Unsound APIs of public `constant::Reader` and `StructSchema`

The safe API functions constant::Reader::get and StructSchema::new rely on PointerReader::getrootunchecked, which can cause undefined behavior UB by constructing arbitrary words or schemas. Reader::get rust pub fn get&self - Result::Reader // ... // UNSAFE: access words without validation...

CVE-2025-11775

An out-of-bounds read vulnerability has been identified in the asComSvc service. This vulnerability can be triggered by sending specially crafted requests, which may lead to a service crash or partial loss of functionality. This vulnerability only affects ASUS motherboard series products. Refer t...

CVE-2025-11775

An out-of-bounds read vulnerability has been identified in the asComSvc service. This vulnerability can be triggered by sending specially crafted requests, which may lead to a service crash or partial loss of functionality. This vulnerability only affects ASUS motherboard series products. Refer t...

CVE-2025-11775

CVE-2025-11775 involves an out-of-bounds read in the asComSvc service used by ASUS Armoury Crate on ASUS motherboard series. The issue can be triggered by specially crafted requests and may cause a service crash or partial loss of functionality. Affected component: asComSvc within Armoury Crate e...

EUVD-2025-203873

An out-of-bounds read vulnerability has been identified in the asComSvc service. This vulnerability can be triggered by sending specially crafted requests, which may lead to a service crash or partial loss of functionality. This vulnerability only affects ASUS motherboard series products. Refer t...

ASUS Armoury Crate 安全漏洞

ASUS Armoury Crate is a software utility from the Chinese company Asus ASUS. It is designed to provide centralized control over supported ROG gaming products. A security vulnerability exists in ASUS Armoury Crate, which stems from the fact that sending a specially crafted request could trigger an...

RUSTSEC-2025-0150 `finch-rst` was removed from crates.io for malicious code

This attempts to typosquat the existing crate finch to steal credentials from local files. The malicious crate had 1 version published on 2025-12-08 and had been downloaded 21 times. There were no crates depending on this crate on crates.io. Thanks to Matthias Zepper of NGI Sweden for reporting...

`finch-rst` was removed from crates.io for malicious code

This attempts to typosquat the existing crate finch to steal credentials from local files. The malicious crate had 1 version published on 2025-12-08 and had been downloaded 21 times. There were no crates depending on this crate on crates.io. Thanks to Matthias Zepper of NGI Sweden for reporting...

alerter (>=0.3.0, <=0.3.2), crate_glitch (0.2.0) +14 more potentially affected by CVE-2025-66622 via matrix-sdk-base (>=0.1.0, <=0.5.1)

matrix-sdk-base CARGO version =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.10-alpha, =0.13.0, =0.13.1 and more Source cves: CVE-2025-66622 Source advisory: OSV:GHSA-JJ6P-3M75-G2P3...

alerter (>=0.3.0, <=0.3.2), crate_glitch (0.2.0) +14 more potentially affected by CVE-2025-66622 via matrix-sdk-base (>=0.1.0, <=0.5.1)

matrix-sdk-base CARGO version =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.10-alpha, =0.13.0, =0.13.1 and more Source cves: CVE-2025-66622 Source advisory: OSV:RUSTSEC-2025-0135...

libcrux-ml-dsa (0.0.3), libcrux-sha3 (>=0.0.3-alpha.2, <=0.0.3) potentially affected by unknown CVE via libcrux-intrinsics (0.0.3)

libcrux-intrinsics CARGO version 0.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-intrinsics and may be impacted: - libcrux-ml-dsa 0.0.3 - libcrux-sha3 =0.0.3-alpha.2, =0.0.3 Source cves: unknown CVE Source advisory: OSV:GHSA-2CGV-28VR-RV6...

`uniswap-utils` was removed from crates.io for malicious code

It depended on the evm-units crate, which appeared to be attempting to steal cryptocurrency...

Malicious Rust Crate Delivers OS-Specific Malware to Web3 Developer Systems

Cybersecurity researchers have discovered a malicious Rust package that's capable of targeting Windows, macOS, and Linux systems, and features malicious functionality to stealthily execute on developer machines by masquerading as an Ethereum Virtual Machine EVM unit helper tool. The Rust crate,...

RUSTSEC-2025-0134 rustls-pemfile is unmaintained

The rustls-pemfile crate is no longer maintained. The repository has been archived since August 2025, and users are encouraged to depend directly on the underlying PEM parsing code included in rustls-pki-types since 1.9.0. The latest version of rustls-pemfile is in fact a thin wrapper around the...

opentelemetry-jaeger crate is unmaintained

The opentelemetry-jaeger crate is deprecated and no longer actively maintained. The Jaeger propagator implementation has been migrated to opentelemetry-jaeger-propagator. More information and examples of using OTLP with Jaeger can be found in Introducing native support for OpenTelemetry in Jaeger...

rand_os crate is unmaintained

The randos crate is deprecated and no longer actively maintained, as OsRng is now part of randcore. If you are using this crate, consider upgrading to randcore 0.5.1 or higher...

gcc crate is unmaintained

The gcc crate is deprecated and no longer actively maintained. If you rely on this crate, consider switching to a recommended alternative. Recommended alternatives - cc...

number_prefix crate is unmaintained

The numberprefix crate is no longer actively maintained. If you rely on this crate, consider switching to a recommended alternative. Recommended alternatives - unit-prefix...

RUSTSEC-2025-0124 rand_os crate is unmaintained

The randos crate is deprecated and no longer actively maintained, as OsRng is now part of randcore. If you are using this crate, consider upgrading to randcore 0.5.1 or higher...

RUSTSEC-2025-0119 number_prefix crate is unmaintained

The numberprefix crate is no longer actively maintained. If you rely on this crate, consider switching to a recommended alternative. Recommended alternatives - unit-prefix...