CVE-2026-21895: Improper Check or Handling of Exceptional Conditions

The rsa crate is an RSA implementation written in rust. Prior to version 0.9.10, when creating a RSA private key from its components, the construction panics instead of returning an error when one of the primes is 1. Version 0.9.10 fixes the issue...

Linux Distros Unpatched Vulnerability : CVE-2026-21895

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The rsa crate is an RSA implementation written in rust. Prior to version 0.9.10, when creating a RSA private key from its components, the construction panics...

CVE-2026-22256: Improper Neutralization of Input During Web Page Generation

Salvo is a Rust web backend framework. Prior to version 0.88.1, the function listhtml generate an file view of a folder which include a render of the current path, in which its inserted in the HTML without proper sanitation, this leads to reflected XSS using the fact that request path is decoded...

actix-web-csp (0.1.0), actor-kit (>=0.1.0, <=0.2.1) +673 more potentially affected by unknown CVE via lru (>=0.9.0, <=0.15.0)

lru CARGO version =0.9.0, =0.1.0, =0.9.0, =0.0.24, =0.0.23, =0.1.0, =1.0.0, =0.4.0, =0.1.0, =0.1.0, =0.4.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-RHFX-M35P-FF5J...

GHSA-RHFX-M35P-FF5J `IterMut` violates Stacked Borrows by invalidating internal pointer

Affected versions of this crate contain a soundness issue in the IterMut iterator implementation. The IterMut::next and IterMut::nextback methods temporarily create an exclusive reference to the key when dereferencing the internal node pointer. This invalidates the shared pointer held by the...

CVE-2019-16880

An issue was discovered in the linea crate through 0.9.4 for Rust. There is double free in the Matrix::zipelements method...

CVE-2019-16882

An issue was discovered in the string-interner crate before 0.7.1 for Rust. It allows attackers to read from memory locations associated with dangling pointers, because of a cloning flaw...

CVE-2019-16141

An issue was discovered in the oncecell crate before 1.0.1 for Rust. There is a panic during initialization of Lazy...

CVE-2019-16137

An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used. Because memory ordering is mishandled, two writers can acquire the lock at the same time, violating mutual exclusion...

CVE-2019-16142

An issue was discovered in the renderdoc crate before 0.5.0 for Rust. Multiple exposed methods take self by immutable reference, which is incompatible with a multi-threaded application...

CVE-2019-16144

An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield during API calls...

CVE-2025-4574 vulnerabilities

Vulnerabilities for packages: oxipng, starship, cargo-audit, nushell, zed, yazi, fd, yara-x, oranda, ruff, samply, wasmcloud, cargo-c, pixi, wadm, deno, rust-analyzer, lychee...

CVE-2025-4574 vulnerabilities

Vulnerabilities for packages: oxipng, zed, oranda, starship, cargo-c, nushell, deno, ztunnel, ruff, yara-x, lychee, rust-analyzer, yazi, cargo-audit, samply, wadm, wasmcloud, fd, pixi...

CVE-2025-69255: Improper Handling of Exceptional Conditions

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes getmetrics to unwrap failed deserialization of metrictype/opts, panicking the handler thread and enabling remote denial of service of the metrics...

abacuz (0.1.1), acmer (>=0.0.1, <=0.0.4) +371 more potentially affected by CVE-2026-21895 via rsa (>=0.1.2, <=0.8.2)

rsa CARGO version =0.1.2, =0.0.1, =0.12.0, =0.5.0, =0.2.0, =0.1.0, =1.0.1, =0.1.0, =0.3.11, =0.2.0, =0.1.0, =0.2.0, =0.11.0, =0.16.0 and more Source cves: CVE-2026-21895 Source advisory: OSV:GHSA-9C48-W39G-HM26...

Rust curve25519‑dalek Data Compromise

The vulnerability of the Rust library for arithmetic operations on the curve25519‑dalek elliptic curve is related to the removal of optimization during compilation or the elimination of critical code. Exploiting this vulnerability can allow an attacker to compromise the confidentiality of the...

acme-compilers (>=0.2.2, <=0.2.4), acvm (>=0.23.0, <=0.26.1) +297 more potentially affected by unknown CVE via rkyv (>=0.1.1, <=0.7.45)

rkyv CARGO version =0.1.1, =0.2.2, =0.23.0, =0.23.0, =0.0.1, =0.2.0, =0.39.0, =0.23.0, =0.26.1 - cairn-import-geonames 0.0.2-alpha - cairn-import-oa 0.0.2-alpha - cairn-import-osm 0.0.2-alpha - cairn-import-wof 0.0.2-alpha and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0001...

a1 (>=1.0.1, <=1.0.2), actor-kit (>=0.1.0, <=0.2.5) +132 more potentially affected by unknown CVE via rkyv (0.8.2)

rkyv CARGO version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on rkyv and may be impacted: - a1 =1.0.1, =0.1.0, =0.1.0, =0.9.0, =0.1.0, =0.2.1, =0.1.0, =0.4.0, =0.9.0, =0.5.0, =0.5.0, =2.0.0-alpha.1, =0.1.2, =0.4.2 and more Source cves: unknown...

PT-2026-22490

Name of the Vulnerable Software and Affected Versions rust-rpm-sequoia affected versions not specified Description A flaw exists in rust-rpm-sequoia that allows an attacker to cause an application-level denial of service. This occurs when a specially crafted Red Hat Package Manager RPM file is...

PT-2026-8202

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's rust binder component related to handling FDA fd array objects. Specifically, the issue arises when processing empty FDA objects with a length of zero...