addr2line (>=0.1.0, <=0.3.0), ai4ose-tg-rcore-tutorial-ch8-doom (0.1.0-preview.1) +139 more potentially affected by unknown CVE via xmas-elf (>=0.3.0, <=0.9.1)

xmas-elf CARGO version =0.3.0, =0.1.0, =0.1.4, =0.1.0, =0.1.0, =0.1.1, =0.11.0-beta, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.0, =0.0.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-9CC5-2PQ7-HFJ8...

addr2line (>=0.1.0, <=0.3.0), ai4ose-tg-rcore-tutorial-ch8-doom (0.1.0-preview.1) +139 more potentially affected by unknown CVE via xmas-elf (>=0.3.0, <=0.9.1)

xmas-elf CARGO version =0.3.0, =0.1.0, =0.1.4, =0.1.0, =0.1.0, =0.1.1, =0.11.0-beta, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.0, =0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0018...

GO-2025-3543 WITHDRAWN: Libcontainer is affected by capabilities elevation in github.com/opencontainers/runc

This report has been withdrawn with reason: "Does not affect Go code.". https://nvd.nist.gov/vuln/detail/CVE-2025-27612 lists https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66 which caused automation to flag as Go; the affected repo is https://github.com/youki-dev/you...

async-std-resolver (>=0.23.0-alpha.2, <=0.23.2), hosts_to (>=0.1.0, <=0.1.3) +1 more potentially affected by unknown CVE via trust-dns-proto (0.23.2)

trust-dns-proto CARGO version 0.23.2 is affected by a known vulnerability. The following packages have a transitive dependency on trust-dns-proto and may be impacted: - async-std-resolver =0.23.0-alpha.2, =0.1.0, =0.23.0-alpha.2, =0.23.2 Source cves: unknown CVE Source advisory:...

Youki security vulnerabilities

youki is a youki open source implementation of the OCI runtime specification in Rust. A security vulnerability exists in versions of youki prior to 0.5.3 that stems from a tenant builder accepting a list of features to be added to the tenant container specification during the creation of a tenant...

CBL Mariner 2.0 Security Update: llvm / rust (CVE-2023-29932)

The version of llvm / rust installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-29932 advisory. - llvm-project commit fdbc55a5 was discovered to contain a segmentation fault via the component...

rust bug fix and enhancement update

An update is available for rust. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Rust is a systems programming language that runs blazingly fast, prevents...

rust-coreos-installer bug fix and enhancement update

An update is available for rust-coreos-installer. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the...

rust-afterburn bug fix and enhancement update

An update is available for rust-afterburn. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Lin...

rust-bootupd bug fix and enhancement update

An update is available for rust-bootupd. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux...

CVE-2025-29787

zip is a zip library for rust which supports reading and writing of simple ZIP files. In the archive extraction routine of affected versions of the zip crate starting with version 1.3.0 and prior to version 2.3.0, symbolic links earlier in the archive are allowed to be used for later files in the...

CVE-2025-29787

zip is a zip library for rust which supports reading and writing of simple ZIP files. In the archive extraction routine of affected versions of the zip crate starting with version 1.3.0 and prior to version 2.3.0, symbolic links earlier in the archive are allowed to be used for later files in the...

RUSTSEC-2025-0156 `tree-sitter-pkl` was removed from crates.io for malicious code

tree-sitter-pkl was part of a campaign that attempted to exfiltrate environmental data from the host. The malicious crate had 1 version published in March 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io...

PT-2025-10682

Name of the Vulnerable Software and Affected Versions Rust-openssl versions prior to 0.10.69 Description The issue allows for a server crash or the return of arbitrary memory contents to the client. Recommendations For versions prior to 0.10.69, update to version 0.10.69 or later to resolve the...

CVE-2023-33289

The urlnorm crate through 0.1.4 for Rust allows Regular Expression Denial of Service ReDos via a crafted URL to lib.rs. NOTE: the Supplier disputes this, taking the position that "Slow printing of URLs is not a CVE."...

aati (>=0.10.2, <=0.11.3), acme-clusters (>=0.2.2, <=0.2.3) +1395 more potentially affected by CVE-2025-4432 via ring (>=0.13.5, <=0.17.9)

ring CARGO version =0.13.5, =0.10.2, =0.2.2, =0.2.2, =0.1.0, =0.3.5, =0.3.0, =1.0.0, =0.1.0, =1.0.0, =0.6.0, =0.1.12, =0.1.14, =0.1.12, =0.1.13, =0.1.19 and more Source cves: CVE-2025-4432 Source advisory: OSV:GHSA-4P46-PWFR-66X6...

aati (>=0.10.2, <=0.11.3), acme-clusters (>=0.2.2, <=0.2.3) +1395 more potentially affected by CVE-2025-4432 via ring (>=0.13.5, <=0.17.9)

ring CARGO version =0.13.5, =0.10.2, =0.2.2, =0.2.2, =0.1.0, =0.3.5, =0.3.0, =1.0.0, =0.1.0, =1.0.0, =0.6.0, =0.1.12, =0.1.14, =0.1.12, =0.1.13, =0.1.19 and more Source cves: CVE-2025-4432 Source advisory: OSV:RUSTSEC-2025-0009...

Linux Distros Unpatched Vulnerability : CVE-2025-24898

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions ssl::selectnextproto can return a slice pointing into the serv...

aati (>=0.10.2, <=0.11.3), acme-clusters (>=0.2.2, <=0.2.3) +1352 more potentially affected by unknown CVE via ring (>=0.13.5, <=0.16.20)

ring CARGO version =0.13.5, =0.10.2, =0.2.2, =0.2.2, =0.1.0, =0.3.5, =0.3.0, =1.0.0, =0.1.0, =1.0.0, =0.1.12, =0.1.14, =0.1.12, =0.1.13, =0.4.0, =0.4.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0010...

Linux Distros Unpatched Vulnerability : CVE-2020-25793

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with From...