OneRingBuf has a Use After Free Vulnerability

Affected versions of oneringbuf exposed the obsolete IntoRef::intoref method through the public IntoRef trait. For heap-backed ring buffers, this method returned a DroppableRef handle. DroppableRef stored an owning raw pointer created from Box::intoraw. Its Clone implementation copied this raw...

[SECURITY] Fedora 43 Update: python-pillow-jxl-plugin-1.3.7-2.fc43

Pillow plugin for JPEG-XL, using Rust for bindings...

[SECURITY] Fedora 43 Update: python-cramjam-2.11.0-12.fc43

Thin Python bindings to de/compression algorithms in Rust...

[SECURITY] Fedora 43 Update: python-rignore-0.7.6-7.fc43

rignore is a Python module that provides a high-performance, Rust-powered file system traversal functionality. It wraps the Rust ignore crate using PyO3, offering an efficient way to walk through directories while respecting various ignore rules...

[SECURITY] Fedora 43 Update: python-fastar-0.11.0-7.fc43

The fastar library wraps the Rust tar, flate2, and zstd crates, providing a high-performance way to work with compressed and uncompressed tar archives in Python...

[SECURITY] Fedora 44 Update: python-cramjam-2.11.0-12.fc44

Thin Python bindings to de/compression algorithms in Rust...

[SECURITY] Fedora 44 Update: python-pillow-jxl-plugin-1.3.7-2.fc44

Pillow plugin for JPEG-XL, using Rust for bindings...

[SECURITY] Fedora 44 Update: python-rignore-0.7.6-7.fc44

rignore is a Python module that provides a high-performance, Rust-powered file system traversal functionality. It wraps the Rust ignore crate using PyO3, offering an efficient way to walk through directories while respecting various ignore rules...

[SECURITY] Fedora 44 Update: python-fastar-0.11.0-7.fc44

The fastar library wraps the Rust tar, flate2, and zstd crates, providing a high-performance way to work with compressed and uncompressed tar archives in Python...

Fedora 43 : python-pillow-jxl-plugin (2026-75b3256794)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-75b3256794 advisory. Update to 1.3.7, and update PyO3 to 0.29, with fixes for RUSTSEC-2026-0176 and RUSTSEC-2026-0177. Tenable has extracted the preceding description block...

Fedora 45 : python-uv-build / rust-astral_async_zip / uv (2026-118fdf066a)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-118fdf066a advisory. https://github.com/astral-sh/uv/releases/tag/0.11.28 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

Fedora 44 : python-cramjam (2026-ed6d2b806a)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ed6d2b806a advisory. Update to PyO3 0.29, with fixes for RUSTSEC-2026-0176 and RUSTSEC-2026-0177. Tenable has extracted the preceding description block directly from the Fedora...

Fedora 43 : python-rignore (2026-8a19b048cc)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8a19b048cc advisory. Update to PyO3 0.29, with fixes for RUSTSEC-2026-0176 and RUSTSEC-2026-0177. Tenable has extracted the preceding description block directly from the Fedora...

Fedora 43 : python-fastar (2026-0f558e63db)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0f558e63db advisory. Update to PyO3 0.29, with fixes for RUSTSEC-2026-0176 and RUSTSEC-2026-0177. Tenable has extracted the preceding description block directly from the Fedora...

Fedora 44 : python-pillow-jxl-plugin (2026-8c2e409ea5)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8c2e409ea5 advisory. Update to 1.3.7, and update PyO3 to 0.29, with fixes for RUSTSEC-2026-0176 and RUSTSEC-2026-0177. Tenable has extracted the preceding description block...

ratex-layout (0.0.3) potentially affected by CVE-2026-53530 via ratex-parser (0.0.3)

ratex-parser CARGO version 0.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on ratex-parser and may be impacted: - ratex-layout 0.0.3 Source cves: CVE-2026-53530 Source advisory: OSV:GHSA-4HGP-59H5-GVRJ...

coreutils (>=0.0.14, <=0.0.16), findutils (>=0.3.0, <=0.4.0) +104 more potentially affected by unknown CVE via uucore (>=0.0.4, <=0.0.17)

uucore CARGO version =0.0.4, =0.0.14, =0.3.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.8, =0.0.1, =0.0.8, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.16 and more Source cves: unknown CVE Source advisory: OSV:GHSA-FQF6-GXHH-2XHW...

SUSE CVE-2026-42327

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocspresponders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref wraps the raw bytes with str::fromutf8unchecked. OpenSSL does not enforce th...

PT-2026-56303

Name of the Vulnerable Software and Affected Versions RaTeX versions prior to 0.1.11 Description The public parser entrypoint ratex parser::parse&str contains a flaw that causes the application to panic when processing a verb command followed by a non-ASCII multibyte UTF-8 delimiter, such as...

CVE-2026-58266: Origin Validation Error

Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal localhost API, and user scripts included via iframes in the editor can access this API despite protections intended to block reviewer and edito...