actix-remote (0.1.0), agnostic (>=0.2.5, <=0.2.6) +272 more potentially affected by CVE-2026-31812 via quinn-proto (>=0.5.2, <=0.11.9)

quinn-proto CARGO version =0.5.2, =0.2.5, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.5.0, =2.0.0, =0.2.3, =0.2.11 and more Source cves: CVE-2026-31812 Source advisory: OSV:RUSTSEC-2026-0037...

basejmp (0.1.0), chompbuild (>=0.2.7, <=0.2.17) +72 more potentially affected by CVE-2026-25541 via bytes (>=1.2.1, <=1.10.1)

bytes CARGO version =1.2.1, =0.2.7, =1.31.0, =0.61.0, =0.61.0, =0.0.0, =0.67.0, =0.149.0, =0.84.0, =0.90.0, =0.54.0, =0.3.0, =0.1.0, =0.61.0, =0.1.0, =0.2.0 and more Source cves: CVE-2026-25541 Source advisory: OSV:GHSA-434X-W66G-QW3R...

a-gpt (>=0.1.0, <=0.4.0), abacuz (0.1.1) +1262 more potentially affected by unknown CVE via git2 (>=0.1.21, <=0.19.0)

git2 CARGO version =0.1.21, =0.1.0, =1.1.0, =0.0.1, =0.3.0, =1.0.0, =0.1.0, =0.1.0, =0.3.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0008...

CVE-2026-24850 ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices

The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard ML-DSA. Starting in version 0.0.4 and prior to version 0.1.0-rc.4, the ML-DSA signature verification implementation in the RustCrypto ml-dsa crate incorrectly accepts signatures with repeated duplicat...

http-api-problem (>=0.23.0, <=0.50.2) potentially affected by CVE-2026-22256 via salvo (>=0.9.7, <=0.11.6)

salvo CARGO version =0.9.7, =0.23.0, =0.50.2 Source cves: CVE-2026-22256 Source advisory: OSV:GHSA-RJF8-2WCW-F6MP...

actix-web-csp (0.1.0), adguard-tui (>=0.9.0, <=1.5.0) +662 more potentially affected by unknown CVE via lru (>=0.9.0, <=0.15.0)

lru CARGO version =0.9.0, =0.9.0, =0.0.24, =0.0.23, =0.1.0, =1.0.0, =0.4.0, =0.1.0, =0.1.0, =0.1.3, =0.3.1 - anni-repo 0.4.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-RHFX-M35P-FF5J...

blyss-rs (0.2.0), lunarbase-pmm-math (>=0.1.0, <=0.2.6) +8 more potentially affected by unknown CVE via ruint (>=1.8.0, <=1.16.0)

ruint CARGO version =1.8.0, =0.1.0, =0.3.0, =0.3.0, =0.1.0, =0.3.0, =0.1.0, =0.5.1 Source cves: unknown CVE Source advisory: OSV:GHSA-9FJQ-45QV-PCM7...

alerter (>=0.3.0, <=0.3.2), crate_glitch (0.2.0) +14 more potentially affected by CVE-2025-66622 via matrix-sdk-base (>=0.1.0, <=0.5.1)

matrix-sdk-base CARGO version =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.10-alpha, =0.13.0, =0.13.1 and more Source cves: CVE-2025-66622 Source advisory: OSV:GHSA-JJ6P-3M75-G2P3...

alerter (>=0.3.0, <=0.3.2), crate_glitch (0.2.0) +14 more potentially affected by CVE-2025-66622 via matrix-sdk-base (>=0.1.0, <=0.5.1)

matrix-sdk-base CARGO version =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.10-alpha, =0.13.0, =0.13.1 and more Source cves: CVE-2025-66622 Source advisory: OSV:RUSTSEC-2025-0135...

libcrux-ml-dsa (0.0.3), libcrux-sha3 (>=0.0.3-alpha.2, <=0.0.3) potentially affected by unknown CVE via libcrux-intrinsics (0.0.3)

libcrux-intrinsics CARGO version 0.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-intrinsics and may be impacted: - libcrux-ml-dsa 0.0.3 - libcrux-sha3 =0.0.3-alpha.2, =0.0.3 Source cves: unknown CVE Source advisory: OSV:GHSA-2CGV-28VR-RV6...

