CVE-2026-77651

The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

CVE-2026-77650

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

EUVD-2026-63780

The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

CVE-2026-77650

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

EUVD-2026-63779

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

CVE-2026-77649

The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Malicious versions of the arrayref Rust crate and others executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios...

`arrayref` 0.3.10 was removed from crates.io due to a malicious dependency

A new version of the arrayref crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. This compromised version was published on 2026-08-20 and removed approximately 86 minutes later. It was downloaded 2,285 times, which constituted less than 10% ...

comiconv (>=0.1.0, <=0.1.2), waifu-diffuser-types (0.0.0) potentially affected by unknown CVE via sevenz-rust (0.2.10)

sevenz-rust CARGO version 0.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on sevenz-rust and may be impacted: - comiconv =0.1.0, =0.1.2 - waifu-diffuser-types 0.0.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0245...

anansi (>=0.10.0, <=0.14.2), anansi-core (>=0.10.0, <=0.14.2) +77 more potentially affected by CVE-2026-46428 via lettre (>=0.10.1, <=0.10.4)

lettre CARGO version =0.10.1, =0.10.0, =0.10.0, =0.1.0, =0.111.0, =0.1.2, =1.6.0, =1.0.0, =1.3.0-beta1, =1.6.4, =0.0.1, =0.1.0, =0.1.1 and more Source cves: CVE-2026-46428 Source advisory: OSV:GHSA-4PJ9-G833-QX53...

bitcoin-nostr-relay (0.1.1), kormir (>=0.1.0, <=1.0.11) +5 more potentially affected by unknown CVE via nostr (>=0.1.5, <=0.40.0)

nostr CARGO version =0.1.5, =0.1.0, =0.2.6, =0.0.1, =0.1.6, =0.19.0, =0.21.0 - nostr-web 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0216...

actix-remote (0.1.0), agnostic (>=0.2.5, <=0.2.6) +270 more potentially affected by CVE-2026-25800 via quinn-proto (>=0.2.0, <=0.11.9)

quinn-proto CARGO version =0.2.0, =0.2.5, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.5.0, =2.0.0, =0.2.3, =0.2.11 and more Source cves: CVE-2026-25800 Source advisory: OSV:GHSA-4W2J-M93H-CJ5J...

RUSTSEC-2026-0210 `libcrux-aesgcm` Renamed to `libcrux-aes`

Crate libcrux-aesgcm was renamed to libcrux-aes and will no longer receive new versions under the name libcrux-aesgcm, with the final released version under that name being version 0.0.8. The original functionality is now provided in crate libcrux-aes, where development continues at version 0.0.9...

GHSA-VVP9-H8P2-XWFC Wasmtime: Memory leak in C API with `externref` and `anyref` types

Impact Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the anyref or externref WebAssembly values. This is caused by a regression introduced during the development of 37.0.0 and all prior versions of Wasmtime are unaffected. If anyref or externref is not used...

[SECURITY] Fedora 44 Update: python-nh3-0.3.6-1.fc44

Python binding to Ammonia HTML sanitizer Rust crate...

coreutils (>=0.0.14, <=0.0.16) potentially affected by CVE-2026-35381 via uu_cut (>=0.0.14, <=0.0.16)

uucut CARGO version =0.0.14, =0.0.14, =0.0.16 Source cves: CVE-2026-35381 Source advisory: OSV:GHSA-PMFC-4WJJ-GMHX...

coreutils (>=0.0.14, <=0.0.16) potentially affected by CVE-2026-35358 via uu_cp (>=0.0.14, <=0.0.16)

uucp CARGO version =0.0.14, =0.0.14, =0.0.16 Source cves: CVE-2026-35358 Source advisory: OSV:GHSA-8VRF-R662-2W2V...

coreutils (>=0.0.14, <=0.0.16) potentially affected by CVE-2026-35347 via uu_comm (>=0.0.14, <=0.0.16)

uucomm CARGO version =0.0.14, =0.0.14, =0.0.16 Source cves: CVE-2026-35347 Source advisory: OSV:GHSA-3WFC-MGPM-9RQ6...

coreutils (>=0.0.14, <=0.0.16) potentially affected by CVE-2026-35371 via uu_id (>=0.0.14, <=0.0.16)

uuid CARGO version =0.0.14, =0.0.14, =0.0.16 Source cves: CVE-2026-35371 Source advisory: OSV:GHSA-XV5W-CW7X-72GJ...

coreutils (>=0.0.14, <=0.0.16) potentially affected by CVE-2026-35373 via uu_ln (>=0.0.14, <=0.0.16)

uuln CARGO version =0.0.14, =0.0.14, =0.0.16 Source cves: CVE-2026-35373 Source advisory: OSV:GHSA-JCJR-RH8Q-7XQF...