12372 matches found
CVE-2026-9565 haojing8312 WorkClaw Blacklist bash.rs is_dangerous os command injection
A vulnerability was determined in haojing8312 WorkClaw up to 0.6.4. This affects the function isdangerous of the file apps/runtime/src-tauri/src/agent/tools/bash.rs of the component Blacklist Handler. Executing a manipulation can lead to os command injection. The attack can be executed remotely...
Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image
Summary Multiple vulnerabilities were addressed in IBM Observability with Instana within Instana Agent container image build 1.0.318 Vulnerability Details CVEID:CVE-2020-25576 DESCRIPTION: An issue was discovered in the randcore crate before 0.4.2 for Rust. Casting of byte slices to integer slice...
CVE-2026-44983: Heap-based Buffer Overflow
smallbitvec is a growable bit-vector for Rust, optimized for size. From 1.0.1 to 2.6.0, an integer overflow in the internal capacity calculation of smallbitvec can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only. This allows memory corruption...
AZL-88281 CVE-2026-5222 affecting package rust for versions less than 1.90.0-9
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the...
AZL-88272 CVE-2026-5223 affecting package rust for versions less than 1.75.0-30
Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is medium for users of third-party registries. Users of crates.io a...
AZL-88278 CVE-2026-5223 affecting package rust for versions less than 1.90.0-9
Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is medium for users of third-party registries. Users of crates.io a...
AZL-88275 CVE-2026-5222 affecting package rust for versions less than 1.75.0-30
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the...
TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO
A new coordinated cross-ecosystem software supply chain attack campaign has targeted npm, PyPI, and Crates.io to distribute credential-stealing malware. The campaign, codenamed TrapDoor , spans more than 34 malicious packages across over 384 versions. The earliest activity was recorded on May 22,...
[SECURITY] Fedora 42 Update: aw-server-rust-0.14.0^20260516.gitdf49b3d-1.fc42
A re-implementation of aw-server in Rust...
[SECURITY] Fedora 43 Update: aw-server-rust-0.14.0^20260516.gitdf49b3d-1.fc43
A re-implementation of aw-server in Rust...
[SECURITY] Fedora 44 Update: aw-server-rust-0.14.0^20260516.gitdf49b3d-1.fc44
A re-implementation of aw-server in Rust...
Fedora 43 : aw-server-rust / awatcher / nodejs-aw-webui (2026-c9d4e8b9a4)
The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-c9d4e8b9a4 advisory. Rebuilt with openssl 0.10.79 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...
Fedora 42 : aw-server-rust / awatcher / nodejs-aw-webui (2026-7047e2fec5)
The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-7047e2fec5 advisory. Rebuilt with openssl 0.10.79 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...
Cargo security vulnerabilities
Cargo is a Rust package manager open-sourced by The Rust Programming Language. A security vulnerability exists in Cargo that stems from the incorrect handling of symbolic links in a crate tarball downloaded from a third-party registry, which could lead to a malicious crate overwriting the source...
Fedora 44 : aw-server-rust / awatcher / nodejs-aw-webui (2026-f4ddcfa64b)
The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-f4ddcfa64b advisory. Rebuilt with openssl 0.10.79 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...
Malicious Package
Overview defi-risk-scanner is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package was linked to a supply chain attack and contained code designed to steal developer secrets, crypto wallets, SSH keys, and cloud...
Malicious Package
Overview solidity-build-guard is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package was linked to a supply chain attack and contained code designed to steal developer secrets, crypto wallets, SSH keys, and cloud...
audio-opus-bsd (>=0.1.0, <=0.1.2), audiopus (>=0.1.0, <=0.3.0-rc.0) +12 more potentially affected by unknown CVE via audiopus_sys (>=0.1.8, <=0.2.2)
audiopussys CARGO version =0.1.8, =0.1.0, =0.1.0, =0.4.0, =0.0.1, =0.3.0, =0.1.32, =0.0.12, =0.9.0, =0.9.3 - zoog 0.2.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0150...