Summary In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in th...

GHSA-94VH-GPHV-8PM8 zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write

Summary In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in th...

UBUNTU-CVE-2025-29787

zip is a zip library for rust which supports reading and writing of simple ZIP files. In the archive extraction routine of affected versions of the zip crate starting with version 1.3.0 and prior to version 2.3.0, symbolic links earlier in the archive are allowed to be used for later files in the...

RUSTSEC-2025-0168 Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write

In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file...

Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write

In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file...

`tree-sitter-pkl` was removed from crates.io for malicious code

tree-sitter-pkl was part of a campaign that attempted to exfiltrate environmental data from the host. The malicious crate had 1 version published in March 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io...

RUSTSEC-2025-0156 `tree-sitter-pkl` was removed from crates.io for malicious code

tree-sitter-pkl was part of a campaign that attempted to exfiltrate environmental data from the host. The malicious crate had 1 version published in March 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io...