[SECURITY] Fedora 43 Update: rust-wayland-scanner-0.31.10-3.fc43

Wayland Scanner for generating rust APIs from XML wayland protocol files...

[SECURITY] Fedora 43 Update: rust-reqsign-aws-v4-3.0.1-2.fc43

AWS SigV4 signing implementation for reqsign...

[SECURITY] Fedora 43 Update: rust-quick-xml-0.41.0-1.fc43

High performance xml reader and writer...

[SECURITY] Fedora 43 Update: rust-busd-0.5.0-3.fc43

A D-Bus bus broker implementation...

[SECURITY] Fedora 43 Update: rust-inferno-0.12.6-3.fc43

Rust port of the FlameGraph performance profiling tool suite...

[SECURITY] Fedora 44 Update: rust-quick-xml-0.41.0-1.fc44

High performance xml reader and writer...

[SECURITY] Fedora 44 Update: rust-wayland-scanner-0.31.10-3.fc44

Wayland Scanner for generating rust APIs from XML wayland protocol files...

[SECURITY] Fedora 44 Update: rust-gtk4-macros-0.11.4-2.fc44

Macros helpers for GTK 4 bindings...

[SECURITY] Fedora 44 Update: rust-busd-0.5.0-3.fc44

A D-Bus bus broker implementation...

[SECURITY] Fedora 44 Update: rust-inferno-0.12.6-3.fc44

Rust port of the FlameGraph performance profiling tool suite...

[SECURITY] Fedora 44 Update: rust-ashpd-0.13.12-2.fc44

XDG portals wrapper in Rust using zbus...

[SECURITY] Fedora 44 Update: python-rpds-py-0.29.0-4.fc44

Python bindings to the Rust rpds crate...

Security Bulletin: Multiple Vulnerabilities in IBM Bob

Summary Multiple vulnerabilities were addressed in IBM Bob V 2.0 Vulnerability Details CVEID:CVE-2026-41676 DESCRIPTION: rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive and PkeyCtxRef::derive sets len = buf.len and passes it...

average (0.14.2), box-bin (0.3.1) +1 more potentially affected by unknown CVE via crossbeam-epoch (>=0.9.7, <=0.9.18)

crossbeam-epoch CARGO version =0.9.7, =0.9.18 is affected by a known vulnerability. The following packages have a transitive dependency on crossbeam-epoch and may be impacted: - average 0.14.2 - box-bin 0.3.1 - qrcode-generator 4.1.3 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0204...

RUSTSEC-2026-0204 Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid

Affected versions of fmt::Display dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with Atomic::null or Shared::null. fmt::Debug impls and pre-0.9 fmt::Display impls, which do not dereference pointers, are not affected by this issue...

RustMizan: A Compilable, Contamination-Aware Benchmarking Framework for Rust Vulnerabilities

LLM agents are increasingly applied to vulnerability analysis, but existing benchmarks have not kept pace. They typically rely on small non-compilable snippets, focus on binary classification vulnerable or not, and do not account for the risk that publicly-released datasets are part of model...

ShadowProbe: Language-Extensible Detection of Hidden Algorithmic Complexity Vulnerabilities

Algorithmic Complexity Vulnerabilities ACVs arise when adversarial inputs trigger worst-case execution behavior, causing severe performance degradation or Denial-of-Service conditions. A key but underexplored source is shadow complexity: non-trivial computational costs hidden inside seemingly...

altv (>=15.0.0-dev.0, <=16.1.1), altv_internal_core_resource (>=15.0.0-dev.0, <=16.1.1) +400 more potentially affected by unknown CVE via cxx (>=1.0.1, <=1.0.131)

cxx CARGO version =1.0.1, =15.0.0-dev.0, =15.0.0-dev.0, =15.0.0-dev2, =15.0.0-dev42, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.5.0, =0.5.0, =0.5.0, =0.5.1, =0.26.0 - autocxx-idalib 0.30.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0202...

RUSTSEC-2026-0202 `let_cxx_string!` uses uninitialized value due to exception safety violations

In affected versions of this crate, letcxxstring! is not exception safe. After creating the StackString, if match $value panics, the content of StackString is not yet initialized, while the drop implementation of StackString unconditionally deinitializes the content, leading to use of uninitializ...

Malicious Package

Overview @briskforge/envcheck is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary. Impact The infostealer targets crypto...