Malicious Rust Crate Delivers OS-Specific Malware to Web3 Developer Systems

Cybersecurity researchers have discovered a malicious Rust package that's capable of targeting Windows, macOS, and Linux systems, and features malicious functionality to stealthily execute on developer machines by masquerading as an Ethereum Virtual Machine EVM unit helper tool. The Rust crate,...

RUSTSEC-2025-0154 `replit_ruspty` was removed from crates.io for malicious code

The OpenSSF Package Analysis project identified 'replitruspty' @ 1.0.0 crates.io as malicious. Version 2.0.0 was also published with malware. It is considered malicious because: The package communicates with a domain associated with malicious activity. The package executes one or more commands...

mirror_sparse_matrix (>=0.1.1, <=0.1.17) potentially affected by unknown CVE via binary_vec_io (0.1.12)

binaryvecio CARGO version 0.1.12 is affected by a known vulnerability. The following packages have a transitive dependency on binaryvecio and may be impacted: - mirrorsparsematrix =0.1.1, =0.1.17 Source cves: unknown CVE Source advisory: OSV:GHSA-WWXP-HXH6-8GF8...

alemat (>=0.3.0, <=0.8.0), box-bin (0.3.1) +24 more potentially affected by unknown CVE via unic-ucd-common (>=0.7.0, <=0.9.0)

unic-ucd-common CARGO version =0.7.0, =0.3.0, =0.3.0, =0.0.0, =0.0.102, =0.1.0, =0.0.7, =0.0.1, =1.0.0, =1.11.3, =0.1.0, =0.0.0, =0.1.0, =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0101...

doge_dns (>=0.2.4-beta, <=1.0.2), rev-up-your-harley (>=0.1.0, <=1.0.1) +4 more potentially affected by unknown CVE via unic-idna-mapping (>=0.4.0, <=0.9.0)

unic-idna-mapping CARGO version =0.4.0, =0.2.4-beta, =0.1.0, =0.1.0, =0.5.0, =0.7.0, =0.4.0, =0.9.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0097...

nftnl (>=0.1.0, <=0.8.0) potentially affected by unknown CVE via mnl (>=0.1.0, <=0.2.3)

mnl CARGO version =0.1.0, =0.1.0, =0.8.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0142...

add_space (>=0.1.2, <=0.1.8), ale_python_parser (>=0.1.0, <=0.1.2) +72 more potentially affected by unknown CVE via unic-emoji-char (>=0.7.0, <=0.9.0)

unic-emoji-char CARGO version =0.7.0, =0.1.2, =0.1.0, =4.0.0-rc.1, =4.4.7, =0.1.0, =0.0.1-pre.3, =0.1.0, =0.1.0, =0.0.1, =1.0.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0090...

alemat (>=0.3.0, <=0.8.0), box-bin (0.3.1) +20 more potentially affected by unknown CVE via unic-ucd-case (>=0.6.0, <=0.9.0)

unic-ucd-case CARGO version =0.6.0, =0.3.0, =0.3.0, =0.0.0, =0.0.102, =0.0.7, =0.0.1, =1.0.0, =1.11.3, =0.1.0, =0.1.0, =0.0.0, =0.1.0, =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0092...

alemat (>=0.3.0, <=0.8.0), box-bin (0.3.1) +18 more potentially affected by unknown CVE via unic-ucd (>=0.5.0, <=0.9.0)

unic-ucd CARGO version =0.5.0, =0.3.0, =0.3.0, =0.0.0, =0.0.102, =0.0.7, =0.0.1, =1.0.0, =1.11.3, =0.1.0, =0.0.0, =0.1.0, =1.1.1, =2.0.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0077...

alemat (>=0.3.0, <=0.8.0), aocleaderboard (>=0.1.0, <=0.6.1) +111 more potentially affected by unknown CVE via unic-ucd-segment (>=0.7.0, <=0.9.0)

unic-ucd-segment CARGO version =0.7.0, =0.3.0, =0.1.0, =0.5.0, =0.5.0, =0.3.0, =1.0.0, =0.1.0, =0.0.4, =0.1.0, =0.2.6, =0.0.15, =0.1.0, =0.1.3, =0.1.4 - config2args 0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0104...