EUVD-2022-0694

Malicious code in bioql PyPI...

EUVD-2023-0424

Malicious code in bioql PyPI...

EUVD-2024-54823

Malicious code in bioql PyPI...

EUVD-2023-59772

Malicious code in bioql PyPI...

Fedora 44 : python-nh3 / rust-ammonia (2025-06a8d5853b)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-06a8d5853b advisory. Update the ammonia crate to version 4.1.2 and rebuild python-nh3 to apply fixes for RUSTSEC-2025-0071. Tenable has extracted the preceding description block...

SUSE-SU-2025:03092-1 Security update for rav1e

This update for rav1e fixes the following issues: - Update crate shlex to 1.3.0: CVE-2024-58266: Fixed command injection bsc1247207 RUSTSEC-2024-0006: Fixed multiple issues involving quote API bsc1230028...

CVE-2023-53159

The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::sethost...

CVE-2023-53161

The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic...

CVE-2023-53160

The CVE-2023-53160 vulnerability affects the sequoia-openpgp crate for Rust prior to 1.16.0, where an out-of-bounds array access can cause a panic. This is referenced in multiple advisories (e.g., RustSec advisory RUSTSEC-2023-0038) and Fedora/NASL entries. Affected versions: sequoia-openpgp befo...

CVE-2023-53158

The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability involving a username field that is more difficult to exploit...

CVE-2023-53160

The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic...

CVE-2022-50237

The CVE-2022-50237 entry concerns the ed25519-dalek Rust crate prior to version 2. The Keypair implementation enables a double public key signing function oracle attack, enabling an attacker to compute/extract a private key from signatures. Reported impact includes confidentiality loss; CVSSv3.1 ...

CVE-2023-53159

The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::sethost...

CVE-2023-53161

The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic...

CVE-2022-50237

The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key...

CVE-2024-58266

The CVE-2024-58266 entry concerns the shlex crate for Rust, affected in versions before 1.2.1. The root cause is that unquoted and unescaped instances of the characters { and �a0 may be processed in command arguments, potentially enabling command injection. Impact is described as high in network-...

CVE-2023-53156

The transpose crate before 0.2.3 for Rust allows an integer overflow via inputwidth and inputheight arguments...

CVE-2024-58265

The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery...

CVE-2025-48752

In the process-sync crate 0.2.2 for Rust, the drop function lacks a check for whether the pthreadmutex is unlocked...

CVE-2025-48756

In groupnumber in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits e.g., 5 bits for group number...