CVE-2026-82452 rust-iot-platform Authentication Bypass via Missing Request Guards

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected...

CVE-2026-82452

rust-iot-platform (through commit 5df942ab) contains an authentication bypass caused by most REST API routes lacking authentication guards in their handler signatures, as seen in the user router. An unauthenticated attacker over the network with low complexity can create, update, list, retrieve, ...

CVE-2026-82452 rust-iot-platform Authentication Bypass via Missing Request Guards

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected...

CVE-2026-82452 rust-iot-platform Authentication Bypass via Missing Request Guards

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected...

CVE-2026-82452: Missing Authentication for Critical Function

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected...

CVE-2026-82453: Plaintext Storage of a Password

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...

PT-2026-83432

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...

PT-2026-83431

Name of the Vulnerable Software and Affected Versions rust-iot-platform versions prior to commit 5df942ab Description An authentication bypass exists because most REST API routes lack authentication guards in their handler signatures. This allows unauthenticated attackers to perform administrativ...

EUVD-2026-44949

Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref...

GHSA-9PWQ-GCRX-WGHH Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

A soundness bug in buffa's OwnedView allowed safe Rust code to trigger a use-after-free. The OwnedView::decode constructor transmuted a borrowed slice to &'static u8, and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields such as &'static str and &'static u8 to...

[SECURITY] Fedora 44 Update: rust-h2-0.4.17-1.fc44

An HTTP/2 client and server...

AZL-98421 CVE-2026-82251 affecting package rust for versions less than 1.96.1-2

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state and open functions to repositories outside .git/modules...

UBUNTU-CVE-2026-82253

gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.findb"..", allowing crafted names such as 'a..b/../../../.git/' to bypass the check;...

maltrail v3.2

Maltrail Maltrail is a network traffic detection system that identifies communication with known malicious infrastructure and reports selected traffic anomalies. It matches domains, URLs, IP addresses, IP:port pairs, and User-Agent values observed on the network against a set of indicators called...

[SECURITY] Fedora 43 Update: rust-h2-0.4.17-1.fc43

An HTTP/2 client and server...

Fedora 44 : rust-h2 (2026-4757e7a415)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4757e7a415 advisory. Update to version 0.4.17. This includes a fix for a low-severity security vulnerability designated RUSTSEC-2026-0258 / GHSA-q83h-524g-xf6h. Tenable has...

CVE-2026-81526

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended...

Cross-database write redirection via unvalidated dotted database name in bulk write namespaces

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended...

CVE-2026-81526 Cross-database write redirection via unvalidated dotted database name in bulk write namespaces

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended...

EUVD-2026-67210

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier in an application using the driver may cause write operations to be applied to an unintended...